Ubuntu sudoers file hacked

hackingsudoUbuntu

I've 3 ubuntu 14.04 vm on a remote hosting for code repository and testing purpose.
I've got them for more than 1 year now.
Two of them are working properly, but on one of them I can't run root commands anymore.
I disabled root access and I'm log in as "user1", using sudo to run commands.
But now it say that the users is no more in the sudoers (last time I logged in, 2 days ago, I didn't change anything)

I've seen the file sudoers has not been changed since months ago.
I tried to log as root running su, but it says that the authentication is wrong.

I'm writing here just for the last chance before running a reinstall command (I can't enter recovery mode cause is a remote hosting vm…).
did it happen to someone else ?
Because I don't know what to think:
1) server hacked;
2) file corruption (but it says that the users is not in, not that there is an error reading and the root password should work)
3) no idea…

Thanks

[Update]
this is the output from stat /etc/sudoers

    File: "/etc/sudoers"
  Dim.: 745             Blocchi: 8          Blocco di IO: 4096   file regolare
Device: 801h/2049d      Inode: 653038      Coll.: 1
Accesso: (0440/-r--r-----)  Uid: (    0/    root)   Gid: (    0/    root)
Accesso  : 2014-11-13 12:56:19.622105032 +0100
Modifica : 2014-02-10 20:16:26.000000000 +0100
Cambio   : 2014-06-22 09:50:38.421005615 +0200
Creazione: -

Best Answer

Not that long ago I accidentically removed myself from the sudoers file by attempting to add my user to another group.

Instead of typing the intended:

usermod -aG groupname username

I instead typed I believe it was the following:

usermod -G groupname username

What happened? Well it did add me to one group, but removed me from all the others including sudo.

NET result? I can't sudo anymore.

To fix it, I had to reboot the server and start in recovery mode and go to straight to a shell. I think fixed my group permissions and rebooted.

Related Topic