Linux in read-only mode

[Madseel]

Cool, thanks.

Ok, I'm probably going to have to reinstall RedHat, but I finally figured out a way to copy the files I need. I couln't create a directory for the USB harddrive to mount to, so I thought, what the hell, I'll try and put it as the mnt directory itself, and walah, it works. Thanks for your help so much. I'll still keep you posted on if I get it to work or not.

Thanks ahead

[IKnowNot]

The thing is that the partion (I think thats what its called but correct me if i'm wrong) that holds the /etc/ folder has no free space, so the fstab file is empty

This is bad, very bad.
Who set up the partitions?
Why does it appear full?

After the reboot, we keep getting sent to a shell promt, except that whenever we try to empty out the /etc folder, it says its a read-only filesystem

Which is why I am guessing the system has SELinux enabled.

but if I try to write to /var, it allows me to.

Again, under SELinux, you may have read capabilities, but not write.
How were you booting?
Single user mode?

How can I gain the ability to erase on the /etc drive?

Again, how were you attempting to boot to it, and do you have SELinux enabled?
If you do, did you write any policies yourself?

Just bare in mind, I am not bashing you unless it was you who set up the system. It sounds like, and you may indeed, be dealing with a system that was set up by someone who is either no longer there and/or did not know what they were doing.

It just sounds odd to me that /etc would be on a partition by itself, and/or full.
Especially since /var is writable.

Opus00 was correct as I understand it, RH4 uses ext3 by default.

What comes to mind first is that this is a system that is on read only media with certain directories on read/write media.

Second was the SELinux scenario.

So what else is on the /etc partition?

If the /etc partition is full, then either it is on read only media, the person who installed it did not know what they were doing, or the system was compromised and you have a whole lot of sh*t on there that shouldn't be.

If this is a legitimate system, and if you suspect a compromise, contact the authorities.

If you suspect that it is due to a mis configuration or equipment failure, the first thing I would do is pull it off line and replace it. Then "dd" the drive. Work with the copy to find out what happened and to recover data.

There are ways to turn off SELinux if this was the problem, but it sounds like it was not.

If you are using RH4, then Red Hat should be able to help recovering data and accessing the drive.

Another thing that had me dismayed:

I couln't create a directory for the USB harddrive to mount to, so I thought, what the hell, I'll try and put it as the mnt directory itself, and walah, it works.

If this person is working administering linux network boxes, are they aware that USB devices under *nix might show up as scuzzy devices?

THe more I read, the more I shake my head.

[SirDice]

IIRC if fstab is empty the system doesn't know what filesystems there are. If this happens the system will boot to single user mode. It'll ask which shell you want to run. The root filesystem / will always be mounted read-only. After a filesystem check a mount -u / will remount root read/write.

Usually /etc is on the root filesystem, so try to find out where it filled up.. And AFAIK if the filesystem fills up it doesn't destroy existing files. So I'm not sure why fstab is empty.. Maybe some admin nuked it? Perhaps it had a crash and that corrupted fstab?

DO NOT clean out /etc! There are lots of config files/startup scripts in there that are needed to properly boot.

[freealans]

Perhaps he just lost journalling on the partition? or perhaps try to mount -o rw /etc?