Cannot use sudo su after I changed my password

Question

I am running Ubuntu 14.04 LTS.

Yesterday, I changed the password on my user account, which is an admin account. This morning, I discovered that I can no longer use sudo su to switch to root. I know that sudo uses my user account's password, not the root account's password, but it did not allow me to go to sudo su with either password.

Then, after a reboot, when I logged in to the user account, it flashed a message on the screen briefly and then asked for my user name and password again. I had also changed privileges on my home directory yesterday, so I logged in as root and issued chmod 777 against my home directory. Now I can log in using that user account, but my directory structure has been replaced as though I am a new user. If I look at the directory from a terminal as root, I see this instead of the former directory structure:

root@CLM1001-Ubuntu:/home/stephen# whoami
root
root@CLM1001-Ubuntu:/home/stephen# ls
Access-Your-Private-Data.desktop  Documents  Music     Public      Templates
Desktop                           Downloads  Pictures  README.txt  Videos
root@CLM1001-Ubuntu:/home/stephen# 

I have seen this behavior before after trying to remove .ecryptfs and my only recourse then was to restore from system backups.

Is there something I can do to get this user account working properly again, short of doing another full system restore from backup?

I looked at /var/log/syslog and /var/log/auth.log but didn't see anything that was obvious to me. I can add dumps from those logs if needed, but they are large.

Adding a little more info: I noticed that my user account can no longer execute mysqldump - it gets privilege denied errors. Although I am able to get into phpmysql. (I know this is another question, so please just ignore it other than as possible, additional info on the first question.)

OK, here is more on this problem (if I can get my iMac to cooperate.) I executed a "script" session and will attempt to post the captured text now:

Script started on Sun 31 May 2020 03:51:24 PM PDT  
  stephen@CLM1001-Ubuntu:~$ whoami  
stephen  
  stephen@CLM1001-Ubuntu:~$ pwd  
/home/stephen  
  stephen@CLM1001-Ubuntu:~$ hostname  
CLM1001-Ubuntu  
  stephen@CLM1001-Ubuntu:~$ uname -a  
Linux CLM1001-Ubuntu 3.13.0-93-generic #140-Ubuntu SMP Mon Jul 18 21:21:05  UTC 2016 x86_64 x86_64 x86_64 GNU/Linux  
  stephen@CLM1001-Ubuntu:~$ passwd  
Changing password for stephen.  
(current) UNIX password:   
Enter new UNIX password:   
Retype new UNIX password:   
passwd: password updated successfully  
  stephen@CLM1001-Ubuntu:~$ sudo su  
[sudo] password for stephen:   
  root@CLM1001-Ubuntu:/home/stephen# whoami  
root  
  root@CLM1001-Ubuntu:/home/stephen# exit  
exit  
  stephen@CLM1001-Ubuntu:~$ whoami  
stephen  
  stephen@CLM1001-Ubuntu:~$ ./SQLbackup  
./SQLbackup  
Sun May 31 15:57:06 PDT 2020  
/dev/sdb5 on /media/stephen/Hitachi72101Ptn5 type ext4 (rw)  
/media/stephen/Hitachi72101Ptn5 is mounted  
-- Warning: Skipping the data of table mysql.event. Specify the --events  option explicitly.  
<snip> [note: SQLbackup is my script that runs mysqldump.]  
  stephen@CLM1001-Ubuntu:~$ echo "Ok, it looks like mysqldump is working."  
Ok, it looks like mysqldump is working.  
  stephen@CLM1001-Ubuntu:~$ exit  
exit  
Script done on Sun 31 May 2020 03:57:35 PM PDT  

THEN

1. I logged in as stephen

   1. I can see my home directory intact
   2. I can sudo su with no problem
   3. I can run mysqldump with no problem.

2. passwd I changed the password for the stephen account

3. I can sudo su with no problem

4. mysqldump with no problem
5. Via the Firefox browser, attempted to log in to phpmyadmin, but cannot log into phpmyadmin as stephen (regardless of which password I use)
6. ls still shows my home directory with no problem
7. rebooted the system
8. Cannot log in as stephen regardless of which password I use
9. Logged in to the system using a different user account
10. sudo su (to root)
11. passwd Stephen
12. I set the password to the original password again for stephen account
13. logoff
14. log in again as Stephen: Something flashes on the screen and it does directly back to the login screen
15. reboot the system again
16. login as Stephen: screen flashes and goes directly back to the login screen again
17. log in using the second user account

18. su Stephen

    Signature not found in user keyring
    Perhaps try the interactive 'ecry0tfs-mount-private'
    

So the machine is dead at this point until I find a fix or restore from backup again.

