0

One of my colleague removed by error etc/passwd and etc/shadow files.

The problem is that now the system doesn't have any account.Impossible to connect by ssh or to work on it.

How can I create a root account?

2

If you have physical access then you could reboot with the kernel line as rw init=/bin/bash. This should give you root access to recreate the user accounts.

| improve this answer | |
0

You might try to copy another computer's passwd and shadow, assuming you know what you're doing. And I hope you've kicked your colleague's butt ;-)

See this and this

| improve this answer | |
0

If you don't have an existing rootshell open then I doubt you can fix this without bios or bootloader access.

At that point you have two options.

  1. Boot a livecd.
  2. Boot from the installed system with init=/bin/sh and then manually bring up the network.

which is easier will depend on the particular circumstances.

If you do have an existing root shell open you should be able to use it.

Now you have a way to create files the next question is what to put in there. Debian has several categories of users (Debian policy 9.2.2).

  1. System users with fixed IDs that always exist for a given Debian release (UIDs 0-99 and 65534)
  2. System users with dynamically allocated IDs (UIDs 100-999)
  3. Regular users (UIDs 1000-59999, systems with insane numbers of users may also use 65536-4294967293)
  4. System users with fixed IDs but that are only created on demand (UIDs 60000-64999).

The first step should be to restore the users in the first category. This will be most easilly done by copying their password and shadow entries from another system running the same release of Debian.

If you have also destroyed your group files then the same ID ranges apply.

Once you have the basics restored you can start re-creating other users. For regular users looking in /home should give you clues as to which user goes with which UID. For system users it may take some more effort to figure out, probablly involving searching for files with unidentified owners and then looking at another system with the same software installed to figure out what user is supposed to own those files.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy