LFCS 72 🐧 Root Password Reset - KandZ

⏱️ Estimated read: 11 min | |

The root password reset is the most common boot recovery procedure and the one most likely to appear on the LFCS exam as a practical task. The procedure has three stages: interrupt the boot to reach a shell that runs before authentication, remount the filesystem so it can be written, and change the password. The complication is that the correct parameter depends on the distribution and on whether SELinux is enforcing. A procedure that works on Debian can leave a RHEL system unable to log in, because the SELinux context of /etc/shadow was not updated when the file was modified .

This chapter covers both routes in detail: the init=/bin/bash route for systems where the root password is lost, and the rd.break route for RHEL-family systems that use an initramfs. It examines the remount requirement, the SELinux relabel trigger, and the verification steps that confirm the reset actually worked before the system is returned to normal operation.

Key point: Resetting the password is not complete when passwd reports success. On SELinux-enforcing systems, the reset is not usable until the file context is restored. The touch /.autorelabel step is what makes the difference between a password that works and a login that rejects it.

Why the reset procedure differs by distribution

The initramfs problem. RHEL-family systems boot through an initramfs that mounts the real root filesystem at /sysroot before switching to it. The rd.break parameter interrupts the boot inside the initramfs, before the switch, which means the real root is mounted read-only at /sysroot and the password change must be performed against that path . The init=/bin/bash parameter bypasses the initramfs switch entirely and runs Bash as PID 1 with the real root as /, which is the Debian and Ubuntu approach .

The SELinux problem. RHEL-family systems enable SELinux by default. Changing /etc/shadow through a shell that is not running under the normal SELinux policy leaves the file with an incorrect context. The login process reads the file under the enforcing policy, and the context mismatch causes the login to fail even though the password hash was updated correctly. The /.autorelabel trigger forces SELinux to relabel the filesystem on the next boot, which restores the correct context .

The read-only mount problem. Both routes start with the root filesystem read-only. The kernel mounts it that way as a safety measure during recovery. The passwd command writes to /etc/shadow, which fails on a read-only filesystem. The remount to read-write is the step that makes the reset possible, and it must be performed before passwd runs.

a. The init=/bin/bash Route

This route is used on Debian, Ubuntu, and other distributions that do not require the rd.break initramfs interruption. The kernel parameter replaces the init process with Bash, so the system boots directly to a root shell with no authentication prompt.

# At the GRUB menu, press e to edit the selected entry
# Locate the line beginning with "linux"
# Replace "ro" with "rw" and append the init parameter
rw init=/bin/bash

# Press Ctrl+X or F10 to boot

The ro to rw replacement is not optional. If the line remains ro, the filesystem is mounted read-only, and passwd fails with a read-only filesystem error. The error message is sometimes unclear, so the mount options should be verified before attempting the password change .

# Verify the root filesystem is writable
mount | grep " / "

# If it shows "ro", remount it
mount -o remount,rw /

# Reset the root password
passwd root

# Verify the password was set
# (the hash in /etc/shadow should have changed)

After the password is set, the system can be returned to normal operation. The exec /sbin/init command replaces the Bash process with systemd and continues the boot without a reboot. A full reboot also works but takes longer.

b. The rd.break Route (RHEL-Family)

RHEL, CentOS, Fedora, and Rocky Linux use an initramfs that mounts the real root at /sysroot. The rd.break parameter stops the boot inside the initramfs, before the switch to the real root. The password change must be performed against /sysroot/etc/shadow, not /etc/shadow, because the real root is not yet the active root filesystem .

# At the GRUB menu, press e to edit the selected entry
# Append the rd.break parameter to the linux line
rd.break

# Press Ctrl+X or F10 to boot
# The system stops at a switch_root prompt

Once at the prompt, the procedure has four steps: remount /sysroot read-write, change the root directory to /sysroot, run passwd, and create the SELinux relabel trigger.

# Remount /sysroot read-write
mount -o remount,rw /sysroot

# Change the root directory to the real root
chroot /sysroot

# Reset the root password
passwd root

# Create the SELinux relabel trigger
touch /.autorelabel

# Exit the chroot
exit

# Exit the initramfs shell; the boot continues
exit

The touch /.autorelabel is mandatory on SELinux-enforcing systems. Without it, the next boot attempts to log in with the new password and fails because the SELinux context of /etc/shadow was not updated. The relabel runs on the next boot and can take several minutes on a large filesystem .

