If you have lost a Linux password and no longer have a working sudo account, use the least invasive recovery path that still applies to your server: another administrator’s account, the distribution’s boot-time recovery mode, or trusted live or installation media. These methods can grant a full root shell, so confirm that you are authorized to administer the machine and copy critical data before changing credentials.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The exact procedure depends on the distribution and release. Ubuntu, Debian, RHEL 7 and RHEL 9 use different recovery behavior, and encrypted storage, a locked-down bootloader or a cloud-only console can require provider-specific help.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteChoose the recovery path before changing anything
Start by identifying the operating system and release, then answer the questions in this table. The safest available option is normally the first one that matches.
| Situation | Use this path | Main requirement | Important limitation |
|---|---|---|---|
Another local administrator can still run sudo |
Reset the affected account from that session | A working sudo-capable account | It cannot help if every administrator account is inaccessible |
| Ubuntu can reboot and display GRUB | Ubuntu recovery mode and its root shell | Local or console access to the boot menu | The recovery filesystem may be read-only |
| The installed system will not provide a usable shell | Trusted live or installation media with chroot |
A bootable USB or other trusted medium | You must identify the correct installed partition and mount layout |
| RHEL 9 has no root login and no sudo-capable account | RHEL 9’s documented special boot mode | Access to edit the GRUB entry | The kernel-line edit is release-specific; use the RHEL 9 procedure rather than a RHEL 7 recipe |
| RHEL 7 cannot be administered normally | Installation-disk recovery or the documented rd.break method |
Console access and compatible RHEL 7 media or boot menu | Rescue, single-user and emergency modes do not behave identically |
| Debian’s root account is disabled | Recover the first user’s sudo authorization through recovery mode or live media | Boot or live-media access | Resetting a root password alone may not restore administration |
If the disk is encrypted, GRUB is password-protected, Secure Boot blocks the medium, or the server is reachable only through a cloud provider’s console, stop before experimenting. Use the provider’s documented rescue workflow or an authorized on-site procedure; there is no single command that covers those configurations.
#1 Best Overall
- Portable Kali Linux: Carry the power of Kali Linux on a bootable USB drive for seamless cybersecurity.
- Live Environment: Pre-configured to boot directly into a 'Live' Kali Linux environment without installation, enabling instant access.
- Versatile Compatibility: Designed to work with most modern computers and laptops, providing a flexible platform for various tasks.
- Secure and Encrypted: Kali Linux offers robust security features, encryption tools, and a vast array of penetration testing utilities.
- Current Version: Kali 2026.2 uses kernel 6.19 and includes GNOME 50 and KDE Plasma 6.6 updates. We will update with newer stable versions of Kali as they are released.
Before you reset a password
- Confirm that you own the server or have explicit authorization to administer it. Boot-loader and live-media methods intentionally bypass normal login controls.
- Record the distribution and release. Commands and mount behavior documented for Ubuntu, Debian, RHEL 7 and RHEL 9 are not interchangeable.
- If the machine is unstable, copy critical files while you still have access. Older Red Hat documentation describes rescue mode as useful for accessing files even when the installed system cannot fully boot.
- Have a way to verify the result after reboot: a console, a known network path, or a second administrator account.
Ubuntu’s recovery guidance warns that a root shell can damage the system if used carelessly. Work only on the intended installation and avoid deleting or replacing authentication files unless the distribution documentation specifically directs it.
Path 1: use another account that still has sudo
This is the preferred route because it leaves the bootloader and filesystem layout untouched.
Reset a normal user’s password
- Log in as the working administrator.
- Reset the affected account, replacing
USERwith the actual login name:
sudo passwd USER- Enter the new password twice when prompted.
- Test a fresh login or switch to the account in a separate session before closing the working administrator’s session.
Reset the root password on RHEL 9
Red Hat Enterprise Linux 9 documents that a non-root user in the wheel group can reset root with:
sudo passwd rootAfterward, check that the administrator is still in the intended group and that sudo policy has not been altered. A successful password change does not prove that the account has a valid shell or that sudo authorization is intact.
