« Ringing Up the Charges | Main | $20 toolkit simplifies web attacks »

What happens when you lose your Linux root password? Since root = god in Linux-land all is lost, right? Actually, no. You'll never recover a lost root password, but you can reset it.

First off, try booting into what's known as single-user mode. How you do so depends on your boot manager.

Grub
Select the Linux system you want to boot from the graphical menu and press e. You'll find yourself in a mini editor where you can alter boot commands.

Move the cursor to the end of the boot command line, add a space and then either a 1 or the word single. Then hit Enter and b to boot this line.

Lilo
Press any key but Enter at the boot menu. If that takes you to a command prompt, type linux single, hit Enter and let the system boot.

Once the system's running, you'll find yourself in runlevel 1 (aka. 'single-user mode'). From here it's just a matter of typing passwd to change the root password followed by exit to reboot into the usual runlevel.


But what if the boot process is protected from this sort of interference? Many modern Linuxes like Suse and Mandrake won't let you start runlevel 1 unless you first supply the root password. Oh, oh; Catch 22! You need the password you've forgotten in order to get into the system to reset the password. What now?

Boot the system in another version of Linux!

You'll need bootable Linux disk. Virtually everyone these days produces versions of Linux that boot and run from CD (they're typically called 'live' distributions) but my personal favourite it Tom's Root and Boot (tomsrtbt), a complete Linux system on a floppy disk.

Boot into your alternate Linux – either from CD or floppy. If you booted into a graphical system start a console session.

  • Make a temporary directory: mkdir /tmp/mylinux
  • Mount the root disk: mount /dev/hda5 /tmp/mylinux
  • Edit and save the shadow password table: vi tmp/mylinux/etc/shadow. (Check this link if you need help with the vi editor's confusing commands.)


The basic idea here is to remove root's encrypted password. Here's how it'll look in /etc/shadow...

root:$1$8cC5pHtr$rT.INHxDBWn1VvU5gjGzi/:12209:0:99999: ... bin:*:12187:0:99999:7::: 
daemon:*:12187:0:99999:7:::

You want to remove the highlighted bit so it looks like this...

root::12209:0:99999: ...
bin:*:12187:0:99999:7:::
daemon:*:12187:0:99999:7:::

Go back to where you were: cd /
Unmount the temporary directory: umount /tmp/mylinux
Reboot the system: shutdown -r now

Root's password is now blank. (Just hit Enter when prompted for it.) Be sure to reset it though. Blank passwords aren't terribly secure!

Comments

I've used an even simpler way which will probably still work. Boot up in "single user" mode. That has no passwords, and runs as root, will full privileges.

If anyone has access to the box and can reboot the system, there is no security.

Post a comment

(If you haven't left a comment here before, you may need to be approved by the site owner before your comment will appear. Until then, it won't appear on the entry. Thanks for waiting.)

Subscribe
Newsletter & SubscriptionsPC World is New Zealand’s top selling computing and technology magazine.

It provides up-to-the-minute editorial, insight and buying advice for personal computing, cell phones, game consoles, digital entertainment and broadband.
SIGN UP
PCWorldUpdate
PC World's weekly round-up of tech news, gear and game reviews, software selections, and handy How Tos.