Su not working for me, locked out of root

angelleye

• June 07, 2015 17:36

I was following a guide about securing my server where it talked about disabling SSH root logins so that you have to login with a regular user and then use su/sudo to gain root access. Per the guide, I added my regular user to the Wheel Group in WHM, and then I logged in via SSH using my root user/password so that I could adjust /etc/ssh/sshd_config. I updated the port being used and I also set PermitRootLogin to no to disable root logins. This all worked fine, and now I can use the new port to connect via SSH using my regular user (and root no longer works here). The problem is when I try to use "su root" and I enter the root password (the same password that I used previously when I edited the sshd_config file) it's telling me the password is incorrect. It's also still the same password I use to login to the WHM control panel, so I know the password is good. I've seen in forums where people say this can happen if the su script is no longer owned by root, but when I browse to that I see "root wheel" as the owner/group, so that doesn't seem to be my problem. Again, I checked that my regular user is added to the Wheel Group in WHM, so I'm very confused why it's not working for me, and at this point I can't do anything that requires root, so I'm a little panicked. Any information on how I can resolve this would be greatly appreciated. Thanks!

• 

  quizknows

  • June 08, 2015 00:31

  Do you happen to have CSF installed? You could use the "watch system logs" feature to watch /var/log/secure while you try to auth to root. The su binary should be root/wheel on a cPanel system, but it also needs to be chmod 4750. The 4 in front of 750 is important so that it's suid when it executes. If you're even able to run the 'su' command at all, the user is in the wheel group, so that's probably not your issue. last but not least check cphulk... it can lock you out of root on your own system if someone else is brute forcing you at the moment.

  0
• 

  angelleye

  • June 08, 2015 04:10

  Do you happen to have CSF installed? You could use the "watch system logs" feature to watch /var/log/secure while you try to auth to root. The su binary should be root/wheel on a cPanel system, but it also needs to be chmod 4750. The 4 in front of 750 is important so that it's suid when it executes. If you're even able to run the 'su' command at all, the user is in the wheel group, so that's probably not your issue. last but not least check cphulk... it can lock you out of root on your own system if someone else is brute forcing you at the moment.

  
  Thanks for the response. I was reading about that and I was planning on installing it, but I haven't gotten there yet because this whole thing happened before I was able to play with that. I have a little bit more info here. Going through the WHM Security Advisor it told me to set the users to have jailed shells, so I had done that. I found through Google somewhere that su root will not work with jailed shell accounts, and that's what was causing the username to be returned as incorrect. So now I'm back in again with the "normal shell", and now when I run su root (or su - root) I get this error. su: cannot set user id: Resource temporarily unavailable.

  0
• 

  cPanelMichael

  • June 08, 2015 18:42

  su: cannot set user id: Resource temporarily unavailable.

  
  Hello, Is "WHM Home " Security Center " Shell Fork Bomb Protection" enabled on this system? If so, does the issue continue when it's disabled? Thank you.

  0
• 

  angelleye

  • June 09, 2015 05:13

  Hello, Is "WHM Home " Security Center " Shell Fork Bomb Protection" enabled on this system? If so, does the issue continue when it's disabled? Thank you.

  
  Yes, it was enabled, and yes, disabling it seems to resolve my issue! Thanks! I'm a little worried, though, because the WHM info in here tells me I should leave this enabled. How am I supposed to fully secure this thing of the security measures conflict with each other?

  0
• 

  cPanelMichael

  • June 09, 2015 17:58

  Hello, It's a useful security feature, but it's not required. You are welcome to implement custom limits as referenced in this thread if the default limits are restricting users too much:

  0
• 

  angelleye

  • June 09, 2015 18:26

  Hello, It's a useful security feature, but it's not required. You are welcome to implement custom limits as referenced in this thread if the default limits are restricting users too much:

  0

Please sign in to leave a comment.