0

Well, for an unknown reason the file /etc/group has been cleared during a ssh session last week. As I manage ssh with allowgroups sshusers I could no more log in, but could however use the current session to modify sshd_config with allowusers so I can still log in.

I first though the problem came from command sudo addgroup user group I entered instead of sudo adduser user group, because group was void just after this. But after retrying it seems both commands are equivalent. So to be completely honnest, /etc/group is not void but contains only the last created groups. After those commands :

$ sudo adduser crashdebug 
$ sudo adduser helloworld testing
$ sudo addgroup helloworld testing
$ sudo deluser helloworld testing

I got this (first line is blank) :

$ sudo cat /etc/group

crashdebug:x:1000:
testing:x:1001:helloworld

And :

$ groups pi && groups crashdebug && groups helloworld
pi : crashdebug
crashdebug : crashdebug
helloworld : groups: cannot find name for group ID 1004
1004 testing
$ id pi && id crashdebug && id helloworld
uid=1000(pi) gid=1000(crashdebug) groups=1000(crashdebug)
uid=1005(crashdebug) gid=1000(crashdebug) groups=1000(crashdebug)
uid=1004(helloworld) gid=1004 groups=1004,1001(testing)
$ getent group
crashdebug:x:1000:
testing:x:1001:helloworld

Some of /etc/passwd including all created users :

$ cat /etc/passwd |  grep /bin/bash
root:x:0:0:root:/root:/bin/bash
pi:x:1000:1000:,,,:/home/pi:/bin/bash
nix:x:1001:1001:,,,:/home/nix:/bin/bash
autossh:x:1002:1002:,,,:/home/autossh:/bin/bash
adminmiaou:x:1003:1003:,,,:/home/adminmiaou:/bin/bash
helloworld:x:1004:1004:,,,:/home/helloworld:/bin/bash
crashdebug:x:1005:1000:,,,:/home/crashdebug:/bin/bash

I have no idea what is going on here. Maybe the problem is sd card corruption because /etc/group- is filled with binary dump and /var/log/auth.log to a great extent too. Anyway, apart the above problems, the Raspberry still works without much issues, though I would not dare to restart it. User pi is still sudoer, though it belongs only to group crashdebug which is not sudoer (tested), even after re-logging/re-sshing pi is still sudoer, how is it possible ???

Has anybody any idea how to address this issue ?

  • Can you show some of your /etc/passwd that includes them? – SDsolar Jun 12 '18 at 3:58
  • 5
    You seem to have two choices. 1) live with the uncertainty of not knowing when you might lose important data, or 2) re-flash the SD card and be more careful in future. – joan Jun 12 '18 at 10:00
  • @Joan that's actually a lovely answer! I'd accept it. <3 – OyaMist Jun 12 '18 at 13:31
  • @SDsolar question edited. Also included all created users. adminmiaou is no more sudoer but pi still is. – hello world Jun 12 '18 at 22:10
  • All good. I agree that backing up your SD card would be a very good idea before proceeding. Here's a good way to do it using Win32DiskImager: howtogeek.com/341944/… – SDsolar Jun 13 '18 at 2:22
1

The situation continued to deteriorate till I could no more ssh (connection refused). It appears that simply unplugging and replugging the raspi finally solved the issue. The files where restored to a state prior to inconsistencies and prior to my latest modifications of sshd_config, so authentication through allowgroups was back ! I guess the restart triggered fsck and it seems now quite sure that a simple reboot through ssh when it was still working would have do the trick, anyway I did not dare to do this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.