Login without running bash_profile or bashrc

Question

So let's say one typoed something in their .bashrc that prevents him (or her) from logging in via ssh (i.e. the ssh login exits because of the error in the file). Is there any way that person could login without executing it (or .bashrc since the one runs the other), or otherwise delete/rename/invalidate the file?

Suppose you don't have physical access to the machine, and this is the only user account with the ability to ssh in.

For Reference: .bash_profile includes .bashrc:

[[ -f ~/.bashrc ]] && . ~/.bashrc

Edit: Things I have tried:

ssh user@host "rm ~/.bashrc"

scp nothing user@host:/RAID/home/tom/.bashrc

ssh user@host  "/bin/bash --norc"

All give the error:

/RAID/home/tom/.bashrc: line 16: /usr/local/bin/file: No such file or directory
/RAID/home/tom/.bashrc: line 16: exec: /usr/local/bin/file: cannot execute: No such file or directory

Your scp command will not work because scp will also read .bashrc when connecting. To avoid the problem In the future, you may add something like ```[ -z "$PS1" ] && return``` at the beginning of ./bashrc. This way scp will stop parsing .bashrc after the first line, and you will be able to overwrite it in case of emergency. — dalloliogm, Aug 26 '16 at 09:27

score 162 · Answer 1 · edited Oct 25 '18 at 12:27

162

ssh -t username@hostname /bin/sh works for me.

edited Oct 25 '18 at 12:27

Daniele Santi

2,479
1
25
22

answered Nov 12 '10 at 14:22

user60069

1,737
2
10
2

This works well - simple and provides a shell you can use to fix the problem. – MT. Oct 02 '11 at 16:55
1

Trying to do this with the Secure Shell app in Google Chrome (https://chrome.google.com/webstore/detail/secure-shell/pnhechapfaindjhompbnflcldabbghjo?hl=en) but can't figure out how/where to put the command line arguments. Any tips? – Benj Feb 19 '14 at 14:19
2

This doesn't work for me (though it should according to the man page). The local host runs ubuntu 14.04.1 and it's ubuntu 12.04.5 on the remote host. I'm unable to rsync because my login shell is tcsh and on the remote host it prints garbage (tcsh: No such file or directory tcsh: Trying to start from "/u/levy" -- which I'm told it's because the directory is NSF mounted). I thought I'd solve the problem bypassing the login shell but that doesn't work. – Silvio Levy Mar 28 '15 at 03:00
2

If your default shell is csh/tcsh it will *always* source your `.cshrc`/`.tcshrc` even for non-interactive shells. – Brian Vandenberg Jul 17 '15 at 21:37
2

I'm sitting here laughing my ass off at my own stupidity to have gotten to this point. Your solution worked great. Thank you so much for helping this tinkerer get some work done – ijustlovemath Jan 28 '17 at 04:54
@Benj you can pass them via the "SSH Arguments" field, e.g. `-t bash`. – dimo414 Mar 11 '20 at 21:18
1

@Tom Ritter - this needs to be the accepted answer. – Dave Dopson Jun 11 '20 at 20:45

score 60 · Answer 2 · answered Feb 18 '11 at 22:12

60

I've had the same problem, and somehow was able to solve it. I used ssh to access the system, and pressed and held Ctrl+c as soon as I logged into the system. Then, ~/.bashrc was not read, and I was able to modify it.

answered Feb 18 '11 at 22:12

miyashin

611
5
2

17

I was skeptic, but this actually works... – rmobis May 19 '16 at 19:42
2

This is genius! – user1747134 Nov 11 '16 at 11:14
Actually works...thanks! The other methods never worked for me. – AlwaysTalkingAboutMyDog Oct 30 '17 at 00:25
on mac with only a .bash_profile, this worked for me :) – AnneTheAgile Jan 13 '18 at 14:51
OMG, I thought I have searched the whole internet, then I decided to try this, and this is the only way that works for me! Thanks! – Jiahao Cai Feb 03 '18 at 22:03
2

Yes! This is the only one that works for me – DavidC Aug 19 '19 at 10:05
took some tries but it worked for me as well! – user1941126 Nov 19 '20 at 22:32
This is the epitome of hacking. Love it! – RossAlexander Jan 26 '21 at 15:15
I had to try like 20 times because my '~/.bashrc' had an exit on the second line, but finally it worked :) – Nisba Feb 09 '22 at 11:05
Thank you, this worked! – Aswath Aug 23 '22 at 16:23

