<p>Generally recovering from this sort of mistake involves editing the boot loader to force a root shell. Since you don't have physical access to the (non-physical) machine, things are a bit different.</p>

<p>If this is an EBS boot drive, you can try <a href="https://serverfault.com/a/235824/12214">detaching it, fixing it on another machine, then reattaching</a>.</p>

<p>This is a good opportunity to learn why it's useful to use configuration management tools for everything: if you were doing this, you could replace the instance in just a few minutes and one command.</p>

CC BY-SA 3.0
2017-07-27T06:40:39.817Z
On some circumstances, detached root volume couldn't be reattached to same machine. This can be avoided by creating a snapshot of detached volume (either before or after removing it from instance) and a volume from this snapshot.
chupasaurus
CC BY-SA 3.0
2017-07-26T15:47:25.570Z
2017-07-26T15:47:25.570Z
Xiong Chiamiov
<p>You need to have root access by using the <code>su</code> command as <code>sudo</code> doesn't seem to be usable and then make appropriate changes. Now for the most important point:</p>

<p><em>Always use</em> <strong>visudo</strong> <em>to edit sudoers file</em></p>

<p>Why? It tells you if there are any errors after you made changes hence preventing one from messing up <code>sudo</code> access.</p>

<blockquote>
  <p>To resolve broken <code>sudo</code> follow <a href="http://www.psychocats.net/ubuntu/fixsudo" rel="nofollow noreferrer">this</a> guide.</p>
</blockquote>

<p>*This may not be possible in virtual compute.</p>

CC BY-SA 3.0
2017-07-26T20:11:31.257Z
2017-07-27T11:58:54.383Z
2017-07-27T11:58:54.383Z
T K Sourabh
<p>Detach the root volume, attach it to a running instance and restore the sudoers file in the volume. 
Detach the volume and re-attach to the instance in question and restart it.
This should work.</p>

CC BY-SA 3.0
2017-07-28T06:26:54.497Z
2017-07-28T06:26:54.497Z
lakshayk
<p>If you know the root password, typically you can type "su" to switch to a super-user. You can then edit your sudoers file to fix sudo.</p>

CC BY-SA 3.0
2017-07-27T07:33:13.920Z
I know, however I never assigned a password to the root account, thus my question...
Adonis
CC BY-SA 3.0
2017-07-26T16:12:13.920Z
2017-07-26T16:12:13.920Z
James Shewey
<p>How about user-data ?</p>

<p>I believe adding the "#cloud-boothook" allow to force the user-data to run at every restart.</p>

<pre><code>#cloud-boothook
#!/bin/bash
echo 'test' &gt; /home/ec2-user/user-script-output.txt
</code></pre>

<p>If so, you could fix your sudo scripts hopefully... or install / add AWS run commands configuration <a href="https://aws.amazon.com/blogs/aws/new-ec2-run-command-remote-instance-management-at-scale/" rel="noreferrer">https://aws.amazon.com/blogs/aws/new-ec2-run-command-remote-instance-management-at-scale/</a></p>

<p>For sure if it is an EBS Drive, you can detach &amp; fix and then re-attach on the original system. A bit of a pain though.</p>

CC BY-SA 3.0
2017-07-26T18:18:50.570Z
2017-07-26T18:18:50.570Z
TheAce
<p>While writing a script to edit the sudoers file without using <code>visudo</code>, the script did not check for issue, and I have introduced some bad edits into the <code>sudoers</code> file, and thus cannot use sudo at all anymore. (I know I did a very bad thing, and should probably have used something like <a href="https://stackoverflow.com/a/28382838/4121573">this</a>)</p>

<p><strong>Question</strong>: Is there anyway I can recover from this mistake, or do I have to destroy the VM and start from scratch with a new one?</p>

CC BY-SA 3.0
2017-07-26T15:05:39.513Z
you can download some sample sudoers file and make sudoers work.
KlwntSingh
CC BY-SA 3.0
2017-07-26T15:08:50.707Z
@KlwntSingh True, but without access to the `sudo` command, the ec2-user cannot perform any root command, which is the core of the issue (perhaps it was confusing!)
Adonis
<amazon-ec2><configuration>
Bad edit to sudoers file on EC2 instance, how to fix it?
Adonis
# Bad edit to sudoers file on EC2 instance, how to fix it?

(Asked by: username_0 on 2017-07-26)

While writing a script to edit the sudoers file without using `visudo`, the script did not check for issue, and I have introduced some bad edits into the `sudoers` file, and thus cannot use sudo at all anymore. (I know I did a very bad thing, and should probably have used something like [this](https://stackoverflow.com/a/28382838/4121573))

**Question**: Is there anyway I can recover from this mistake, or do I have to destroy the VM and start from scratch with a new one?

**Tags:** amazon-ec2, configuration

> **Comments:**
> **username_1**: you can download some sample sudoers file and make sudoers work.  
> **username_0**: @username_1 True, but without access to the `sudo` command, the ec2-user cannot perform any root command, which is the core of the issue (perhaps it was confusing!)  

---

## 5 answers

### Answer by username_7 on 2017-07-26. Score: 5 | Accepted answer

How about user-data ?
I believe adding the "#cloud-boothook" allow to force the user-data to run at every restart.
#cloud-boothook
#!/bin/bash
echo 'test' > /home/ec2-user/user-script-output.txt

If so, you could fix your sudo scripts hopefully... or install / add AWS run commands configuration https://aws.amazon.com/blogs/aws/new-ec2-run-command-remote-instance-management-at-scale/
For sure if it is an EBS Drive, you can detach & fix and then re-attach on the original system. A bit of a pain though.


---

### Answer by username_2 on 2017-07-26. Score: 4

Generally recovering from this sort of mistake involves editing the boot loader to force a root shell. Since you don't have physical access to the (non-physical) machine, things are a bit different.

If this is an EBS boot drive, you can try [detaching it, fixing it on another machine, then reattaching](https://serverfault.com/a/235824/12214).

This is a good opportunity to learn why it's useful to use configuration management tools for everything: if you were doing this, you could replace the instance in just a few minutes and one command.

> **Comments:**
> **username_3**: On some circumstances, detached root volume couldn't be reattached to same machine. This can be avoided by creating a snapshot of detached volume (either before or after removing it from instance) and a volume from this snapshot.  

---

### Answer by username_4 on 2017-07-26. Score: 1

You need to have root access by using the `su` command as `sudo` doesn't seem to be usable and then make appropriate changes. Now for the most important point:

*Always use* **visudo** *to edit sudoers file*

Why? It tells you if there are any errors after you made changes hence preventing one from messing up `sudo` access.

> To resolve broken `sudo` follow [this](http://www.psychocats.net/ubuntu/fixsudo) guide.

\*This may not be possible in virtual compute.


---

### Answer by username_5 on 2017-07-28. Score: 1

Detach the root volume, attach it to a running instance and restore the sudoers file in the volume.
Detach the volume and re-attach to the instance in question and restart it.
This should work.


---

### Answer by username_6 on 2017-07-26. Score: 1

If you know the root password, typically you can type "su" to switch to a super-user. You can then edit your sudoers file to fix sudo.

> **Comments:**
> **username_0**: I know, however I never assigned a password to the root account, thus my question...  

---

