userdel "must be a local user" error

[gustaf]

After deleting gwenview and all leftover unused dependencies,
$ doas pkg_del -civ gwenview ; doas pkg_del -a,
the following messages appeared:

--- -polkit-0.116p1 -------------------
You should also run /usr/sbin/userdel _polkitd
--- -pulseaudio-13.0p0 -------------------
You should also run /usr/sbin/userdel _pulse

Running these commands yielded the following results:

$ doas /usr/sbin/userdel _polkitd
userdel: /etc/master.passwd: line `' too long (492 bytes), skipping
...
userdel: /etc/master.passwd: line `�S��z��yy�'' too long (515 bytes), skipping
...
userdel: User `_polkitd' must be a local user

$ doas /usr/sbin/userdel _pulse
userdel: /etc/master.passwd: line `' too long (492 bytes), skipping
...
userdel: /etc/master.passwd: line `�S��z��yy�'' too long (515 bytes), skipping
...
userdel: User `_pulse' must be a local user

Both _polkitd and _pulse show up as users:

$ less /etc/passwd
_polkitd:*:701:701:Polkit Daemon User:/var/empty:/sbin/nologin
_pulse:*:683:683:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin

$ userinfo _polkitd
login   _polkitd
passwd  *
uid     701
groups  _polkitd
change  NEVER
class   daemon
gecos   Polkit Daemon User
dir     /var/empty
shell   /sbin/nologin
expire  NEVER

$ userinfo _pulse      
login   _pulse
passwd  *
uid     683
groups  683
change  NEVER
class   daemon
gecos   PulseAudio System Daemon
dir     /var/run/pulse
shell   /sbin/nologin
expire  NEVER

A NetBSD thread from 2013, pwd_mkdb exited with status 1, looked promising, but...

vipw(8) gives me a cryptic list of ^@ signs and what looks like hex notation for characters (\xad\x91F5, for example)--definitely not a human-readable, editable file.

Additional suggestions in this thread are to remove the possibly corrupted compiled password databases, and then rebuild them with pwd_mkdb(8).

Since these are password files and I have no experience working with them, aside from looking at /etc/passwd, I tried what seemed like the safest commands:

$ doas pwd_mkdb -c /etc/master.passwd
pwd_mkdb: line too long
pwd_mkdb: /etc/master.passwd: Inappropriate file type or format

$ doas pwd_mkdb -c /etc/passwd
pwd_mkdb: corrupted entry
pwd_mkdb: at line #1
pwd_mkdb: /etc/passwd: Inappropriate file type or format

$ doas pwd_mkdb -c /etc/pwd.db
pwd_mkdb: corrupted entry
pwd_mkdb: at line #1
pwd_mkdb: /etc/pwd.db: Inappropriate file type or format

$ doas pwd_mkdb -c /etc/spwd.db
pwd_mkdb: corrupted entry
pwd_mkdb: at line #1
pwd_mkdb: /etc/spwd.db: Inappropriate file type or format

Is this even the right approach and are these the right commands? I'd rather not find out what happens if I accidentally delete all my passwords.

Thanks in advance.

[TronDD]

Looks like something got corrupted. /etc/passwd and /etc/master.passwd should be human readable with vi.

Check in /var/backups/ for etc_passwd.backup and master.passwd.backup and see if they look ok.

If they look good I'd copy them the .db files back to /etc

[gustaf]

Thanks for your quick response.

The files /etc/passwd and /var/backups/etc_passwd.backup appear to be OK:

$ vi /etc/passwd   # same result as $ less /etc/passwd
...
_polkitd:*:701:701:Polkit Daemon User:/var/empty:/sbin/nologin
_pulse:*:683:683:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin

$ doas less /var/backups/etc_passwd.backup
...
_polkitd:*:701:701:Polkit Daemon User:/var/empty:/sbin/nologin
_pulse:*:683:683:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin

The file /etc/master.passwd appears to be corrupted, but /var/backups/master.passwd.backup looks OK:

$ doas vi /etc/master.passwd   # same result as [oman8]vipw[/oman]
^A^@...\xad\x91F5...

$ doas less /var/backups/master.passwd.backup
...
_polkitd:*:701:701:daemon:0:0:Polkit Daemon User:/var/empty:/sbin/nologin
_pulse:*:683:683:daemon:0:0:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin

The .db files appear to be binary:

$ less /etc/pwd.db
"/etc/pwd.db" may be a binary file.  See it anyway?

$ doas less /etc/spwd.db
"/etc/spwd.db" may be a binary file.  See it anyway?

These are the password files in /var/backups:

etc_passwd.backup
etc_passwd.current
etc_pwd.db.backup.sha256
etc_pwd.db.current.sha256
etc_spwd.db.backup.sha256
etc_spwd.db.current.sha256
master.passwd.backup
master.passwd.current

Originally Posted by TronDD

If they look good I'd copy them the .db files back to /etc

Can you explain what you mean by this? I don't think I can just copy the files from /var/backups without renaming them first. There is also the problem of the corrupted /etc/master.passwd file.

[jggimi]

If you review the passwd(5) and pwd_mkdb(8) man pages, you will learn that the Berkeley DB files are created from the master.passwd file whenever it is changed.

I would:

1. Manually back up your damaged set of password files from /etc/: passwd, pwd.db, master.passwd, and spwd.db in the event the next step is catastrophic.
2. Restore all 4 files from your possibly good backup.

In the event you need to recover your current damaged environment, boot into single-user mode (boot> -s), # mount -a, restore the 4 files from your damaged set, then exit from the single-user shell or # reboot.

[TronDD]

Yes, backup what you have. You can then regenerate the DB files from the fixed master.password.

Looks like the easiest way to restore from /var/backups is
pwd_mkdb -p /var/backups/master.passwd.backup

That will create /etc/master.passwd, /etc/passwd, pwd.db and spwd.db

I haven't run this, so make a backup and double check me in the man page.

[gustaf]

Problem fixed! Thanks!