How can I restore the pam file system-auth?

Question

In my Centos 7 machine, and as an inexplicable mistake, I ran:

rm  /etc/pam.d/system-auth

Now, my system won't boot up, the network does not work, and in a few words, the system is trashed.

I tried to fix the problem with single user mode and running

ln -s /etc/pam.d/system-auth-ac /etc/pam.d/system-auth

This did not make any change and, after rebooting, my system is still not working.

The only solution that I found involves restoring the symlink from emergency mode, the challenge is, that emergency mode requires the root password which I don't have, and I don't seem to be able to change it from single user mode.

 Steps to reproduce:

 In a new CentOS installation:

• sudo rm  /etc/pam.d/system-auth    
• Restart    
• You will notice that the system won't reach the login page(if Gnome or KDE are enabled). Otherwise, you will reach the login page but it won't work even if you have the right credentials. 

Error I received I tried to login in emergency mode after I changed the root password in single user mode.

Steps trying to fix it : 
• Enter single user mode enabling it with rw init=/bin/bash
• ln -s  /etc/pam.d/system-auth-ac /etc/pam.d/system-auth

Thank you

Answer 1

I mistakenly did rm /etc/pam.d/system-auth

that file is actually a link to /etc/pam.d/system-auth-ac

at least looking at my RHEL 7.8 system at the moment, I expect it to be the same for CentOS.

So you may be able to simply boot your system using the CentOS install dvd (or usb stick) or any recovery type of live linux where you can mount your broken operating system's partition as read write. Then it may simply be a matter of doing, as root,

ln -s   /etc/pam.d/system-auth-ac   /etc/pam.d/system-auth

If that didn't fix it, then here is the contents of /etc/pam.d/system-auth-ac as it is in my RHEL 7.8 system Linux 3.10.0-1127.8.2.el7.x86_64, which should be the same as CentOS. Simply recreate that /etc/pam.d/system-auth file being this.

# This is the contents of   /etc/pam.d/system-auth-ac   from RHEL 7.8

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        required      pam_faildelay.so delay=2000000
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 200000 quiet_success
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 200000 quiet
account     required      pam_permit.so

password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
-session     optional      pam_systemd.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so

If you suspect SELINUX compounding the problem, then all you should need to do is edit /etc/selinux/config and do SELINUX=permissive

Answer 2

Don't forget selinux. Sestatus may tell you.

I'm not good enough with selinux. So if sestatus says enforcing, then

sed -i~ '/SELINUX=/s/=.*/=permissive/' /etc/selinux/config

and the reboot should kick it into allowing that system-auth to be used.

It's not an awesome fix if your home/shop loves it some selinux, but you should/can figure out the proper context to spackle around system-auth, relabel that, re-enable selinux on the box, bounce again and move on.