2

I have a computer with Ubuntu 13.10 installed. The user (say Walesa) has changed the ownership of etc folder and all its subfolders from root to Welesa using a privileged file manager. As sudo was disabled, he rebooted hoping it will be re-enabled again. But security does not allow log-in after entering username and password saying "owner of etc/profile is not root".

But a commandline login with I have no name!@Walesa is possible. Is there a way to restore ownership of etc and all its subfolders to root using this commandline?

Improve this question
7

Doing:

sudo chown -R root.root /etc

on the commandline will set /etc and everything underneath to owner root and group root

However on my system (Ubuntu 12.04) not everything under /etc is in group root. The following list might help (generated with sudo find /etc ! -gid 0 -ls | cut -c 29-):

root     dovecot      5348 Apr  8  2012 /etc/dovecot/dovecot-sql.conf.ext
root     dovecot       782 Apr  8  2012 /etc/dovecot/dovecot-dict-sql.conf.ext
root     dovecot       410 Apr  8  2012 /etc/dovecot/dovecot-db.conf.ext
root     shadow       2009 Dec 23 16:10 /etc/shadow
root     lp           4096 Mar 12 19:38 /etc/cups
root     lp            540 Mar 12 19:38 /etc/cups/subscriptions.conf
root     lp            108 Sep  1  2012 /etc/cups/classes.conf
root     lp           4096 Oct  8  2012 /etc/cups/ppd
root     lp           2751 Mar 12 07:38 /etc/cups/printers.conf
root     lp           2751 Mar 11 21:06 /etc/cups/printers.conf.O
root     lp            108 Jun  6  2012 /etc/cups/classes.conf.O
root     lp            540 Mar 12 19:24 /etc/cups/subscriptions.conf.O
root     lp           4096 Mar 28  2012 /etc/cups/ssl
root     sasl        12288 Jun  6  2012 /etc/sasldb2
root     daemon        144 Oct 25  2011 /etc/at.deny
root     dialout        66 Oct 31  2012 /etc/wvdial.conf
root     lightdm         0 Apr 21  2012 /etc/mtab.fuselock
root     shadow        981 Feb 19 23:38 /etc/gshadow
root     dovecot      1306 Jun  6  2012 /etc/ssl/certs/dovecot.pem
root     ssl-cert     4096 Jun  6  2012 /etc/ssl/private
root     dovecot      1704 Jun  6  2012 /etc/ssl/private/dovecot.pem
root     ssl-cert     1704 Apr 21  2012 /etc/ssl/private/ssl-cert-snakeoil.key
root     fuse          216 Oct 18  2011 /etc/fuse.conf
root     dip          4096 Oct 31  2012 /etc/ppp/peers
root     dip          1093 Mar 28  2012 /etc/ppp/peers/provider
root     dip          4096 Mar 28  2012 /etc/chatscripts
root     dip           656 Mar 28  2012 /etc/chatscripts/provider
Improve this answer
  • but sudo is disabled with this error: etc/sudoers is owned by uid 1000 should be 0. – Minimus Heximus Mar 12 '14 at 18:53
  • 1
    @MinimusHeximus rebooting with single on your kernel command line (edit it in grub) might get you a root shell. If not, you can try init=/bin/bash on the kernel line instead. Note that later method will leave you with no init scripts run, so you'll have to mount filesystems (etc.) yourself. – derobert Mar 12 '14 at 19:23
  • @MinimusHeximus see my answer here unix.stackexchange.com/a/119393/33055 to get into single user mode as root, from there you should be able to change the permissions with the command in my answer. – Anthon Mar 12 '14 at 20:09
  • can you just use su ? get root priviliges then use the command from this answer without sudo? – Eric Mar 12 '14 at 23:37
2

Since you can modify /etc/passwd, you can remove password verification on the root account. Edit /etc/passwd and change the line

root:x:0:0:root:/root:/bin/sh

to

root::0:0:root:/root:/bin/sh

(i.e. the second colon-separated field must be empty). Now you can run su and become root without typing a password. (I think this works on Ubuntu, but if empty passwords are disabled, you can put aaxSuH/.jTvGs in the second field instead and use the password changeme.)

Repair the permissions by running

cd /etc
chown -R root:root /etc
chgrp shadow shadow gshadow

and a whole bunch more chgrp commands — Anthon's list is a good start.

Once you've done that, check on another terminal that you can use sudo normally.

Then change root's password back to being disabled or the one in /etc/shadow: edit /etc/password and put x (or *) as the second field.

Finally, send a nasty email to Walesa and tell him not to pull such stunts anymore. It's the equivalent of closing your eyes and throwing a knife in the air hoping that it'll fall down just right to cure your hangnail.

Improve this answer
1

I just changed all of my files in /etc to user:user then changed them back to root:root once they're changed, you have to change your user to superuser : su then provide your credentials for the superuser account.

once you're the superuser, just run chown -R root:root /etc and you're back

Improve this answer
1

Thanks to Anthon's answer above login problem was solved:

I found an old kubuntu 12.04 alternate CD, entered rescue shell, where 

sudo chown -R root.root /etc

could be run. Then we could log in and everything seemed perfect

But sudo did not work with this error:

/etc/sudoers is world writable
no valid sudoers sources found, quitting...
unable to initialise policy plug-in

I seached the errors and found this thread, in which this command:

pkexec visudo

weirdly solved sudo probelm, the error /etc/sudoers is world writable persisting (but not interfering). wierdly because I think I did not change anything manually (or if so, I tried to avoid saving).

Then in the same thread, these:

chmod u=rwx,g=rx,o=rx /etc/sudoers.d/
chmod u=r,g=r,o= /etc/sudoers.d/*

removed sudo's persisting error. Still there may be issues (probably not serious).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.