Re: Re: Rescue mode when root account locked

[Jeffrey Walton]

On Thu, Jan 4, 2024 at 2:48 AM Larry Tyree  wrote:
>
> What do I do with no access to another computer?

I'm having trouble following your thread. The "Re: Re:" is throwing me off.

Is this the original message you are replying to:
?

Jeff

Re: Re: Rescue mode when root account locked

[Greg Wooledge]

On Wed, Jan 03, 2024 at 08:44:16PM -0600, Larry Tyree wrote:
> What do I do with no access to another computer?

The original Subject: line says "Rescue mode when root account locked".
Putting the Subject: and the body together, I conclude that the question
is "How do I enter rescue mode when there is no root password set?"

One way is to boot with your installation medium.  It'll probably offer
you some way to "rescue" your installed system.  Some menu option, most
likely.

Another way is to use your boot loader to add "init=/bin/bash" to
the kernel parameters.  This should give you a root shell on a root
file system that's mounted read-only.  Do an fsck on the root file
system, then remount it read-write, then set the root password, sync,
remount it read-only, reboot, and you should be able to enter rescue
mode using your newly set password.

If any of the file systems are encrypted, then I can't help.  I've never
dealt with that.

Re: Re: Rescue mode when root account locked

[Larry Tyree]

What do I do with no access to another computer?

Re: Rescue mode when root account locked

[solitone]

I'll unlock the root account then.

Re: Rescue mode when root account locked

[Curt]

On 2017-09-20, solitone  wrote:
> When I boot in rescue mode, I get this message:
>
> Cannot open access to console, the root account is locked. See 
> sulogin(8) man page for more details
>
> When I press Enter to continue, it continues bootup in normal graphical 
> mode.
>
> Would it be wiser to unlock the root account, so that I can go into 
> single user mode? Or is there something I can do, without unlocking the 
> root account?
>

It seems this a "bug."

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211

Michael Biebl says (to explain why careful deliberation is called for before 
it's
"fixed"):

 Consider this: You have a laptop with a locked root account. By default
 the grub boot loader generates a boot entry for rescue mode.
 So, even if you lock down the bios to not allow booting from CD-Rom or
 USB, and you password protect grub, someone could easily get root access
 if you leave the laptop unattended for a moment.

Marga Manterola created a "drop-in" fix:

  cat /etc/systemd/system/rescue.service.d/sulogin.conf
  [Service]
  ExecStart=
  ExecStart=-/bin/sh -c "/sbin/sulogin --force; /bin/systemctl
  --job-mode=fail --no-block default"

the security implications of which ("/sbin/sulogin --force") are beyond my 
meager
abilities to comment upon.

-- 
"Time flies like an arrow. Fruit flies like a banana." Groucho

Re: Rescue mode when root account locked

[Michael Biebl]

Am 20.09.2017 um 13:46 schrieb solitone:
> When I boot in rescue mode, I get this message:
> 
> Cannot open access to console, the root account is locked. See
> sulogin(8) man page for more details
> 
> When I press Enter to continue, it continues bootup in normal graphical
> mode.
> 
> Would it be wiser to unlock the root account, so that I can go into
> single user mode? Or is there something I can do, without unlocking the
> root account?

See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211

-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?



signature.asc
Description: OpenPGP digital signature

Re: Rescue mode when root account locked

[Dejan Jocic]

On 20-09-17, solitone wrote:
> When I boot in rescue mode, I get this message:
> 
> Cannot open access to console, the root account is locked. See sulogin(8)
> man page for more details
> 
> When I press Enter to continue, it continues bootup in normal graphical
> mode.
> 
> Would it be wiser to unlock the root account, so that I can go into single
> user mode? Or is there something I can do, without unlocking the root
> account?
> 

You have locked root account, presumably during install, when you
decided that you do not need it and that you will just use sudo instead.
That stuff is more for Ubuntu than for Debian, because ubuntu has
patched sulogin to allow single user mode when root account is locked.
You can easily unlock you root account with sudo passwd root. Enter
password and root account will be unlocked. Unless you've used some
other method for locking root, like putting /usr/sbin/nologin shell in
/etc/passwd for root instead of /bin/bash. In that case you will have to
undo your changes there. 

Rescue mode when root account locked

[solitone]

When I boot in rescue mode, I get this message:

Cannot open access to console, the root account is locked. See 
sulogin(8) man page for more details


When I press Enter to continue, it continues bootup in normal graphical 
mode.


Would it be wiser to unlock the root account, so that I can go into 
single user mode? Or is there something I can do, without unlocking the 
root account?