From owner-freebsd-questions@FreeBSD.ORG Mon May 28 12:11:30 2007 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 63E1116A47B for ; Mon, 28 May 2007 12:11:30 +0000 (UTC) (envelope-from wmoran@potentialtech.com) Received: from mail.potentialtech.com (internet.potentialtech.com [66.167.251.6]) by mx1.freebsd.org (Postfix) with ESMTP id 388C113C43E for ; Mon, 28 May 2007 12:11:30 +0000 (UTC) (envelope-from wmoran@potentialtech.com) Received: from working (c-71-60-105-193.hsd1.pa.comcast.net [71.60.105.193]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.potentialtech.com (Postfix) with ESMTP id EFB40EBC78; Mon, 28 May 2007 08:11:28 -0400 (EDT) Date: Mon, 28 May 2007 08:11:22 -0400 From: Bill Moran To: Schiz0 Message-ID: <20070528081122.48d7319d@working> In-Reply-To: <8d23ec860705271617v60fab47fo264e8aa43120338a@mail.gmail.com> References: <8d23ec860705271617v60fab47fo264e8aa43120338a@mail.gmail.com> X-Mailer: Claws Mail 2.9.1 (GTK+ 2.10.12; i386-portbld-freebsd6.2) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Cc: freebsd-questions@freebsd.org Subject: Re: Locked Myself Out - Cannot "su" X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 May 2007 12:11:30 -0000 Schiz0 wrote: > This is one of those things where after you realize what you've done, > you just want to smack yourself. > > I've been working on hardening my FreeBSD 6.2-Stable box. I disabled > root login from everywhere, including the console (The box isn't > physically secure, so I didn't want anyone screwing around). Now, me > being stupid, didn't reboot after making all these changes to harden > it. So I finally rebooted (With the secure level set to 2) and I found > that I can't run "su." I get the following error: > > $ su - > su: not running setuid > > I can't shutdown since I can't become root, so I pulled the plug and > rebooted into single-user mode. I edited /etc/rc.conf and set > kern_securelevel_enable="NO" > > I rebooted again, but for some reason I still get the same error for "su." > > So basically, I locked myself out of my box completely. I fail :-( > > su has the following permissions: > -r-sr-xr-x 1 root wheel schg 12240 May 13 13:15 su > > And sudo isn't installed, unfortunately. Any ideas of how to get root back? What's the output of mount? Did you maybe mount /usr nosetuid? -- Bill Moran http://www.potentialtech.com