Linux-kernel mailing list archive 1998-50,: Re: HELP!! "Unable to open initial console"

# Re: HELP!! "Unable to open initial console"

Mike Orr (mso@oz.net)
Sun, 13 Dec 1998 12:22:23 -0800

- Messages sorted by: [ date ][ thread ][ subject ][ author ]
- Next message: Jamie Lokier: "Re: arch/i386/lib/checksum.c bug?"
- Previous message: John Goerzen: "2.1.131-ac10 doesn't compile"

On Sat, Dec 12, 1998 at 12:16:33PM +1100, Aaron Lehmann wrote:

> The moment I got home, I saw on the screen a seemingly normal boot
> scroll. It was stopped after the line "VFS: mounted root fs read-only"
> with "Unable to open initial console". Same thing happens under 2.0.35
> and 2.0.36. I would try a rescue disk but my floppy drive does not
> seem to be working.

I get the "Unable to open initial console" error when the /dev file
corresponding to the console is missing. Usually it means I specified
the wrong root partition on the LILO command line. (One wishes the
error message were more precise -- it could at least say why it can't
open it: "/dev/tty0 not found", "/dev/console not found", "/dev
directory missing".) This would be consistent with your suspicion that
files were unexpectedly deleted. Whether that points to a cracker, disk
failure, or a very buggy program running as root I cannot say. You
didn't mention which kernel you were running at the time -- was it a
2.1.something?

> basically all the services (telent, smtp, pop, ftp) would disconnect
> you in a few miliseconds.

Does your inetd use the tcpd wrapper around these services? Tcpd
disconnects you without error message if you fail its security checks.
Missing files could have caused false failures. If inetd can't find
the executable at all, perhaps it does the same thing (I haven't tried
this.)

> My questions are:
> 1) What does that message mean?
> 2) How can I fix it?

You need to boot Linux somehow and examine the disk. Do you have a
second hard drive you can plug in and install a minimal Linux on?
Or can you borrow a working floppy drive from somebody? Then mount
your partitions readonly and back up your data. Then use your favorite
fdisk program and fsck to determine whether the system is salvageable or
you want to reformat/reinstall or send the disk for warranty exchange.

> 3) How did the daemon wackiness evolve into this? Did I get hacked? It
> seems as if the hacker was able to screw up the hardware somehow!!

I'll leave others to explain how to exhaustively check for signs of
hackerdom. If you seriously expect you've been cracked, I'd reinstall
Linux anyway to close any loopholes you might overlook during your
inspection. Or at least change everybody's password and delete any
users in /etc/{passwd,shadow} you don't recognize. (But don't delete
system users like "news" that came with the Linux distribution.
Instead, change the password to "x" or "*" so no-one can log in.)
Turn off unnecessary services. Consider switching to ssh instead of
telnet.

    --
    -Mike Orr, mso@jimpick.com

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.rutgers.edu
    Please read the FAQ at http://www.tux.org/lkml/

- Next message: Jamie Lokier: "Re: arch/i386/lib/checksum.c bug?"
- Previous message: John Goerzen: "2.1.131-ac10 doesn't compile"