1

I am running Ubuntu 14.04 LTS.

Yesterday, I changed the password on my user account, which is an admin account. This morning, I discovered that I can no longer use sudo su to switch to root. I know that sudo uses my user account's password, not the root account's password, but it did not allow me to go to sudo su with either password.

Then, after a reboot, when I logged in to the user account, it flashed a message on the screen briefly and then asked for my user name and password again. I had also changed privileges on my home directory yesterday, so I logged in as root and issued chmod 777 against my home directory. Now I can log in using that user account, but my directory structure has been replaced as though I am a new user. If I look at the directory from a terminal as root, I see this instead of the former directory structure:

root@CLM1001-Ubuntu:/home/stephen# whoami
root
root@CLM1001-Ubuntu:/home/stephen# ls
Access-Your-Private-Data.desktop  Documents  Music     Public      Templates
Desktop                           Downloads  Pictures  README.txt  Videos
root@CLM1001-Ubuntu:/home/stephen# 

I have seen this behavior before after trying to remove .ecryptfs and my only recourse then was to restore from system backups.

Is there something I can do to get this user account working properly again, short of doing another full system restore from backup?

I looked at /var/log/syslog and /var/log/auth.log but didn't see anything that was obvious to me. I can add dumps from those logs if needed, but they are large.

Adding a little more info: I noticed that my user account can no longer execute mysqldump - it gets privilege denied errors. Although I am able to get into phpmysql. (I know this is another question, so please just ignore it other than as possible, additional info on the first question.)

OK, here is more on this problem (if I can get my iMac to cooperate.) I executed a "script" session and will attempt to post the captured text now:

Script started on Sun 31 May 2020 03:51:24 PM PDT  
  stephen@CLM1001-Ubuntu:~$ whoami  
stephen  
  stephen@CLM1001-Ubuntu:~$ pwd  
/home/stephen  
  stephen@CLM1001-Ubuntu:~$ hostname  
CLM1001-Ubuntu  
  stephen@CLM1001-Ubuntu:~$ uname -a  
Linux CLM1001-Ubuntu 3.13.0-93-generic #140-Ubuntu SMP Mon Jul 18 21:21:05  UTC 2016 x86_64 x86_64 x86_64 GNU/Linux  
  stephen@CLM1001-Ubuntu:~$ passwd  
Changing password for stephen.  
(current) UNIX password:   
Enter new UNIX password:   
Retype new UNIX password:   
passwd: password updated successfully  
  stephen@CLM1001-Ubuntu:~$ sudo su  
[sudo] password for stephen:   
  root@CLM1001-Ubuntu:/home/stephen# whoami  
root  
  root@CLM1001-Ubuntu:/home/stephen# exit  
exit  
  stephen@CLM1001-Ubuntu:~$ whoami  
stephen  
  stephen@CLM1001-Ubuntu:~$ ./SQLbackup  
./SQLbackup  
Sun May 31 15:57:06 PDT 2020  
/dev/sdb5 on /media/stephen/Hitachi72101Ptn5 type ext4 (rw)  
/media/stephen/Hitachi72101Ptn5 is mounted  
-- Warning: Skipping the data of table mysql.event. Specify the --events  option explicitly.  
<snip> [note: SQLbackup is my script that runs mysqldump.]  
  stephen@CLM1001-Ubuntu:~$ echo "Ok, it looks like mysqldump is working."  
Ok, it looks like mysqldump is working.  
  stephen@CLM1001-Ubuntu:~$ exit  
exit  
Script done on Sun 31 May 2020 03:57:35 PM PDT  

THEN

  1. I logged in as stephen

    1. I can see my home directory intact
    2. I can sudo su with no problem
    3. I can run mysqldump with no problem.
  2. passwd I changed the password for the stephen account

  3. I can sudo su with no problem

  4. mysqldump with no problem
  5. Via the Firefox browser, attempted to log in to phpmyadmin, but cannot log into phpmyadmin as stephen (regardless of which password I use)
  6. ls still shows my home directory with no problem
  7. rebooted the system
  8. Cannot log in as stephen regardless of which password I use
  9. Logged in to the system using a different user account
  10. sudo su (to root)
  11. passwd Stephen
  12. I set the password to the original password again for stephen account
  13. logoff
  14. log in again as Stephen: Something flashes on the screen and it does directly back to the login screen
  15. reboot the system again
  16. login as Stephen: screen flashes and goes directly back to the login screen again
  17. log in using the second user account
  18. su Stephen

    Signature not found in user keyring
    Perhaps try the interactive 'ecry0tfs-mount-private'
    

So the machine is dead at this point until I find a fix or restore from backup again.


