Reset user password won't work

[pondtreader]

I'm new here. My neighbor died & his wife needs to get into his PC but doesn't know his password. The PC is running Linux Mint 17.3 Cinnamon 64 bit.
I have learned just enough to access "recovery mode" where I have entered the root password & gotten to the command lines. From there I have entered "Passwd" "user name" and gotten the option to enter a new password. I entered the new password, confirmed it, and the command line said the new password was successfully updated.

(Side Note) I noticed in this process that after entering "passwd" "username" I get a list of optional commands to enter to do different things with the passwd such as "-s" for status, "-d" for delete. None of these commands seem to do anything when I try to enter them. After this list of optional commands appears I type "passwd" hit "enter" and then I get my option to enter a new passwd.

Anyway, after changing the passwd, I reboot and get the login page. I select the user name and enter my new passwd and it won't except it. Could there be some encryption or something that I'm not seeing going on here???

[xenopeek]

Linux Mint 17.3 reached end of support 3 years ago so I don't know / can't recall how it worked back then but on current versions of Linux Mint the recovery mode will boot with a read-only disk, for safety. So changing the password wouldn't write the new password to disk. Hence after reboot the new password wouldn't work. In recovery mode you first have to make the disk writable.

Try these steps instead, which will make the disk writable before resetting the password: viewtopic.php?p=2060826#p2060826

If the account had been set up with home directory encryption there is no way to recover access to the account without knowing the original password (or having backup mount passphrase). Run ls -a /home from recovery mode to check for this. If there is a directory called ".ecryptfs" or something like that in /home they most likely used home directory encrypted and there is no way to get access.

If there is no home directory encryption but you still can't get the password to work, there are various other things we can do to get access to files. Seeing as you know the root password you could create a new user account, grant it administrator role and then log in to that user account and access the files from there. Or boot from a Linux Mint installation USB and from the live boot environment access the hard disk and copy the user's files to some external storage. The installation guide covers the steps to get to a live boot: https://linuxmint-installation-guide.re ... index.html. Let us know if the above doesn't work and you need further help with either of these alternatives.

[pondtreader]

Thanks for the reply!!! I will give these steps a try later today and get back to you with the results.

[pondtreader]

Using the command: ls -a /home returns a line with the user name followed by .ecryptfs
I'm guessing that means encrypted.
Is there a way to go around it and copy the files in his user account?

[Termy]

It's passwd, not Passwd. All lower-case. You can reset the password of the user with: passwd USER, where 'USER' is the username you type out, such as 'bob'. You should then be prompted to change the password for that user. The -d flag is not what you want, BTW, because it effectively stops the user from being able to log in (due to empty password).

If the '/home' is encrypted, that's me out, because I never mess around with encryption.

[xenopeek]

I'm guessing that means encrypted.
Is there a way to go around it and copy the files in his user account?

I'm very sorry for the bad news but no, encrypted files can't be accessed in any way without having the account password (or the mount passphrase, for when access to the account itself is lost). Also not by professional data recovery services. That is the point of encryption, that those without the password can't access your files.

The PC can be made usable again by creating a new user account or—as I would suggest—doing a fresh install of a currently supported Linux Mint version. But that doesn't help with recovering the files.

I hope that the password may still be found. It's not uncommon for people to write down passwords (maybe someplace close to the PC or in a safety deposit box). And it's common that people re-use passwords for multiple accounts so if relatives know one of his passwords maybe that also works here. If his password can be found you would first have to use the same steps as you did to change the password on his account back to that. Else the account can still not be logged in to.

Maybe there is a backup disk in the home, he might not have encrypted that.

[Termy]

[...]

Dang! Didn't realise how aggressive good encryption was in Linux. That's kinda cool, although obviously a problem here. Handy for a portable machine.

[pondtreader]

Thanks so much for all of your help!!!
At this point I will abandon all hope of recovering any of his files then.

[Cosmo.]

Termy, this has nothing to do with aggressiveness. Encryption, which leaves a backdoor, is not worth to be mentioned at all. In cases as this one this is a problem, but encryption gets usually done to protect against attackers and data thieves and those people would be very lucky, if a backdoor would exist.
Perhaps the widow needs at first some time because of her loss, but than she will be the person with some chance to retrieve the password.

[all41]

I would put in a new drive and keep the encrypted one around for a while.
The passphrase may be discovered someday

[Termy]

Termy, this has nothing to do with aggressiveness.

Then I'll rephrase: I had no idea Linux was so good for encryption. I'm just impressed.

[Cosmo.]

Then I rephrase also:
Any software in any OS, which leaves a backdoor, has a serious security hole, which must be fixed quickly.

Reading in the last years users whining, because they cannot remember their password and beg for help to find a way to recover it with whatever method, I come to the conclusion, that people think, that recovering a password is in any case doable, if you only have enough time and experience. This is a big and serious misunderstanding. If a software and an OS has no security hole, than it is absolutely impossible to recover it! This means it is urgently needed, to make a reliable and secure database for the used passwords. I recommend a password manager.
To those, who might argue: "There is a lost password function on nearly every online account in the web." This is something different. Even the forum staff cannot recover the password, what they can do is to send another one to the registered mail-address. (If a forum would be able to retrieve the old password, than the forum has and probably is itself a security leak.)

For completeness: What I wrote here does not concern the topic starter, (s)he has not lost a password (but a neighbor). This here is an foray out of the current situation and on the background, that those requests for help to find a password happen again and again.