Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #187055 > unrolled thread

Rescue mode when root account locked

Back to article view | Back to linux.debian.user

Contents

  Rescue mode when root account locked solitone <solitone@mail.com> - 2017-09-20 13:50 +0200
    Re: Rescue mode when root account locked Dejan Jocic <jodejka@gmail.com> - 2017-09-20 15:10 +0200
    Re: Rescue mode when root account locked Michael Biebl <biebl@debian.org> - 2017-09-20 15:10 +0200
    Re: Rescue mode when root account locked Curt <curty@free.fr> - 2017-09-20 15:20 +0200
      Re: Rescue mode when root account locked solitone <solitone@mail.com> - 2017-09-20 16:00 +0200

#187055 — Rescue mode when root account locked

When I boot in rescue mode, I get this message:

Cannot open access to console, the root account is locked. See 
sulogin(8) man page for more details

When I press Enter to continue, it continues bootup in normal graphical 
mode.

Would it be wiser to unlock the root account, so that I can go into 
single user mode? Or is there something I can do, without unlocking the 
root account?

[toc] | [next] | [standalone]

#187056

On 20-09-17, solitone wrote:
> When I boot in rescue mode, I get this message:
> 
> Cannot open access to console, the root account is locked. See sulogin(8)
> man page for more details
> 
> When I press Enter to continue, it continues bootup in normal graphical
> mode.
> 
> Would it be wiser to unlock the root account, so that I can go into single
> user mode? Or is there something I can do, without unlocking the root
> account?
> 

You have locked root account, presumably during install, when you
decided that you do not need it and that you will just use sudo instead.
That stuff is more for Ubuntu than for Debian, because ubuntu has
patched sulogin to allow single user mode when root account is locked.
You can easily unlock you root account with sudo passwd root. Enter
password and root account will be unlocked. Unless you've used some
other method for locking root, like putting /usr/sbin/nologin shell in
/etc/passwd for root instead of /bin/bash. In that case you will have to
undo your changes there. 

[toc] | [prev] | [next] | [standalone]

#187057

[Multipart message — attachments visible in raw view] — view raw

Am 20.09.2017 um 13:46 schrieb solitone:
> When I boot in rescue mode, I get this message:
> 
> Cannot open access to console, the root account is locked. See
> sulogin(8) man page for more details
> 
> When I press Enter to continue, it continues bootup in normal graphical
> mode.
> 
> Would it be wiser to unlock the root account, so that I can go into
> single user mode? Or is there something I can do, without unlocking the
> root account?

See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211

-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

[toc] | [prev] | [next] | [standalone]

#187058

On 2017-09-20, solitone <solitone@mail.com> wrote:
> When I boot in rescue mode, I get this message:
>
> Cannot open access to console, the root account is locked. See 
> sulogin(8) man page for more details
>
> When I press Enter to continue, it continues bootup in normal graphical 
> mode.
>
> Would it be wiser to unlock the root account, so that I can go into 
> single user mode? Or is there something I can do, without unlocking the 
> root account?
>

It seems this a "bug."

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211

Michael Biebl says (to explain why careful deliberation is called for before it's
"fixed"):

 Consider this: You have a laptop with a locked root account. By default
 the grub boot loader generates a boot entry for rescue mode.
 So, even if you lock down the bios to not allow booting from CD-Rom or
 USB, and you password protect grub, someone could easily get root access
 if you leave the laptop unattended for a moment.

Marga Manterola created a "drop-in" fix:

  cat /etc/systemd/system/rescue.service.d/sulogin.conf
  [Service]
  ExecStart=
  ExecStart=-/bin/sh -c "/sbin/sulogin --force; /bin/systemctl
  --job-mode=fail --no-block default"

the security implications of which ("/sbin/sulogin --force") are beyond my meager
abilities to comment upon.

-- 
"Time flies like an arrow. Fruit flies like a banana." Groucho

[toc] | [prev] | [next] | [standalone]

#187060

I'll unlock the root account then.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web