-1

I’m a newbie to Linux and have been over sometime setting up a NAS box based on an old Iomega NAS box modifying the installed software, mostly successfully. I haven’t done anything with it for over a month other than using it for storage as planned and all has been working well for longer.

In the past week I hit a issue which highlighted my problem. I login in, OK, then try to change to SU, password requested but is says “su: Authentication failure”. I’m sure what the password is and using “John The Ripper” on the Shadow file confirmed that the password is correct. So unable to go to SU to fix issues.

In trying to sort a solution I tried SUDO, but unsure if this is set up to work. Result being “sudo: must be setuid root” so no progress.

I’ve managed to find out that the permissions for SU in /bin/ is “-rwxr-xr-x 1 root nogroup 24480 1970-01-01 01:00 su” and SUDO in /usr/bin is “-rwxr-xr-x 2 root nogroup 110540 1970-01-01 01:01 sudo” I can’t find if SU is correct, but wonder if it should be –rwsr-xr-x. I understand the SUDO should be –rwsr-xr-x, but I can not set with chmod 4755 /usr/bin/sudo result “chmod: changing permissions of `/usr/bin/sudo': Operation not permitted”. If I try sudo chmod 4755 /usr/bin/sudo the result is “sudo: must be setuid root”. This may be a side track but its a dead end.

Last mod I did in the system was over a month ago and in the data section only of the NAS box, I mass changed all permissions on the data to 777. Only on the data storage area not any of the Linux folders. The data storage area is called NAS and lives in the root. Otherwise I do not know what has happened.

As to the actual question. Can anyone indicate what may have happened and more to the point how to sort and return SU level access again? The system is an Embedded Linux so headless and I use a Telnet connection to change everything, but Windows Explorer to explore and search areas.

My last idea is to remove the disk and place in a USB hard disk box and access via a VM Ubuntu installation. Then change the permissions to SUDO to –rwsr-xr-x if possible and if I can find out what SU should be change it’s permissions to suit, both using the VM’s chmod command. Can this be done?

Any help REALLY appreciated, thanks.

Update

Thanks for the confirmation offered in the second answer by Scott. If anyone has an alternative to re-instate the sticky bit with chmod I would appreciate it, otherwise I have to remove the disk as indicated, possible later this week on next weekend, so please comment, thanks.

0

The su utility allows you to become any user - as long as you know their password. Basically saves you from logging out and logging back in.

The sudo utility allows you to run commands as the root user. It can allow that to be done without entering a password, or it can require the user running the command to enter their own password.

So...

su - - you enter the root password.

sudo -i or sudo service foo status etc - you enter your own password if prompted

Then where it gets confusing - a lot of examples/directions/forum posts/etc have

sudo su -

The password you are prompted for is your own password - the sudo utility then calls su as the root user, and doesn't prompt for the root user's password.

Personally I'd use sudo -i over sudo su - ...

  • Thanks for that, it is informative but I can't see how it helps in this case, but thanks. – Private61 Apr 25 at 16:00
0

It seems like you basically understand the problem.  /bin/su and /bin/sudo must be setuid (to root), i.e., -rwsr-xr-x, i.e., 4755.  If they are -rwxr-xr-x (755) now, that means somebody (or something) chmod’ed them to an incorrect mode, perhaps by doing an ill-advised mass chmod.  This has crippled the system.

The Catch-22 is that you have to be root to fix this, and it’s very hard to become root if you don’t have a working su or sudo.  Normally in situations like this, the advice is:

  • Try to log in as “root”.  (And normally you are advised to configure your system not to allow direct login as “root”, especially remotely.)
  • Boot into single-user mode.  I don’t know how that would be possible on a headless system.

So, yeah, if you can remove the disk and access it in another computer, then

chmod 4755 /mnt/bin/su /mnt/bin/sudo

should fix it.

  • Thanks for that, at least I'm thinking in the right direction. It has to be done by myself as there nobody else to do it unless I've been hacked, no evidence of that. My mass Chmod was on the Data area which doesn't include the /bin/ area so how I've managed it I do not know. Thanks for your input. – Private61 Apr 28 at 15:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.