Mysteriously, on our public SSH server, root user is now showing up as qroot. All the files owned by root are now owned by qroot.

id qroot shows qroot is UID 0

/etc/passwd file is owned by qroot

/etc/shadow is readable only by qroot

su - says su: user root does not exist

su qroot says password is wrong (probably because shadow file mismatches)

What can I do to recover root user?

Fedora 14, plain /etc/passwd file based auth.

  • but from live CD and change the /etc/passwd, /etc/shadow, /etc/group, ... should work - as anyways IDs are used. And you could compare with another healthy system. – Zina Feb 6 '18 at 21:57
  • 1
    Public SSH? Your server has been p0wned. Wipe it and reconfigure it and be more careful with your security set up on it. Even if you regained control of root, there's no way to confirm the server is clean or not still compromised in some way. – music2myear Feb 6 '18 at 23:57

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.