Check authorization without weakening policy
Use the account’s existing group membership and the distribution’s normal sudo checks. Do not make broad, temporary edits to /etc/sudoers just to get past a single forgotten password. If you do need to repair sudo policy from a root shell, validate its syntax with the distribution’s supported checker before rebooting and keep a second console session open until the new policy is confirmed.
Path 2: Ubuntu recovery mode
Ubuntu’s current recovery guidance lists recovery mode when neither the root account nor another local administrator can log in.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #2
- LINUX MINT 22.3 MEDIA - 16GB bootable USB with Linux Mint Cinnamon 22.3 for compatible x86-64 PCs.
- LIVE OR INSTALL - On supported hardware, start the Linux Mint live environment to evaluate it or launch the installer.
- PLATFORM BOUNDARY - Not designed to boot Apple Silicon or other ARM-based computers. Confirm CPU architecture and USB-boot support before purchase.
- BOOT SETTINGS VARY - Boot-menu keys and UEFI settings differ by manufacturer; consult the computer maker's instructions if the USB is not listed.
- BACK UP BEFORE INSTALLING - Disk-partition and installation choices can erase files or operating systems. Disconnect nonessential drives and preserve the USB until it is no longer needed for installation or recovery.
Open the recovery shell
- Reboot the server and use the platform’s documented method to display GRUB. On many systems, holding the right Shift key during startup exposes the menu; firmware and virtual consoles can use a different key or timing.
- Choose Advanced options for Ubuntu.
- Select the kernel entry marked recovery mode. If several kernels are listed, select the one that normally boots the installed system.
- Choose drop to root shell prompt.
Remount the installed root filesystem read-write
Recovery environments commonly mount the root filesystem read-only. A password change can appear to succeed while failing to write to disk if you skip this step. At the recovery root prompt, Ubuntu Community Help documents:
mount -rw -o remount /Wait for the command to return, then run the smallest required repair, such as:
passwd USERUse passwd root only when you specifically need to restore a root password. If the real problem is a missing sudo authorization, repair the affected user’s membership or policy instead of assuming root login is enabled.
Finish and verify
- Exit the shell using the menu’s continue or reboot option, or the shell command appropriate to the recovery environment.
- Allow the machine to boot normally.
- Test a new login with the repaired account.
- If sudo was repaired, run a harmless command through sudo and confirm that the expected privileges, shell and home directory are present.
Do not leave an experimental kernel-line edit in a persistent GRUB configuration. The recovery edit should apply only to that boot.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Path 3: recover with trusted live or installation media
Use this path when the installed system cannot reach a usable recovery shell. A writable USB flash drive is the usual physical medium for creating trusted Linux live media. Boot only media you obtained and verified through an authorized source.
Mount the installed system
- Boot the live or installation environment.
- Identify the partition that contains the installed Linux root filesystem. Device names vary with hardware, storage controllers and virtualization; never assume that the installation is
/dev/sda1. - Mount that partition at
/mnt, adapting the device name and mount options to the actual layout:
mount /dev/DEVICE /mntIf the installation uses separate boot, home or other filesystems, mount them at their corresponding locations beneath /mnt before entering the installed system. Encrypted volumes must first be unlocked using the distribution and platform’s supported procedure.
Rank #3
- 1. 9-in-1 Linux:32GB Bootable Linux USB Flash Drive for Ubuntu 24.04 LTS, Linux Mint cinnamon 22, MX Linux xfce 23, Elementary OS 8.0, Linux Lite xfce 7.0, Manjaro kde 24(Replaced by Fedora Workstation 43), Peppermint Debian 32bit (being replaced by MX Linux 32bit) for older PC, Pop OS 22, Zorin OS core xfce 17. The versions you received might be latest than above as we update them to latest/LTS when we think necessary.
- 2. Try or install:Before installing on your PC, you can try them one by one without touching your hard disks.
- 3. Easy to use: These distros are easy to use and built with beginners in mind. Most of them Come with a wide range of pre-bundled software that includes office productivity suite, Web browser, instant messaging, image editing, multimedia, and email. Ensure transition to Linux World without regrets for Windows users.
- 4. Support: Printed user guide on how to boot up and try or install Linux; please contact us for help if you have an issue. Please press "Enter" a couple of times if you see a black screen after selecting a Linux.
