The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →A sudo prompt normally asks for the password of the account you are currently using, not the root password. If another administrator can still use sudo, reset the affected account with sudo passwd username. If no administrator can log in, you need an authorized recovery path: Ubuntu recovery mode, RHEL 9’s rd.break boot method, or trusted live-rescue media for Debian and similar systems.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
First identify which password was forgotten
Linux systems commonly involve three different credentials: a user’s login password, the root account’s password, and the password entered when sudo asks for authorization. Confusing them leads to the wrong recovery procedure.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
A sudo prompt usually validates your own password
The sudoers policy validates the invoking user’s credentials, not the target account’s credentials. When user alice runs sudo systemctl restart ssh, the prompt normally expects Alice’s password even though the command runs with root privileges. It does not normally expect the root password.
Therefore, forgetting the password for your regular account is an account-recovery problem. Forgetting a separately enabled root password is a root-account problem. A failed sudo prompt can also mean that the account is not authorized, is locked, or is using an unexpected authentication policy rather than simply having the wrong password.
#1 Best Overall
Ubuntu’s default root-account model
Ubuntu disables direct administrative root login by default. The installer generally places the first user in the sudo group, and that account uses its own password for administration. A root password may still be set later, but it is not required for normal Ubuntu administration.
On Ubuntu, use sudo passwd username to change a user’s password when you have a working administrator account. To set a root password deliberately, an authorized administrator can run sudo passwd root. To lock the root password again, use sudo passwd -l root.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Choose the recovery path
| Situation | Best path | Access required | Important side effects |
|---|---|---|---|
| Another account can run sudo | Run sudo passwd username from that account |
Normal SSH or console login | Changes only the selected account’s password |
| Ubuntu has no usable administrator login | GRUB Advanced options, recovery mode, root shell | Local console or a provider console that exposes GRUB | Requires remounting the root filesystem read-write |
| RHEL 9 has no wheel user with sudo | GRUB edit with rd.break |
Console access and permission to edit the boot entry | Requires SELinux relabeling after the reset |
| Debian or another distribution lacks a usable local recovery entry | Trusted live-rescue media, mount, and chroot | Physical or virtual-media console access | You must mount the installed system, not the live environment |
| Full-disk encryption is enabled | Use the normal recovery path after unlocking the encrypted volume | Console plus the disk-unlock passphrase or key | Without the unlock credential, password reset cannot reach the installed filesystem |
Only use these procedures on systems you are authorized to administer. Boot editing, virtual-console access, and live-media access can allow anyone with that access to replace local credentials.
Reset a password when another sudo-capable account works
This is the shortest and least disruptive method. Log in as an administrator whose password is known and whose account is authorized for sudo.
- List local accounts if you need to confirm the exact login name:
getent passwd. Ubuntu’s local account database is represented in/etc/passwd; do not rely on a display name or an abbreviated username. - Reset the affected user’s password:
sudo passwd username. Replaceusernamewith the exact account name. - For a root password that was intentionally enabled, run
sudo passwd root. The currently logged-in administrator’s password authenticates the sudo operation. - When prompted, enter the new password twice. A successful run reports that the password was updated.
- Check that the target account still has the intended administrative group. On Ubuntu, inspect membership with
id usernameand look forsudo; on RHEL, look forwheel.
Changing a user’s password does not automatically add that user to an administrative group. Conversely, adding broad privileges to solve a password problem can create a larger security issue. Preserve the existing authorization design unless you have a separate reason to change it.
If sudo says the user is not authorized
A correct password cannot compensate for missing sudo policy. Check the account’s groups and the policy files /etc/sudoers and /etc/sudoers.d/. Do not edit the main sudoers file with an ordinary text editor; if a policy change is required, use visudo so syntax is checked before the file is installed.
On RHEL, the normal administrative group is wheel. On Ubuntu, it is usually sudo. If the account is absent from the appropriate group, an existing administrator can add it with the distribution’s group-management command, then start a new login session before testing again.
