Get root access back

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Vaardigheden in dit hoofdstuk

Root-toegang terugkrijgen als het wachtwoord kwijt is

Know what you need

All methods need the console (keyboard and screen, a VM console, or the server's management card). You can not do this over SSH.

With disk encryption (LUKS) you also need the disk passphrase.
If the GRUB menu has a password, you need it to edit the boot entry.
Plan a short downtime: the system reboots, and the SELinux relabel can take some minutes.

Notitie

If a user with sudo rights can still log in, you do not need any of this: sudo passwd root.

13.2

Reset the password with rd.break

rd.break stops the boot inside the initramfs, before the real root file system is used. The real system is mounted read-only on /sysroot.

Reboot. At the GRUB menu, select the entry and press e.
At the end of the line that starts with linux, add rd.break. If the line has console= options for a serial console, remove them so the shell appears on your screen. Press Ctrl+X.
At the switch_root:/# prompt, make /sysroot writable and enter it.
```
#mount -o remount,rw /sysroot
#chroot /sysroot
```
Set the new password and order a full SELinux relabel.
```
#passwd root
#touch /.autorelabel
```
Leave the chroot and the initramfs shell. The system boots, relabels (one more automatic reboot) and you can log in.
```
#exit
#exit
```

Examentip

Do not forget touch /.autorelabel. Without it, the new /etc/shadow has a wrong SELinux label and nobody can log in.

13.3

Reset the password with init=/bin/bash

A second way: tell the kernel to start Bash instead of systemd. You get a root shell on the real root file system — read-only at first.

At the GRUB menu press e, go to the linux line, and add init=/bin/bash at the end (remove rhgb quiet to see messages). Press Ctrl+X.
Make the root file system writable, set the password, order the relabel.
```
#mount -o remount,rw /
#passwd root
#touch /.autorelabel
```
There is no systemd running, so reboot does not work. Start systemd in place of the shell, or force a reboot.
```
#exec /usr/lib/systemd/systemd
#/usr/sbin/reboot -f
```

Op het werk

If the keyboard layout is wrong in this early shell, passwords with special characters are typed wrong. Set a simple password first, and change it after the login.

13.4

Use the installation ISO

When GRUB is protected or broken, boot from the RHEL installation ISO, choose Troubleshooting → Rescue a Red Hat Enterprise Linux system, and work on the installed system in /mnt/sysroot.

#chroot /mnt/sysroot
#passwd root
#touch /.autorelabel
#exit
#reboot

13.5

Unlock a locked root account

Sometimes the password is known but the account is locked (passwd -l, or too many failed logins). Check it and unlock it.

#passwd -S root
root LK 2026-10-20 0 99999 7 -1 (Password locked.)
#passwd -u root
#faillock --user root
#faillock --user root --reset
#chage -l root

Command	What it does
`passwd -S USER`	Show the status: `PS` = has password, `LK` = locked, `NP` = no password
`passwd -u USER` / `usermod -U USER`	Unlock
`faillock --user USER --reset`	Reset failed login counts (pam_faillock)

13.6

Protect servers from the same trick

Everybody with console access can do this. Protect the console, the boot menu and the disk.

#grub2-setpassword
Enter password:
Confirm password:
#cat /boot/grub2/user.cfg
GRUB2_PASSWORD=grub.pbkdf2.sha512.10000.6E1A...

Protection	Stops
GRUB password (`grub2-setpassword`)	Editing boot entries (`e`) without the password
Disk encryption (LUKS)	Reading or changing data without the passphrase, also with a rescue ISO
UEFI / BIOS password and boot order	Booting from a USB stick or ISO
Locked server room, protected VM console	Physical access

Onthoud

Physical access = full access, unless the disk is encrypted. Treat the console like the root password.

Oefenen

Lab 18.1Break and repair the bootMoeilijk · 45 minNog niet begonnen

Oefenen

Alle commando's in dit hoofdstuk