Urist McDev · Answer 3 · 2017-05-07T11:35:54.500

33

You need to a) start bash without source'ing either ~/.bashrc or ~/.bash_profile and b) since such a shell wouldn't be a full login shell / have no tty attached, force ssh to attach a tty:

ssh -t user@host bash --norc --noprofile

edited May 07 '17 at 11:35

answered Feb 17 '15 at 12:51

Urist McDev

491
5
5

4

This works, but note that you won't have your usual prompt, just an empty screen. try doing an `ls` to convince yourself that you're in :). Also note this will use a `dumb` term, so for me nano doesn't work – Ciprian Tomoiagă Sep 04 '18 at 08:22
1

@CiprianTomoiagă well that's kind of the idea, since the premise of the question is that `.bashrc` is busted :) This should get you far enough to be able to clean up the damage, then you can try to ssh again into a normal shell. – dimo414 Mar 18 '20 at 07:58
indeed ! I was just a bit confused at first as there wasn't even a `$` symbol to indicate the prompt :). – Ciprian Tomoiagă Mar 18 '20 at 11:16

score 29 · Accepted Answer · answered Dec 15 '09 at 14:32

29

I think your only options are:

ssh in as another user and su to your account;
use something like ftp or smbclient, if the relevant services are enabled on the host;
find an open vulnerability in an open network service and exploit it :).
get an admin to fix the problem.

answered Dec 15 '09 at 14:32

larsks

41,276
13
117
170

6

"Suppose you don't have physical access to the machine, and this is the only user account with the ability to ssh in." – Dennis Williamson Dec 15 '09 at 16:05
I am going down this route. I will post the solution after I find it. Fortunetly, I have a few avenues of attack. – Tom Ritter Dec 15 '09 at 21:07
4

used Filezilla to SFTP into my server and it fixed me. Thanks soooo much, you saved me. I had a "exit 1" condition in my .bash_profile by accident and it hosed me. – djangofan Oct 19 '12 at 23:46

score 21 · Answer 5 · edited Oct 25 '18 at 12:27

21

I used a published CVE to execute a command as root through a web interface in a network monitoring software I had installed. rm /RAID/home/tom/.bashrc

Then I could login and svn revert the changes I made.

edited Oct 25 '18 at 12:27

Daniele Santi

2,479
1
25
22

answered Dec 19 '09 at 17:54

Tom Ritter

3,147
5
25
30

12

That is both awesome and failriffic at the same time. – MikeyB Feb 18 '11 at 22:18
1

@TomRitter : Please provide that ᴄᴠᴇ reference. – user2284570 Oct 16 '15 at 13:24
2

It was in an oooold version of cacti, so unless you're running 8-year old software I don't think it will help you. And if you are running 8 year old software, I can't help you. ;) – Tom Ritter Oct 16 '15 at 20:32
Surprisingly worked for me. Thanks. – Daniel Da Cunha Mar 05 '20 at 23:38

score 7 · Answer 6 · answered Dec 15 '09 at 13:29

7

You're out of luck.

All ssh commands run your login shell. ssh $COMMAND runs $SHELL -c $COMMAND, scp runs $SHELL -c /path/to/sftp-server, plain ssh just runs your shell.

answered Dec 15 '09 at 13:29

Tobu

4,367
1
23
31

3

This is also true for sftp - even SSH subsystems are apparently executed from within a shell. – lxgr Jun 09 '14 at 23:17
In my experience you are correct, even though the ssh man page says "If command is specified, it is executed on the remote host instead of a login shell." Yet the poster was able to solve the problem using the highest-rated answer (ssh hostname /bin/sh). What gives? – Silvio Levy Mar 26 '15 at 21:15
@Silvio, OP's answer is that he used an exploit not related to SSH. – Tobu Mar 27 '15 at 23:48
Right. Someone reported success with the highest-rated answer and I hastily assumed it was the OP. I wish it did work -- I have a similar situation, though it's merely annoying not crippling. (See my comment under the highest-rated answer above.) – Silvio Levy Mar 28 '15 at 03:02

Evan Langlois · Answer 7 · 2015-07-25T07:07:01.433

None of the above answers can bypass the login shell of ssh. You can pass a full command line, and so it runs the remote shell to process the command and set the working environment for the command. That's what shells are for and it's the Unix way. You would have all sorts of compatibility problems if you tried to run something without a shell. Likewise, trying a control-C should do the same as calling exit which is the behavior you are trying to avoid. If bash continues its a bug. Why people keep saying that the man page says something different need to quote it because it says nothing of the sort in my man page.

