5

While writing a script to edit the sudoers file without using visudo, the script did not check for issue, and I have introduced some bad edits into the sudoers file, and thus cannot use sudo at all anymore. (I know I did a very bad thing, and should probably have used something like this)

Question: Is there anyway I can recover from this mistake, or do I have to destroy the VM and start from scratch with a new one?

Improve this question
2
  • you can download some sample sudoers file and make sudoers work.
    – KlwntSingh
    Jul 26, 2017 at 15:05
  • @KlwntSingh True, but without access to the sudo command, the ec2-user cannot perform any root command, which is the core of the issue (perhaps it was confusing!)
    – Adonis
    Jul 26, 2017 at 15:08

5 Answers 5

Reset to default
5

How about user-data ?

I believe adding the "#cloud-boothook" allow to force the user-data to run at every restart.

#cloud-boothook
#!/bin/bash
echo 'test' > /home/ec2-user/user-script-output.txt

If so, you could fix your sudo scripts hopefully... or install / add AWS run commands configuration https://aws.amazon.com/blogs/aws/new-ec2-run-command-remote-instance-management-at-scale/

For sure if it is an EBS Drive, you can detach & fix and then re-attach on the original system. A bit of a pain though.

Improve this answer
0
4

Generally recovering from this sort of mistake involves editing the boot loader to force a root shell. Since you don't have physical access to the (non-physical) machine, things are a bit different.

If this is an EBS boot drive, you can try detaching it, fixing it on another machine, then reattaching.

This is a good opportunity to learn why it's useful to use configuration management tools for everything: if you were doing this, you could replace the instance in just a few minutes and one command.

Improve this answer
1
  • On some circumstances, detached root volume couldn't be reattached to same machine. This can be avoided by creating a snapshot of detached volume (either before or after removing it from instance) and a volume from this snapshot.
    – chupasaurus
    Jul 27, 2017 at 6:40
1

If you know the root password, typically you can type "su" to switch to a super-user. You can then edit your sudoers file to fix sudo.

Improve this answer
1
  • 1
    I know, however I never assigned a password to the root account, thus my question...
    – Adonis
    Jul 27, 2017 at 7:33
1

You need to have root access by using the su command as sudo doesn't seem to be usable and then make appropriate changes. Now for the most important point:

Always use visudo to edit sudoers file

Why? It tells you if there are any errors after you made changes hence preventing one from messing up sudo access.

To resolve broken sudo follow this guide.

*This may not be possible in virtual compute.

Improve this answer
1

Detach the root volume, attach it to a running instance and restore the sudoers file in the volume. Detach the volume and re-attach to the instance in question and restart it. This should work.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.