Changing root password Redhat

At a glance#

• Purpose: Reset a forgotten root password on RHEL, CentOS, Rocky or AlmaLinux using GRUB single-user mode.
• Applies to: RHEL 7, 8 and 9 and their derivatives.
• Risk: High — requires a reboot and full downtime; SELinux mislabelling can render the system unbootable if steps are skipped.
• Time: About 15 minutes, plus reboot time.

Overview#

When the root password is lost and no sudo-capable account remains, the only route in is to interrupt the boot loader and start a minimal shell before the normal system comes up. From there the root password can be changed directly.

This requires console access — physical, iDRAC/iLO, or the VM console in vCenter. It cannot be done over SSH, because the machine must be rebooted and caught during boot.

Note: The fact that this works is a reminder that anyone with console access to an unencrypted Linux server effectively has root. If that matters for a given host, set a GRUB password and enable disk encryption. See Hardening Linux Server.

Before you start#

• Confirm you have console access and can watch the machine boot.
• Schedule downtime. The server will be offline for the duration.
• Check first whether any other account has sudo rights — if one does, use sudo passwd root instead and skip all of this.

Procedure#

1. Reboot and interrupt the boot loader#

Reboot the machine and watch the console. When the GRUB menu appears, press any arrow key immediately to stop the countdown.

If GRUB flashes past too quickly, hold Shift during boot, or press Esc repeatedly.

2. Edit the boot entry#

With the default kernel entry highlighted, press e to edit it.

Find the line that begins with linux16, linuxefi or just linux. Which one depends on the version:

3. Modify the kernel parameters#

On that line:

1. Find ro and change it to rw.
2. Append init=/sysroot/bin/sh to the end of the same line.

The end of the line should look roughly like this:

... rw init=/sysroot/bin/sh

Note: This change is temporary and lives only in memory. It is not written to disk, so a normal reboot restores the original boot entry automatically.

4. Boot into the single-user shell#

Press Ctrl + X to boot with the edited parameters.

You are dropped at a switch_root:# prompt. The real filesystem is mounted under /sysroot, not at /.

5. Switch into the real filesystem#

chroot /sysroot

The prompt changes to sh-4.4# or similar. You are now operating on the actual installed system.

6. Change the root password#

passwd root

Enter the new password twice. There is no echo, which is normal.

Note: If the system rejects a weak password, it will still usually let you set it after a warning. Choose something strong regardless and store it in the password manager immediately — this whole procedure exists because the last one was lost.

7. Flag the filesystem for SELinux relabelling#

touch /.autorelabel

Do not skip this. Changing /etc/shadow from the single-user shell writes the file without a correct SELinux context. If SELinux is enforcing and the label is wrong, login will fail after reboot — including for the password you just set — and you will be back at the console with a harder problem.

The empty /.autorelabel file tells SELinux to relabel the whole filesystem on next boot, then remove the flag itself.

8. Exit and reboot#

exit
reboot -f

reboot -f forces the reboot; a normal reboot may not work from this minimal environment.

Note: The first boot after relabelling takes noticeably longer — several minutes on a large filesystem — and the console shows relabelling progress. This is expected. Do not interrupt it.

Verification#

Once the system has fully booted, log in at the console as root with the new password.

Then confirm SELinux is healthy:

getenforce
ls -Z /etc/shadow

getenforce should return Enforcing (or whatever the host's normal setting is). The shadow file's context should read system_u:object_r:shadow_t:s0.

Finally, verify remote login works before you walk away from the console:

ssh root@<server-ip>

Troubleshooting#

Related#

• Changing root password Ubuntu — the equivalent on Ubuntu, which uses recovery mode rather than init=.
• RHEL 6 Filesystem Recovery and Root Password Reset