help! i overwrote my /etc/passwd file

[jiggolo182]

i have done something terrible, as the subject implies! i was playing around with htpasswd and used /etc/passwd as my passwd file. this is what i get for learning stuff on my own i guess. i do have all the data from the /etc/passwd file but im not sure how to go about replacing it. i did this while i was ssh'd into my home box from work. i logged out and later tried to log back in.. no luck. if i re-run part of the install to create users again will that work? is there any easier way to get the /etc/passwd file back to the way it was before i made this retarded move? as always, i appreciate anyone's help and ideas!

brandon

[TheCatMan]

You could try booting from a floppy (http://www.toms.net/rb) or a Knoppix/Ubuntu/whatever CD, then mount the drive and restore the file. That would avoid any other changes the installer might make.

[jiggolo182]

i have thought about doing that as well but one problem is that if i logout/restart so i can boot into knoppix.. if i cant fix it from knoppix then i wont be able to log back into my machine as any user. right? i looked at that floppy link but knoppix seems bit easier.. can i mount and start knoppix while im still logged in to debian and replace the file from there? that doesnt seem like it would work but ive never tried it.

[bwkaz]

If you aren't currently logged in as root, then I don't think there's any way to become root without a passwd file anyway, so you may already be in a state where you can't recover from that system.

However, there is a way to recover (even if Knoppix doesn't work for some reason): you can boot with init=/bin/bash appended to the kernel command line. This will dump you into a (primitive!) shell instead of running all the boot scripts. From this shell, you should mount your root FS read-write, edit the passwd file, remount the root FS read-only, and reboot (ctrl-alt-delete should work).

But try Knoppix (or any other livecd) first. If you know what data needs to be in the file (and actually, if you need a list of users, check /etc/shadow), then you can just put it in using any text editor, as long as you're root. You won't even need to know any users' passwords to replace the file, since the hashes aren't stored in /etc/passwd anymore :)

[jiggolo182]

well it wasnt as bad as i thought. the entire /etc/passwd file wasnt overwritten, just my particular user account info was trashed.. thus, i could still get into root and then i added my user info back into the file and voila! problem solved.