Recovering a lost root password

When you need this

An admin leaves without handing over passwords, or a lab VM's root password is forgotten. If no one with sudo can log in, the only way back is to stop the boot before normal logins and change the password directly. You need access to the console: the physical screen and keyboard, or the virtual console of a VM or cloud instance.

Method 1: rd.break (the classic RHCSA method)

rd.break tells the initramfs to stop just before it switches to the real root, and give you a shell. At that moment the real root file system is mounted read-only at /sysroot, and SELinux is not yet active.

# 1. Reboot. In the GRUB menu, select the normal entry and press e.
# 2. Go to the end of the line starting with "linux" and add:  rd.break
#    (on some VMs and cloud images you must also remove console=ttyS0 arguments
#     to see the shell on your screen)
# 3. Press Ctrl+X. You get a prompt:
switch_root:/# mount -o remount,rw /sysroot
switch_root:/# chroot /sysroot
sh-5.1# passwd root
Changing password for user root.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.
sh-5.1# touch /.autorelabel
sh-5.1# exit
switch_root:/# exit

Why touch /.autorelabel?

passwd writes a new /etc/shadow file. Because SELinux was not running, the new file is created without the correct label (shadow_t). On the next boot, an enforcing system would block programs from reading it, and nobody could log in. The empty file /.autorelabel tells the boot to relabel the whole file system. This can take several minutes on large disks; let it finish.

Method 2: init=/bin/bash

This method replaces systemd with a bash shell for one boot. It works on any distribution and is handy when rd.break does not behave on a particular system.

# In GRUB, press e, and at the end of the "linux" line add:  init=/bin/bash
# Press Ctrl+X. You get a root shell on the REAL root, mounted read-only:
bash-5.1# mount -o remount,rw /
bash-5.1# passwd root
bash-5.1# touch /.autorelabel
bash-5.1# exec /sbin/init          # continue a normal boot (or: /usr/sbin/reboot -f)

Protecting against this

The same trick lets anyone with console access become root. Defences: a GRUB password (grub2-setpassword), a firmware password and disabled USB boot, locked server rooms, restricted access to VM consoles in vCenter or the cloud portal, and full-disk encryption (LUKS) so the disk cannot be read without its passphrase.

Common mistakes

• Forgetting touch /.autorelabel: the password is changed, but logins fail after reboot with SELinux enforcing.
• Forgetting to remount read-write: passwd fails with "Authentication token manipulation error".
• With rd.break, running passwd before chroot /sysroot: you change the password inside the temporary initramfs, which is thrown away.
• Interrupting the relabel because it "looks stuck". Wait.