What Can I Do If the Permissions on the Root Directory of My CentOS ECS Changed to 777?

Symptom

You executed the chmod -R 777 / command on your ECS running CentOS, and the permissions on the root directory were changed to 777. As a result, most services were unavailable and most commands could not be executed. In this case, you can run the getfacl command provided by the system to back up and restore the permissions on the root directory.

Setting 777 permissions for a file or directory means that it will be readable, writable and executable by all users and may pose a huge security risk. The operations described in this section are a temporary remedy. After you restore the permissions, it is recommended that you back up your data and reinstall the OS to prevent security risks caused by 777 permissions.

Procedure

This section uses an ECS running CentOS 7.5 as an example.

1. Do not stop or restart the ECS after the 777 permissions are configured for the root directory. Run the following commands on this ECS to restore the permissions on the SSH connection-related files:

   cd /etc

   chmod 644 passwd group shadow

   chmod 400 gshadow

   cd ssh

   chmod 600 moduli ssh_host_dsa_key ssh_host_key ssh_host_rsa_key

   chmod 644 ssh_config ssh_host_dsa_key.pub ssh_host_key.pub ssh_host_rsa_key.pub

   chmod 640 sshd_config

2. After the preceding commands are executed, the SSH connection can be established. Run the following command to check whether you can remotely log in the ECS as user root:

   su root

   root "su: cannot set groups:"

   If information similar to the proceeding output is displayed, run the following command to grant the s permission to the su program for reading the configurations of user root:

   chmod u+s 'which su'

   After the command is executed, you can log in to the ECS as user root.

3. Create a temporary Linux ECS that has the correct permission configurations and the kernel of the same version as the faulty ECS.
4. Run the following command on the temporary ECS to back up the permissions on all files in the / directory to a systemp.bak file:

   getfacl -R / >systemp.bak

5. Transmit the systemp.bak file to the faulty ECS using one of the following methods:
   • Run the following command on the temporary ECS to upload the systemp.bak file to the faulty ECS:

     scp Path in which the systemp.bak file is stored on the temporary ECS Username@EIP:Path in which the systemp.bak is to be stored on the faulty ECS

     For example, run scp /systemp.bak root@119.**.**.**:/121.**.**.**.

   • Alternatively, run the following command on the faulty ECS to download the systemp.bak file from the temporary ECS to the faulty ECS:

     scp Username@EIP: Path in which the systemp.bak file is stored on the temporary ECS Path in which the systemp.bak file is to be stored on the faulty ECS

     For example, run scp root@121.**.**.**:/systemp.bak /.

6. Run the following command on the faulty ECS to restore the system permissions:

   setfacl --restore=systemp.bak

7. Run the following command to create a script before restarting the faulty ECS:

   vim sshtmp.sh

   Add the following content to the script to avoid SSH connection failure:

   cat sshtmp.sh
   #----------start----------
   sleep 300
   cd /etc
   chmod 644 passwd group shadow
   chmod 400 gshadow
   cd ssh
   chmod  600  moduli  ssh_host_dsa_key ssh_host_key ssh_host_rsa_key
   chmod  644 ssh_config ssh_host_dsa_key.pub ssh_host_key.pub ssh_host_rsa_key.pub
   chmod  640 sshd_config
   chmod u+s `which su`
   #-----------------end---------

8. Run the following command to add the script to the Linux startup script file rc.local:

   echo '/sshtmp.sh &' >>/etc/rc.local

9. Run the following command to restart the faulty ECS:

   reboot

   After the ECS restarts, stop process sshtmp.sh, restore script file rc.local, delete process sshtmp.sh. Then check whether the system permissions are restored.

Next Steps

Setting 777 permissions for a file or directory means that it will be readable, writable and executable by all users and may pose a huge security risk.

The operations described in this section are a temporary remedy. After you restore the permissions, it is recommended that you back up your data and reinstall the OS to prevent security risks caused by 777 permissions.