An alternative to the relabel is to disable SELinux temporarily with setenforce 0 before the password change and re-enable it afterward. However, this changes the enforcement state for the running system and does not fix the file context. The /.autorelabel trigger is the reliable fix.

c. Verification and Common Failures

After the password is reset and the system reboots, the verification is straightforward: log in with the new password. If the login succeeds, the reset is complete. If the login fails, the failure mode indicates which step was skipped.

# After reboot, log in as root with the new password
# If the login succeeds, the procedure is complete

# If the login fails, check which step was missed

The three common failure modes correspond to the three steps that are easy to skip. A login that fails with a password error on a non-SELinux system usually means the filesystem was read-only and passwd did not actually write the new hash. A login that fails with a password error on a SELinux system usually means the relabel trigger was not created. A login that succeeds but the system behaves strangely usually means the exec /sbin/init was not run or the system was rebooted before the relabel completed.

Complete Example Session

# ============================================
# PART 1: ACCESS THE CONSOLE
# ============================================
# Single-user recovery requires console access
# Cloud: VNC or serial console
# Physical: keyboard and monitor
# SSH is not available during recovery


# ============================================
# PART 2: INTERRUPT GRUB
# ============================================
# Reboot
# BIOS: hold Shift during firmware screen
# UEFI: tap Esc repeatedly
# At GRUB menu: press e to edit


# ============================================
# PART 3A: INIT=/BIN/BASH ROUTE (DEBIAN/UBUNTU)
# ============================================
# Change "ro" to "rw"
# Append: init=/bin/bash
# Press Ctrl+X or F10


# ============================================
# PART 3B: RD.BREAK ROUTE (RHEL-FAMILY)
# ============================================
# Append: rd.break
# Press Ctrl+X or F10
# System stops at switch_root prompt


# ============================================
# PART 4: REMOUNT AND RESET
# ============================================
# init=/bin/bash route:
mount -o remount,rw /
passwd root

# rd.break route:
mount -o remount,rw /sysroot
chroot /sysroot
passwd root


# ============================================
# PART 5: SELINUX RELABEL (RHEL-FAMILY)
# ============================================
touch /.autorelabel
# Without this, login rejects the new password


# ============================================
# PART 6: EXIT RECOVERY
# ============================================
# init=/bin/bash route:
exec /sbin/init

# rd.break route:
exit  # exit chroot
exit  # exit initramfs shell


# ============================================
# PART 7: WAIT FOR RELABEL
# ============================================
# On the next boot, SELinux relabels the filesystem
# This can take several minutes
# The system reboots automatically after relabeling


# ============================================
# PART 8: VERIFY THE RESET
# ============================================
# Log in as root with the new password
# If login fails, check which step was skipped


# ============================================
# PART 9: TROUBLESHOOT FAILURES
# ============================================
# Read-only error during passwd: remount not done
# Login rejects password on RHEL: relabel not triggered
# System hangs after recovery: relabel in progress


# ============================================
# PART 10: CLEAN UP
# ============================================
# Remove the relabel trigger after it runs
# (it is removed automatically by the relabel process)
# Verify normal boot and login

The ten parts trace both routes and the verification. The critical distinction is in Parts 3A and 3B: the init=/bin/bash route for Debian-family systems, and the rd.break route with chroot /sysroot for RHEL-family systems.

Quick Reference

Route Comparison

Aspect	init=/bin/bash	rd.break
Distributions	Debian, Ubuntu, Arch	RHEL, CentOS, Fedora
Boot stage	Before initramfs switch	Inside initramfs
Root filesystem	`/`	`/sysroot`
Remount command	`mount -o remount,rw /`	`mount -o remount,rw /sysroot`
chroot required	No	Yes (`chroot /sysroot`)
SELinux relabel	If SELinux enabled	Mandatory on RHEL

Required Steps

Step	init=/bin/bash	rd.break
1	`mount -o remount,rw /`	`mount -o remount,rw /sysroot`
2	`passwd root`	`chroot /sysroot`
3	`touch /.autorelabel` (if SELinux)	`passwd root`
4	`exec /sbin/init`	`touch /.autorelabel`
5	—	`exit` twice

Failure Diagnosis

Symptom	Cause	Fix
`passwd` fails with read-only	Filesystem not remounted	Remount rw
Login rejects new password (RHEL)	SELinux context mismatch	`touch /.autorelabel`
System hangs after recovery	Relabel in progress	Wait several minutes
`passwd` works but login fails	Wrong route for distribution	Use `rd.break` on RHEL

Best Practices

✅ Do This:

# Verify the filesystem is writable before passwd
mount | grep " / "                                                     # ✅