Ubuntu: use recovery mode when no administrator can log in
Ubuntu’s documented recovery route gives you a root shell outside the normal login process. It is intended for a local machine or a virtual machine whose console exposes the bootloader. Many hosted servers hide GRUB behind a provider interface, so the exact screens and keystrokes vary.
Open the recovery shell
- Reboot the server and open the GRUB menu. On many systems, holding
Shiftduring BIOS startup or pressingEscduring UEFI startup reveals it; a hosted console may provide its own control for showing the menu. - Choose Advanced options for Ubuntu.
- Select the appropriate Ubuntu kernel entry ending in (recovery mode). If several kernels are listed, choose the kernel you normally boot unless you are troubleshooting a kernel-specific failure.
- In the recovery menu, choose root – Drop to root shell prompt.
- If the shell reports that the installed root filesystem is read-only, remount it read-write:
mount -o remount,rw /.
Change the account password
At the root prompt, reset a regular user with:
passwd username
To set a root password specifically, use:
passwd root
Enter the new password twice. If the command reports that the password was updated, leave the shell with exit and choose the menu option to resume normal boot, or reboot from the shell with reboot after any pending recovery operation has finished.
Recovery mode acts on the installed Ubuntu filesystem. It does not require you to know the old password, but it does require access to the machine’s console and, when applicable, the disk-encryption passphrase.
When an Ubuntu hosted server does not show GRUB
A cloud or virtual-server provider may expose only a serial console, a web console, or a rescue image. If GRUB is inaccessible, use the provider’s documented console or rescue workflow rather than assuming that the desktop recovery instructions apply. If the provider offers an out-of-band reset, confirm that it changes the installed instance’s account and not a temporary rescue environment.
RHEL 9: reset with the rd.break boot method
Red Hat Enterprise Linux 9 documents a special boot path for the case in which root login is unavailable and no non-root user has sudo permission. It pauses the boot process before the installed system is fully started, allowing you to change the password from a root shell.
Enter the emergency shell
- Reboot and stop at the GRUB menu. Select the RHEL kernel you intend to boot.
- Press
eto edit the boot entry. - Find the line beginning with
linux(on some systems it may wrap onto a second screen). - Move to the end of that line, add a space followed by
rd.break, and pressCtrl+xto boot with the temporary option. - At the break prompt, remount the installed system read-write:
mount -o remount,rw /sysroot. - Change the apparent root directory to the installed system:
chroot /sysroot.
Set the password and prepare SELinux relabeling
For the root account, run:
passwd
For a regular account, specify its name:
passwd username
Create the relabel marker required by the RHEL procedure:
touch /.autorelabel
Leave the chroot with exit, then leave the break shell with a second exit. The system will continue booting, or you can follow the console’s reboot prompt. On the next boot, SELinux relabeling runs across the filesystem. The first startup can take considerably longer than usual; do not interrupt it merely because the login prompt is delayed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The rd.break option is a temporary boot argument. It is not a setting that should remain in the bootloader configuration after recovery.
Rank #4
Debian and similar systems: use trusted live-rescue media
When the installed system has no usable recovery entry, boot a trusted Debian live image or another rescue environment that matches the machine’s architecture. Physical media, a virtual ISO, or a provider rescue image can work, provided you control its provenance and can access the server console.
Mount the installed root filesystem
- Boot the rescue environment and open a root shell. A live environment may provide a terminal where you can become root with its documented method.
- Identify the installed root partition with
lsblk -f. Confirm the filesystem, labels, and sizes before mounting anything. - Create a mount point and mount the installed root filesystem, for example:
mkdir -p /mntfollowed bymount /dev/your-root-partition /mnt. Replace the device name with the actual root partition; do not copy the example literally. - If the installation uses separate
/boot,/usr, or other filesystems, mount them beneath/mntat their installed paths before chrooting. - Enter the installed system:
chroot /mnt /bin/bash.
