Emergency Recovery IV

Summary:

• Scenario III: Login Fails
• Scenario IV: System Hangs On Loading X
• Scenario V: System Freeze
• Scenario VI: Important Files Deleted

Scenario III: Login Fails

Notice that this scenario deals with the traditional console login. For problems related to X, check the next scenario.

Before panicking, make sure that you have not just fallen victim to a typing error: check if 'capslock' is on, try different capitalization, try to login on another account or terminal (switch with CTL-ALT-F2) etc.

A failed login might be due to a wrong / corrupt entry in either '/etc/passwd', '/etc/shadow' or '/etc/securetty', wrong file permissions or a forgotten 'root' password.

• In order to get into the system, reboot and type

at the ~LiLo boot prompt. If you are using GNU GRUB, hit the 'e' key twice and add

init 1

to the boot command and then ENTER and 'b' to boot.
This will boot the system into single user mode.

• By default Linux keeps backups of '/etc/shadow' and '/etc/passwd', called '/etc/passwd-' and '/etc/shadow-'. Your first line of rescue is using these backup files.
• Backup the current 'shadow' and 'passwd' files:

• Now overwrite them with their system backups:

• Try to switch to runlevel three to see if you can log into the system now:

• If this approach doesn't work, reboot into runlevel 1 again (press simultaneously).
• Once the system is up, type

Have a look at this file. It mustn't contain any blank lines, comments or non-ASCII characters. If you find them, delete them. The entry for 'root' must look exactly like this:

root:x:0:0:root:/root:/bin/bash

If it does not, change it and save the file.
Run

chmod 644 /etc/passwd

• Next, run vi /etc/shadow.

account_name:password:other stuff

root:$1$KODLGetc:10979:0:99999:7:::

The password entry is encrypted, of course.
Delete the password entry for 'root' by moving the cursor to first character of the password (usually the first '$') and typing dw. Now type :wq to save the file.

• Also have a look at '/etc/securetty' (more /etc/securetty), which should contain these entries:

tty1<br> tty2<br> tty3<br> tty4<br> tty5<br> tty6

• Other things to check include having a look at '/var/log/messages', which might reveal something about the nature of your problems with logging in, and checking the ownership and permissions (ls -al) of '/root/.bash_profile', '/root/.bashrc' and '/etc/gettydefs'. All these files must belong to 'root' and must be readable and writable for him.
• Reboot with init 6
• On the next login, type root for the account name and just hit at the 'password' prompt.
• Once you are logged in, type passwd to give 'root' a new password.

section index

Scenario IV: System Hangs On Loading X

If you have configured your machine to boot directly into graphics mode, configuration problems with your X server can prevent you from logging in.
Press to log into another console, kill the process which tries to start the X server and perform the troubleshooting steps outlined in the article on X Setup Troubles.
Alternatively, reboot and use the boot loader option (after pressing ESC)

linux init 3

to boot to the console while X isn't working.

section index

Scenario V: System Freeze

Silent interruptions, commonly called 'hang' or 'freeze', are usually caused by some problem of the operating system with the hardware it is running on (bad memory chips, driver bugs, IRQ conflicts etc). These interruptions usually do not leave a trace in the system's log files in '/var/log' and require either a software update or a hardware change.

Your main task in such a situation is to prevent further damage, e.g. file system corruption by just turning the computer off. The 'Magic ~SysRq Key' feature comes in handy here.

The Magic ~SysRq Key

This feature allows you to do some basic maintenance tasks even if the rest of the system isn't responding. It is enabled by default on Mandrake Linux. In particular, it allows you to shutdown your system properly, thus avoiding the risk of file system corruption when simply turning the machine off with media still being mounted.

The '~SysRq' sequence involves pressing three keys at once, the left ALT key, the '~SysRq' key (also labeled '~PrtSc' or 'F13') and a letter key:

• ALT <~SysRq> r , puts the keyboard in 'raw' mode.
  This might be helpful in cases where the graphical interface does not respond to keyboard or mouse commands any more. Having pressed that sequence, press simultaneously. This will try to kill the X server and drops you onto the console (i.e. it's the emergency key combination to switch from runlevel 5 to runlevel 3).
• ALT <~SysRq> s , attempts to write all unsaved data to disk ('sync' the disk) to prevent file corruption.
• ALT <~SysRq> e , sends a termination signal to all processes, except for 'init'.
• ALT <~SysRq> i , sends a kill signal to all processes, except for init, thus terminating all processes which ignored the termination signal.
• ALT <~SysRq> u , remounts all mounted file systems read-only. This prevents file system corruption.
• ALT <~SysRq> b , reboots the system. Alternatively, replace the 'b' with an 'o' to turn the machine off.

Via A Network

If your machine runs a telnet or SSH server, you should try to log into the frozen system from another machine. There are cases when just the graphical interface is frozen but the basic system and network services are still working.

section index

Scenario VI: Important Files Deleted

Do yourself a favour and install the Recover undeletion utility form your Mandrake Linux 8.2 CD, which makes file recovery a lot easier (it acts as a front end to the 'debugfs' tool). All you have to do is point it to the partition where that file was (as 'root'):

recover /dev/device

'recover' will ask you a row of questions to get the most possible deletion date, thus minimizing the files you'll have to look through later. Notice that 'recover' does recover the content of a file, but not it's name, therefore it is in your own best interest to provide as much data to it as possible.

section index

Related Resources:

Mdk-Ref 13
LIGS, 4.11
MAGIC SYSRQ KEY DOCUMENTATION
LIGS, 4.11
man 5 shadow
man 5 passwd
man recover

Other Languages : Français?

Revision / Modified: Jan. 28, 2002
Author: Tom Berger

Legal: This page is covered by the GNU Free Documentation License. Standard disclaimers of warranty apply. Copyright LSTB and Mandrakesoft.