How can I restore/repair my broken /etc/sudoers file?

Hi,
so i messed with something I shouldn't have, I tried following this tutorial ( http://www.onlineaspect.com/2008/12/02/how-to-start-mamp-on-port-80-without-a-pa ssword/) to execute a single .sh script without being prompted for a password.

Anyway, I opened the /etc/sudoers file with TextMate, wrote a the line "username group = NOPASSWD: /path toscript" onto the first line (file seemed to be empty when opened by me) but this didn't work.

I deleted the content of the file so it is blank now and saved it again but now I cannot 'sudo' anymore.
Instead I just get a prompt saying:

*Syntax Error*
root is not in the sudoers file. This incident will be reported.

Is there any way I can repair this file or simply have the OS rebuild it?


Thanks,
Jannis

Mac Pro (early 2008), Mac OS X (10.6.2), Dual Quad 2,8Ghz / GeForce 8800GT / 16GB RAM / Boot: 128GB Crucial SSD

Posted on Mar 30, 2010 3:23 AM

Reply
6 replies

Mar 30, 2010 4:43 AM in response to meemorize

You probably want to ask that question on the Unix forum, but here's what i think you will have to do:
[Learn about vim|http://vim.sourceforge.net> (it's the text editor that you'll be using to change the file).
[Enable the root user and log in as root|http://support.apple.com/kb/ht1528].
Open Terminal and run visudo
That may be enough to reset the permissions so it works and all the text is still there. Otherwise, you'll have to add this:
# sudoers file.
#
# This file MUST be edited with the 'visudo' command as root.
# Failure to use 'visudo' may result in syntax or file permission errors
# that prevent sudo from running.
#
# See the sudoers man page for the details on how to write a sudoers file.
#
# Host alias specification
# User alias specification
# Cmnd alias specification
# Defaults specification
Defaults env_reset
Defaults env_keep += "BLOCKSIZE"
Defaults env_keep += "COLORFGBG COLORTERM"
Defaults env_keep += "_CF_USER_TEXTENCODING"
Defaults env_keep += "CHARSET LANG LANGUAGE LC_ALL LC_COLLATE LC_CTYPE"
Defaults env_keep += "LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME"
Defaults env_keep += "LINES COLUMNS"
Defaults env_keep += "LSCOLORS"
Defaults env_keep += "SSHAUTHSOCK"
Defaults env_keep += "TZ"
Defaults env_keep += "DISPLAY XAUTHORIZATION XAUTHORITY"
Defaults env_keep += "EDITOR VISUAL"
# Runas alias specification
# User privilege specification
root ALL=(ALL) ALL
%admin ALL=(ALL) ALL
# Uncomment to allow people in group wheel to run all commands
# %wheel ALL=(ALL) ALL
# Same thing without a password
# %wheel ALL=(ALL) NOPASSWD: ALL
# Samples
# %users ALL=/sbin/mount /cdrom,/sbin/umount /cdrom
# %users localhost=/sbin/shutdown -h now

Log out of root and disable the root user (see above link).

Mar 30, 2010 5:33 PM in response to meemorize

Hi,
and thank you for your help.

I followed your steps, including reading through (some) of the docs of the vim editor online, but I am getting stuck on what you mention as 'Open Terminal and run visudo'.

So I logged in as Root into my system, started the terminal and typed in

"visudo -c"

and I also tried just typing "visudo" in.

The first said no parsing errors.
The latter started the editor.

I copied your text into the clipboard and pasted it into the vim editor terminal window but I don't know how to save the file.

I ultimately typed ':quit' and got out of vim but the /etc/sudoers file remains at 0 KB size and the root is still 'not found' when I am trying to run something.

Would you please give me slightly more details on how I can copy your text into my empty file?
Or perhaps if I have failed to do the 'reset of permissions on the file' correctly tell me how to do so properly?

Thanks for reading,
kindest regards,
Jannis

Mar 30, 2010 7:54 PM in response to meemorize

Jannis, once you’ve logged in as root and opened Terminal, I’d recommend the following steps:

• Enter *cd /etc* and *ls -l sudoers* — in your case, the information shown might be something like


-r--r----- 1 root wheel 0 Mar 30 01:23 sudoers


The first field is a representation of the file’s permissions. The default permissions for the file (shown above) are “read-only access for the root user and all users in the wheel group; no access for anyone else”. The fifth field (the lone zero above) is the size of the file.

• Run the visudo command. When vim is running, press the lower case letter a to start adding text, copy and paste the text that Barney-15E provided, and press the Escape key to stop adding. Press :w to write the text to the sudoers file, and press :q to quit vim. (Alternatively, press either :wq or ZZ (lower-case in the former, upper-case in the latter) to write the file and quit vim in one command.)

• Run the *openssl dgst -sha1 -c sudoers* command on the restored sudoers file to make sure that it has the identical “signature” as its original contents. If it has an exact copy of its original contents, the following output should be returned:


SHA1(sudoers)= 81:0f:97:11:83:7c:80:49:7f:56:89:d5:cd:50:34:4b:81:6c:e4:29


• Ensure that the default permissions, owner, and group of the sudoers file are in place by the following commands: *chmod ug=r,o= sudoers* and *chown root:wheel sudoers*. Running *ls -l sudoers* should then show something like


-r--r----- 1 root wheel 1242 Mar 31 12:34 sudoers


• Now that you have a restored original sudoers file, save a copy of it so that if future circumstances require it, you can restore it easily. Something like *cp -p sudoers sudoers.original* will make it easy to find in the /etc directory.

Mar 31, 2010 5:28 PM in response to meemorize

Jannis, I’m glad that I could help. I have no idea if the same standard sudoers content is provided on every Mac OS X install, but I’m not aware of any reason why different content would be needed on different installations; as long as every Mac OS X system has a root user and an admin group, the same default sudoers file should work equally well on all of them.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

How can I restore/repair my broken /etc/sudoers file?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.