2

There is an authentication failure when I'm trying to enter password for any of my accounts. I am logged in using ssh to my AWS EC2 instance.

After a while I checked the privileges to files that store user information and found something strange.

I don't think it's normal that:

$ ls -l /etc/passwd /etc/shadow

Results in this:

-rw-r--r-- 1 root root 1402 Oct  7 10:58 /etc/passwd
---------- 1 root root  838 Oct  7 10:58 /etc/shadow

This may be the cause of the problem, since no user can read/write the file. In my opinion the normal output for /etc/shadow should look something like this.

-rw-r----- 1 root root  838 Oct  7 10:58 /etc/shadow

Could this be the problem and how can I fix it?

OS config:

NAME="Amazon Linux AMI"
VERSION="2015.09"
ID="amzn"
ID_LIKE="rhel fedora"
VERSION_ID="2015.09"
PRETTY_NAME="Amazon Linux AMI 2015.09"
ANSI_COLOR="0;33"
CPE_NAME="cpe:/o:amazon:linux:2015.09:ga"
HOME_URL="http://aws.amazon.com/amazon-linux-ami/"
Amazon Linux AMI release 2015.09
0

Amazon Linux, a RHEL clone, uses RPM to define the permissions on installed files. You can use the rpm -qf /etc/shadow command to determine the ownership. This shows that /etc/shadow is part of the setup package. You can then use the RPM database to query what the permissions should be for that file. There's a program called rpmls in the rpmdevtools package that does this, but you can do it with simple RPMs if you know the right syntax:

$ rpm -q --qf='[%-11{filemodes:perms} %-8{fileusername} %-8{filegroupname} %{filenames}\n]' setup | grep /etc/shadow
----------  root     root     /etc/shadow

This shows that it is expected that /etc/shadow are mode 0000. You shouldn't try to change it to something else. The PAM stack is perfectly capable of reading the shadow file. You must have some other problem.

0

Like @lese says try :

chmod 640 /etc/shadow
chown root:shadow /etc/shadow

and if it give's you "Operation not permitted" try :

lsattr /etc/shadow

and if it says ----i--------e- then run chattr -i /etc/shadow and chmod again.

  • The command returns lsattr: Permission denied While reading flags on /etc/shadow. Main thing is that I have no privileges at all to the file :( – Peter Gerhat Oct 9 '15 at 19:33
0

Yes you right, the permissions on your /etc/shadow seems to be wrong, but this depends on what distribution you are running. Please clarify this point, you can find it out with the following command:

# cat /etc/*release
DISTRIB_ID=LinuxMint
DISTRIB_RELEASE=17.2
DISTRIB_CODENAME=rafaela
DISTRIB_DESCRIPTION="Linux Mint 17.2 Rafaela"
NAME="Ubuntu"
VERSION="14.04.3 LTS, Trusty Tahr"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 14.04.3 LTS"
VERSION_ID="14.04"
HOME_URL="http://www.ubuntu.com/"
SUPPORT_URL="http://help.ubuntu.com/"
BUG_REPORT_URL="http://bugs.launchpad.net/ubuntu/"
cat: /etc/upstream-release: Is a directory

According to my distro (which is Linux Mint 17.2 Rafaela in fact) the default and correct permissions are: -rw-r----- 640 root shadow /etc/shadow

you can try to fix them by running following commands with root superpowers:

chmod 640 /etc/shadow
chown root:shadow /etc/shadow
  • It gives me chmod: changing permissions of ‘/etc/shadow’: Operation not permitted – Peter Gerhat Oct 9 '15 at 12:09
  • If you have root access to the server, become root and execute commands : ) Otherwise chattr -i /etc/shadow as Nikolay suggested should work, found same solution also here webhostingtalk.com/showthread.php?t=569413 – lese Oct 9 '15 at 14:08
  • 1
    My ssh only logs in as user without administrative privileges. I'm running Amazon Linux, but it seems that the problem is not unique to me and affects also other AWS users. I added the output of cat /etc/*release. – Peter Gerhat Oct 9 '15 at 18:40
0

Looks like a shadow config issue,

You could try the shadowconfig on command

  • shadowconfig not installed on my system – Peter Gerhat Oct 9 '15 at 18:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.