How to reset a forgotten root user password in Linux systems
Losing the root administrator password on a physical Linux server or virtual machine blocks all access to system configurations. Fortunately, if you have physical access or access to the virtualization emulator console (KVM/IPMI), you can bypass authentication by editing kernel parameters in GRUB.
Quick Diagnostics
init=/bin/bash in GRUBmount -o remount,rw / and reset password via passwdLosing the root administrator password on a physical Linux server or virtual machine blocks all access to system configurations. Fortunately, if you have physical access or access to the virtualization emulator console (KVM/IPMI), you can bypass authentication by editing kernel parameters in GRUB.
Step-by-Step Solution
Step 1: Acceder e interceptar el cargador de arranque GRUB
-
1
Step 1
Restart the server. -
2
Step 2
When the GRUB operating system selection menu screen appears, immediately press theekey on your keyboard to edit the boot variables of the selected kernel.
Step 2: Modificar los parámetros del kernel
- Scroll down using the arrow keys to locate the line starting with the word
linuxorlinux16. - Go to the end of that line, delete the silent boot words (such as
rhgb quiet) and add the following command to force the kernel to open a secure command prompt instead of the login interface:
init=/bin/bash
- Press the
Ctrl + XorF10key combination to boot the server with this new temporary configuration.
Step 3: Montar el disco en modo escritura y cambiar la clave
The system will boot directly as superuser without asking for a password, but with the disk configured in read-only mode. Enable write access to save changes:
# Remontar la partición raíz con privilegios de escritura
mount -o remount,rw /
# Modificar la clave del usuario administrador root
passwd root
# Forzar el reetiquetado de seguridad si usas SELinux (esencial en RHEL/Fedora/Rocky)
touch /.autorelabel
# Reiniciar el equipo
exec /sbin/init
Prevention Advice
Recommended security practices:
- The ability to reset passwords in this way is a kernel feature, but it represents a major security risk if an attacker has physical access to your local servers. Protect your production system's bootloader by setting an access password for the GRUB console (
grub-mkpasswd-pbkdf2), which will prevent unauthorized users from editing kernel parameters without prior authentication.