My roommate, who is a sysadmin, hosed the root account by accident on a Solaris machine. He edited the passwd file and somehow bolloxed up the root account, which now has no shell. Root is the only user account. Given that root has no shell specified, there is no way to log in to the machine to fix the problem.
Naturally, there are ways to fix this, the easiest we thought of being to pull the drive and edit the file on another box. Fixing the problem has become less of an issue, but the process of working on the problem has raised an interesting academic question: If root has no shell, how does one get into the box?
We started discussing the potential of this as an intentional security measure. Remote root shell exploits would not give you a shell, since there is no shell specified to run. You would have to attack it with some kind of priviledge escalation, but if there are no other user accounts to login with…? Could this be a way to lock down a box? Certainly inconvenient for administration.
The plan is to bring home this box once it is no longer in use, set up this scenario again (if it is repaired), and then hack the gibson. Should be a fun and very educational project.