Howtos

Recover and Reset the Root Password on CentOS

Learn how to reset a forgotten CentOS root password with sudo or recover access through the GRUB console using chroot and a temporary shell.

Recovering the CentOS root password means assigning a new authentication secret to the root account. The safest method depends on what access remains available: use an authorized sudo-enabled account when possible, or use local, serial, or virtual-machine console access when no usable privileged account exists.

Use these procedures only on systems you are authorized to administer. Console-based recovery requires authorized physical console access, a serial console, or a virtual machine console.

What the Important Terms Mean

• root: The unrestricted administrative account on Linux.
• Root password: The password used to log in directly as root or switch to the root account.
• sudo: A mechanism that lets authorized users run commands with elevated privileges.
• wheel group: A conventional CentOS administrative group whose members are commonly allowed to use sudo.
• passwd: The command used to set or change account passwords.
• GRUB: The bootloader menu and boot-entry editor used to select and modify startup configurations.
• chroot: A command that changes the apparent root directory for a process.

Choose a Recovery Method

Method 1: Reset Root Password from a Wheel-Group Account

CentOS commonly grants administrative sudo privileges to members of the wheel group. Membership alone is not an absolute guarantee: the system's sudo policy must also authorize the account.

Run the Password Command

1. Log in as the authorized administrative user.
2. Run:

sudo passwd root

sudo normally asks for the current password of the non-root user who ran the command. It does not ask for the old root password.

3. Enter the administrative user's own password when prompted.
4. At the password prompt, enter the new root password.
5. Enter the same new password again for confirmation.

A successful operation reports that the authentication information was updated successfully, or displays equivalent success output from passwd. The root password has then been changed without rebooting the host.

Example Interaction

$ sudo passwd root
[sudo] password for admin: ********
New password: ********
Retype new password: ********
passwd: all authentication tokens updated successfully.

Use a password that complies with the host's password policy. Avoid placing the password in shell history, scripts, tickets, or chat messages.

Method 2: Recover the Root Password Through GRUB

Use this method when the root password is forgotten and no usable sudo-enabled account is available. It requires authorized access to the machine's startup console. Anyone with unrestricted console access and permission to edit GRUB entries may be able to reset local passwords, so this is also an important physical and infrastructure security consideration.

1. Restart and Reach the GRUB Menu

1. Restart the host using the approved operational procedure.
2. Open the physical, serial, or virtual-machine console.
3. During startup, press Esc early enough to display the GRUB menu. On some systems, the menu may already be visible.
4. Select the normal CentOS boot entry. Do not start it yet.
5. Press e to edit the selected GRUB boot entry.

If the menu flashes past too quickly, restart and begin pressing Esc earlier. A short boot-menu timeout, fast startup, or an inactive console connection can prevent the menu from being seen.

2. Edit the Kernel Command Line

In the GRUB editor, locate the line containing the kernel command. On applicable CentOS releases, this line commonly begins with linux16. The rest of the line is the kernel command line: startup parameters passed from GRUB to the Linux kernel.

On that kernel line:

1. Find the root-mount option ro, which initially mounts the root filesystem read-only.
2. Change ro to rw, which requests a read-write root mount.
3. Add init=/sysroot/bin/sh to start a temporary shell using the installed system mounted beneath /sysroot.

The exact surrounding parameters vary by CentOS release and installation. Change only the required options and preserve the rest of the entry.

3. Boot the Edited Entry

Press Ctrl+X to boot the edited configuration. This change applies to the current boot only; it does not permanently rewrite the normal GRUB entry.

The temporary environment is not the installed system as its active root. Instead, the installed operating system is mounted beneath /sysroot. Therefore, running passwd immediately may modify the temporary environment rather than the installed CentOS account database.

4. Enter the Installed System with chroot

At the recovery shell, change the apparent root directory to the installed system:

chroot /sysroot

After this command, commands such as passwd operate against the installed CentOS filesystem and its account configuration.

5. Set and Confirm the New Root Password

Run:

passwd

1. Enter the new root password when prompted.
2. Enter it again when asked to confirm it.
3. Check that passwd reports a successful authentication-token update.

If the root filesystem is still read-only, review the edited kernel command line and confirm that the intended rw option was used.

6. Force a Reboot

Leave the recovery shell and force a restart:

reboot -f

The host should return to its normal boot configuration. If the console remains at the temporary shell or the command does not restart the machine, use the authorized console or hypervisor controls to perform a forced restart according to local operating procedures.

7. Validate the New Credentials

After the system starts normally, test the replacement root password through an approved local or remote login path. Do not assume the recovery succeeded solely because passwd accepted the input.

Recovery Flow at a Glance

1. Access the authorized console.
2. Interrupt startup and edit the normal GRUB boot entry.
3. Change ro to rw.
4. Add init=/sysroot/bin/sh.
5. Boot the edited entry with Ctrl+X.
6. Run chroot /sysroot.
7. Run passwd and confirm the new password.
8. Run reboot -f.
9. Boot normally and validate root authentication.

Troubleshooting

sudo passwd root Fails

• The account may not be in wheel or otherwise authorized in sudoers.
• The administrative user may have entered an incorrect personal password.
• The sudo policy may block the command.

Use another authorized administrator account, or use console-based recovery if you are authorized to do so.

The GRUB Menu Does Not Appear

A short timeout, fast startup, or an inactive console can prevent interruption. Restart the host and use the correct physical, serial, or hypervisor console early in the boot process. Do not attempt this procedure through an ordinary SSH session after the operating system has stopped.

The Root Filesystem Cannot Be Modified

The entry may still be using ro, or the GRUB edit may not have been applied correctly. Recheck the kernel command line, replace the intended read-only option with rw, add init=/sysroot/bin/sh, and boot the edited entry again.

passwd Changed the Wrong Environment

Run chroot /sysroot before running passwd. Without the chroot, the temporary recovery environment may not be operating on the installed system's account database.

The New Password Is Rejected After Reboot

• The password may not have been entered identically at both prompts.
• passwd may have been run before entering chroot /sysroot.
• The host may not have been rebooted into its normal boot configuration.

Repeat the recovery carefully, verify the chroot step, and test the credentials only after a normal startup.

Post-Recovery Validation

1. Confirm that the host boots normally without the temporary init parameter.
2. Test the new root password through an approved local or remote authentication path.
3. Confirm that normal users can still authenticate.
4. Confirm that existing sudo access was not unintentionally changed.
5. Review relevant authentication and system logs according to operational policy.
6. Document the recovery action, operator, time, reason, and validation results according to your organization's procedures.

Security Considerations

GRUB editing is a local recovery capability, not an access-control boundary. Anyone who has unrestricted physical, serial, or virtual-machine console access and can edit a GRUB entry may be able to reset local passwords.

• Limit physical console and hypervisor-console access to authorized administrators.
• Protect server-management interfaces and audit their use.
• Consider GRUB bootloader authentication where appropriate for the threat model.
• Use disk encryption and other platform controls when protection against offline password-reset attacks is required.
• Use these procedures only on systems you are authorized to administer.

For related guidance, see Howtos and this root-password recovery guide.