---

Ok, so I am logged in to the problem machine again, using the second user account. I sudo sud (to root) then, as root, did these steps: (the second user is rootytooty.)

root@CLM1001-Ubuntu:/home/rootytooty# whoami
root
root@CLM1001-Ubuntu:/home/rootytooty# cd /
root@CLM1001-Ubuntu:/# pwd
/
root@CLM1001-Ubuntu:/# su stephen
Signature not found in user keyring
Perhaps try the interactive 'ecryptfs-mount-private'
stephen@CLM1001-Ubuntu:/$ man ecryptfs-mount-private
stephen@CLM1001-Ubuntu:/$ ecryptfs-mount-private
Enter your login passphrase:
Error: Unwrapping passphrase and inserting into the user session keyring failed [-5]
Info: Check the system log for more information from libecryptfs
ERROR: Your passphrase is incorrect
Enter your login passphrase:
Error: Unwrapping passphrase and inserting into the user session keyring failed [-5]
Info: Check the system log for more information from libecryptfs
ERROR: Your passphrase is incorrect
Enter your login passphrase:
Error: Unwrapping passphrase and inserting into the user session keyring failed [-5]
Info: Check the system log for more information from libecryptfs
ERROR: Your passphrase is incorrect
ERROR: Too many incorrect password attempts, exiting
stephen@CLM1001-Ubuntu:/$ whoami
stephen
stephen@CLM1001-Ubuntu:/$ ecryptfs-mount-private stephen
Enter your login passphrase:
Error: Unwrapping passphrase and inserting into the user session keyring failed [-5]
Info: Check the system log for more information from libecryptfs
ERROR: Your passphrase is incorrect
Enter your login passphrase:
Error: Unwrapping passphrase and inserting into the user session keyring failed [-5]
Info: Check the system log for more information from libecryptfs
ERROR: Your passphrase is incorrect
Enter your login passphrase:
Error: Unwrapping passphrase and inserting into the user session keyring failed [-5]
Info: Check the system log for more information from libecryptfs
ERROR: Your passphrase is incorrect
ERROR: Too many incorrect password attempts, exiting

I guess I go for the restore again.

By the way: /var/log/syslog just shows the same messages that we saw in the terminal.

Answer 1

Ok, here is how I recovered:

1. Log in using a second administrator account [My second account is rootytooty]

2. Change to the root account: sudo su

3. Look at the contents of the home directory for the damaged account with ls /home/stephen and notice that the directory contains Access-Your-Private-Data.desktop and README.txt files, but not the files that should have been there.

4. Remove the home directory for the damaged account: rm -r stephen

5. Remove the ecryptfs package

   apt-get remove ecryptfs-utils libecryptfs0
   

6. Make a new, empty, home directory for the damaged account

   mkdir /home/stephen
   

7. Set the privileges for the new, home directory

   chown stephen /home/stephen
   chgrp stephen /home/stephen
   chmod 777 /home/stephen
   

8. Delete the .Private and .ecryptfs subdirectories from the backup copy of the damaged account's home directory. (You DID have a copy of that directory backed up on an external disk, didn't you?)

   cd /externaldrive/Backups/stephen-home
   rm -r .ecryptfs
   rm -r .Private
   

9. Restore the files from the backup drive to the new home directory you created.

   cp -pvr /externaldrive/Backups/stephen-home/* /home/stephen/
   

   Note: During this copy activity, my monitor went black and then displayed a message, "no signal," and the red, disk activity light went out and all I could hear was the motherboard fan running. So I rebooted from a live disk (Redo backup disk). I mounted the drive containing the backup files and the drive containing the /home/stephen directory and resumed copying the files using the live CD.

   cp -vprf /externaldrive/Backups/stephen-home/* /home/stephen/
   

10. Rebooted the system and logged in as stephen. My hidden directories were not there (.mozilla, .firefox, .local, etc.), so I had to copy the hidden directories from the backup.

    cp -pvr /externaldrive/Backups/stephen-home/.[^.]* /home/stephen/
    

    Several of the launcher icons were missing, the user settings were gone (window background image, etc.) The saved settings for my ftp software were gone. Same for other applications. So I had to set up my applications again. But my email history was all there.

Thanks to Nikos Alexandris for his post on December 25, 2012 How to stop using built-in home directory encryption and thanks to A.B. and pLumo and roaima for their sleuthing. They nailed the reason for the problem: a bug that has been there since Ubuntu 10.04.

So, if you are running ecryptfs then don't change your password. I hope this helps the next person who runs into this issue. I don't know if it persists in the later versions of Ubuntu, but it is still there in Ubuntu 14.04 LTS.

Thanks, StackExchange, for providing this venue.

Answer 2

So, if you have root account before password change you can login using username:root and unchanged password because sudo su is to create root login for the user account. If you use sudo su, it will work on user acount login to so after that type sudo su and change the password. I hope this will be make root access.