Scenario III: Login Fails

Notice that this scenario deals with the traditional console login. For problems related to X, check the next scenario.

Before panicking, make sure that you have not just fallen victim to a typing error: check if 'capslock' is on, try different capitalization, try to login on another account or terminal (switch with ALT-F2) etc.

A failed login might be due to a wrong / corrupt entry in either '/etc/passwd', '/etc/shadow' or '/etc/securetty', wrong file permissions or a forgotten 'root' password.

1. In order to get into the system, reboot and type

   linux init 1

   at the LiLo boot prompt. If you are using GNU GRUB, hit the 'e' key twice and add

   init 1

   to the boot command and then ENTER and 'b' to boot.
   This will boot the system into single user mode.

2. By default Linux keeps backups of '/etc/shadow' and '/etc/passwd', called '/etc/passwd-' and '/etc/shadow-'. Your first line of rescue is using these backup files.

   1. Backup the current 'shadow' and 'passwd' files:

      cp /etc/shadow /etc/shadow.old
      cp /etc/passwd /etc/passwd.old

   2. Now overwrite them with their system backups:

      cp /etc/passwd- /etc/passwd
      cp /etc/shadow- /etc/shadow

   3. Try to switch to runlevel three to see if you can log into the system now:

      init 3

3. If this approach doesn't work, reboot into runlevel 1 again (press<ALT> <CTRL> <BACKSPACE> simultaneously).

4. Once the system is up, type

   vi /etc/passwd

   Have a look at this file. It mustn't contain any blank lines, comments or non-ASCII characters. If you find them, delete them. The entry for 'root' must look exactly like this:

   root:x:0:0:root:/root:/bin/bash

   If it does not, change it and save the file.
   Run

   chmod 644 /etc/passwd

5. Next, run vi /etc/shadow.

   The format of entries in '/etc/shadow' is

   account_name:password:other stuff e.g.
   root:$1$KODLGetc:10979:0:99999:7:::

   The password entry is encrypted, of course.
   Delete the password entry for 'root' by moving the cursor to first character of the password (usually the first '$') and typing dw. Now type :wq to save the file.

6. Also have a look at '/etc/securetty' (more /etc/securetty), which should contain these entries:

   tty1
tty2
tty3
tty4
tty5
tty6

7. Other things to check include having a look at '/var/log/messages', which might reveal something about the nature of your problems with logging in, and checking the ownership and permissions (ls -al) of '/root/.bash_profile', '/root/.bashrc' and '/etc/gettydefs'. All these files must belong to 'root' and must be readable and writable for him.

8. Reboot with init 6

9. On the next login, type root for the account name and just hit<ENTER> at the 'password' prompt.

10. Once you are logged in, type passwd to give 'root' a new password.

If you still can't get into your system, there's something deeply mysterious going on. This might be one of the few cases where reinstalling might solve the problem.

section index top

Scenario IV: System Hangs On Loading X

If you have configured your machine to boot directly into graphics mode, configuration problems with your X server can prevent you from logging in.
Press <CTRL> <ALT> <F2> to log into another console, kill the processwhich tries to start the X server and perform the troubleshooting steps outlined in the article on X Setup Troubles.
Alternatively, reboot and use the boot loader option

linux init 3

to boot to the console while X isn't working.

section index top

Scenario V: System Freeze

Silent interruptions, commonly called 'hang' or 'freeze', are usually caused by some problem of the operating system with the hardware it is running on (bad memory chips, driver bugs, IRQ conflicts etc). These interruptions usually do not leave a trace in the system's log files in '/var/log' and require either a software update or a hardware change.

Your main task in such a situation is to prevent further damage, e.g. file system corruption by just turning the computer off. The 'Magic SysRq Key' feature comes in handy here.

The Magic SysRq Key

This feature allows you to do some basic maintenance tasks even if the rest of the system isn't responding. It is enabled by default on Mandrake Linux. In particular, it allows you to shutdown your system properly, thus avoiding the risk of file system corruption when simply turning the machine off with media still being mounted.

The 'SysRq' sequence involves pressing three keys at once, theleft ALT key, the 'SysRq' key (also labeled 'PrtSc' or 'F13') and a letter key:

1. <ALT> <SysRq> <r> puts the keyboard in 'raw' mode.
   This might be helpful in cases where the graphical interface does not respond to keyboard or mouse commands any more. Having pressed that sequence, press <ALT> <CTRL> <BACKSPACE> simultaneously. This will try to kill the X server and drops you onto the console (i.e. it's the emergency key combination to switch from runlevel 5 to runlevel 3).

2. <ALT> <SysRq> <s> attempts to write all unsaved data to disk ('sync' the disk) to prevent file corruption.

3. <ALT> <SysRq> <e> sends a termination signal to all processes, except for 'init'.

4. <ALT> <SysRq> <i> sends a kill signal to all processes, except for init, thus terminating all processes which ignored the termination signal.

5. <ALT> <SysRq> <u> remounts all mounted file systems read-only. This prevents file system corruption.

6. <ALT> <SysRq> <b> reboots the system. Alternatively, replace the 'b' with an 'o' to turn the machine off.

If you look at this sequence, you see that you are - apart from the first step - actually emulating the 'init' shutdown process. Therefore it is important that you press these sequences in the correct order (e.g. that you 'sync' the drives before remounting them): Raw -Sync - tErm - kIll -Umount - reBoot. A possible mnemonic phrase: 'Raising Skinny Elephants Is Utterly Boring'. Mandrake Linux user Louis suggested this phrase, which is a bit more on topic: 'Remembering the Sequence Entirely Is Useful Buddy'.

Via A Network

If your machine runs a telnet or SSH server, you should try to log into the frozen system from another machine. There are cases when just the graphical interface is frozen but the basic system and network services are still working.

section index top

Scenario VI: Important Files Deleted

Do yourself a favour and install the Recover undeletion utility form your Mandrake Linux 8.2 CD, which makes file recovery a lot easier (it acts as a front end to the 'debugfs' tool). All you have to do is point it to the partition where that file was (as 'root'):

recover /dev/device

'recover' will ask you a row of questions to get the most possible deletion date, thus minimizing the files you'll have to look through later. Notice that 'recover' does recover the content of a file, but not it's name, therefore it is in your own best interest to provide as much data to it as possible.

section index top