Reset a forgotten root password on Linux

Everything here is done in the VirtualBox console window, not over SSH, because that is the point of the lesson. Take a snapshot of both VMs first (VBoxManage snapshot rocky01 take before-l71 and the same for ubu01, run on your laptop). You set rocky01’s root password in Lesson 2; you’ll pretend you forgot it, recover it, then leave both machines exactly as Lesson 33 left them, key-only SSH and all.

1Open the boot-loader menu on rocky01

In VirtualBox, click rocky01, choose Machine then Reset. Rocky shows its menu for 5 seconds. Highlight the top entry (do not press Enter) and press e. You’ll see something like this:

load_video
set gfxpayload=keep
insmod gzio
linux ($root)/vmlinuz-6.12.0-211.16.1.el10_2.0.1.x86_64 root=/dev/mapper/rl-root ro crashkernel=2G-64G:256M,64G-:512M resume=/dev/mapper/rl-swap rd.lvm.lv=rl/root rd.lvm.lv=rl/swap rhgb quiet
initrd ($root)/initramfs-6.12.0-211.16.1.el10_2.0.1.x86_64.img $tuned_initrd

This is the entry for your running kernel, the same options line you read in Lesson 50. The cursor keys move around it. Nothing you change here is saved: it affects this one boot only, which is what makes it safe to experiment.

✅ Checkpoint: You are looking at the editable boot entry with the linux line visible.

2Add rd.break and boot once

Move to the end of the line that starts with linux. For a clearer screen, delete rhgb quiet, then type a space and add:

rd.break

Press Ctrl+X to boot this one time. Dracut stops before handing over to systemd and you land at a prompt. You should see something like this:

[  OK  ] Reached target Basic System.
Press Enter for maintenance
(or press Control-D to continue):
switch_root:/#

The switch_root:/# prompt means you are in the initramfs, a tiny temporary system in RAM. Your real root is here too, mounted on /sysroot, but read-only. Run ls /sysroot and you’ll see the normal folders (etc, var, home).

✅ Checkpoint: You are at a switch_root:/# prompt and ls /sysroot shows the real file system.

3Make the root writable and change the password

Run this:

mount -o remount,rw /sysroot
chroot /sysroot

The prompt changes to sh-5.2#. You should see something like this:

switch_root:/# mount -o remount,rw /sysroot
switch_root:/# chroot /sysroot
sh-5.2#

remount,rw makes /sysroot writable and chroot steps inside it, so /etc/shadow now means the real file. Set the new password:

passwd root

You should see something like this:

sh-5.2# passwd root
Changing password for user root.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

No old password was asked, because inside the chroot you are already root. If passwd instead says “Read-only file system”, you skipped the remount in the step above; run it and try again.

✅ Checkpoint: passwd reports “all authentication tokens updated successfully”.

4Ask SELinux to relabel, then leave

Still inside the chroot, run this:

touch /.autorelabel
exit
exit

The empty /.autorelabel file is the whole reason logins keep working afterwards. Because SELinux wasn’t loaded in the initramfs, the /etc/shadow you just wrote has the wrong label, and without a relabel every login would be denied. The two exit commands leave the chroot and then the initramfs shell, and the boot carries on.

On the next boot you’ll see a line like “Relabeling / , this may take a while” and the VM reboots once more on its own. On a 20 GB lab disk it’s a minute or two. Never power the VM off while it relabels.

✅ Checkpoint: rocky01 relabels, reboots, and you can log in on the console as root with the new password.

5Prove it worked, from your normal login

Log in as student on the console (or over SSH with your key), and check the shadow file changed:

sudo grep '^root:' /etc/shadow | cut -c1-14
getenforce
sudo ls -Z /etc/shadow

You should see something like this:

[student@rocky01 ~]$ sudo grep '^root:' /etc/shadow | cut -c1-14
root:$6$Hk2pYq
Enforcing
system_u:object_r:shadow_t:s0 /etc/shadow

The hash starts with $6$ (SHA-512, the default on Rocky 10), getenforce still says Enforcing, and /etc/shadow carries its proper shadow_t label, which the relabel restored. If getenforce said Permissive or logins failed, the relabel didn’t run, and you’d repeat step 4.