Additionally, on most linux systems, specifying /bin/sh does NOTHING since this is just a symlink to bash!

Wanna test? Add "echo" statements to you .bashrc and .profile and see which is run. I did. Here's the results.

ssh user@host will execute .bash_profile ssh user@host /bin/bash will execute .bashrc, but it thinks its non-interactive (no prompt). ssh -t user@host /bin/bash executes .bashrc twice ... once at login, once for the passed command, so specifying ANY shell will always run the first. ssh -T user@host is the same as not specifying -T or -t at all.

Now, if you notice, MY system isn't running both files, only one or the other. But the original poster has a line in .bash_profile running .bashrc, so .bashrc will always get run no matter what. Shouldn't have put that line there! If that line didn't exist, you wouldn't have had a problem.

You'll need to find another way in or find an admin. This is what admins are for.

Some good points; no executable passed as a command can help, as you explain, but on a somewhat moot point: if `/bin/sh` _did_ get to execute first, it _would_ help, because Bash _doesn't_ load `~/.bashrc` when invoked as `sh`. This answer is a superset of your other answer, so please delete the other one. — mklement, Mar 29 '17 at 21:23

Dennis Williamson · Answer 8 · 2009-12-15T12:27:47.727

4

Something like:

ssh host "/bin/bash --norc"

which seems to work, but note that PS1 is not set so you'll be typing commands without a prompt.

This has the advantage of being non-destructive.

edited Dec 15 '09 at 12:27

answered Dec 15 '09 at 12:20

Dennis Williamson

60,515
14
113
148

1

This doesn't work, it tried for a successful login first, but can't login, and therefore can't run bash --norc – Tom Ritter Dec 15 '09 at 12:27

score 3 · Answer 9 · edited Apr 09 '18 at 20:13

3

ssh -t user@host "bash --norc --noprofile -c '/bin/rm .bashrc'"

edited Apr 09 '18 at 20:13

chicks

3,639
10
26
36

answered Apr 09 '18 at 17:16

wytten

131
3

This worked for me in a very restricted environment when nothing would. I had to specify the full path to .bashrc. – zbeekman May 23 '18 at 15:28

score 2 · Answer 10 · edited Feb 21 '13 at 18:58

2

try

echo ^C | ssh <hostname> ' rm .bashrc'

^C there is control-v then c

edited Feb 21 '13 at 18:58

user9517

114,104
20
206
289

answered Feb 21 '13 at 18:18

user161180

21
1

2

It's ctrl-v and ctrl-c on my system. Thanks anyway! :) – mzuther Feb 14 '16 at 13:24

score 1 · Answer 11 · answered Aug 22 '19 at 13:54

Mashing ctrl-C works as long as you can get a ctrl-C in before the .bashrc exits. Unfortunately, this can be difficult to do if exit is early in the .bashrc.

You can put in a ctrl-C as soon as possible by piping it to ssh directly:

{ echo ^C; cat /dev/tty; } | ssh -tt user@host

Note that ^C is typed like ctrl-V followed by ctrl-C.

This pipes a single ctrl-C followed by input from the controlling terminal, while -tt forces a psuedo-terminal to be allocated. All told this gives you a (somewhat malformed) shell on the remote machine while bypassing as much of .bashrc as is possible.

score 0 · Answer 12 · answered Sep 10 '20 at 12:02

0

That's works for me

$ ssh <hostname> bash --rcfile /dev/null

answered Sep 10 '20 at 12:02

david villa

101
1

Hugh Perkins · Answer 13 · 2021-10-28T19:02:30.957

0

Simply move the old .bashrc out of the way:

ssh user@wherever mv /home/ubuntu/.bashrc /home/ubuntu/.bashrc_old

Now ssh in normally :)

