What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
There is no separate “sudo password” on a normal Linux installation. When sudo prompts, it normally validates the password of the user who typed the command, not the root account’s password. If another administrator can still use sudo, reset the affected account with sudo passwd username. If no administrator can log in, use the distribution’s recovery mode, a RHEL boot break, or trusted live-rescue media.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Choose the procedure that matches your distribution, console access and encryption layout. These methods require authorized console, bootloader or storage access; they are not remote workarounds for a server you do not administer.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →First identify which password was forgotten
Linux separates user authentication from privilege elevation. A sudo-enabled account normally enters its own login password when running an administrative command. Sudoers policy validates the invoking user’s credentials, not the target user’s or root’s credentials.
| Situation | What is actually being reset | Normal route |
|---|---|---|
| You forgot the password for your ordinary account, but another administrator works | That ordinary user’s password | Log in as the administrator and run sudo passwd username |
| You forgot the root password, and a sudo-capable account works | The root account’s password | Run sudo passwd root |
| No account can authenticate to sudo on Ubuntu, but you have local or provider console access | The selected local user’s password | Boot Ubuntu recovery mode and use a root shell |
| No sudo-capable account exists on RHEL 9 | Usually root’s password, or a named local user’s password | Use the GRUB rd.break procedure |
| The server has no usable local recovery entry | A local account in the installed system | Boot trusted live-rescue media, mount the installed root filesystem and chroot into it |
Changing a user password does not automatically grant that user administrative rights. Ubuntu normally uses the sudo group, while Red Hat Enterprise Linux normally uses the wheel group. Password recovery and authorization repair are separate tasks.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Check access and the target before changing anything
- Confirm authorization. Password recovery changes local credentials. Obtain the owner’s approval and follow your incident and change-control process.
- Identify the distribution and release. Recovery menus and initramfs behavior differ between Ubuntu, RHEL, Debian and provider images.
- Determine how you can reach the boot process. A physical keyboard, hypervisor console, serial console or cloud-provider rescue console may be required. A normal SSH session cannot open a recovery shell after every account has lost sudo access.
- Check encryption. Full-disk encryption must be unlocked before the installed root filesystem can be mounted or repaired. Keep the recovery key available.
- Confirm the exact username. On a local system, Ubuntu documents
/etc/passwdas the local account database. Do not guess between similarly named accounts. - Take an approved snapshot or backup first. A password reset should not alter user data, but booting recovery tools and mounting filesystems are privileged operations.
If the account comes from LDAP, Active Directory, Kerberos or another identity service, a local passwd command may not be authoritative. The procedures below apply to local accounts in the installed operating system.
Path 1: another sudo-capable account still works
This is the least disruptive method. It does not require a reboot, a GRUB edit or a rescue environment.
- Log in with the working administrator account.
- Confirm the target username from the server’s account records rather than relying on memory.
- Reset the forgotten user’s password:
sudo passwd usernameReplace username with the actual local account name. Sudo asks for the working administrator’s password first. The passwd program then asks for and confirms the new password for the target account.
To reset root’s password from a non-root administrator, use:
sudo passwd rootRed Hat documents this command for a non-root user in the administrative wheel group with sudo permission. The current wheel user’s password authenticates the sudo operation; the old root password is not needed.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Restore or remove administrative membership separately
If the user can log in after the reset but receives a “not in the sudoers file” or “user is not allowed” error, inspect the intended authorization rather than granting unrestricted access automatically. Ubuntu administrators commonly add an authorized account to sudo; RHEL administrators commonly use wheel. Use your organization’s approved group-management procedure and verify the result with a fresh login.
Free tools Windows power users keep installed
One-click scans. No signup required.
On Ubuntu, setting a root password is an explicit change to the normal security model. Ubuntu disables the administrative root account for direct password login by default and expects authorized users to elevate through sudo. If you intentionally enabled a root password and later want to lock it again, Ubuntu documents:
sudo passwd -l rootPath 2: Ubuntu recovery mode when no administrator can log in
Ubuntu’s recovery route is designed for a local console. A hosted virtual machine may hide GRUB, boot too quickly to display it, or provide a provider-specific console instead. Do not assume that an SSH-only cloud instance exposes the same menu as a physical Ubuntu server.
- Arrange an approved console session and reboot the server.
- When GRUB appears, select Advanced options for Ubuntu.