- 5. Compatibility: Except for MACs,Chromebooks and ARM-based devices, works with any brand's laptop and desktop PC, legacy BIOS or UEFI booting, Requires enabling USB boot in BIOS/UEFI configuration and disabling Secure Boot is necessary for UEFI boot mode. Packing: The bootable USB drive comes in a colored PET/CPP zipper bag with instructions on how to get started. The box pictured is not included.
Enter the installed environment
Ubuntu’s LiveCdRecovery documentation describes entering the mounted installation with:
chroot /mntInside the chroot, the commands operate on the installed system rather than the live environment. Change the required account password:
passwd USERWhen the root password itself is the issue, use passwd root only if that account is intended to be usable on the installation. Debian installations often disable root by default and give administrative rights to the first user through sudo, so restoring that user’s password or sudo authorization may be the correct repair.
Leave cleanly and reboot
- Exit the chroot.
- Unmount the installed filesystems in the reverse order in which you mounted them.
- Reboot from the installed disk and remove the live medium when the firmware requests it.
- Log in normally and verify the repaired account, shell, groups and sudo behavior.
Mount-point and device mistakes are the most common live-media failures. If a password change does not survive reboot, return to the live environment, verify that you mounted the actual root filesystem read-write, and check that the command ran inside chroot /mnt rather than only in the temporary live system.
RHEL 9: use the documented special boot mode
RHEL 9’s documented procedure applies when root login is unavailable and no non-root account can run sudo. It uses GRUB and the early boot environment so that the installed system can be repaired before normal userspace starts.
- Reboot and interrupt GRUB.
- Press
eto edit the selected boot entry. - Apply the kernel-command-line change specified by the RHEL 9 recovery procedure. Do not substitute the RHEL 7
rd.breakrecipe unless the release documentation explicitly calls for it. - Boot the edited entry with the key sequence shown by GRUB, commonly
Ctrl+XorF10. - Follow the RHEL 9 procedure to remount the installed root filesystem writable, set the new password and hand control from initramfs back to the installed system.
- Reboot normally and test the new root password or repaired administrator account.
The crucial distinction is release matching: RHEL 9’s special-mode instructions and RHEL 7’s early-break instructions are separate procedures. A kernel argument that works on one release can leave the other at an unusable prompt or fail to relabel the filesystem correctly.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- 3-in-1: 16GB Multiboot USB flash drive for Ubuntu 24.04 LTS 64bit & 22.04 LTS 64bit, Lubuntu 18.04 LTS 32bit. All are LTS versions, namely, Long Terrm Support Version. The versions you received might be latest than above as we update them when we think necessary.
- Compatibility: Compatible with any brand's PC, works with both legacy BIOS and UEFI booting mode, except for Apple computers, Chromebooks and ARM-based devices.
- Popularity：Most popular linux distributions and all come with common software includes office software, web browser, image editing, multimedia, and email except Lubuntu which is desgined to targted for very old PC.
- Support: Print user guide and support available. please contact us for help if you have an issue.
- Live USB or install: You can either try on USB or install on hard drive.
RHEL 7: installation media or rd.break
RHEL 7 documentation describes two approaches: booting from installation media, or stopping the boot sequence with rd.break before initramfs hands control to systemd.
Installation-disk recovery
Boot the matching RHEL 7 installation disk, choose its rescue option, locate and mount the installed system, then use the documented rescue sequence to reset the password. Confirm which directory represents the installed root before running passwd; a command executed only in the temporary rescue environment will not repair the disk installation.
The rd.break method
- At the RHEL 7 GRUB entry, press
e. - Append
rd.breakto the kernel line as described by the RHEL 7 procedure. - Boot the edited entry.
- Use the documented early-boot steps to make the installed root filesystem writable, enter the installed root, reset the password and complete any required relabeling before reboot.
RHEL 7 guidance specifically warns that rescue, single-user and emergency behavior differs from older GRUB releases. Follow the procedure for the exact release and boot layout rather than combining commands from several guides.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Older Red Hat rescue, single-user and emergency modes
Older Red Hat documentation separates three modes that are often incorrectly treated as synonyms:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Rescue mode is intended to provide file access when the installed system cannot fully boot. It is useful for copying data and repairing an installation from a controlled environment.
