1

So recently, some of my friends had been tampering with my files and data through terminal, so I decided to secure it by doing two things:

First, I added the following to my ~/.bash_profile for ALL commands: alias <command>="sudo <command>", to require a password to use any command.

Second, I ran the command sudo visudo to edit the sudo settings and added Defaults:user_name timestamp_timeout=0 to the end of the file to make sudo be required instantly after every new command (for those who don't know, with default settings, if you enter your password once to unlock sudo, sudo doesn't require a password for the couple of minutes).

Anyways, I did all of this to secure my file-system, but now newly-opened tabs in terminal require a password to get in, and once I enter the correct password, the tab doesn't unlock; I just get another password requirement. No matter how many times I enter my correct password, it keeps on asking again (with default timeout 0).

Last login: Sat Jan 10 14:52:20 on ttys002
Password:
Password:
Password:
Password:
Password:

Essentially, I am locked out of my own terminal, unable to do anything.

Also, I cannot edit the /etc/sudoers/ file because I do not have permission; I cannot even view my ~/.bash_profile because it is a hidden file.

Is there any way to undo either of these two commands or to somehow access or unlock my terminal?

  • 2
    Your alias trick is easily defeated. An alias for ls won't work if I call it as /bin/ls or as 'ls'. Also, it's a form of blacklisting, which means you open a new hole every time you add another program to the system. If you want to keep "friends" from screwing with Terminal behind your back, lock your screen whenever you step away from your Mac. Also, turn on FileVault so that someone can't use the ⌘-S trick against you. – Warren Young Jan 10 '15 at 23:41
  • Thanks everyone! I ended up accessing the emacs application and running shell commands through there (they didn't require a password for some reason). – Vedaad Shakib Jan 11 '15 at 0:11
  • If you started Emacs using Finder, it's probably because it started the sub-shell in such a way that it didn't run your .bash_profile, so the aliases weren't installed. This is another reason why aliases are easily bypassed. Brian's answer below gives another reason. – Warren Young Jan 11 '15 at 0:14
2

Is there any way to undo either of these two commands or to somehow access or unlock my terminal?

Reboot into single-user mode: while the screen is still black as it first boots up, hold down ⌘-S. You can let go once the "Apple" screen appears.

You will land in an unrestricted root shell, where you can fix things.

2

OK, you have a couple of options:

The option I like best is to rename your ~/.bash_profile with AppleScript:

 do shell script "mv /Users/YOURLOGINNAME/.bash_profile /Users/YOURLOGINNAME/x"

You could also configure Terminal to drop you straight into a root shell, so it won't ask you for the password again after the first time. In Terminal, go to Preferences → Profiles → Shell and put sudo -s in the "Run command" box. Then say ⌘-T to open another Terminal tab.

You could also use Secrets to flip the visibility of invisible files. Then just move your .bash_profile out of the way.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.