Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Lately my machine's authentication system broke twice: once because I messed up with PAM/LDAP and the other one because I messed up with /etc/passwd or /etc/shadow.

In order to recover things I had to boot from a live system, but I found it quite annoying (longer boot times, on the live system I had a different kernel, different insalled tools and so on).

Since I'm having lots of fun with PAM/LDAP in these days (...) this is likely to happen again. I was thus thinking of permanently putting /sbin/sulogin -p on tty1, instead of /sbin/agetty, through /etc/inittab, in order to be able to log in even if something brokes. At least in some circumstances.

Is it safe to do that, or is there any side effect?
I need to specify that other people can physically log in on this machine.

share|improve this question
    
I'm not sure it makes sense to run sulogin outside of single-user mode. What are you trying to accomplish? –  jw013 Feb 3 '12 at 1:40
    
@jw013: I want to be able to log in as root even if something bad happens (like an empty getent passwd output). Of course it won't work if /sbin/sulogin cannot find root password, but for all other cases it should work, I think. I'm not sure either if sulogin is supposed to be ran out of single mode, but it's actually working... –  peoro Feb 3 '12 at 1:57
    
sulogin is meant to run only in single user mode. If you need it, boot to single user mode, otherwise, you don't use it. –  psusi Feb 3 '12 at 4:02

1 Answer 1

up vote 3 down vote accepted

I don't see how running sulogin in this way helps you. sulogin is normally run when you boot into single user mode, so if it doesn't work there (because the shadow password file is hopelessly corrupted) it isn't going to work if you run it in multi-user mode. And if sulogin works in single-user mode you have no need to run it in multi-user mode.

A better solution for getting the system back into a working state during your time of reckless experimentation is to save known functioning copies of the authentication files (passwd, shadow, pwdb.conf, whatever else) somewhere, and write a script that copies those saved files into their official locations. Edit /etc/inittab and set the ctrlaltdelete action to run that script. Later, if you screw up the authentication files on your system, hit CTRL-ALT-DELETE and the files will be restored to your saved versions.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.