User dietpi dissapeared, user root is locked

Hi,

I have a problem with dietpi, it ran ok last weeks, and even some days ago; I don’t know what happened from yesterday, but today I can’t login anymore. The “dietpi” user completely dissapeared (it doesn’t exist in /etc/shadow and /etc/passw files) and I’m stuck in with login console requests but my old password or default passwords are not working.
Tried some things from this forum and other links, like modifying the shadow file, modifying the dietpi.txt options, but none worked.
I’m desperate since I had an official app and a DB on this dietpi, and I thought this OS would be very stable, as this situation didn’t happened to me with any other OS.

Before this, on the last day, I was configuring the wifi inner chip from RPI, repedeately using the dietpi-config to do this (it didn’t wanted in the first time, I had to do it with an external widi dongle, and after that, it saw the inner dongle chip as well). So all that I did was some dietpi-config → network settings and some multiple restarts. Then, maybe (I’m not sure) a accidental power interrupt and this was all. Today, like I explained, it boots up ok, but I can’t log in. And, btw, it says “mariabdb NOT started” (which I would want to debug but I can’t, I can’t enter the system, but this error is strange).

Please help me !

First of all, there is no function in DietPi who could delete user dietpi, because this is a user required for some functionality and therefor part of DietPi core. Loosing the root password is as well not an issue of DietPi. And I need to disagree with your statement about instability of DietPi related to loosing passwords.

I guess you are running a Raspberry Pi? If yes, you could have a look to following post. https://dietpi.com/forum/t/reset-password-for-login/6581/5

Wondering how the case of yours can happen: Did you move your DietPi userdata and/or the root filesystem to an external drive? Probably the external drive has connection our powering issues and it is booting somehow an old root filesystem from the SD card then. Although the UUID/PARTUUID wouldn’t match so not such a fitting expansion.

Or, the more troublesome expansion: Your server has been hacked. And the dietpi user has been intentionally removed by the attacker to lock you out.

@MichaIng

Probably I was attacked, I don’t know. The fact is what I described.
But now, what is the solution ?, as I read lots and lots of dietpi forum (this forum) pages and nothing seems to work for me.

Can I recover this data with a fresh install of dietpi ? Meaning to overwrite a fresh install with the data I have on the corrupted system.

did you followed the link I shared above?

https://howtoraspberrypi.com/recover-password-raspberry-pi/

basically this should allow to reset the root password.

@Joulinar

Yes, it worked, with some minor fstab fixes, and suceeded to login with root on a normal boot (removed init=/bin/sh), so thanks for that.
But when trying to do a “sudo su dietpi” it says: “user dietpi does not exist or the user entry does not contain all the required fields”.
Tried sudo useradd dietpi, it says the group dietpi already exists.
Tried sudo useradd dietpi dietpi, it says “the user dietpi does not exist”.

Something is corrupted probably because of the sdcard I’m assuming, but I do not know how to fix this user.
Should a remove and re-add user work ?

could you share following

cat /etc/passwd
cat /etc/group

Yes, I suceeded recreating dietpi user and group, then I had to recreate mysql user and group.
Then I see I’m having problems with apt, it says _apt user is not an existent user, so very strange.

So, the files you requested are:
/etc/passwd

root:x:0:0::/root:/bin/bash
daemon:x:1:1::/usr/sbin:/usr/sbin/nologin
bin:x:2:2::/bin:/usr/sbin/nologin
sys:x:3:3::/dev:/usr/sbin/nologin
sync:x:4:65534::/bin:/bin/sync
games:x:5:60::/usr/games:/usr/sbin/nologin
man:x:6:12::/var/cache/man:/usr/sbin/nologin
lp:x:7:7::/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8::/var/mail:/usr/sbin/nologin
news:x:9:9::/var/spool/news:/usr/sbin/nologin
uucp:x:10:10::/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13::/bin:/usr/sbin/nologin
www-data:x:33:33::/var/www:/usr/sbin/nologin
backup:x:34:34::/var/backups:/usr/sbin/nologin
list:x:38:38::/var/list:/usr/sbin/nologin
irc:x:39:39::/run/ircd:/usr/sbin/nologin
gnats:x:41:41::/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534::/nonexistent:/usr/sbin/nologin
systemd-network:x:103:103:systemd Network Management:/:/usr/sbin/nologin
systemd-resolve:x:104:104:systemd Resolver:/:/usr/sbin/nologin
systemd-timesync:x:101:101:systemd Time Synchronization:/:/usr/sbin/nologin
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
dietpi:x:100:65534::/home/dietpi:/bin/bash
mysql:x:1000:1001::/home/mysql:/bin/sh

and for the
/etc/group

root:x:0:
daemon:x:1:
bin:x:2:
sys:x:3:
adm:x:4:
tty:x:5:
disk:x:6:
lp:x:7:
mail:x:8:
news:x:9:
uucp:x:10:
man:x:12:
proxy:x:13:
kmem:x:15:
dialout:x:20:
fax:x:21:
voice:x:22:
cdrom:x:24:
floppy:x:25:
tape:x:26:
sudo:x:27:
audio:x:29:
dip:x:30:
www-data:x:33:
backup:x:34:
operator:x:37:
list:x:38:
irc:x:39:
src:x:40:
gnats:x:41:
shadow:x:42:
utmp:x:43:
video:x:44:
sasl:x:45:
plugdev:x:46:
staff:x:50:
games:x:60:
users:x:100:
nogroup:x:65534:
systemd-timesync:x:101:
systemd-journal:x:102:
systemd-network:x:103:
systemd-resolve:x:104:
input:x:105:
kvm:x:106:
render:x:107:
crontab:x:108:
netdev:x:109:
systemd-coredump:x:999:
dietpi:x:1000:dietpi
spi:x:998:
i2c:x:997:
gpio:x:996:
ssh:x:111:
jenkins:x:112:
mysql:x:1001:mysql

yes the users are not as they should be. On my system it is like this

_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
dietpi:x:1000:1000::/home/dietpi:/bin/bash
mysql:x:104:111:MySQL Server,,,:/nonexistent:/bin/false

and the related groups

nogroup:x:65534:
dietpi:x:1000:
mysql:x:111:

On a default DietPi system, dietpi user id and groups should be 1000. In your case, the user dietpi has the assigned ID’s 100:65534. This would match my user _apt

User and group id for mysql depends on your system and could be different. But at least I should not be 1000 as user id.

Yes, mysql should be a system user (ID lower than 1000), now it is a login user, for “dietpi” the other way round (which is why login failed). Looks like somehow these three users for rotated (e.g. as of a file corruption and incorrect repair). You could try to rotate the UIDs and primary GIDs back as they should be via usermod.

@MichaIng
The dietpi and mysql user were added by me today. They were completely missing in those two files until today. I will try to correct those numbers manually to see if the things are getting corrected.

@Joulinar
Thanks for the comparison. Are these three (dietpi, _apt, mysql) the only differences you see in your /etc/passwd file ? Do you have some more users missing from my file ?

I changed both files with the info provided by Joulinar and after a restart, mariadb seems to be started succesfully, which was my whole purpose. It seems everything (and hope) is ok again right now.

Thanks for all the help.

I will try to configure some system backup method from now on. I was thinking into using raspiBackup but I see diepi has something similar ?!

you could use dietpi-backup. Best to create your backup on an external medium like a USB pen drive or similiar.