DSM-G600, DNS-3xx and NSA-220 Hack Forum

Unfortunately no one can be told what fun_plug is - you have to see it for yourself.

You are not logged in.

Announcement

#1 2011-09-11 23:23:44

kV29
New member
Registered: 2008-09-21
Posts: 2

missing root entry in /etc/shadow

Hello everyone,

i have a DNS-323 since 3 years now. It runs firmware 1.04 and is fun plugged with cleanboot and ssh enabled. To prevent unallowed access, i didn't leave the root password blank and changed it. I stored it using /mnt/HD_a2/fun_plug.d/bin/store-passwd.sh, all worked fine for the past 3 years.

Yesterday, after a long period of inactivity I attempted to log as root over ssh... and wondered why I was not able to log in. All other user would work, but root not. Since I didn't change the root password the least 3 years, I started to investigate... and found that there was a root entry in /etc/passwd and none in /etc/shadow ?!? A blank root password wouldn't either work.

I guess the whole happened a few months ago when I added a new user over the web interface, it changed the /etc/shadow and kicked the root entry out.

All what doesn't require special privileges still work well.

So now the question: Is there some possibility to recover from this... or do I simply have definitively bricked my unit? The warranty is now elapsed, I do not have any problems to modify the unit to add serial access if it can help.

Many thanks in advance for any help.

Offline

 

#2 2011-11-15 23:09:45

sm8ps
Member
From: Switzerland
Registered: 2009-12-13
Posts: 13

Re: missing root entry in /etc/shadow

Hello kV29

Really strange what you describe! Even stranger to me that I had exactly the same issues last night. I had been working on the device (a DNS-320) over the last few days and weeks, developing some rather elaborate home server set-up.

Out of the blue, there was no entry for 'root' in '/etc/passwd' anymore. The password entry in '/etc/shadow' was still present. I can track it down in the logs and am almost certain that there was no mis-configuration by my side. It appears to me that there was some file system corruption in the flash memory as quite a few files and folders had their time entries reset to January 1st, 1970.

I tried with all possible means to re-integrate 'root': Extracted the disks and SUID and SGID on the binaries in '/ffp/sbin' from a Linux computer which allowed me then to re-add user 'root' on the NAS and run 'store-passwd.sh'. Unfortunately to no avail. The user was added but for some unknown reason its password would not be recognized, even after I changed it.

I did make copies of the left over 'passwd', 'shadow', 'group' files and after checking that no user files were lost, I decided to reset the device from the web interface. AFAIR this did not do the trick. Though that was way past mid-night and I am uncertain now if it might have worked nevertheless. Anyways, I tried factory resetting (hardware button) and re-installed the firm ware and after that the device is running smoothly again. I had to add the additional user which was easy from the copies of the respective files.

If you have a backup of your settings from the web interface you might give them a try as well. For I did create some after the crash and when I applied them afterwards again -- thinking they might simply store the settings of the web interface -- was surprised to find out that the crushed 'passwd' file was re-introduced by that. (If anyone cares to investigate any further, I can provide the back-up file.) So it seems the back-up does contain some parts of '/usr/local/config/' where the files are persistently stored.

In terms of a resumé I am very proud of the device, really! I did experience what I should deem a super-maximum credible accident ("Super-GAU" in German) that could be fixed by re-installing a single firm ware file and manually restoring the password files. There was no data loss or loss of functionality at all. In a comparable crash on a real server machine you would be running for the fire alarm. Embedded Linux devices really rock, with FFP added they even rock n'roll!

Hope this helps you sort out the troubles. I am pretty certain your device will be running smoothly again.

Cheers!
St. Müller, Switzerland

Offline

 

#3 2011-11-16 01:46:44

sm8ps
Member
From: Switzerland
Registered: 2009-12-13
Posts: 13

Re: missing root entry in /etc/shadow

At a second glance, there was some damage in the file system on the hard disks, indeed. Namely the permissions were messed up a bit. Nothing major but enough to prevent e.g. Lighttpd from running. You may want to check that as well.

At a second glance, I deem it possible that I may have introduced an empty line into '/etc/passwd'. At least it is present in the (slightly crushed) copy that I saved from the crashed system. Cannot tell for sure how it got there. Maybe it was a result of the crash or the cause. But then I have never heard of Linux being so picky about empty lines in that file. I shall run 'pwck' from now one for sure! Well, it may have been due to a strong burst of solar winds or also just an OSI layer 8 effect.

Cheers!
sm

Offline

 

#4 2011-11-20 22:24:19

kV29
New member
Registered: 2008-09-21
Posts: 2

Re: missing root entry in /etc/shadow

Hello sm8ps,

thank you very much for your answer. I'll try a factory reset and reinstall the firmware when I find time to do it... I've about 250 GB data on the device and I don't dare experimenting before I've backed up all my data... I've a very old backup of my settings but am not sure if it is up-to date. I may try it after a factory reset.

Thank you again,

Cheers,

kV29.

Offline

 

Board footer

Powered by PunBB
© Copyright 2002–2010 PunBB