# Use chroot /sysroot on RHEL-family systems
chroot /sysroot                                                        # ✅

# Create the SELinux relabel trigger on RHEL
touch /.autorelabel                                                    # ✅

# Wait for the relabel to complete before logging in
# Relabel can take several minutes                                       # ✅

❌ Don’t Do This:

# Run passwd without remounting
passwd root  # fails: read-only filesystem                              # ❌

# Skip the relabel on SELinux systems
# Login rejects the new password                                        # ❌

# Use init=/bin/bash on RHEL without chroot
# The real root is at /sysroot, not /                                    # ❌

# Attempt the procedure over SSH
# Networking is not available in recovery mode                           # ❌

Real-World Examples

1. Debian/Ubuntu Route

rw init=/bin/bash

2. RHEL-Family Route

rd.break

3. Remount for init=/bin/bash

mount -o remount,rw /

4. Remount and chroot for rd.break

mount -o remount,rw /sysroot
chroot /sysroot

5. Reset Password

passwd root

6. SELinux Relabel Trigger

touch /.autorelabel

7. Exit init=/bin/bash

exec /sbin/init

8. Exit rd.break

exit
exit

9. Verify Writable Filesystem

mount | grep " / "

10. Wait for Relabel

Relabel runs on next boot, takes several minutes

Visual

The Two Routes

┌──────────────────────────────────────────────────────────────┐
│  DISTRIBUTION?                                               │
│                                                              │
│  ┌─────────────────┐        ┌─────────────────┐             │
│  │ Debian/Ubuntu   │        │ RHEL/CentOS     │             │
│  │                 │        │ Fedora/Rocky    │             │
│  └────────┬────────┘        └────────┬────────┘             │
│           │                          │                       │
│           ▼                          ▼                       │
│  ┌─────────────────┐        ┌─────────────────┐             │
│  │ rw init=/bin/   │        │ rd.break        │             │
│  │ bash            │        │                 │             │
│  └────────┬────────┘        └────────┬────────┘             │
│           │                          │                       │
│           ▼                          ▼                       │
│  ┌─────────────────┐        ┌─────────────────┐             │
│  │ Root = /        │        │ Root = /sysroot │             │
│  │ passwd root     │        │ chroot /sysroot │             │
│  │                 │        │ passwd root     │             │
│  └────────┬────────┘        └────────┬────────┘             │
│           │                          │                       │
│           ▼                          ▼                       │
│  ┌─────────────────┐        ┌─────────────────┐             │
│  │ SELinux:        │        │ SELinux:        │             │
│  │ touch           │        │ touch           │             │
│  │ /.autorelabel   │        │ /.autorelabel   │             │
│  └────────┬────────┘        └────────┬────────┘             │
│           │                          │                       │
│           ▼                          ▼                       │
│  ┌─────────────────┐        ┌─────────────────┐             │
│  │ exec /sbin/init │        │ exit; exit      │             │
│  └─────────────────┘        └─────────────────┘             │
│                                                              │
│  The route is determined by the distribution's boot process. │
│                                                              │
└──────────────────────────────────────────────────────────────┘

SELinux Relabel Timeline

┌──────────────────────────────────────────────────────────────┐
│  PASSWORD CHANGED                                            │
│         │                                                    │
│         ▼                                                    │
│  ┌─────────────────┐                                        │
│  │ touch           │  Trigger created                        │
│  │ /.autorelabel   │                                        │
│  └────────┬────────┘                                        │
│           ▼                                                  │
│  ┌─────────────────┐                                        │
│  │ Reboot          │  System boots normally                 │
│  └────────┬────────┘                                        │
│           ▼                                                  │
│  ┌─────────────────┐                                        │
│  │ SELinux detects │  Relabels filesystem                   │
│  │ trigger         │  (several minutes)                     │
│  └────────┬────────┘                                        │
│           ▼                                                  │
│  ┌─────────────────┐                                        │
│  │ Automatic       │                                        │
│  │ reboot          │                                        │
│  └────────┬────────┘                                        │
│           ▼                                                  │
│  ┌─────────────────┐                                        │
│  │ Login with new  │  Context is correct; login succeeds    │
│  │ password        │                                        │
│  └─────────────────┘                                        │
│                                                              │
│  Without the trigger, login rejects the new password.        │
│                                                              │
└──────────────────────────────────────────────────────────────┘

