Cannot Login as root

Question

At my work we ship our product on pre-installed servers as a software/hardware package. We are using open SUSE 10.3 for the OS and we setup and we always log in with the root user to do maintenance on the box. Recently we just had box returned to us that the customer said the could not longer connect to the box through the network interface. So when I started to work on the box I run into the this problem: At the command prompt to login i type the user name "root" and hit enter. Then even before it asks me for a password I get "Login incorrect".

I have never seen this behavior before and could not find any information about it online. Does anybody know what is going on?

Thanks.

Solution 1

Check your /var/log/auth.log against failed root login. You might find out something similar to these:

Dec 30 07:31:51 vps login[18093]: (pam_securetty) access denied: tty 'hvc0' is not secure ! Dec 30 07:31:51 vps login[18093]: FAILED LOGIN (1) on 'hvc0' FOR `root', Authentication failure

In modern systems there are lots of new technologies used, and for example XenServer virtualized instance might have console as hvc0.

This can be fixed by including that console into /etc/securetty. Just type: echo hvc0 >> /etc/securetty && kill -1 1 Then try login again.

Solution 2

some possibilities that immediately occur to me:

• most likely, someone changed the root password. which could mean that the box has been hacked.
• the passwd or shadow file got corrupted or deleted somehow.
• ditto for /etc/nsswitch.conf or your PAM configuration.

to fix (or, at least get root access again):

reboot the system. at the grub prompt, edit the kernel line and add "init=/bin/bash". when the system boots, you'll get a bash prompt, and the root fs will be mounted read-only. you'll need to remount it RW. then change the root password. then run sync, remount / as RO again, and "reboot -f now" (optionally do some more investigation/fixing before rebooting).

note: however, that the console tty will be in a very strange state. you won't, for example, be able to kill processes by pressing ^C (because ^C isn't mapped to SIGINT yet). so don't make the mistake of pinging anywhere or running anything else that keeps going until it gets an INT. open a few more VTs with the openvt command before doing anything.

(BTW, for more about this topic, see my blog post ^C doesn’t kill processes, SIGINT does)

Solution 3

I would imagine nobody cares at this point, but I just hit this problem.

Scenario: We attempt to boot SuSE Linux 11 with Rescue mode, and replace the /etc/shadow entry with null so that root can log in without a password. The result is what the original poster said: "Login incorrect" without being prompted for a password. Not sure what, but something else is being changed by passwd.

The solution is to use the real passwd command, and the sticky point is the mount --bind below, because without it, passwd fails as the needed block devices aren't there:

• (boot in rescue)
• mount /dev/sda1 /mnt
• mount --bind /dev /mnt/dev
• chroot /mnt
• passwd root

Then the usual umount, umount, sync, halt.

Hope this helps someone.

Comments

[Philip Reynolds]

have you tried booting into single user mode? or with init=/bin/bash?

[Josh Moore]

Yes, it has a root account, I logged into that account before the box left our office

[Josh Moore]

I have physical access to the box so I am using the local console

[niXar]

I don't know of any Linux OS w/o a root account. It's just that logging in as root is discouraged.

[RainyRat]

Fair enough - does the same thing happen with either console and SSH access? Also, is there any account that you can use to get in, and check if the box still has a root account?

[Araejay]

Yes, OSs like ubuntu have a root account, but you can't log in unless you reset the password

[Ben Penwell]

in my Debian7 on XEN, this console was comented out, and I just un-commnet, and now I can log in as root on the local xen console.