Recovering a password on a ZFS '/' filesystem

Somehow the password file got clobbered on a workstation. I was pretty easy to recover a password file on a UFS filesystem, but it is a another thing if the root partition is ZFS. These are the step I took to recover the /etc/shadow file:

Recovering a root password on a zfs filesystem.

1. Boot the machine into single user:

Ok> boot cdrom –s

2. Find out what pools are available to import. In this case we are looking for rpool:

# zpool import

3. Since rpool is available, we need to import it:

# zpool import rpool

The system returns with:

The system will report messages similar to this:

cannot mount '/export': failed to create mountpoint

cannot mount '/export/home': failed to create mountpoint

cannot mount '/rpool': failed to create mountpoint

Although the ZFS file systems in the pool cannot be mounted, they exist.

4. zfs list will return what is mounted:

# zfs list

NAME USED AVAIL REFER MOUNTPOINT

rpool 12.5G 54.4G 97K /rpool

rpool/ROOT 6.97G 54.4G 21K legacy

rpool/ROOT/s10s_u10wos_17b 6.97G 54.4G 6.97G /

rpool/dump 1.00G 54.4G 1.00G -

rpool/export 2.53G 54.4G 23.5K /export

rpool/export/home 2.53G 54.4G 2.53G /export/home

rpool/swap 2G 56.4G 16K –

5. The mount point we are interested in is rpool/ROOT/s10s_u10wos_17b

# zfs get mountpoint rpool/ROOT/s10s_u10wos_17b

NAME PROPERTY VALUE SOURCE

rpool/ROOT/s10s_u10wos_17b mounted no -

6. Change the mountpoint of rpool/ROOT/s10s_u10wos_17b

# zfs set mountpoint=/mnt rpool/ROOT/s10_u10wos_17b

7. Mount rpool/ROOT/s10s_u10wos_17b

# zfs mount rpool/ROOT/s10s_u10wos_17b

8. Change the password for root.

# cd /mnt/etc

What I did now was get rid of the 2^nd field in both the /etc/passwd and /etc/shadow.

9. Umount the filesystem or just reboot.

# cd /

# zfs umount rpool/ROOT/s10s_u10wos_17b

10. Reset the mountpoint back to /.

# zfs set mountpoint=/ rpool/ROOT/s10_u10wos_17b

11. Reboot the system and you can log in to the system with root again.

#reboot