Root Password Recovery

The Principle of Password Recovery

Before we dive into the "how," let's start with the "why" this is possible. As you've seen, physical access to a machine allows you to interrupt the bootloader (GRUB). This gives you the power to change how the Linux kernel starts. Instead of loading the full operating system with its usual security and authentication checks, you can instruct the kernel to bypass them and drop you directly into a root-level command prompt.

Once you have a root shell, the system considers you the superuser, granting you full administrative privileges. From there, you can use the standard passwd command to reset the password for any user, including root.

This capability is a double-edged sword: it's an essential recovery tool, but it also underscores the importance of physical security. If an unauthorized person has physical access to your server, they can use these same techniques to take control. We'll touch on ways to mitigate this later in the course.

Method 1: Using Recovery Mode (The Debian/Ubuntu Way)

Many user-friendly distributions, particularly those in the Debian family like Ubuntu and Linux Mint, provide a simplified "recovery mode" directly in the GRUB menu. This is the most straightforward method when available.

To see this in action, we'll watch a short video that demonstrates the process on an Ubuntu system.

To recap the process shown in the video:

1. Reboot the machine. As it starts, repeatedly press the Esc key (or hold Shift) to display the GRUB boot menu.
2. Select "Advanced options for Ubuntu".
3. Choose the entry that ends with "(recovery mode)".
4. A new menu will appear. Use the arrow keys to select "root - Drop to root shell prompt" and press Enter.
5. You will be presented with a command prompt at the bottom of the screen, with root privileges. The filesystem is typically mounted in read-write mode automatically.
6. Type passwd <username> to change the password for a specific user, or just passwd to change the root password. Enter the new password twice when prompted.
7. Type exit to return to the recovery menu.
8. Select "resume - Resume normal boot" to continue booting the system. You can now log in with the new password.

Method 2: Manually Editing GRUB Parameters (The Universal Method)

What if your distribution doesn't have a convenient "recovery mode" entry? Or what if that mode doesn't work? There is a more universal method that involves manually editing the boot parameters in GRUB. This technique works on a wide variety of systems, including Debian, Ubuntu, CentOS, Fedora, and Arch Linux.

The goal is to tell the kernel to run a shell (/bin/bash) as its initial process (init), completely bypassing systemd and all login procedures.

The general steps for this method are:

1. Reboot the machine and get to the GRUB menu (using Esc or Shift).
2. With the default boot entry selected, press the e key to edit it.
3. Use the arrow keys to find the line that starts with linux.
4. At the end of this line, add the parameter init=/bin/bash.
5. It's also a good idea to find the ro (read-only) parameter on that line and change it to rw (read-write). This saves you from having to remount the filesystem later.
6. Press Ctrl+X or F10 to boot with these modified parameters.
7. The system will boot directly to a root shell prompt (#).

Once you have the root shell, you can change the password.

After you've successfully changed the password, you must reboot the machine. Because the normal init system isn't running, you may need to force a reboot. A common command to restart correctly from this state is exec /sbin/init, or you can force a reboot with reboot -f.

Variations for Red Hat, CentOS, and Fedora

The CompTIA Linux+ exam requires you to know about different Linux families. While the manual GRUB editing method is similar for Red Hat-based systems, there are a few crucial differences, primarily due to the initramfs environment and SELinux.

As you read, the process for a modern Red Hat-based system (like CentOS 8, Rocky Linux, or RHEL 8/9) looks like this:

1. Interrupt GRUB and press e to edit, just like before.
2. Find the linux line and add rd.break to the end.
3. Press Ctrl+X to boot. The system will boot into a temporary RAM-based environment (initramfs).
4. The real root filesystem is mounted read-only at /sysroot. You must remount it as read-write:

   mount -o remount,rw /sysroot
   

5. Next, you must switch your environment so that /sysroot is treated as the actual root (/) of the filesystem. This is done with the chroot command:

   chroot /sysroot
   

   This step is critical; without it, the passwd command won't be able to find the necessary files in /etc.
6. Now, you can run passwd to reset the password.
7. SELinux Step: Because you've modified the /etc/shadow file from outside the normally running system, SELinux needs to relabel the file to restore its security context. To trigger this on the next boot, create an empty file named .autorelabel in the root directory:

   touch /.autorelabel
   

8. Type exit to leave the chroot, and then exit again or reboot to restart the machine. The system will take longer to boot as it performs the SELinux relabeling.

Conclusion

You now possess a vital system recovery skill. By leveraging physical access to interrupt the boot process, you can gain a root shell and reset a forgotten password.

Key Takeaways:

• The Core Principle: Password recovery in Linux works by interrupting the normal boot sequence to gain a privileged root shell before authentication is required.
• Debian/Ubuntu Method: Use the "Advanced options" -> "recovery mode" entry in GRUB for a guided process.
• Universal Method: Edit the GRUB boot parameters to add init=/bin/bash, which replaces the standard init system with a root shell.
• Red Hat/CentOS Method: Use the rd.break boot parameter. This requires extra steps: remounting /sysroot as read-write, using chroot /sysroot, and creating the /.autorelabel file for SELinux.
• The Final Command: In all cases, the passwd command is the tool used to set the new password once you have a root shell.

Preview of the Next Lesson:
We've spent a lot of time on local system recovery. In our next lesson, we will shift gears and move into the realm of network security by exploring a fundamental concept: "Explain the role of SSL/TLS certificates in securing network communications."