- Single-user mode provides a limited administrative environment suitable for a password reset when the bootloader and release support it.
- Emergency mode is more minimal and mounts the root filesystem read-only. You must make it writable before changing credentials.
The older Red Hat guidance states that you can reset the root password by booting into rescue or single-user mode and using passwd. Treat that as a release-specific instruction: verify how the mode mounts the filesystem and whether required services or storage volumes are available.
Debian: losing sudo may be the real problem
Debian’s default account model can disable the root account and grant administrative access to the first user through sudo. In that configuration, there may be no usable root password to recover.
Best Value
- Dual USB-A & USB-C Bootable Drive – works with almost any laptop or desktop (UEFI & Legacy BIOS). Boot Tails directly from the USB for secure, private sessions on any computer.
- Customizable Outside Tails – you may Add / Replace / Upgrade any other compatible bootable ISO app, installer, or utility on the USB without modifying Tails itself. You can also update Tails at any time by adding the latest Tails ISO.
- Designed for Privacy & Anonymity – Tails routes all internet traffic through Tor for maximum online privacy and protection against tracking or surveillance. Leave No Trace – your sessions run entirely from the USB and don’t touch the host system. When you shut down, no activity or data remains on the computer.
- Bypass Censorship & Access the Web Freely – browse and communicate securely from anywhere with built-in encryption and privacy tools. No Installation Required – run Tails LIVE directly from the USB. Perfect for journalists, researchers, or anyone who values freedom and security online.
- Premium Hardware & Reliable Support – built with high-quality flash chips for speed and longevity. TECH STORE ON provides responsive customer support within 24 hours.
If the first user’s password is lost, reset that user through recovery mode or a live-media chroot. If the user still authenticates but no longer has sudo authorization, restore the intended group membership or sudo policy from a root shell, then validate the policy before rebooting. Creating an unrelated root password can leave the original administrative path broken and may conflict with the installation’s security model.
Verify the repair after a normal reboot
A password reset is only one part of recovery. Once the server boots normally, check each item below in a fresh session:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- The repaired username is correct and its login shell is valid.
- The account can authenticate locally or through the intended remote service.
- The account has the expected group membership, including the distribution’s administrator group where applicable.
sudopolicy parses successfully and grants only the required commands.- The root filesystem and any separate filesystems mounted during recovery are present and writable as expected.
- No temporary GRUB argument remains in persistent boot configuration.
- A second administrator can still log in, giving you a fallback before you close the recovery session.
If the password works locally but remote login fails, treat that as a separate service, account-shell or policy problem. Do not repeatedly reset the password without checking the login path and authorization rules.
Troubleshooting common failure points
The password change says it worked, but the old password still works
You may have changed the live environment rather than the installed system, or the installed root filesystem may still have been read-only. Re-enter the correct chroot or recovery shell, remount the installed root read-write, and repeat the command against the intended account.
The recovery shell cannot write files
Read-only mounting is expected in several recovery modes. Use the distribution’s documented remount command; Ubuntu’s recovery procedure uses mount -rw -o remount /. If storage errors prevent a writable mount, copy important data first and repair the filesystem using the release-appropriate tools.
There is no root password to reset
This is common on Debian-style installations where root is disabled. Recover the first user’s password or sudo authorization instead.
The server never shows GRUB
Firmware settings, a protected bootloader, a remote virtual console or a cloud provider may hide or restrict the menu. Do not guess at repeated key presses on a production server; use the provider’s documented console or rescue image process.
The disk is encrypted
You must unlock the volume before the installed root filesystem can be mounted or chrooted. If you do not have the unlock credential or the platform requires a hardware-backed key, stop and involve the authorized storage or infrastructure administrator.
Quick Recap
Prevent a second lockout
- Maintain at least two authorized administrator accounts and test both before an emergency.
- Store recovery credentials and encryption keys in an approved, access-controlled system.
- Document the distribution, release, console method, storage layout and provider rescue procedure for each server.
- Keep trusted installation or live media available for systems where physical or virtual-console access is possible.
- After policy changes, test a fresh sudo session instead of relying on an already-open shell.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
