Wednesday, October 29, 2008

How to Reset forgotten Root passwords?

There are various methods available for resetting a root password.
  • Boot into single-user mode (easiest, least risky)
  • Boot using a boot disk and edit the password file
  • Mount the drive on another computer and edit the password file
I will also go over some steps to prevent some other person from doing this and hacking your machine.

Reseting passwords by booting into single-user mode

This is the easiest and the fastest method to reset passwords. The steps are a little different depending on if you are using GRUB or LILO as a bootmanager.

Booting into single-user mode from LILO

Follow these steps to reset the password when using LILO:
  • Reboot the system. When you see the LILO: prompt (see Fig. 1 below), type in linux single and press 'Enter'. This will log you in as root in single-user mode. If your system re quires you to enter your root password to log in, then try linux init=/bin/bash instead.
  • Once the system finishes booting, you will be logged in as root in single-user mode. Use passwd and choose a new password for root.
  • Type reboot to reboot the system and then you can login with the new password you just selected.


If you have a new version of LILO which gives you a menu selection of the various kernels available press Tab to get the LILO: prompt and then proceed as shown above.

Booting into single user mode from GRUB

Follow these steps to reset the password when using GRUB:

  • Reboot the system, and when you are at the selection prompt (See Fig. 2 below), highlight the line for Linux and press 'e'. You may only have 2 seconds to do this, so be quick.
  • This will take you to another screen where you should select the entry that begins with 'kernel' and press 'e' again.
  • Append ' single' to the end of that line (without the quotes). Make sure that there is a space between what's there and 'single'. If your system requires you to enter your root password to log into single-user mode, then append init=/bin/bash after 'single'. Hit 'Enter' to save the changes.
  • Press 'b' to boot into Single User Mode.
  • Once the system finishes booting, you will be logged in as root. Use passwd and choose a new password for root.
  • Type reboot to reboot the system, and you can login with the new password you just selected.



passwords by using a boot disk and editing the password file

This method is a little bit more complicated than the previous one and has a very high chance of success (assuming your filesystem is not encrypted and you didn't forget the password to decrypt it if it is). As before, get permission before you do this.

To start, you need a Linux boot disk or a rescue disk. (If you didn't create one when prompted during the installation then let this be a lesson for you.) You can use your installation CD as a rescue disk; most distros have an option to allow you to boot into rescue mode. With my Redhat Linux CD, I have to enter linux rescue to start the rescue mode. But this might be a bit different in each distro. You can also use a live linux CD like Knoppix or Gnoppix for system recovery. (Click here for a list of all the live Linux CD's). In this tutorial I will use Knoppix as my rescue CD but the process is almost the same for any rescue CD you might use.

[ You can also download one of the many single-floppy Linux distributions (e.g., Tom's RootBoot ), and use it to bring up the machine as described. This is, of course, much faster than downloading and burning a rescue CD, especially on a slow connection. -- Ben ]

Follow these steps to reset the password using Knoppix:

  • Reboot the system and configure it to boot from the Knoppix CD (instructions available here)
  • At the Knoppix Boot Prompt (See Fig. 3 below) enter: knoppix lang=us to start boot Knoppix using the english locale. If you understand German, feel free to just hit 'Enter' to boot into Knoppix.
  • Once the system finishes booting, press + + (The Control, Alt and F1 key together) to switch to a virtual terminal.
  • Type mkdir mountplace to create a directory called 'mountplace'. This is where we will mount the filesystem.
  • Type mount /dev/hdaX mountplace, where /dev/hdaX is your root partition. More information on Linux partitions is available here.
  • Change to the "/etc" directory on your root partition by typing cd mountplace/etc.
  • Use your favorite text editor and open the 'shadow' file for editing. I use 'vi', so I type vi shadow (If you have a really old system, you won't have a shadow file, in which case you need to edit the 'passwd' file.)
  • Scroll down to the line containing the root user's information, which looks something like:
    root:dsfDSDF!s:12581:0:99999:7:::
  • Delete everything between the first and second colons, so that the line looks like:
    root::12581:0:99999:7:::
  • Save the file and exit your editor.
  • Type cd to return to your home directory.
  • Type umount mountplace to unmount the partition.
  • Type reboot to reboot your system, and remove the Knoppix CD from the drive.
  • Now you can log into your system as root with no password. Make sure you change the password immediately.

Reseting passwords by mounting on another system and editing the password file

This option is a bit more work than any of the earlier options but is almost sure to work (except when the filesystem is encrypted).

Follow these steps to reset the password:

  • Shut down the machine after backing up all important data.
  • Open the casing, unplug the hard drive, and take it to another machine. (This system should be running Linux, since Windows can't read the Linux partition formats.)
  • Connect the hard disk as a slave drive and boot the new system.
  • Once the system finishes booting, mount the slave drive's root partition as shown above and edit the password file.

No comments: