Bdevil
Posts: 4
Joined: Fri Mar 21, 2014 10:26 am

Raspbian Startup Issue

Thu Nov 10, 2016 9:11 pm

Hi to all

I've a problem with my RPI with Raspbian

So

When it is booting, i display me 3 errors

[FAILED] Failed to start dhcpcd on all interfaces
See 'systemctl status dhcpd.service' for details
[FAILED] Failed to start Login Service
See 'systemctl status systemd-logind.service' for details
[FAILED] Faile to start Avahi mDNS/DNS-SD Stack
See 'systemctl status avahi-daemon.service' for details

And RPI stop to boot . Black Screen will appear after 10 mins

Any idea to resolve this issue?

Thank you :)

jcalmeida79
Posts: 8
Joined: Mon Nov 12, 2018 10:13 pm

Re: Raspbian Startup Issue

Sun May 26, 2019 12:52 am

3 years later, I'm having the some issue. Can anyone give any hint?

My system was working fine until I noticed it was out of space. It seems someone was heavily trying to ssh into my pi with a brute force approach, and my /var/log/auth.log and var/log/btmp files were huge.

This was what I did:
  • Deleted all .1 files and all .gz also (probably bad idea).
  • Changed the ssh port from 22 to 1025, by editing /etc/ssh/sshd_config file
  • Tried to change my pi user's password to anything different than "raspberry", but I think I got the read-only error, but I'm not sure
I booted the pi and started getting the same errors as Bdevil.
I can only get in the pi with the Single User Mode. In the meantime I truncated the files with "> auth.log" and "> btmp".

What do you guys think I should check/do to fix my pi (3B+ running raspbian lite)?

Thank you.

Ernst
Posts: 1231
Joined: Sat Feb 04, 2017 9:39 am
Location: Germany

Re: Raspbian Startup Issue

Sun May 26, 2019 6:57 am

jcalmeida79 wrote:
Sun May 26, 2019 12:52 am
3 years later, I'm having the some issue. Can anyone give any hint?

My system was working fine until I noticed it was out of space. It seems someone was heavily trying to ssh into my pi with a brute force approach, and my /var/log/auth.log and var/log/btmp files were huge.

This was what I did:
  • Deleted all .1 files and all .gz also (probably bad idea).
  • Changed the ssh port from 22 to 1025, by editing /etc/ssh/sshd_config file
  • Tried to change my pi user's password to anything different than "raspberry", but I think I got the read-only error, but I'm not sure
I booted the pi and started getting the same errors as Bdevil.
I can only get in the pi with the Single User Mode. In the meantime I truncated the files with "> auth.log" and "> btmp".

What do you guys think I should check/do to fix my pi (3B+ running raspbian lite)?

Thank you.
You have a few important points in your post:
[*] It seems someone was heavily trying to ssh into my pi with a brute force approach, and my /var/log/auth.log and var/log/btmp files were huge
[*] Changed the ssh port from 22 to 1025, by editing /etc/ssh/sshd_config file
[*] Tried to change my pi user's password to anything different than "raspberry"
Together it points to it that you have not secured the Pi but you may have been using it in an unfriendly environment and the it may have been hacked.

The ONLY ACCEPTABLE solution is to start with a new card using a new installation, this time make sure that the password is changed and disable password authentication for ssh, use keys instead.

If the problem is caused by something else then we will not be able to help because you have destroyed evidence.

For future posts, you must provide information if you need our assistance meaning which model Pi, what operating system release, network connection, etc. If this Pi has been running for three years and has not been upgrade then now the time has arrived to do so. But if this is a Pi3B+ I wonder where the three years come from.
The road to insanity is paved with static ip addresses

jcalmeida79
Posts: 8
Joined: Mon Nov 12, 2018 10:13 pm

Re: Raspbian Startup Issue

Sun May 26, 2019 10:02 am

Ernst wrote:
Sun May 26, 2019 6:57 am
jcalmeida79 wrote:
Sun May 26, 2019 12:52 am
3 years later, I'm having the some issue. Can anyone give any hint?

My system was working fine until I noticed it was out of space. It seems someone was heavily trying to ssh into my pi with a brute force approach, and my /var/log/auth.log and var/log/btmp files were huge.

This was what I did:
  • Deleted all .1 files and all .gz also (probably bad idea).
  • Changed the ssh port from 22 to 1025, by editing /etc/ssh/sshd_config file
  • Tried to change my pi user's password to anything different than "raspberry", but I think I got the read-only error, but I'm not sure
I booted the pi and started getting the same errors as Bdevil.
I can only get in the pi with the Single User Mode. In the meantime I truncated the files with "> auth.log" and "> btmp".

What do you guys think I should check/do to fix my pi (3B+ running raspbian lite)?

Thank you.
You have a few important points in your post:
[*] It seems someone was heavily trying to ssh into my pi with a brute force approach, and my /var/log/auth.log and var/log/btmp files were huge
[*] Changed the ssh port from 22 to 1025, by editing /etc/ssh/sshd_config file
[*] Tried to change my pi user's password to anything different than "raspberry"
Together it points to it that you have not secured the Pi but you may have been using it in an unfriendly environment and the it may have been hacked.

The ONLY ACCEPTABLE solution is to start with a new card using a new installation, this time make sure that the password is changed and disable password authentication for ssh, use keys instead.

If the problem is caused by something else then we will not be able to help because you have destroyed evidence.

For future posts, you must provide information if you need our assistance meaning which model Pi, what operating system release, network connection, etc. If this Pi has been running for three years and has not been upgrade then now the time has arrived to do so. But if this is a Pi3B+ I wonder where the three years come from.
First of all, thank you for your reply.
Just a few things to clarify what I might have missed in my previous post, that you mention in your reply:

[*] My Pi is the 3B+, as I stated at the end. I should have mentioned it as soon as I started the post.
[*] My system hasn't been running for 3 years. I'm not the original poster, I just replied here, because I was having the same issue the OP had 3 years ago. It's been running for 5/6 months
[*] My operating system is Raspbian Lite. I mention it where I mention the Pi version. I didn't mention the specific release version though, and don't really know what it is at the moment. Only that it was installed fresh in December
[*] It's connected to my home network with wifi with port forwarding in my router for ssh port 22, for me to manage it when I'm out

By the way, before I truncated the pi, I investigated the auth.log and btmp files. I'm almost certain it hasn't been hacked. I removed the port forward when I was working on it and did several boots with no problems. Only after when I removed the .1 and .gz files, changed the ports and tried to change de password for the pi user, the pi didn't boot. I ended being the hacker :)

I'm resisting on doing a fresh install, because I have my home automation system there, that I created myself using nodejs and homebridge. I'm afraid I might not have the latest version of it backed up.

If I can't restore the Login Services, any idea how to remove it from the Pi? I tried the ext4fuse but it says "Partition doesn't contain EXT4 filesystem".

pcmanbob
Posts: 6934
Joined: Fri May 31, 2013 9:28 pm
Location: Mansfield UK

Re: Raspbian Startup Issue

Sun May 26, 2019 10:24 am

It sounds like you have corrupted your files system, your only option may be to try repairing/reading the SD card using your pi.

So using a second SD card loaded with raspbian boot your pi.

place your faulty SD card in a USB card reader and attach to pi

if you are lucky you may be able to mount the partitions and copy off the files you want.

if you can't and decide to attempt to fix the faulty SD card while using this method I would make a copy of the faulty SD card and use that for your repair attempt, that way if it fails you can copy the original SD card again and try something else.
We want information… information… information........................no information no help
The use of crystal balls & mind reading are not supported

jcalmeida79
Posts: 8
Joined: Mon Nov 12, 2018 10:13 pm

Re: Raspbian Startup Issue

Sun May 26, 2019 10:38 am

pcmanbob wrote:
Sun May 26, 2019 10:24 am
It sounds like you have corrupted your files system, your only option may be to try repairing/reading the SD card using your pi.

So using a second SD card loaded with raspbian boot your pi.

place your faulty SD card in a USB card reader and attach to pi

if you are lucky you may be able to mount the partitions and copy off the files you want.

if you can't and decide to attempt to fix the faulty SD card while using this method I would make a copy of the faulty SD card and use that for your repair attempt, that way if it fails you can copy the original SD card again and try something else.
It seems so, although I can't figure how I corrupted it by deleting the .1 and .gz files.
I don't have an external card reader, but I'll try to grab one soon.
I just hope someone here has a magical solution for me in the meantime, because this is really puzzling me. I don't understand how I damaged it so much with the actions I stated above.

