URGENT...someone deleted the etc/passwd

[jodavi23]

URGENT...someone deleted the etc/passwd from root and I can't restore it.

My only option seems to be using a Debian GNU\Linux 3.0 bootup disk that I don't know the commands to. I don't want to end up erasing all of the disks when I just want to mount the right drives and restore the etc/passwd and etc/shadow files.

I have already tried using Linux init=/bin/sh at LILO boot screen, but it gets me only to read-only access in root. And single user mode is only good if you have user or root access.

I have a passwd.bak and a shadow.bak in root that I can't seem to restore since I have only read-only acces.

Is there another way besides the bootup disk solution?
OR, what tutorial or commands would I use for the bootup disk?

Thank you so very much if someone has a solution to this horrible problem-Dave

[lacek]

You can remount the read-only filesystem read-write after you passed the init=/bin/sh line to LILO. Do this:

Code: Select all

mount -n -o remount,rw /

After this, you can copy your backup files.

Note, however, that nobody should be able to remove the passwd file, except root. You should really find the source of this problem...

[Guest]

Thank you SO MUCH!!!!! I didn't know that I could so easily mount the file system for write access. That is an awesome command!!! FYI, don't let the president of your son have ssh ability into the server as user.

[oudaim]

hi

you can use backup /etc/passwd_
cp /etc/passwd_ /etc/passwd

regards