Reset the installed account
From the chroot, run:
passwd username
To change root’s password, use passwd root. The command must run after the installed root filesystem is mounted and the chroot is active. Running passwd in the live environment without the chroot changes the rescue system’s accounts, not the server you are repairing.
When finished, leave the chroot with exit, unmount the installed filesystems cleanly, remove the rescue media, and reboot into the installed system. If the machine uses software RAID, LVM, or encryption, activate and mount those layers according to the installation’s layout before attempting the chroot; an incomplete mount can make the command appear to succeed while modifying the wrong environment.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsVerify the reset without creating a new access problem
- Start a fresh login session. Existing SSH sessions may retain cached credentials or an existing sudo timestamp and therefore do not prove that the new password works.
- Test the account’s normal login method, such as the console or SSH path used by that account. Use the exact username you reset.
- For an administrative user, run a harmless check such as
sudo whoami. A successful result should beroot. Do not use a destructive command merely to test elevation. - Confirm authorization with
id username. Check for the intendedsudogroup on Ubuntu orwheelon RHEL rather than granting unrestricted access to compensate for a missing group. - If sudo still reports that the user is not permitted, inspect
/etc/sudoersand/etc/sudoers.d/for the policy that should authorize the account. Validate any policy edit withvisudo. - On RHEL, wait for the SELinux relabel operation to complete and then test again. A delayed first boot is expected after creating
/.autorelabel.
Common failure modes and their fixes
“I used the root password at the sudo prompt, and it failed”
That is expected on a normal sudo configuration because sudo asks for the invoking user’s password. Log in as that user and reset its password from another administrator, or use the appropriate offline recovery path.
“The recovery shell says the filesystem is read-only”
Password databases cannot be updated on a read-only root filesystem. In Ubuntu recovery mode, run mount -o remount,rw /. In the RHEL 9 break environment, remount /sysroot with mount -o remount,rw /sysroot before chrooting.
Best Value
“The reset worked, but sudo still says I am not allowed”
Password authentication and sudo authorization are separate checks. Verify group membership and the applicable policy files. A password reset does not add the account to sudo or wheel.
“The live-media reset changed nothing”
You probably changed the rescue environment instead of the installed system, or mounted the wrong partition. Recheck lsblk -f, mount the actual root filesystem at /mnt, and run passwd only after entering the chroot.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall“The server will not show GRUB”
Hosted platforms often suppress the boot menu. Use the provider’s serial or virtual console, attach approved rescue media, or request an authorized out-of-band recovery. Do not assume that an SSH-only interface can perform an offline password reset.
“RHEL takes a long time to boot after the reset”
The /.autorelabel marker causes SELinux to relabel files. Allow that operation to finish before declaring the recovery unsuccessful. Interrupting it can leave contexts incomplete and create additional startup problems.
Security implications and prevention
Anyone who can edit a boot entry, access a provider console, attach a rescue image, or remove a server’s storage can often replace local passwords. Treat those capabilities as equivalent to administrator access.
- Protect physical access, GRUB editing, and out-of-band management consoles with strong authentication and restricted operator permissions.
- Use full-disk encryption where its operational model fits the server, and store the unlock key separately from the machine. Encryption protects data at rest, but it does not remove the need to secure an already-unlocked console.
- Keep at least one tested, authorized administrative account and document its recovery route. Test the route during maintenance rather than during an outage.
- Store credentials in an approved password manager and maintain a controlled break-glass process.
- Do not edit
/etc/shadowmanually whenpasswdis available. The command applies the correct hashing and account-file updates for the distribution. - Avoid permanently enabling direct root login unless a documented security policy requires it. On Ubuntu, restore the default locked state with
sudo passwd -l rootafter any temporary root-password operation. - If the reset follows a suspected compromise, preserve authentication logs, console records, and incident details before rotating additional credentials or rebuilding the host.
The safest procedure is the narrowest one that restores the intended account: use a working sudo administrator when available, an offline root shell only when necessary, and verify both authentication and authorization before returning the server to service.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
