CertGrid CertGrid
Hands-on Lab·Red Hat Certified System Administrator

Root Password Reset from Boot Loader

One objective, asked in some form on almost every attempt. The procedure is six commands and the failure mode is always the same: the password is changed, the machine reboots, and the new password does not work - because `/etc/shadow` was written with the wrong SELinux label. That mechanism is demonstrated here on a running system.

Operating Running Systems Guide 24 of 67 Advanced

Written against the versions above. `rd.break` drops you into the **initramfs** shell before the real root filesystem is handed over, which is why the disk is at `/sysroot` and mounted read-only. That is the whole reason for the `mount -o remount,rw` and the `chroot` - without both, you are editing a file in a temporary root that is about to disappear.

The verifiable parts run on RHCSA-A01. The boot-loader steps need console access to any machine.
Server NameIP AddressOSRolesCPURAMHDD
RHCSA-A01192.168.0.31RHEL 10.0 (Coughlan)Practice node (graded) - spare /dev/sda2 Core4 GB50 GB + 15 GB

Before you start

  1. The boot arguments you will be editing

  2. At the boot menu

  3. Where the password actually lives

  4. Remount, chroot, change

  5. The SELinux step people skip

  6. `/.autorelabel`, and the targeted alternative

  7. Proving the change took

  8. Stopping anyone else doing this

Official sources

← All RHCSA guides