Ok, so I am logged in to the problem machine again, using the second user account. I sudo sud (to root) then, as root, did these steps: (the second user is rootytooty.)

root@CLM1001-Ubuntu:/home/rootytooty# whoami
root
root@CLM1001-Ubuntu:/home/rootytooty# cd /
root@CLM1001-Ubuntu:/# pwd
/
root@CLM1001-Ubuntu:/# su stephen
Signature not found in user keyring
Perhaps try the interactive 'ecryptfs-mount-private'
stephen@CLM1001-Ubuntu:/$ man ecryptfs-mount-private
stephen@CLM1001-Ubuntu:/$ ecryptfs-mount-private
Enter your login passphrase:
Error: Unwrapping passphrase and inserting into the user session keyring failed [-5]
Info: Check the system log for more information from libecryptfs
ERROR: Your passphrase is incorrect
Enter your login passphrase:
Error: Unwrapping passphrase and inserting into the user session keyring failed [-5]
Info: Check the system log for more information from libecryptfs
ERROR: Your passphrase is incorrect
Enter your login passphrase:
Error: Unwrapping passphrase and inserting into the user session keyring failed [-5]
Info: Check the system log for more information from libecryptfs
ERROR: Your passphrase is incorrect
ERROR: Too many incorrect password attempts, exiting
stephen@CLM1001-Ubuntu:/$ whoami
stephen
stephen@CLM1001-Ubuntu:/$ ecryptfs-mount-private stephen
Enter your login passphrase:
Error: Unwrapping passphrase and inserting into the user session keyring failed [-5]
Info: Check the system log for more information from libecryptfs
ERROR: Your passphrase is incorrect
Enter your login passphrase:
Error: Unwrapping passphrase and inserting into the user session keyring failed [-5]
Info: Check the system log for more information from libecryptfs
ERROR: Your passphrase is incorrect
Enter your login passphrase:
Error: Unwrapping passphrase and inserting into the user session keyring failed [-5]
Info: Check the system log for more information from libecryptfs
ERROR: Your passphrase is incorrect
ERROR: Too many incorrect password attempts, exiting

I guess I go for the restore again.

By the way: /var/log/syslog just shows the same messages that we saw in the terminal.

0

Ok, here is how I recovered:

  1. Log in using a second administrator account [My second account is rootytooty]
  2. Change to the root account: sudo su

  3. Look at the contents of the home directory for the damaged account with ls /home/stephen and notice that the directory contains Access-Your-Private-Data.desktop and README.txt files, but not the files that should have been there.

  4. Remove the home directory for the damaged account: rm -r stephen

  5. Remove the ecryptfs package

    apt-get remove ecryptfs-utils libecryptfs0
    
  6. Make a new, empty, home directory for the damaged account

    mkdir /home/stephen
    
  7. Set the privileges for the new, home directory

    chown stephen /home/stephen
    chgrp stephen /home/stephen
    chmod 777 /home/stephen
    
  8. Delete the .Private and .ecryptfs subdirectories from the backup copy of the damaged account's home directory. (You DID have a copy of that directory backed up on an external disk, didn't you?)

    cd /externaldrive/Backups/stephen-home
    rm -r .ecryptfs
    rm -r .Private
    
  9. Restore the files from the backup drive to the new home directory you created.

    cp -pvr /externaldrive/Backups/stephen-home/* /home/stephen/
    

    Note: During this copy activity, my monitor went black and then displayed a message, "no signal," and the red, disk activity light went out and all I could hear was the motherboard fan running. So I rebooted from a live disk (Redo backup disk). I mounted the drive containing the backup files and the drive containing the /home/stephen directory and resumed copying the files using the live CD.

    cp -vprf /externaldrive/Backups/stephen-home/* /home/stephen/
    
  10. Rebooted the system and logged in as stephen. My hidden directories were not there (.mozilla, .firefox, .local, etc.), so I had to copy the hidden directories from the backup.

    cp -pvr /externaldrive/Backups/stephen-home/.[^.]* /home/stephen/
    

    Several of the launcher icons were missing, the user settings were gone (window background image, etc.) The saved settings for my ftp software were gone. Same for other applications. So I had to set up my applications again. But my email history was all there.

Thanks to Nikos Alexandris for his post on December 25, 2012 How to stop using built-in home directory encryption and thanks to A.B. and pLumo and roaima for their sleuthing. They nailed the reason for the problem: a bug that has been there since Ubuntu 10.04.

So, if you are running ecryptfs then don't change your password. I hope this helps the next person who runs into this issue. I don't know if it persists in the later versions of Ubuntu, but it is still there in Ubuntu 14.04 LTS.

Thanks, StackExchange, for providing this venue.

| improve this answer | |
-3

So, if you have root account before password change you can login using username:root and unchanged password because sudo su is to create root login for the user account. If you use sudo su, it will work on user acount login to so after that type sudo su and change the password. I hope this will be make root access.

| improve this answer | |
  • 3
    Welcome! I have read your answer several times now but I am not able to understand what you want to say - please edit your answer to make it better readable. – guntbert May 30 at 19:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.