- Choose the appropriate Ubuntu kernel entry ending in (recovery mode). On systems with several kernels, select the one that normally boots the installed system unless your administrator has a documented reason to use another.
- In the recovery menu, select drop to root shell prompt.
- Check whether the installed root filesystem is mounted read-only. Recovery environments often do this deliberately. If it is read-only, remount it read-write:
mount -o remount,rw /The exact mount target can vary with the recovery environment. The important check is that the installed root filesystem, not a temporary rescue filesystem, is writable before changing a password.
- Reset the affected local user:
passwd usernameFor a forgotten ordinary login password, use that account’s name. If your documented goal is to set a root password, use passwd root; remember that enabling direct root authentication changes Ubuntu’s default model.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
- Exit the root shell and reboot from the recovery menu, or issue the recovery environment’s reboot command after the password change completes.
- Start a normal boot and test the account in a new console or SSH session.
If the recovery menu is absent, the server may be using a custom image, encrypted boot, a provider-managed bootloader or a serial-console configuration. Use the provider’s documented console or rescue workflow rather than repeatedly guessing GRUB keystrokes.
Path 3: RHEL 9 with no sudo-capable account
Red Hat Enterprise Linux 9 provides a special GRUB method for the case where root cannot log in and no non-root user has sudo permission. It interrupts the early boot process before the installed system is fully started.
- Open the server’s physical, virtual or serial console and reboot.
- At the GRUB menu, highlight the normal RHEL entry and press e to edit it.
- Find the line beginning with
linux. Appendrd.breakto that line, separated by a space. - Press Ctrl+x to boot with the temporary parameter.
- At the emergency prompt, remount the installed system’s root at
/sysrootas read-write:
mount -o remount,rw /sysroot- Change the apparent root directory to the installed system:
chroot /sysroot- Reset root’s password:
passwdTo reset a named local account instead, run passwd username while inside the chroot.
- Create the SELinux relabel marker:
touch /.autorelabelRed Hat requires this step so SELinux contexts are rebuilt for the changed system state. Omitting it can leave files with incorrect labels and prevent a normal boot or login.
- Leave the chroot and the emergency shell. At the first prompt, type
exit; when the switch-root or emergency prompt returns, typeexitagain as required by the boot environment. - Allow the server to reboot and wait for SELinux relabeling to finish. The first boot can take substantially longer than usual. Do not power-cycle the machine just because the console appears idle.
After boot, test the reset account and confirm that the intended administrative account belongs to wheel or has an approved rule in the sudo configuration. RHEL defines sudo authorization through /etc/sudoers and files under /etc/sudoers.d/.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Path 4: Debian or another distribution using trusted live-rescue media
Use this route when the installed system has no usable recovery entry, GRUB is inaccessible, or a provider supplies a rescue image instead. Debian Reference describes mounting the installed system under /mnt, entering a root shell or chroot, and performing repairs there.
- Boot a trusted live-rescue image through an approved physical, hypervisor or provider console.
- If the server uses full-disk encryption, unlock the volume with the authorized recovery key.
- Identify and mount the installed system’s root filesystem at
/mnt. Make sure you have selected the installed server’s root, not the live environment’s root. - Enter the installed system’s root context:
chroot /mnt- Set the local account’s password:
passwd usernameUse the actual account name. Running passwd before entering the chroot changes the live-rescue system’s account, not the installed server’s account.
- Exit the chroot, unmount the installed filesystems cleanly according to your rescue environment’s procedure, remove the rescue image and reboot from the installed disk.
- Open a fresh login session and verify the account.
The exact device name, encrypted-volume steps and mount layout depend on the server’s partitioning scheme. If the installed root filesystem uses separate boot, home or application volumes, mount them according to the distribution’s layout before relying on a chroot-based repair.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteRecovery-path comparison
| Path | Requires another working admin? | Requires console or boot access? | Important distribution constraint | Effect on root-account state |
|---|---|---|---|---|
| Another sudo-capable account | Yes | No reboot required; SSH is sufficient | Use the account and group policy of the distribution | Only changes root if you explicitly run sudo passwd root |
| Ubuntu recovery mode | No | Yes; GRUB or provider console | Root filesystem may initially be read-only | Resetting a named user does not enable root; passwd root intentionally sets a root password |
RHEL 9 rd.break |
No | Yes; GRUB edit access | Remount /sysroot and create /.autorelabel |
Normally resets root when passwd is run without a username |
| Live rescue and chroot | No | Yes; trusted media or rescue service | Correct root volume must be mounted, and encryption must be unlocked | Changes only the account named inside the installed system |
When a reset appears not to work
The filesystem is read-only
A failure such as “Authentication token manipulation error” commonly means the installed root filesystem is still read-only, the filesystem has errors, or the rescue environment mounted a different root. Verify the mount target and remount it read-write only after checking the filesystem’s condition. Do not edit /etc/shadow manually when passwd is available.
