Password bypassing - (for the clueless)

[Andrew_C]

Replies by PM if you feel appropriate.

 

A long time ago, a student set up a couple of *nix boxes in our observatory. They were removed some years ago, and were lurking in a store. Now, it transpires that there just might be some astronomical images on them, but no one knows the password. He's long gone...

 

If they were windoze boxes, I'd just boot them into Ubuntu with a cd, and copy the images off. Windows, obviously, can't handle the disk file structure.

 

Can anyone offer a clue how to get into the disk? I've got external an adaptor to hang the disk on.

[JJonas]

Why wont booting with a Ubuntu cd work?

[jinnantonnixx]

If you have physical access to the server, all security is out of the window.

 

Pause at the Grub loader (or Lilo)

Select the boot kernel and 'e' to edit the boot command line.

Add init=/bin/bash to the end of the line

Boot (press 'b')

Enter the command passwd to change root password.

 

That said, it's probably easier to connect it up to a network (or USB disk), pop in a modern Linux live CD (Ubuntu or Knoppix are good choices) and connect to your Windows network (or a USB disk) and copy whatever you want.

Edited March 7, 2012 by jinnantonnixx

[Andrew_C]

Why wont booting with a Ubuntu cd work?

It recognises the security on the disk.

[tom_newton]

It recognises the security on the disk.

 

Unless the student encrypted the disk (likelyhood = low) then it will just be that the unpriv'd user on the ubuntu live CD has a different uid from the one on-disk - if the disk mounts you should be able to read as root - "sudo -i" in a shell.

 

Otherwise, the previously mentioned trick by @jinnantonnix works

[oxide54]

If you have physical access to the server, all security is out of the window.

 

Pause at the Grub loader (or Lilo)

Select the boot kernel and 'e' to edit the boot command line.

Add init=/bin/bash to the end of the line

Boot (press 'b')

Enter the command passwd to change root password.

 

 

i think this mounts it readonly?? i think i had to remount the disk read-write before you could reset the root passwd ?

[CyberNerd]

If you have physical access to the server, all security is out of the window.

 

Unless Grub is password protected and the bios is locked - or the volume is encrypted.

[tom_newton]

Unless Grub is password protected and the bios is locked - or the volume is encrypted.

 

Even then, when physical access includes a screwdriver, only the latter provides protection, and even that is susceptible to evil-maid, and in some cases memory dump key recovery attacks.