Get root access back

$ run as a normal user# run as root (or with sudo)

Skills in this chapter

Get root access back when the password is lost

Know what you need

All methods need the console (keyboard and screen, a VM console, or the server's management card). You can not do this over SSH.

With disk encryption (LUKS) you also need the disk passphrase.
If the GRUB menu has a password, you need it to edit the boot entry.
Plan a short downtime: the system reboots, and the SELinux relabel can take some minutes.

Note

If a user with sudo rights can still log in, you do not need any of this: sudo passwd root.

13.2

Reset the password with rd.break

rd.break stops the boot inside the initramfs, before the real root file system is used. The real system is mounted read-only on /sysroot.

Reboot. At the GRUB menu, select the entry and press e.
At the end of the line that starts with linux, add rd.break. If the line has console= options for a serial console, remove them so the shell appears on your screen. Press Ctrl+X.
At the switch_root:/# prompt, make /sysroot writable and enter it.
```
#mount -o remount,rw /sysroot
#chroot /sysroot
```
Set the new password and order a full SELinux relabel.
```
#passwd root
#touch /.autorelabel
```
Leave the chroot and the initramfs shell. The system boots, relabels (one more automatic reboot) and you can log in.
```
#exit
#exit
```

Exam tip

Do not forget touch /.autorelabel. Without it, the new /etc/shadow has a wrong SELinux label and nobody can log in.

13.3

Reset the password with init=/bin/bash

A second way: tell the kernel to start Bash instead of systemd. You get a root shell on the real root file system — read-only at first.

At the GRUB menu press e, go to the linux line, and add init=/bin/bash at the end (remove rhgb quiet to see messages). Press Ctrl+X.
Make the root file system writable, set the password, order the relabel.
```
#mount -o remount,rw /
#passwd root
#touch /.autorelabel
```
There is no systemd running, so reboot does not work. Start systemd in place of the shell, or force a reboot.
```
#exec /usr/lib/systemd/systemd
#/usr/sbin/reboot -f
```

At work

If the keyboard layout is wrong in this early shell, passwords with special characters are typed wrong. Set a simple password first, and change it after the login.

13.4

Use the installation ISO

When GRUB is protected or broken, boot from the RHEL installation ISO, choose Troubleshooting → Rescue a Red Hat Enterprise Linux system, and work on the installed system in /mnt/sysroot.

#chroot /mnt/sysroot
#passwd root
#touch /.autorelabel
#exit
#reboot

13.5

Unlock a locked root account

Sometimes the password is known but the account is locked (passwd -l, or too many failed logins). Check it and unlock it.

#passwd -S root
root LK 2026-10-20 0 99999 7 -1 (Password locked.)
#passwd -u root
#faillock --user root
#faillock --user root --reset
#chage -l root

Command	What it does
`passwd -S USER`	Show the status: `PS` = has password, `LK` = locked, `NP` = no password
`passwd -u USER` / `usermod -U USER`	Unlock
`faillock --user USER --reset`	Reset failed login counts (pam_faillock)

13.6

Protect servers from the same trick

Everybody with console access can do this. Protect the console, the boot menu and the disk.

#grub2-setpassword
Enter password:
Confirm password:
#cat /boot/grub2/user.cfg
GRUB2_PASSWORD=grub.pbkdf2.sha512.10000.6E1A...

Protection	Stops
GRUB password (`grub2-setpassword`)	Editing boot entries (`e`) without the password
Disk encryption (LUKS)	Reading or changing data without the passphrase, also with a rescue ISO
UEFI / BIOS password and boot order	Booting from a USB stick or ISO
Locked server room, protected VM console	Physical access

Remember

Physical access = full access, unless the disk is encrypted. Treat the console like the root password.

Practice

Lab 18.1Break and repair the bootHard · 45 minNot started

Practice

All commands in this chapter