3

We're running a small Centos 5 server in a virtual machine for a class assignment. For reasons unknown, starting about a week ago a number of services started failing. When we tried to investigate we discovered that we could no longer login as root. We booted into single user mode and reset the root password, but even after doing so, still got an error message of "Login incorrect" when logging in. We can login in as other users. At first we were not able to run the command su root. We would recieve the error message "cannot set groups operation not permitted." However we resolved that error by running the command chmod u+s /bin/su in single user mode. We still cannot log directly into root.

Any thoughts on how to get root access back. It's problematic because we still can't get some services like ssh running with the setup we've got. The screen also locks up whenever we try to boot into the gui with run level 5, instead of the command line with level 3

Improve this question

1 Answer 1

Reset to default
5

Look at the logs generated when you try to log in (they're in /var/log, I think /var/log/auth.log but the name might be different on CentOS).

Do you keep /etc under version control? If you do, check what's changed. If you don't, consider doing it in the future. I recommend etckeeper.

Since this is a virtual machine, try mounting its filesystem on the host with Guestfs. (On a physical machine, you could mount the disk in another computer.) Alternatively, boot from a live CD or USB. This will allow you to explore the filesystem.

A possible explanation for your problem is that you've installed a security feature incorrectly, causing su to lose its setuid bit and other problems. Or you might have unduly changed some files' permissions. It's rather hard to tell without more information, and even with more information, such forensics can be difficult even when you have your hands on the machine.

I would recommend no longer using this VM for production. Install another, and extract any data you want to keep off the first VM.

Improve this answer
5
  • and if possible, take periodic backups of your vms. that allows you to directly compare a problematic VM with the last known good iteration of the same VM, as well as providing a way to restore service. and, @Gilles, thanks for the pointer to etckeeper. I'm definitely going to take a look at that.
    – Tim Kennedy
    Nov 9, 2011 at 2:36
  • Thanks I'll look into this tonight. @Tim, I wish we could do that, the VM's are part of a vSphere instance managed by university sysadmins. They've been less than helpful and all they've been willing to do is rebuilt a brand new VM without any of the work we did all semester.
    – AndrewSwerlick
    Nov 14, 2011 at 5:01
  • Giles, Your hint pointed me in the right direction. In the var/log/secure file (Centos's equivalent to auth.log), I found the follwing "/etc/securetty is either world writable or not a normal file." I looked at that file and sure enough it's permissions were 777. I set them back to 600 and then I could log on as root. Poking around though, I realized somehow every file in etc had been made 777. Someone in our group must have fat fingered a command. So this means that we pretty much have to start from scratch, copying over what we can. Thanks for pointing me in the right direction though.
    – AndrewSwerlick
    Nov 14, 2011 at 5:21
  • 2
    @AndrewSwerlick Broken permissions is recoverable, if you can trust all the users of the system. (If not, consider the machine thoroughly pwned.) Take a clean system and compare. Start with every directory at 755 and every file at 644, and make a few key files private. See What directories/file permissions should i ensure are set?, Wrongly set chmod / 777. Problems? and maybe one or two other questions on the site.
    – Gilles 'SO- stop being evil'
    Nov 14, 2011 at 8:27
  • Giles, Thanks again. Fortunately the only users are the 5 group members and the lifetime of this VM is until the end of the semester. It's only purpose is this project that only our class and the prof will see. I'll try to recover using the information provided.
    – AndrewSwerlick
    Nov 14, 2011 at 17:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .