4

I bricked the login of my root user by removing zsh while it was still the default shell. Now as a result will login in fail, since on login will it try to use /bin/zsh(1), which is missing.

Only one other user is still available to execute code, but it has nearly no permissions. I tried elevating rights, both with su(2), sudo and various others without any success. Is there any way to fix this using command?

As a last resort would I try booting the server into a live CD and altering the file storage directly. But I would prefer avoiding this, since it would induce downtime and on failure also give me no possibility to restart all currently running services. The server is running CentOS.

(1)

$ cat /etc/passwd
root:x:0:0:root:/root:/bin/zsh

(2)

$ echo my-root-password | su --shell=/bin/bash - root -c 'yum install zsh -y'
Password: su: using restricted shell /bin/zsh
su: failed to execute /bin/zsh: No such file or directory

(The password is piped in, because running the code is not done in an interactive shell.)

EDIT: Thanks for all suggestions! Sadly none of them were applicable, so I had to settle for downtime. It took me a bit longer than I hoped, tried a lot of things which did not work but in retrospective are the following steps which solved the issue:

I changed the boot parameters to be able to have some basic control over the server. Edited the /etc/passwd file, and lastly disabled SELinux since it had some policies which caused the authentication service to fail on boot.

  • 3
    As a non-root user with sudo privileges, sudo chsh root. – DopeGhoti May 17 '18 at 22:12
  • Or you can mount this drive in a Live CD and edit config files from there. – ajeh May 17 '18 at 22:12
  • From the OP: "As a last resort would I try booting the server into a live CD and altering the file storage directly. But I would prefer avoiding this" – DopeGhoti May 17 '18 at 22:13
  • 1
    In a normal configuration, you can't do this. You may have left an accidental backdoor somewhere but it's a needle in a haystack (if it wasn't, security would be easy). A session that's still open somewhere? A cron job that executes a script that you have permission to modify? Check which groups you're in, that may give a clue of what to try. – Gilles May 18 '18 at 11:36
  • 1
    If you have FTP or SFTP (sftp, not ssh) enabled on the root account, those bypass the login shell. – Gilles May 18 '18 at 11:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.