✅ Checkpoint: The root line in /etc/shadow has a fresh $6$ hash, SELinux is Enforcing, and /etc/shadow is labelled shadow_t.

6Reset the admin password on ubu01

Reset ubu01 in VirtualBox. Ubuntu hides its menu, so press Esc on a UEFI VM or hold Shift on a BIOS VM as it starts. Highlight the top Ubuntu entry, press e, find the line starting with linux, change ro to rw, remove quiet splash, and add this at the end:

init=/bin/bash

Press Ctrl+X. The kernel runs bash straight away, as the first process, with no login and no systemd. Set student’s password (root is locked on Ubuntu, so student is the account that matters):

mount -o remount,rw /
passwd student
exec /sbin/init

You should see something like this:

bash-5.2# mount -o remount,rw /
bash-5.2# passwd student
New password:
Retype new password:
passwd: password updated successfully
bash-5.2# exec /sbin/init

You changed ro to rw on the kernel line, so the disk was already writable and no separate remount was strictly needed, but running it is harmless and saves you if you forgot. There is no SELinux relabel on Ubuntu. Leave only with exec /sbin/init, which replaces bash with the real init and boots normally; typing exit or reboot here leaves the system half-started.

[Add your screenshot here]: the Ubuntu boot entry open for editing with init=/bin/bash added at the end of the linux line.

✅ Checkpoint: ubu01 boots normally and you can log in as student with the new password.

7See where Ubuntu recovery mode fits

Reset ubu01 again, open the menu the same way, but this time choose “Advanced options for Ubuntu”, then the entry ending in “(recovery mode)”. After a moment you reach the Recovery Menu. Choose “root – Drop to root shell prompt”. You’ll see this:

Cannot open access to console, the root account is locked.
See sulogin(8) man page for more details.

Press Enter to continue.

That message is Ubuntu telling you root has no password to check, so it has no shell to open for you. Press Enter, pick “resume – Resume normal boot”, and let it start. Recovery mode is useful for a root shell on a server where root does have a password, and for its fsck and network options, but for a lost admin password the init=/bin/bash route in step 6 is the one that works on a stock Ubuntu Server.

✅ Checkpoint: You saw the “root account is locked” message and returned to a normal boot with resume.

8Lock the boot-loader editor on rocky01

Back as student on rocky01, put a password on the GRUB editor so the step-1 trick asks for one:

sudo grub2-setpassword

You should see something like this:

[student@rocky01 ~]$ sudo grub2-setpassword
Enter password:
Confirm password:
[student@rocky01 ~]$ sudo ls -l /boot/grub2/user.cfg
-rw-------. 1 root root 221 Oct 27 12:14 /boot/grub2/user.cfg

grub2-setpassword writes a hashed password into /boot/grub2/user.cfg and sets the superuser to root, without you editing any script. The file holds a PBKDF2 hash, not the password:

sudo cat /boot/grub2/user.cfg

You should see something like this:

GRUB2_PASSWORD=grub.pbkdf2.sha512.10000.5F9A...C3B1

The server still boots on its own, because the default entry is unrestricted. But pressing e now asks for the user “root” and this password before it lets you edit, so a stranger at the keyboard can no longer add rd.break. On Ubuntu the same idea is a set superusers and password_pbkdf2 pair in a /etc/grub.d file (generate the hash with grub-mkpasswd-pbkdf2), then update-grub.

✅ Checkpoint: Resetting rocky01 and pressing e now prompts for a user name and password before the entry can be edited.

9Put the boot-loader password back to open

So later lessons’ Break-It labs can still edit the entry freely, remove the GRUB password on rocky01:

sudo rm -f /boot/grub2/user.cfg
sudo ls /boot/grub2/user.cfg

You should see:

ls: cannot access '/boot/grub2/user.cfg': No such file or directory

Deleting user.cfg is all it takes; there is nothing to regenerate. On a real server you would keep the password and store it in your vault. Reset rocky01 once to confirm pressing e no longer asks for anything, then leave the VM running.

✅ Checkpoint: user.cfg is gone and the GRUB editor opens without a prompt again, leaving rocky01 as earlier lessons expect.