0

I cant seem to get either sudo to work or my root to work. i thought it was related to me changing the default shells or forgetting the root password but i rest the root password and changed the default shells from the emergancy shell ass wel as rebuild the selinux tags.

then i applied chmod 4755 /usr/bin/sudo from recovery mode this also did not fix anything.

Below is an illustration of the problem.

~/scripts took 1m1s ❯ sudo reboot now Failed to write reboot parameter file: Permission denied ~/scripts took 3s ❯ sudo ./houdini.sh nice: cannot set niceness: Permission denied ~ ❯ su root Password: This account is currently not available. ~/scripts took 8m35s ❯ sudo -u root ./houdini.sh [root@fedora scripts]$ cd .. bash: cd: ..: Permission denied [root@fedora scripts]$ mount -o remount,rw / mount: /: must be superuser to use mount. dmesg(1) may have more information after failed mount system call. ❯ grep ^root: /etc/passwd grep: CGI: Is a directory grep: Desktop: Is a directory grep: dev: Is a directory grep: Documents: Is a directory grep: Downloads: Is a directory grep: git: Is a directory grep: houdini19.0: Is a directory grep: houdini19.5: Is a directory grep: Music: Is a directory grep: omniverse:: Is a directory grep: Omniverse: Is a directory grep: output.txt: Permission denied grep: Pictures: Is a directory grep: Public: Is a directory grep: scripts: Is a directory grep: Templates: Is a directory grep: tools: Is a directory grep: Videos: Is a directory ❯ id root uid=970(root) gid=0(root) groups=0(root) ❯ grep root: /etc/passwd oot:x:0:0:root:/root:/bin/bash operator:x:11:0:operator:/root:/sbin/nologin root:x:970:0:Super User:/root:/usr/sbin/nologin

currently this worries me

❯ sudo killall -u root ~ ❯ sudo usermod -u 0 -o root usermod: user root is currently used by process 100784

(the process shifts every time i rerun)

Improve this question
9
  • Run login and login as root Commented Sep 26, 2022 at 20:20
  • Not sure i understand. ~ ❯ login ~ took 5s ❯ login root I beleave it wont let me log in as root with the same password that works to sudo su and that i just changed to I`ll try again Commented Sep 26, 2022 at 20:24
  • Can you login as root user? sudo su Commented Sep 26, 2022 at 20:31
  • when i log in as root i cant open anny terminal or chrome or firefox and my gnome system updater gui tells me it doesn`t have acces. But i can log in. Commented Sep 26, 2022 at 20:35
  • 1
    root id is 0. Your root account in passwd is fake root - ordinal user. I dont know why you do this thing. Correct root account and remove fake root account. What idiot do this thing? Commented Sep 27, 2022 at 3:51

1 Answer 1

Reset to default
2

It looks like the username of the root account has been changed to oot.

This might be a result of a mistake in editing the /etc/passwd file without using vipw to safeguard it... but together with having UID 970 as a fake root account looks more like your system may have been hacked: this looks like it might be the work of an intruder that tries to ensure the legitimate owner won't be able to easily revoke intruder's access.

See this post in Information Security StackExchange: How to deal with a compromised server?

Improve this answer
6
  • Could it be that setting 'rw init=/sysroot/bin/sh' in grub to reset my password could have made this change ? Commented Sep 27, 2022 at 9:43
  • This is just my personal pc and I don't have the budget to spoof my Mac address and firewall everything. I have been having suspicions someone keeps hacking me but it might just be paranoia Commented Sep 27, 2022 at 9:45
  • If you edited /etc/passwd after doing a rw init=/sysroot/bin/sh, that might explain the root -> oot change, but the fact that a new user with UID 970 has been created and named root is harder to explain as an accident. You would have had to type that entire line. You might be using an easily bruteforceable/guessable password while having SSH logins from the internet enabled, or might have made some other basic security mistake. Commented Sep 27, 2022 at 10:15
  • if i you realy think i got hacked i fear its worse and someone has been deliberatly targetting me acros multiple reinstalls OSes and public ip`s. i fear spoofing my mac adress wont help at this point. I reinstalled and added PermitRootLogin no to my ssh config thank all of you for your time and advice. i really apreciate it Commented Sep 27, 2022 at 11:54
  • More likely it was a mindless piece of malware on another hacked system, actively looking for vulnerable hosts to add into a botnet. Perhaps to mine bitcoins without paying for hardware and electricity, perhaps to use your system as part of a distributed attack against someone else, perhaps to send junk email. If you have your system accepting SSH connections from the internet, you should use really good passwords or disable password authentication altogether and use SSH keys instead. Might also install fail2ban to block connections from an IP after a number of consecutive auth failures. Commented Sep 27, 2022 at 12:11

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.