Failure Decision Tree

┌──────────────────────────────────────────────────────────────┐
│  LOGIN FAILS AFTER RESET                                     │
│                                                              │
│  ┌─────────────────┐                                        │
│  │ Read-only error │────► Remount was skipped               │
│  │ during passwd?  │      mount -o remount,rw               │
│  └────────┬────────┘                                        │
│           │ NO                                               │
│           ▼                                                  │
│  ┌─────────────────┐                                        │
│  │ RHEL-family?    │────► Was relabel triggered?            │
│  │                 │      NO → touch /.autorelabel           │
│  └────────┬────────┘                                        │
│           │ NO                                               │
│           ▼                                                  │
│  ┌─────────────────┐                                        │
│  │ Used rd.break   │────► Did chroot /sysroot happen?        │
│  │ on RHEL?        │      NO → redo with chroot              │
│  └─────────────────┘                                        │
│                                                              │
│  Each failure maps to a specific skipped step.               │
│                                                              │
└──────────────────────────────────────────────────────────────┘

Recovery Flow Summary

┌──────────────────────────────────────────────────────────────┐
│  GRUB EDIT                                                   │
│  ┌─────────────────┐                                        │
│  │ Debian: rw init │                                        │
│  │ =/bin/bash      │                                        │
│  │ RHEL: rd.break  │                                        │
│  └────────┬────────┘                                        │
│           ▼                                                  │
│  REMOUNT READ-WRITE                                          │
│  ┌─────────────────┐                                        │
│  │ mount -o remount│                                        │
│  └────────┬────────┘                                        │
│           ▼                                                  │
│  RESET PASSWORD                                              │
│  ┌─────────────────┐                                        │
│  │ passwd root     │                                        │
│  └────────┬────────┘                                        │
│           ▼                                                  │
│  SELINUX RELABEL (RHEL)                                      │
│  ┌─────────────────┐                                        │
│  │ touch           │                                        │
│  │ /.autorelabel   │                                        │
│  └────────┬────────┘                                        │
│           ▼                                                  │
│  CONTINUE BOOT                                               │
│  ┌─────────────────┐                                        │
│  │ exec /sbin/init │                                        │
│  │ or exit twice   │                                        │
│  └────────┬────────┘                                        │
│           ▼                                                  │
│  VERIFY LOGIN                                                │
│  ┌─────────────────┐                                        │
│  │ Log in as root  │                                        │
│  └─────────────────┘                                        │
│                                                              │
└──────────────────────────────────────────────────────────────┘

Summary

Item	Value
Debian/Ubuntu parameter	`rw init=/bin/bash`
RHEL-family parameter	`rd.break`
Root filesystem (Debian)	`/`
Root filesystem (RHEL)	`/sysroot`
Remount command	`mount -o remount,rw`
chroot required	Yes on RHEL (`chroot /sysroot`)
SELinux relabel	`touch /.autorelabel`
Continue boot	`exec /sbin/init` (Debian)
Exit recovery (RHEL)	`exit` twice
Console access	Required

Key takeaways:

The route depends on the distribution. Debian and Ubuntu use init=/bin/bash, which runs Bash as PID 1 with the real root as /. RHEL-family systems use rd.break, which stops in the initramfs with the real root at /sysroot. Using the wrong route produces a passwd command that appears to work but writes to the wrong filesystem .
The filesystem must be remounted read-write. Recovery mode mounts root read-only as a safety measure. passwd writes to /etc/shadow, which fails on a read-only mount. The remount is mount -o remount,rw / on Debian and mount -o remount,rw /sysroot on RHEL .
SELinux relabeling is mandatory on RHEL-family systems. The password change modifies /etc/shadow. Without touch /.autorelabel, the file’s SELinux context is inconsistent with the enforcing policy, and the login prompt rejects the new password. The relabel runs on the next boot and takes several minutes .
chroot /sysroot is required on RHEL. The passwd command must operate on the real root filesystem, not the initramfs. Without the chroot, it modifies the initramfs environment, which is discarded when the boot continues .
The relabel is not a hang. A system that appears to be stuck after the reset is likely performing the SELinux relabel. The relabel completes and the system reboots automatically. Interrupting it leaves the filesystem in an inconsistent state.

Remember: The root password reset is a sequence of steps that must be performed in order and against the correct filesystem. The parameter selects the route. The remount makes the filesystem writable. The passwd command changes the hash. The relabel trigger ensures the change is accepted by SELinux. The exit command continues the boot. Each step has a specific failure mode when skipped, and the failure mode is usually a login that rejects a password that was set correctly. The exam tests the procedure, but the production skill is recognizing which step was missed when the login fails.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!