Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm playing with a rather old, heavily customized Linux installation (based on Debian etch, running on a Netgear ReadyNAS device).

Recently I've switched from /etc/passwd to /etc/shadow via pwconv.

Now I'd like to switch back due to authentication problems with the Apache server, because mod_auth_shadow is not installed and I'm hesitant to install it.

As an additional complication: pwunconv does not exist either.

I have a backup, but it's old and I have been installing a lot of packages since it was taken. I also have the option of doing a factory reset, but that will mean I lose the RAID configuration which I do not want.

What steps would I need to take to go back to regular passwd-based password authentication rather than shadow passwords?

share|improve this question
    
Have a look in /etc/pam and friends. Chances are there's a call to the shadow password authentication module there that might need to be replaced. –  Michael Kjörling Nov 11 '13 at 10:02
    
Are we to assume that you don't have a useful backup to restore from, or are you just wondering which files to restore? –  Michael Kjörling Nov 11 '13 at 10:02
1  
@Michael I do have a backup, albeit an older one, made at the time before I started installing all kinds of libs and packages. There also is the option of factory-resetting the box, but that's scary because I would lose the RAID. I prefer poking the right files, but currently I lack the necessary understanding. –  Tomalak Nov 11 '13 at 10:18
add comment

2 Answers 2

up vote 2 down vote accepted

The pwconv command automagically backups the /etc/passwd in a file called /etc/passwd-.

Try to restore this file and rename /etc/shadow to /etc/shadow-.

share|improve this answer
    
You mean passwd and passwd-? Yes, that file exists. But how do I configure the system to stop using shadow? –  Tomalak Nov 11 '13 at 9:11
2  
@Tomalak, remove or rename it. –  Stéphane Chazelas Nov 11 '13 at 13:04
    
Okay, sounds reasonable enough, I just wanted a confirmation. I'll try and report back. –  Tomalak Nov 11 '13 at 13:20
    
I've renamed /etc/shadow to /etc/shadow_ and /etc/passwd- to /etc/passwd. So far this had no ill-effects, I can still log in normally. (Apache still does not let me in though, apparently that's a disconnected problem.) –  Tomalak Nov 13 '13 at 7:28
add comment

Instead of going back manually you could try if you have the apache PAM authentication module available "libapache2-mod-auth-pam" as a distribution supported package.

I have no test boxes that old but the pam_unix module supports both shadow and regular passwd, so I would think that merging the encrypted passwords back into your etc/passwd file and renaming the /etc/shadow* files should be sufficient. You may need to add the option broken_shadow to pam configuration files in /etc/pam.d/* referencing the pam_unix module.

share|improve this answer
    
Yes, I've tried installing that module (apt-get), but for some reason it wouldn't install. I did not want to break apache by meddling with it unless I also had a way to back out. I'll try merging/renaming as soon as I understand what makes the system use shadow in the first place. –  Tomalak Nov 11 '13 at 10:13
    
It's a single user system anyway, so having all stuff in /etc/passwd is not a real drawback. I'm also hesitant of changing stuff in /etc/pam.d for fear shutting myself out of the system. I have set up ssh with public key authentication, is there a chance that changing pam_unix options breaks this? –  Tomalak Nov 11 '13 at 10:14
    
Changing pam settings typically doesn't break existing sessions... –  HBruijn Nov 11 '13 at 10:20
    
Now that I know I can easily switch between shadow and passwd I can try to make authentication work in apache. –  Tomalak Nov 13 '13 at 7:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.