Ernst
Posts: 1231
Joined: Sat Feb 04, 2017 9:39 am
Location: Germany

Re: Raspbian Startup Issue

Sun May 26, 2019 11:08 am

Your problem could be a corrupted and/or fake memory card.

but
jcalmeida79 wrote:
Sun May 26, 2019 10:02 am
[*] It's connected to my home network with wifi with port forwarding in my router for ssh port 22, for me to manage it when I'm out

By the way, before I truncated the pi, I investigated the auth.log and btmp files. I'm almost certain it hasn't been hacked. I removed the port forward when I was working on it and did several boots with no problems. Only after when I removed the .1 and .gz files, changed the ports and tried to change de password for the pi user, the pi didn't boot. I ended being the hacker :)
portforwarding is extremely dangerous, you could have been hacked without noticing.

I am using fail2ban to protect ssh access into my network, about the 1st of May I decided to change the rules and to ban forever.
This is the number of IP addresses I have banned until now (<30 days = +/- 30 per day)
Attachments
Untitled.png
Untitled.png (27.09 KiB) Viewed 747 times
The road to insanity is paved with static ip addresses

pcmanbob
Posts: 6934
Joined: Fri May 31, 2013 9:28 pm
Location: Mansfield UK

Re: Raspbian Startup Issue

Sun May 26, 2019 1:11 pm

jcalmeida79 wrote:
Sun May 26, 2019 10:38 am

It seems so, although I can't figure how I corrupted it by deleting the .1 and .gz files.
The corruption may have occurred because the SD card was full, so changes were not being written to the card, upon reboot the card became corrupt because of inconsistency's in the partitions.
We want information… information… information........................no information no help
The use of crystal balls & mind reading are not supported

jcalmeida79
Posts: 8
Joined: Mon Nov 12, 2018 10:13 pm

Re: Raspbian Startup Issue

Sun May 26, 2019 2:04 pm

Ernst wrote:
Sun May 26, 2019 11:08 am
Your problem could be a corrupted and/or fake memory card.

but
jcalmeida79 wrote:
Sun May 26, 2019 10:02 am
[*] It's connected to my home network with wifi with port forwarding in my router for ssh port 22, for me to manage it when I'm out

By the way, before I truncated the pi, I investigated the auth.log and btmp files. I'm almost certain it hasn't been hacked. I removed the port forward when I was working on it and did several boots with no problems. Only after when I removed the .1 and .gz files, changed the ports and tried to change de password for the pi user, the pi didn't boot. I ended being the hacker :)
portforwarding is extremely dangerous, you could have been hacked without noticing.

I am using fail2ban to protect ssh access into my network, about the 1st of May I decided to change the rules and to ban forever.
This is the number of IP addresses I have banned until now (<30 days = +/- 30 per day)
On my next build, I'll use fail2ban for sure, thanks.

jcalmeida79
Posts: 8
Joined: Mon Nov 12, 2018 10:13 pm

Re: Raspbian Startup Issue

Sun May 26, 2019 2:05 pm

pcmanbob wrote:
Sun May 26, 2019 1:11 pm
jcalmeida79 wrote:
Sun May 26, 2019 10:38 am

It seems so, although I can't figure how I corrupted it by deleting the .1 and .gz files.
The corruption may have occurred because the SD card was full, so changes were not being written to the card, upon reboot the card became corrupt because of inconsistency's in the partitions.
That makes sense. Like Next time I'll use fail2ban to avoid getting my auth logs file so big and secure myself better.

jcalmeida79
Posts: 8
Joined: Mon Nov 12, 2018 10:13 pm

Re: Raspbian Startup Issue

Tue May 28, 2019 10:54 pm

I'm back up and running.

I managed to read the card on my macbook with ext4fuse tool, that maps ext4 partitions as a folder on mac. I got my configuration and system out of it, and did a fresh image install.

I put it back online but did the smart moves now:
[*] change default password (duh!)
[*] changed the external port, that is open on my router, for it not to be the default 22, but kept 22 in my home network for simplicity (might change it later)
[*] installed fail2ban. Tried it and it works great - Great simple tutorial here: https://www.youtube.com/watch?time_cont ... SOYd2zSQhg

So, thank you all for your help and guidance. I learned a bit more and this was a wake-up call. I feel a lot safer now, but I'll keep an eye on the logs just the same.

Return to “Raspbian”