2

A student at my school, whilst logged in as root, committed

userdel -r root

We quickly came to the consensus that he needed to reinstall (not too big a burden in this environment). But is this situation, where the root account has actually been removed, not just disabled - is this even theoretically recoverable?

Brighid McDonnell
  • 389
  • 1
  • 8
  • 20

3 Answers3

4

If all goes wrong and you can't use sudo or boot in single user mode as suggested by Zypher, put on a live CD, mount the partition and add it manually to the /etc/passwd and /etc/shadow.

You will have to fix groups too after that.

For reference, there're the lines on passwd and shadow. The password for root in this shadow line is test

passwd

root:x:0:0:root:/root:/bin/bash

shadow

root:$6$YlqpNCBt$yYpknNzO8e4NLEKwXqHeJLTixssV8AxNRPKn/pr1CrsIlHSv7chPRDJ9Li3XMqsDm9zytWt8KQOd99VT0cBGF0:14824:0:99999:7:::
coredump
  • 12,713
  • 2
  • 36
  • 56
  • 2
    `sudo` shouldn't work, as there is no UID 0 to become, so mounting the partition rw and manually adding the root user back sounds like the most direct and workable solution. – cpbills Aug 03 '10 at 20:30
  • Manually adding "root" back into /etc/passwd and /etc/shadow is what we ended up doing. Accepting on that basis. – Brighid McDonnell Aug 04 '10 at 04:28
1

theoretically you should be able to use a sudo user, or single user mode and re-add the user with the --uid 0 & --gid 0 & --home /root options. I've never tried it but it should work.

Zypher
  • 37,405
  • 5
  • 53
  • 95
  • Sudoing actually didn't work while the root account was not present. Going to runlevel 1 and manually adding the user to /etc/passwd and /etc/shadow, then changing the password, seemed to work. With the help of vm snapshots, we recreated the situation. :D – Brighid McDonnell Aug 03 '10 at 20:18
0

From the man page, userdel will remove the account and the "home" directory of the deleted user. The crontab for the user will also be removed.

My guess is that the root account and password could be regenerated. And from backups, the root crontab and the /root directory could be recovered.

mdpc
  • 11,856
  • 28
  • 53
  • 67