You changed the wrong account
Names can be similar, and a live system can contain accounts that do not exist in the installed image. Before running passwd, verify the username in the installed system’s account database. In a chroot, run the check after entering the chroot, not before.
The password works, but sudo still refuses the command
Password validity and sudo authorization are independent. Confirm that the account has the intended membership—sudo on Ubuntu or wheel on RHEL—or an explicit, approved rule in /etc/sudoers or /etc/sudoers.d/. Avoid giving full administrative rights merely to make a test pass.
SSH still rejects the account
SSH may be configured for keys only, may disable password authentication, or may prohibit direct root login. A successful local password reset does not override those SSH policies. Test the account through the authentication method the server is intended to use.
RHEL takes a long time to boot after recovery
SELinux relabeling after creation of /.autorelabel can make the first reboot slow. Keep the console open and wait for it to complete before declaring the repair unsuccessful.
GRUB or the recovery shell is unavailable
Hosted servers often conceal the bootloader, require a special key sequence, or expose only a provider rescue workflow. Ask the hosting administrator for an approved console or attach the provider’s rescue environment. If full-disk encryption prompts before the rescue system can mount the disk, the encryption key is indispensable.
Verify the result safely
- Start a completely new login session rather than relying on an existing shell whose credentials or sudo timestamp may still be cached.
- Log in as the affected user with the new password through the server’s normal access method.
- Where that user is supposed to administer the machine, run a harmless identity check:
sudo whoamiThe expected output is root. Do not use a destructive command as a test.
- Confirm the intended group membership and sudo policy. On RHEL, inspect the relevant entries in
/etc/sudoersand/etc/sudoers.d/without making unreviewed edits. - On RHEL, wait for the SELinux relabeling boot to finish and review the console for errors.
- Record the change, the approving administrator, the recovery path and any unusual boot or console access in the server’s operational log. If the reset followed signs of compromise, preserve relevant authentication and console records before rotating other credentials.
Security and prevention
Anyone who can alter a server’s boot parameters, attach its disk to another machine or open a live-rescue console may be able to change local credentials. Protect physical access, hypervisor consoles, provider consoles and GRUB with the controls appropriate to the environment.
Quick Recap
- Keep at least one separately managed, tested break-glass administrator account, with access governed by your organization’s approval process.
- Store recovery credentials in an approved password manager and test the recovery key for encrypted servers before an outage.
- Document the distribution, release, console method, disk layout and recovery procedure for each critical server.
- Prefer named sudo administration over routine direct root login. On Ubuntu, leave the root account locked unless there is a documented reason to enable it.
- Do not permanently add broad sudo rights just because a password was forgotten. Restore only the membership or rule the account actually needs.
- After a suspected compromise, treat the password reset as containment, not a complete recovery. Review keys, tokens, service credentials and authorization logs as required by your incident plan.
Command reference
| Purpose | Command | Where it applies |
|---|---|---|
| Reset a named local user from a working sudo account | sudo passwd username |
Any distribution with a working sudo policy |
| Reset root from a working sudo account | sudo passwd root |
Ubuntu, RHEL and other sudo-configured systems |
| Lock Ubuntu’s root password again | sudo passwd -l root |
Ubuntu, after an intentional root-password change |
| Remount Ubuntu recovery root read-write | mount -o remount,rw / |
Ubuntu recovery shell when the root filesystem is read-only |
| Enter the installed RHEL system | mount -o remount,rw /sysrootchroot /sysroot |
RHEL 9 after booting with rd.break |
| Mark RHEL for SELinux relabeling | touch /.autorelabel |
Inside the RHEL chroot before reboot |
Enter an installed system mounted at /mnt |
chroot /mnt |
Debian or another live-rescue workflow |
| Test sudo after starting a fresh session | sudo whoami |
Any system where the account should have sudo access |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
