How to Reset a Forgotten Root Password on Linux

Losing the root password on a Linux machine feels like a disaster, but your data is fine and nothing is broken. There is almost always a way back in. This DevAnswers guide covers the three routes: the sudo shortcut when you still have another admin account, the boot-time reset when you can reach the machine at a physical console, and the provider console for a cloud server you can only reach over the network.

Quick Answer #

Pick the line that matches your situation:

• You have another account with sudo. You do not need a recovery boot at all. Just reset root’s password directly.
• You have console or physical access but no sudo account. Interrupt the boot loader, start a root shell, and change the password.
• It is a hosted cloud server. Use the provider’s web console or password-reset feature, because you cannot reach the boot menu over SSH.

If you have a sudo-capable account, this is the entire job, no reboot required:

sudo passwd root

Enter a new password twice and you are done. The rest of this guide is for when you do not have that shortcut.

Which Method Do You Need? #

The right recovery path depends on two things: whether you have a working account with sudo rights, and how you can reach the machine. Match your situation before you start so you do not reboot a server you did not need to.

Reset via GRUB (Ubuntu and Debian) #

When you have no sudo account but can watch the machine boot, you interrupt the GRUB boot loader and tell the kernel to start a plain shell instead of the normal startup. From that shell you set a new password.

1. Reboot. As the machine starts, hold Shift (older BIOS systems) or tap Esc repeatedly (newer UEFI systems) to bring up the GRUB menu.
2. Highlight the default entry and press e to edit it.
3. Find the line that begins with linux and add init=/bin/bash to the end of it.
4. Press Ctrl+X or F10 to boot with that change.

The machine boots straight to a root shell, but the disk is mounted read-only at this stage, so a password change would fail. Remount it read-write first, then set the password:

mount -o remount,rw / && passwd root

Choose a strong replacement with the password generator. When the password is set, write the change to disk and reboot into the normal system:

sync
exec /sbin/init

Reset on RHEL, Rocky, and AlmaLinux #

Red Hat-family systems use a different, documented sequence. Instead of init=/bin/bash, you interrupt the boot with rd.break, which drops you into the early boot environment before the real system starts.

1. At the GRUB menu, press e on the default entry.
2. Add rd.break to the end of the line starting with linux, then boot with Ctrl+X.
3. The system root is mounted read-only under /sysroot. Remount it read-write and switch into it.

mount -o remount,rw /sysroot
chroot /sysroot
passwd root

Create the relabel flag, then exit both shells to continue booting:

touch /.autorelabel
exit
exit

Cloud VPS: Use the Provider Console #

On a cloud server there is no keyboard to interrupt GRUB and no way to reach the boot menu over SSH, which is exactly why you are stuck. Providers solve this with a web-based console that acts like a monitor and keyboard plugged into the virtual machine. It shows the boot screen, so reboot the server and use the console to catch the GRUB menu, then follow the boot-time reset from the sections above. Or skip the boot menu entirely and use the provider’s dedicated password-reset feature.

On DigitalOcean, for example, the Droplet’s Access tab offers both a Recovery Console and a Reset Root Password button that emails you a temporary password to change on first login. On Rocky, AlmaLinux, and other RHEL-family images the Reset Root Password button often does not work, because the password is managed by cloud-init at boot; there, use the Recovery Console to reach the boot menu and follow the rd.break method above. If SSH itself is the problem rather than the password, our guide to regaining access to a Linux server when SSH fails covers the same console in more depth.

What This Means for Security #

This procedure only needs console access, which carries a blunt lesson: anyone who can reach your boot menu can become root. That is not a flaw in Linux; it is the expected trust model, where physical (or virtual-console) access is total access. Two controls close the gap where it matters:

• Password-protect GRUB. A GRUB password stops someone editing the boot entry to add init=/bin/bash in the first place.
• Encrypt the disk. Full-disk encryption with LUKS makes the boot-shell trick useless: without the passphrase, the attacker cannot even mount the filesystem to change a password.

For a server in a locked rack or a reputable data center, the console-access risk is already managed by physical security. For a laptop or a machine others can touch, disk encryption is the real answer.

Troubleshooting #

Two things go wrong often enough to name:

• The GRUB menu never appears. Many systems hide it by default. Hold Shift throughout boot on BIOS machines, or press Esc repeatedly on UEFI. If it still will not show, the GRUB_TIMEOUT and GRUB_TIMEOUT_STYLE settings control whether the menu is displayed; a value of hidden or a zero timeout suppresses it.
• “Authentication token manipulation error.” The filesystem is read-only. This is the remount step: run mount -o remount,rw / (or /sysroot on RHEL) before passwd.

Whichever route your situation calls for, the reassuring part is that a lost root password is recoverable, not fatal. Once you are back in, set a strong replacement and reconnect the normal way by logging in over SSH; and if the lockout worried you, that is the cue to add a GRUB password or full-disk encryption so console access alone cannot reset it.