root user renamed as qroot - unable to su or sudo

Question

Mysteriously, on our public SSH server, root user is now showing up as qroot. All the files owned by root are now owned by qroot.

id qroot shows qroot is UID 0

/etc/passwd file is owned by qroot

/etc/shadow is readable only by qroot

su - says su: user root does not exist

su qroot says password is wrong (probably because shadow file mismatches)

What can I do to recover root user?

Fedora 14, plain /etc/passwd file based auth.

You should also mention in your question what getent passwd root tells you. — JdeBP
– JdeBP, Commented Feb 6, 2018 at 20:03
@JdeBP I get no response for getent passwd root Just blank prompt... — Aravindh Sathish
– Aravindh Sathish, Commented Feb 6, 2018 at 20:38
@GAD3R Yes, I stumbled on that link upon Googling already. Couldnt get any useful remedies from it.. — Aravindh Sathish
– Aravindh Sathish, Commented Feb 6, 2018 at 20:42
is sudo installed? and configured to allow you to get a shell or run sudo vipw or similar? if so, then do that. Similarly, if you have an ~root/.ssh/authorized_keys set up to allow password-less root access you can ssh qroot@hostname and edit /etc/passwd. Otherwise, your best bet option would be to reboot to a rescue CD/USB-stick, mount the rootfs RW, and edit the /etc/passwd file to change qroot back to root. — cas
– cas, Commented Feb 7, 2018 at 1:10

Hauke Laging · Accepted Answer · 2020-05-21 23:35:53Z

Use the following command:

sudo -u \#0 vi /etc/passwd

1 Answer 1