Resetting a lost root password

A root password is never "recovered": it is not stored in clear text, not even by us. It is replaced. Every method below comes down to the same idea: temporarily obtain privileged access to the machine, then run passwd.

They are ordered from the simplest to the most technical. Try them in order.

How do I reset a lost root password from the client area?

This is the normal route, and it requires no prior access to the machine.

1. Open your service in the client area.
2. On the Access & Security tab, enter a new password and confirm.
3. Reboot the machine.

The reboot is not optional on a KVM VPS: the new password is written to the VM's initialisation configuration and is only read on the next boot. Without a reboot, nothing changes.

This method covers the vast majority of cases. Move to the next one only if the new password is still refused after a reboot, which happens on a machine whose initialisation configuration was disabled or removed after installation.

How do I reset the root password using GRUB and the rescue console?

The Console tab of your service opens the machine's screen, as if you were sitting in front of it with a keyboard. It is the only access that still works once SSH is out of the picture.

The principle: at boot time, ask the kernel to start a shell instead of the full system. You get root access without authentication, just long enough to change the password.

Step 1: bring up the GRUB menu

Open the Console, then reboot the machine from the client area and keep the console in view. Right at the start of the boot, hold Shift or press Esc repeatedly to make the GRUB menu appear.

This is the fiddly part: the window is short. Do not hesitate to try again.

Step 2: edit the boot line

In the menu:

1. select the usual Linux entry;
2. press e to edit it;
3. find the line starting with linux, linux16 or linuxefi;
4. at the end of that line, add:

rw init=/bin/bash

If the line already contains ro, replace it with rw.

Boot with Ctrl + X (or F10).

This edit is temporary: it is not saved and disappears on the next boot.

Step 3: make sure the root filesystem is writable

You now have a shell prompt. Check:

mount | grep " on / "

If you see ro, remount the root filesystem read-write:

mount -o remount,rw /

Without this step passwd will fail: the password file cannot be modified on a read-only system.

Step 4: change the password

passwd root

Type it, then confirm. On Ubuntu the root account is often locked by default: reset the password of your administrator user instead.

passwd username

Step 5: reboot cleanly

Since the system did not boot normally, the usual commands may not respond. Try first:

sync
exec /sbin/init

If the machine does not restart:

sync
reboot -f

The sync is not decorative: it forces changes still held in memory to be written to disk. Without it, the password change can be lost on reboot.

What is different on Rocky, AlmaLinux, Fedora or RHEL?

On these distributions the recommended method uses rd.break rather than init=/bin/bash. In GRUB, add at the end of the kernel line:

rd.break

Then, in the resulting shell:

mount -o remount,rw /sysroot
chroot /sysroot
passwd root
touch /.autorelabel
exit
reboot

The /.autorelabel file tells SELinux to recompute security labels on the next boot. Without it, the system may refuse logins despite a correct password. That boot will take longer than usual, which is expected.

What should I do if the reset fails?

First identify the exact symptom: each of the cases below has a precise cause and a known fix.

passwd: Authentication token manipulation error

The root filesystem is mounted read-only. Run again:

mount -o remount,rw /

The password is right but SSH refuses root

The password is not the problem: the SSH configuration forbids direct root login. Check from the console:

grep -E "^PermitRootLogin|^PasswordAuthentication" /etc/ssh/sshd_config

Log in with a sudo user instead. That is the configuration to prefer anyway.

The GRUB menu never appears

Some images boot too fast to give the keyboard a chance. In that case, open a ticket: we can act on the machine. Mounting an external rescue image is not available from the client area.

You would rather start over

If the machine holds no data yet, the Reinstall tab is faster and safer than any boot-time manipulation. It wipes the disk and reinstalls the system with a password of your choosing.

What should I check after regaining access?

Losing a password is a good moment to check that nobody else has been through.

find /root /home -name authorized_keys -type f -print
last -a

The first command lists authorised SSH keys: any key you do not recognise should be removed. The second shows recent logins.

Then update the system, and switch to SSH key authentication so you no longer depend on a password.