Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Shadow file deleted!!

510 views
Skip to first unread message

Sherief Reda

unread,
Sep 17, 1997, 3:00:00 AM9/17/97
to

One of my colleages accidently deleted the Shadow file, so what is the
procudre to recover from this accident??


Geoff. Lane

unread,
Sep 17, 1997, 3:00:00 AM9/17/97
to

In article <341f9f2...@news.idsc.gov.eg>,

com...@idsc1.gov.eg (Sherief Reda) writes:
> One of my colleages accidently deleted the Shadow file, so what is the
> procudre to recover from this accident??

If you are still logged in as root DON'T LOGOUT. Restore an old version
of /etc/shadow from the backups.

If you're not logged in as root it more difficult; you'll have to boot the
system from CDROM, mount the disk containing /etc and create a dummy entry
for root in /etc/shadow by hand. That'll get you to a point where you can
reboot, login as root and restore /etc/shadow from the backups.

If you haven't got backups the pwconv program may be of some help but you'll
have to reset all the passwords for all the users.

--
Geoff. Lane.

Exactly who makes the Tannoy announcements in M*A*S*H? It can't be
Radar and there is never anyone else in the office. (This refers to
classic M*A*S*H of course, not M*A*S*H*Lite with all the Radar removed
at source.)

Tony Walton

unread,
Sep 17, 1997, 3:00:00 AM9/17/97
to

Ravi C. Kumar wrote:

>
> Sherief Reda wrote:
> >
> > One of my colleages accidently deleted the Shadow file, so what is the
> > procudre to recover from this accident??
>
> Run pwconv and it will recreate the /etc/shadow file if it is missing
> or will update, in your case it will re-create it.

No it won't - it won't rebuild the password entries. It also won't
rebuild any password aging information. (It can't as the only place the
entries are stored is in /etc/shadow itself).

pwconv will at least provide a formatted shadow file (with x in the
encrypted password field for each entry) - it will NOT "rebuild" it.

Tony

Ravi C. Kumar

unread,
Sep 17, 1997, 3:00:00 AM9/17/97
to Sherief Reda

Sherief Reda wrote:
>
> One of my colleages accidently deleted the Shadow file, so what is the
> procudre to recover from this accident??

Run pwconv and it will recreate the /etc/shadow file if it is missing

or will update, in your case it will re-create it. man on pwconv
for more details.

--
Opinions are my own

Daniel

unread,
Sep 17, 1997, 3:00:00 AM9/17/97
to

>> Sherief Reda wrote:
>> >
>> > One of my colleages accidently deleted the Shadow file, so what is the
>> > procudre to recover from this accident??
>>
cp /etc/oshadow /etc/shadow?

--
Daniel Craigmile | Texas A&M University
http://void.tamu.edu/~danielc/ | Computing & Information Services
mailto:Dan...@TAMU.Edu | Operating Systems Project
(409) 845-6905 (voice) | UNIX Group

tw...@not.valid

unread,
Sep 17, 1997, 3:00:00 AM9/17/97
to

: > One of my colleages accidently deleted the Shadow file, so what is the

: > procudre to recover from this accident??

: Run pwconv and it will recreate the /etc/shadow file if it is missing


: or will update, in your case it will re-create it. man on pwconv
: for more details.

In this case you will probably lose the passwords with pwconv as they
will not appear in the /etc/passwd file.

Another way is to go to your backup tapes and simply restore the /etc/shadow
file.

You do take backups, don't you ?

IAP
--
In an attempt to reduce junk email I use an invalid 'From' address.
My my correct email address can be be determined by replacing 'not.valid' with
'value.net'

Joachim Peters

unread,
Sep 17, 1997, 3:00:00 AM9/17/97
to Sherief Reda

Sherief Reda wrote:
>
> One of my colleages accidently deleted the Shadow file, so what is the
> procudre to recover from this accident??

If you are running NIS or NIS+, you may be able to recover from this.
Try doing (in NIS) a
ypcat passwd > /tmp/passwd

This should give a pretty good approximation of the passwod file.

pwconv can then be the ticket to re-create the shadow file.
--
Joachim Peters
e-mail: jpe...@interaccess.com

Ravi C. Kumar

unread,
Sep 18, 1997, 3:00:00 AM9/18/97
to

Tony Walton wrote:


>
> Ravi C. Kumar wrote:
> >
> > Sherief Reda wrote:
> > >
> > > One of my colleages accidently deleted the Shadow file, so what is the
> > > procudre to recover from this accident??
> >

> > Run pwconv and it will recreate the /etc/shadow file if it is missing
> > or will update, in your case it will re-create it.
>

> No it won't - it won't rebuild the password entries. It also won't
> rebuild any password aging information. (It can't as the only place the
> entries are stored is in /etc/shadow itself).
>
> pwconv will at least provide a formatted shadow file (with x in the
> encrypted password field for each entry) - it will NOT "rebuild" it.
>
> Tony

Thanks, what I meant was exactly the same. It just recreates the
/etc/shadow with no password. However, he has a basis to start
from, that's what I meant. That's why I refered him to the man pages.

Secondly if you know anything about oshadow I'd like to know? When
is it created, what is its purpose and is it always one version
older than the /etc/shadow?? Why sun didn't have any man pages
info on this?? I know that it is for recvovery.

Horst Scheuermann

unread,
Sep 18, 1997, 3:00:00 AM9/18/97
to


> One of my colleages accidently deleted the Shadow file, so what is the
> procudre to recover from this accident??

look for /etc/oshadow and copy it to shadow, but some changes will
be lost.
--
Horst Scheuermann Universitaets-Rechenzentrum Trier __o 16
Universitaetsring 19 D-54286 Trier _`\<,_
Telefon: 0651 201 3436 Telefax: 0651 201 3921 (_)/ (_)
scheu...@uni-trier.de - Often in error; Never in Doubt! ~~~~~~~~~~~~
PGP Key fingerprint = 26 0E 77 0D 70 E5 D6 1C 7F 52 4D 4F 21 51 1F B5

Pierre Merle

unread,
Sep 18, 1997, 3:00:00 AM9/18/97
to Sherief Reda

use pwconv but the passwd are lost ...
If you already used this command you should have a shadow.something.
0 new messages