On one of our RHEL6 servers I made a change to /etc/pam/d/system-auth and password-auth then after rebooting lost the ability to sudo and su. Specifically I changed this line:

auth        sufficient      pam_unix.so  try_first_pass

to this:

auth        optional      pam_unix.so  try_first_pass

I can still ssh to the server and get in with a standard user account however I have no rights to make any changes to any files so I can reverse this. This server is also a VM. Is there anything I can do? Any PAM tricks out there?

  • 1
    I assume you have no access to a console via your VM infrastructure? (From what you say, it sounds like you do know the root password, you just have ssh login for root disabled.) Oct 8 '15 at 20:13
  • 3
    You will definitely need to get access to the actual console so you can either log in as root or boot to single user mode :\ One piece of advice I can give is this(learned this the hard way as well): PAM modules do not require a reboot to take effect, they are validated as they are needed. So when changes are made, before closing a root window, always try to log in through another window and elevate. I've been where you are a few too many times myself :(
    – Gravy
    Oct 8 '15 at 20:16
  • @Ulrich - yes, root for ssh is disabled. :( I do have access to the VM console but root login is not working from there either. (this may be because of a STIG we recently applied, I'll have to double-check). Gravy - I will give single user mode a try, thanks for the tips on pam.
    – user53029
    Oct 8 '15 at 20:27

If you've locked yourself out of the root account, you'll need to use physical access. There are two approaches:

  • Reboot the system. At the prompt from the bootloader (e.g. Grub), request a root shell. You may need to press a key to make the bootloader prompt appear; with Grub, you typically need to press and hold Shift. Edit the kernel command line, i.e. the line that starts with linux, to add init=/bin/sh at the end. Boot, and you'll get a root shell. Use this to fix whatever configuration file needs fixing. This method requires access to the console and a bootloader that isn't locked up.
  • Power off the system. Take out the hard disk, plug it into another machine, and mount the system partition. Edit whatever configuration file needs fixing. This method requires access to the machine's storage.

Since your system is running in a virtual machine, the “physical” access is in fact access to the account on the host system that's running the virtual machine. Rebooting and accessing the console is a straightforward analog of the physical case. Accessing the disk can be done with virtual machine software. Here are some methods:

  • I am going to try the Grub method then single user mode. For the "guestmount" option I am assuming that VMware tool has a CLI interface somewhere where I can run that command? Also, the last link you posted does that work for vmdk files as well as virtualbox?
    – user53029
    Oct 9 '15 at 14:04
  • @user53029 Sorry, I don't know enough about VMware to answer that. You could ask it as a new question. Oct 9 '15 at 14:14
  • I was able to get a shell using grub but unable to make changes. Says the FS is RO. Is there a way to have Grub mount RW?
    – user53029
    Oct 9 '15 at 14:43
  • 1
    @user53029 Not related to grub. At the shell prompt: mount -o remount,rw / and perhaps also (depending on what programs you use) mount -t tmpfs tmpfs /tmp, mount -t proc proc /proc, mount -t tmpfs tmpfs /run. Oct 9 '15 at 15:39
  • hmmmm...etc/mtab shows it RW. I wonder if its a permissions thing.
    – user53029
    Oct 9 '15 at 16:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.