How to Recover a Forgotten Root Password in Linux

It happens to every system administrator eventually: you sit down at a server console, type the root password from memory, and… access denied. Whether it’s a forgotten password, a typo somewhere in a password manager, or inheriting a server with no documentation, losing root access doesn’t have to mean losing the system. Linux provides several well-established, safe methods to recover from this situation, provided you have physical or console access to the machine.

This article walks through, step by step, how to recover a forgotten root password using the GRUB bootloader, covering both systemd-based and legacy systems, plus important security considerations.

Why This Is Even Possible (And Why That’s Okay)

Some people are surprised that you can reset a root password without knowing the old one. This is intentional: physical/console access to a machine has always been treated as a higher trust level than remote access in traditional security models — “if you can touch the hardware, you can eventually gain full control.” This is precisely why physical server security (locked server rooms, encrypted disks, BIOS passwords) matters as much as software security.

flowchart TD
    A[Reboot System] --> B[Interrupt at GRUB Menu]
    B --> C[Edit Boot Parameters]
    C --> D[Boot into Single-User / Rescue Mode]
    D --> E[Remount Root Filesystem as Read-Write]
    E --> F[Run passwd to Set New Root Password]
    F --> G[Reboot Normally]

Method 1: Using GRUB to Boot into Single-User/Rescue Mode

Step 1: Reboot and Interrupt GRUB

Restart the machine. As soon as the GRUB menu appears, press and hold Shift (on BIOS systems) or repeatedly press Esc (on UEFI systems) to prevent it from auto-booting. If GRUB is hidden entirely, you may need to press Esc immediately after POST.

Step 2: Edit the Boot Entry

Highlight your normal kernel entry and press e to edit it.

Step 3: Modify the Kernel Line

Find the line starting with linux (or linux16) and locate the part that ends with ro quiet splash or similar. Change ro to rw and append one of the following, depending on your init system:

For systemd-based systems (modern):

rw init=/bin/bash

rw init=/bin/bash

Alternative, using rescue target:

systemd.unit=rescue.target

systemd.unit=rescue.target

For older SysVinit systems:

rw single

rw single

Step 4: Boot With the Modified Line

Press Ctrl+X (or F10) to boot with these temporary changes. This does not permanently modify your GRUB configuration — it only applies for this one boot.

Step 5: Remount the Root Filesystem as Read-Write (if needed)

If you used init=/bin/bash, the filesystem might still be mounted read-only:

mount -o remount,rw /

mount -o remount,rw /

Step 6: Reset the Root Password

passwd root

passwd root

You’ll be prompted to type and confirm a new password.

Step 7: Handle SELinux Relabeling (RHEL/CentOS/Fedora Only)

If your system uses SELinux, force a filesystem relabel on next boot to avoid permission issues:

touch /.autorelabel

touch /.autorelabel

Step 8: Reboot Normally

exec /sbin/init

exec /sbin/init

Or, if that doesn’t cleanly return you to normal boot:

reboot -f

reboot -f

Method 2: Booting From a Live USB/CD

If GRUB editing is disabled or password-protected (a good security practice, ironically making self-recovery harder), boot from a Linux live USB instead:

Step 1: Boot the machine from a live USB (Ubuntu Live, SystemRescue, etc.)

Step 2: Identify and mount the root partition of the installed system:

lsblk
sudo mount /dev/sda2 /mnt

lsblk
sudo mount /dev/sda2 /mnt

Step 3: Use chroot to “enter” the installed system:

sudo chroot /mnt

sudo chroot /mnt

Step 4: Reset the password as normal:

passwd root

passwd root

Step 5: Exit the chroot and reboot:

exit
sudo reboot

exit
sudo reboot

Comparison of Recovery Methods

Cloud Environments: A Different Approach

On cloud platforms (AWS EC2, Azure, Google Cloud), you typically don’t have physical console access in the traditional sense, but providers offer equivalent tools:

• AWS EC2: Use EC2 Instance Connect, or detach the root volume, attach it to a rescue instance, edit the password/SSH keys, then reattach.
• Azure: Use the “Reset password” feature in the VM’s support/troubleshooting blade, powered by the VM agent.
• Google Cloud: Use gcloud compute ssh with OS Login, or the serial console, or reset via a rescue disk similar to AWS.

