% Linux Installation and Getting Started    -*- TeX -*-
% emergency.tex
% Copyright (c) 1993 by Matt Welsh and Lars Wirzenius
%
% This file is freely redistributable, but you must preserve this copyright 
% notice on all copies, and it must be distributed only as part of "Linux 
% Installation and Getting Started". This file's use is covered by
% the copyright for the entire document, in the file "copyright.tex".

\section{What To Do In An Emergency}

\index{emergencies!recovery from|(}
\index{disasters!recovery from|(}
On some occasions, the system administrator will be faced with the
problem of recovering from a complete disaster, such as 
forgetting the root password or trashing filesystems. The best advice
is, {\em don't panic.} Everyone makes stupid mistakes---that's the
best way to learn about system administration: the hard way. 

Linux is not an unstable version of UNIX. In fact, I have had
fewer problems with system hangs than with commercial
versions of UNIX on many platforms. Linux also benefits from a
strong complement of wizards who can help you get out of a bind.

The first step in investigating any problem is
to attempt to fix it yourself. Poke around, see how things work.
Too much of the time, a system administrator will post a desperate
plea for help before looking into the problem at all. Most of the
time, you'll find that fixing problems yourself is actually very
easy. It is the path to guruhood. 

There are very few cases where reinstalling the system from
scratch is necessary. Many new users accidentally delete some 
essential system file, and immediately reach for the installation
disks. This is not a good idea. Before taking such drastic measures,
investigate the problem and ask others to help fix things up. In
almost all cases, you can recover your system from a maintenance
diskette.

\subsection{Recovering using a maintenance diskette}
\label{sec-maint-diskette}
\index{disasters!recovery from!with maintenance floppy}
\index{emergencies!recovery from!with maintenance floppy}
\index{booting!from maintenance floppy}
\index{maintenance floppy}
\index{boot floppy}
\index{floppy disk!boot/root}
\index{floppy disk!maintenance}
One indispensable tool for the system administrator is the so
called ``boot/root disk''---a floppy which can be booted for a complete
Linux system, independent of your hard drive. Boot/root disks are
actually very simple---you create a root filesystem on the floppy, 
place all of the necessary utilities on it, and install LILO and a 
bootable kernel on the floppy. Another technique is to use one floppy
for the kernel and another for the root filesystem. In any case, the
result is the same: you are running a Linux system completely from
floppy.

The canonical example of a boot/root disk is the Slackware 
boot disks\footnote{See Section~\ref{sec-getting-internet} for information on
downloading these from the Internet. For this procedure, you don't 
need to download the entire Slackware release---only the 
boot and root diskettes.}. These
diskettes contain a bootable kernel and a root filesystem, all on
floppy. They are intended to be used to install the Slackware distribution,
but come in very handy when doing system maintenance.

The H.J Lu boot/root disk, available from {\tt /pub/Linux/GCC/rootdisk}
on {\tt sunsite.unc.edu}, is another example of such a maintenance
disk. Or, if you're ambitious, you can create your own.
In most cases, however, using a pre-made boot/root disk is
much easier and will probably be more complete.

Using a boot/root disk is very simple. Just boot the disk on your
system, and login as {\tt root} (usually no password). In order
to access the files on your hard drive, you will need to mount your
filesystems by hand. For example, the command
\begin{tscreen}
\# {\em mount -t ext2 /dev/hda2 /mnt}
\end{tscreen}
will mount an ext2fs filesystem on {\tt /dev/hda2} under {\tt /mnt}.
Remember that {\tt /} is now on the boot/root disk itself; you need
to mount your hard drive filesystems under some directory in order to
access the files. Therefore, {\tt /etc/passwd} on your hard drive
is now {\tt /mnt/etc/passwd} if you mount your root filesystem on
{\tt /mnt}. 

\subsection{Fixing the root password}
\index{password!fixing root}
\index{root!fixing password for}
If you forget your root password, no problem. Just
boot the boot/root disk, mount your root filesystem on {\tt /mnt},
and blank out the password field for {\tt root} in 
{\tt /mnt/etc/passwd}, as so:
\begin{tscreen}
root::0:0:root:/:/bin/sh
\end{tscreen}
Now {\tt root} has no password; when you reboot from the hard drive
you should be able to login as {\tt root} and reset the password
using {\tt passwd}. 

Aren't you glad you learned how to use {\tt vi}? On your boot/root
disk, other editors such as Emacs probably aren't available, but
{\tt vi} should be. 

\subsection{Fixing trashed filesystems}
\index{filesystems!fixing corrupted}
\index{e2fsck@{\tt e2fsck}}
\index{fsck@{\tt fsck}}
If you somehow trash your filesystems, you can run {\tt e2fsck} 
(if you use the ext2fs filesystem type, that is) to correct any
damaged data on the filesystems from floppy. Other filesystem types use
different forms of the {\tt fsck} command; see 
Section~\ref{sec-manage-fs} for details.

When checking your filesystems from floppy, it's best for the
filesystems to not be mounted. 

\index{superblock!defined}
\index{superblock!fixing corrupted}
One common cause of filesystem damage is superblock corruption. 
The {\em superblock\/} is the ``header'' of the filesystem that contains
information on the filesystem status, size, free blocks, and so forth.
If you corrupt your superblock (for example, by accidentally writing
data directly to the filesystem's partition), the system may not 
recognize the filesystem at all. Any attempt to mount the filesystem
could fail, and {\tt e2fsck} won't be able to fix the problem.

Happily, the {\em ext2fs} filesystem type saves copies of the superblock
at ``block group'' boundaries on the drive---usually, every 8K blocks. 
In order to tell {\tt e2fsck} to use a copy of the superblock, you can
use a command such as 
\begin{tscreen}
\# {\em e2fsck -b 8193 \cparam{partition}}
\end{tscreen} 
where \cparam{partition} is the partition on which the filesystem resides.
The {\tt -b 8193} option tells {\tt e2fsck} to use the copy of the superblock
stored at block 8193 in the filesystem.

\subsection{Recovering lost files}
\index{files!recovering}
If you accidentally deleted important files on your system,
there's no way to ``undelete'' them. However, you can copy the
relevant files from the floppy to your hard drive. For example,
if you deleted {\tt /bin/login} on your system (which allows you
to login), simply boot the boot/root floppy, mount the root filesystem
on {\tt /mnt}, and use the command
\begin{tscreen}
\# {\em cp -a /bin/login /mnt/bin/login}
\end{tscreen}
The {\tt -a} option tells {\tt cp} to preserve the permissions 
on the file(s) being copied.

Of course, if the files you deleted weren't essential system files
which have counterparts on the boot/root floppy, you're out of
luck. If you made backups, you can always restore from them.

\subsection{Fixing trashed libraries}
\index{libraries!fixing corrupted}
If you accidentally trashed your libraries or symbolic links in {\tt /lib},
more than likely commands which depended on those libraries will no
longer run (see Section~\ref{sec-upgrade-libs}). The easiest solution is
to boot your boot/root floppy, mount your root filesystem, and fix the 
libraries in {\tt /mnt/lib}.

\index{emergencies!recovery from|)}
\index{disasters!recovery from|)}
