Root privilege/sbin/init no faulty murders.

Environment: Linux 5.4 server,ORACLE 10.0.2.4 Database

Case : last week a dba in a database did a migration operation and said it was suddenly out of the blue, to confirm that the password was suddenly changed to someone who might have ROOT privileges. But it's too weird, this database server is in a high security level and has been running for several years without any problems. There's been a problem with the new DBA just root . Fortunately there is a bastion host, so immediately confirm the action of the fortress host, did not find the command to change the ROOT password. Startled by a cold sweat, it is difficult to be attacked.

: Inthe IDC room, with the display to intervene to find the interface to stay in the radhat login interface, but the input password are prompt authentication failure ;

: Asoft shutdown, but for a long time to stay on an interface for more than half an hour do not move;

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/6E/80/wKioL1V-lXaD3IOzAAUC-Cq7ruw232.jpg "title=" 1.jpg " alt= "Wkiol1v-lxad3iozaauc-cq7ruw232.jpg"/>

A:try to force shutdown, restart the system after the initialization of the exception;

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/6E/84/wKiom1V-k7fxL5EIAAT5tyQV3i4787.jpg "title=" 2.jpg " alt= "Wkiom1v-k7fxl5eiaat5tyqv3i4787.jpg"/>

:,try Linux single-user mode to modify the password, the results of single-user mode can not enter the system, the error as above;

A:xx, suspected that the underlying file was deleted, require second-line preparation LINUX5.4 operating system CD to the computer room;

at:xx, we installed a fault machine and the same operating system and database virtual machine, in case of failure to recover, we export data files directly to restore the database;

at:xx, through the CD-ROM boot Linux into the rescue mode, we log on to the system after the discovery of the key database file directory is still in, immediately relieved a lot;

A:we found that the file system underlying file has been moved, through the Fort Host video analysis Instantaneous conclusion, should be the operator with FTP operation accidentally dragged the underlying file /lib64 to /media directory, and because /sbin/init is dynamically linked, the resulting surface appearance is /sbin/init not exist;

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/6E/80/wKioL1V-lUnhO7XLAADDfk7U9x0737.jpg "title=" 3.jpg " alt= "Wkiol1v-lunho7xlaaddfk7u9x0737.jpg"/>

Lesson: Root permissions must be tightened, especially for unfamiliar old-timers in the new environment.

Experience: Linux Rescue mode is very important, if necessary, can save a life, we must learn.

This article is from the "Wheat Dock" blog, please make sure to keep this source http://yunlongzheng.blog.51cto.com/788996/1662089

Root privilege/sbin/init no faulty murders.