(since you don't run .bashrc when running commands; this worked great for me :) )

edited Oct 28 '21 at 19:02

answered Oct 28 '21 at 17:59

Hugh Perkins

1,065
7
9

Exactly this solution has already been posted 12 years ago. – Gerald Schneider Oct 28 '21 at 19:28

score 0 · Answer 14 · edited Nov 21 '12 at 05:39

0

UH='user@host'; ssh $UH 'mv ~/.bashrc ~/letmein'; ssh $UH

Please don't cut and run, change user and host, then edit letmein and save as .bashrc

edited Nov 21 '12 at 05:39

HopelessN00b

53,385
32
133
208

answered Jul 16 '11 at 23:11

SpiesInOrbit

1

score 0 · Answer 15 · answered Mar 16 '17 at 21:55

Kudos to user60069, it worked for me, but I use the shell-specific startup file .bashrc, so logging in with /bin/sh worked for me.

However, if you are in the "no such luck" situation, I offer this solution, based on user60069's and Dennis W's solutions:

ssh -t you@host  /bin/bash --noprofile  --norc

Dennis W offered the --norc option, which someone said did not work for them.

Run "man bash" or "man (your shell)" for options to disable the start up files. You only need to use an abhorrent shell for the time it takes to fix the problem.

score 0 · Answer 16 · answered Oct 25 '18 at 10:27

0

Other way to login to server is without profile, please find below command
ssh -t user@host bash --noprofile

For AWS using pem file and no other user
ssh -ti "YOUR-PEM-FILE-NAME.pem" ec2-user@YOUR-IP-ADDRESS bash --noprofile

Hope this helps!

answered Oct 25 '18 at 10:27

Krutarth Shah

1
1

score 0 · Answer 17 · answered Dec 15 '09 at 12:22

0

You can try to overwrite the .bash_profile with an empty file using the scp command. From what I have googled, scp use a non-interactive login that does not read .bash_profile.

answered Dec 15 '09 at 12:22

Laurent Etiemble

246
2
7

Unless I'm (hypothetically) remembering the directory structure wrong, and it's not giving me an error on that, this does not work - scp also runs the file(s). – Tom Ritter Dec 15 '09 at 12:30
1

The thing that people are not realizing is that scp isn't anything special; it's just another command run over ssh -- which means just about everything that happens for an interactive ssh session happpens with scp, also. – larsks Dec 15 '09 at 14:24
what about sftp, afaik its a ssh subsystem. – allo Mar 16 '17 at 23:42

score 0 · Answer 18 · answered Dec 15 '09 at 12:25

0

You can also just delete the bashrc file:

ssh <hostname> rm ~/.bashrc

answered Dec 15 '09 at 12:25

sybreon

7,357
1
19
19

The problem is in the .bash_profile file, not in the bashrc. – Laurent Etiemble Dec 15 '09 at 12:31
1

This doesn't work - it tries for a shell first and fails. – Tom Ritter Dec 15 '09 at 12:32

score 0 · Answer 19 · answered Dec 15 '09 at 12:36

0

If you system is setup normally, .bash_profile won't be run for a non-interactive shell (such as running a command).

Since you state the problem is in the .bash_profile file, try moving it out of the way:

ssh user@host "mv ~/.bash_profile ~/.bash_profile_broken"

answered Dec 15 '09 at 12:36

Lockie

886
5
8

I didn't think which way the files were linked mattered - .bash_profile includes .bashrc =( I added more info. – Tom Ritter Dec 15 '09 at 12:37
1

But what Lockie is suggesting -- which is confirmed by the bash man page -- is that a non-interactive shell will not run either .bashrc or .bash_profile. However, even when you pass commands on the ssh command line (like in this example), bash is still started as an "interactive" shell, which means it will read your .bashrc file. So a good idea, but unfortunately ssh won't cooperate. – larsks Dec 15 '09 at 14:32

score -1 · Answer 20 · answered Dec 15 '09 at 13:34

From the suggestions and responses given above, I'd say it's not the .bashrc or .bash_profile files. Also ssh manpage says that if you specify a command to be executed then your profile files won't be read.

I'd suggest try executing a different login shell (ksh? csh? sh?) from the absolute path; also, beware that it might be a totally different problem (quota? execute and read permission on your home directory?), so a side approach would be better. Can you ask another user to do a ls -la $YOUR_HOME_DIR and mail you the result?

Login without running bash_profile or bashrc

20 Answers20

Linked