Real-World Example: Recovering a Forgotten Password on Ubuntu Server

Step 1: Reboot, press Shift at boot to reach GRUB menu.

Step 2: Select the default kernel entry, press e.

Step 3: Find the line beginning with linux, append:

rw init=/bin/bash

rw init=/bin/bash

Step 4: Press Ctrl+X to boot.

Step 5: At the resulting root shell:

mount -o remount,rw /
passwd root

mount -o remount,rw /
passwd root

Type a new password twice.

Step 6:

exec /sbin/init

exec /sbin/init

The system continues booting normally with the new password in effect.

Preventing This Situation in the Future

• Use a password manager for all root/admin credentials, with secure sharing for teams.
• Set up sudo-based administration instead of relying on direct root logins, so individual admin accounts (each with their own recoverable password) are used instead.
• Document recovery procedures specific to your environment (cloud provider rescue tools, GRUB password if set, etc.) in your team’s runbook.
• Consider SSH key-based access as the primary method, reducing reliance on passwords entirely for remote administration.

Best Practices

• Only perform password recovery on systems you own or are authorized to administer. Unauthorized password resets on systems you don’t control is illegal in most jurisdictions.
• Set a GRUB password on production systems to prevent unauthorized boot-parameter tampering — but store that password securely, since losing it just adds another recovery layer needed (typically requiring live-media boot instead).
• Use full-disk encryption (LUKS) on sensitive systems; this adds a layer of protection so that GRUB-edit-based recovery alone can’t bypass security without also knowing the disk encryption passphrase.
• After any password reset, review /var/log/auth.log or /var/log/secure for suspicious activity, in case the password loss was actually a result of unauthorized access rather than a simple forgotten password.
• Test your recovery procedure in a non-production VM before you need it for real, so you’re not learning the steps for the first time during an actual outage.

Troubleshooting

Problem: GRUB menu doesn’t appear at all

The GRUB menu timeout may be set to 0. Try holding Shift (BIOS) or tapping Esc repeatedly right after POST completes, before the OS starts loading.

Problem: init=/bin/bash results in a filesystem that’s still read-only

Explicitly remount it:

mount -o remount,rw /

mount -o remount,rw /

Problem: SELinux blocks login after password reset

You forgot the relabel step. Boot into rescue mode again and run:

touch /.autorelabel
reboot

Problem: GRUB is password-protected and you don’t know that password either

You’ll need to boot from live media and use the chroot method instead (Method 2 above), or physically reset the BIOS/UEFI if a firmware password is also involved.

Problem: System uses full-disk encryption (LUKS) and won’t even reach GRUB’s editable menu without the passphrase

Full-disk encryption is specifically designed to prevent this kind of bypass. Without the LUKS passphrase, password recovery via this method is not possible — you’d need your recovery key (generated when encryption was set up) instead.

Conclusion

Losing root access to a Linux system is stressful but almost always recoverable, as long as you have physical or console access. Whether by dropping into a root shell through GRUB’s init=/bin/bash trick, booting into rescue/single-user mode, or using a live USB with chroot, the underlying principle is the same: boot the system in a way that bypasses the normal login prompt, then use the standard passwd command to set a new password. Combine this knowledge with strong preventive practices — password managers, sudo-based administration, and documented recovery runbooks — and a forgotten password becomes a minor inconvenience rather than a crisis.

Further Reading

• GRUB manual — Security
• Ubuntu: Reset a forgotten root password
• Red Hat: Resetting the root password
• Arch Wiki: Reset lost root password
• passwd(1) man page
• AWS: Reset a Linux instance password