So, on one fine day you found that the /etc/passwd file is missing from your linux system. You are not able to login into the system because of this and Upon rebooting into single-mode mode the /etc/passwd file was found to be empty – no account information available. Do not worry, its not the end of the world. You can still recover it. Follow the steps below to recover a deleted /etc/passwd file in RHEL system.
Purpose of /etc/passwd- file
While adding or modifying a user, the original /ect/passwd file will be saved as /etc/passwd-.
This functionality is same with /etc/shadow, /etc/gshadow and /etc/group files. When these files are changed, the old file will be saved ending with a dash “–“.
Recovering deleted /etc/passwd file
1. Boot into single mode.
2. Remount root file system in read/write mode:
# mount -o rw,remount /
3. Locate the /etc/passwd- file.
# ls -lah /etc/passwd- -rw------- 1 root root 2.4K May 15 15:46 /etc/passwd-
3. Copy the file /etc/passwd- to the file /etc/passwd.
# cp /etc/passwd- /etc/passwd
4. Use the pwconv command to create /etc/shadow file from the /etc/passwd file.
# pwconv
5. Use the passwd command to reset the root password.
# passwd root
6. Reboot normally and verify successful login.
# shutdown -r now