Bad edit to sudoers file on EC2 instance, how to fix it?

Question

While writing a script to edit the sudoers file without using visudo, the script did not check for issue, and I have introduced some bad edits into the sudoers file, and thus cannot use sudo at all anymore. (I know I did a very bad thing, and should probably have used something like this)

Question: Is there anyway I can recover from this mistake, or do I have to destroy the VM and start from scratch with a new one?

Answer 1

How about user-data ?

I believe adding the "#cloud-boothook" allow to force the user-data to run at every restart.

#cloud-boothook
#!/bin/bash
echo 'test' > /home/ec2-user/user-script-output.txt

If so, you could fix your sudo scripts hopefully... or install / add AWS run commands configuration https://aws.amazon.com/blogs/aws/new-ec2-run-command-remote-instance-management-at-scale/

For sure if it is an EBS Drive, you can detach & fix and then re-attach on the original system. A bit of a pain though.

Answer 2

Generally recovering from this sort of mistake involves editing the boot loader to force a root shell. Since you don't have physical access to the (non-physical) machine, things are a bit different.

If this is an EBS boot drive, you can try detaching it, fixing it on another machine, then reattaching.

This is a good opportunity to learn why it's useful to use configuration management tools for everything: if you were doing this, you could replace the instance in just a few minutes and one command.

Answer 3

If you know the root password, typically you can type "su" to switch to a super-user. You can then edit your sudoers file to fix sudo.

Answer 4

You need to have root access by using the su command as sudo doesn't seem to be usable and then make appropriate changes. Now for the most important point:

Always use visudo to edit sudoers file

Why? It tells you if there are any errors after you made changes hence preventing one from messing up sudo access.

To resolve broken sudo follow this guide.

*This may not be possible in virtual compute.

Answer 5

Detach the root volume, attach it to a running instance and restore the sudoers file in the volume. Detach the volume and re-attach to the instance in question and restart it. This should work.