Changing root password Ubuntu

At a glance#

• Purpose: Reset a forgotten root or user password on Ubuntu using GRUB recovery mode.
• Applies to: Ubuntu Server and Desktop 18.04 and later.
• Risk: High — requires a reboot and full downtime.
• Time: About 10 minutes, plus reboot time.

Overview#

If the root password is lost and no account with sudo rights remains, the system has to be booted into recovery mode, where a root shell is available without authentication. The password can then be reset directly.

This needs console access — physical, IPMI/iDRAC, or the VM console. It cannot be done over SSH.

Note: Anyone with console access to an unencrypted Ubuntu machine can do this. Where that is a concern, set a GRUB password and use full-disk encryption.

Before you start#

• Confirm console access and the ability to watch the machine boot.
• Schedule downtime.
• Check whether another account still has sudo. If one does, use sudo passwd root and skip this entirely.

Procedure#

1. Reboot and open the GRUB menu#

Reboot, and hold Shift (BIOS systems) or press Esc repeatedly (UEFI systems) as the machine starts.

On a server with a single installed OS, GRUB is often hidden with a zero timeout, so start pressing before you expect to see anything.

2. Select recovery mode#

1. Choose Advanced options for Ubuntu.
2. Select the entry ending in (recovery mode).
3. Wait for the recovery menu to appear.

3. Drop to a root shell#

From the recovery menu, select root — Drop to root shell prompt and press Enter.

Press Enter once more if prompted for maintenance mode.

4. Remount the filesystem as writable#

Recovery mode mounts the root filesystem read-only. Password changes will fail until you remount it:

mount -o remount,rw /

Warning: This is the step most often missed. Without it, passwd appears to accept the new password but fails with an authentication token error, and the change is silently lost.

If the system uses a separate /home partition and you need it, mount everything:

mount -a

5. Identify the account you need#

List the real user accounts on the machine — system accounts have UIDs below 1000:

awk -F: '$3 >= 1000 && $3 < 65534 {print $1}' /etc/passwd

To see all accounts including system ones:

cut -d: -f1 /etc/passwd

6. Reset the password#

For root:

passwd root

For a specific user:

passwd username

Enter the new password twice. Nothing is echoed as you type, which is normal.

Note: On Ubuntu the root account is normally locked by design, and administration is done through sudo. Rather than enabling root, it is usually better to reset the password of an existing sudo user. If you do set a root password here, consider re-locking it afterwards with passwd -l root once you have restored sudo access.

7. Optional — restore sudo access instead#

If the problem is that no account has sudo any more, create one or repair the existing one:

adduser newadmin
usermod -aG sudo newadmin

8. Return and reboot#

exit

Choose resume — Resume normal boot from the recovery menu, or reboot cleanly:

reboot -f

Verification#

Log in at the console with the new password.

Then confirm remote access works before leaving the console:

ssh username@<server-ip>

If you reset a sudo account, verify escalation works:

sudo -v

Troubleshooting#

Related#

• Changing root password Redhat — the RHEL equivalent, which also requires an SELinux relabel.
• Hardening Linux Server