Updated for 2026: originally written for RHEL 7, which went end-of-life in June 2024. The procedure below is the current one for RHEL 8/9 and AlmaLinux 8/9 (Rocky Linux works identically) — on RHEL 10 / AlmaLinux 10, read the EL10 section first, because the method differs. One thing has genuinely improved since the RHEL 7 days: there is now a single method that works everywhere on EL9 — physical hardware, KVM, VMware, VirtualBox — and it’s the rd.break method that used to be the “VM workaround” at the bottom of this article.
Environment
- Red Hat Enterprise Linux 8, 9 or 10, AlmaLinux 8, 9 or 10 (or Rocky) — but the method differs on 10 (see the EL10 section)
- Console access: physical, IPMI/iDRAC/iLO, or your hypervisor/cloud serial console
- SELinux in enforcing mode (the default — and the reason for step 7)
Issue
- The root password is lost or unknown
- Single-user mode still asks for the root password (
systemdrequires it for the rescue/emergency shells), so the old “boot into single user and run passwd” trick no longer works
Resolution: the rd.break method
rd.break stops the boot process inside the initramfs, before the real root filesystem is handed over to systemd — and before anything asks you for a password.
1. Reboot the system and wait for the GRUB2 menu. Highlight the entry you normally boot and press e to edit it.
2. Find the line beginning with linux. Append this to the end of that line:
rd.break
(Removing rhgb quiet from the same line makes the boot output easier to follow, but isn’t required.)
3. Press Ctrl+X (or F10) to boot with the edited entry. The system stops in the initramfs and drops you at a prompt, no credentials asked:
switch_root:/#
4. Your real root filesystem is mounted read-only at /sysroot. Remount it read-write:
switch_root:/# mount -o remount,rw /sysroot
5. Chroot into it, so you’re working on the installed system:
switch_root:/# chroot /sysroot
6. Set the new root password:
sh-5.1# passwd root Changing password for user root. New password: Retype new password: passwd: all authentication tokens updated successfully.
7. Do not skip this step. You edited /etc/shadow from outside the running system, so the file now has the wrong SELinux context. On an enforcing system that can lock you straight back out. Tell SELinux to relabel the filesystem on the next boot:
sh-5.1# touch /.autorelabel
The relabel happens before the login prompt appears and can take a while on large filesystems — that’s normal, let it finish.
8. Leave the chroot, then leave the initramfs shell:
sh-5.1# exit switch_root:/# exit
The system reboots (or continues booting, depending on release), performs the relabel, and presents a normal login prompt. Log in as root with the new password.
RHEL 10 / AlmaLinux 10: a different method (EL10 coverage added Oct 26, 2026)
On EL10, do not assume rd.break works. Current guides disagree about it: several say rd.break no longer works for root password recovery on RHEL 10 and to use init=/bin/bash instead, while other EL10 guides still document rd.break — and Red Hat’s own EL10 documentation did not settle the question at the time of writing, so this guide does not pretend otherwise. The safe path on EL10 is the init=/bin/bash method below: it is the one with the most EL10-specific documentation, and if you try rd.break first and do not land in the initramfs shell, reboot and use this instead. Either way, test in a VM before you need it for real.
1. Reboot and wait for the GRUB2 menu. Highlight the entry you normally boot and press e to edit it.
2. Find the line beginning with linux. Change ro to rw and append this to the end of that line:
init=/bin/bash
3. Press Ctrl+X (or F10) to boot. You land in a bash shell as PID 1, with the root filesystem already writable (because of the rw you just set). If it still shows read-only, remount it:
mount -o remount,rw /
4. Set the new root password:
passwd root
5. Do not skip this step, for the same SELinux reason as step 7 above:
touch /.autorelabel
6. Continue the normal boot sequence:
exec /sbin/init
The system performs the relabel (which can take a while on large filesystems) and presents a normal login prompt. Log in as root with the new password. Note the difference from the init=/bin/sh fallback below: this method uses a full SELinux relabel via /.autorelabel rather than load_policy.
Fallback: init=/bin/sh
If rd.break isn’t available for some reason, the EL7-era method still works. At the GRUB edit screen, append this to the linux line instead:
init=/bin/sh
Boot with Ctrl+X. You land in a shell as PID 1, with the root filesystem mounted read-only and no SELinux policy loaded. Fix both, then reset:
sh-5.1# /usr/sbin/load_policy -i sh-5.1# mount -o remount,rw / sh-5.1# passwd root sh-5.1# mount -o remount,ro / sh-5.1# exec /sbin/init
The load_policy step is what makes this variant safe for /etc/shadow‘s SELinux context without a full relabel — which is also why rd.break + /.autorelabel is the recommended path: fewer ways to get it subtly wrong.
When this won’t work
- GRUB has a password. If the boot menu itself is protected (
grub2-setpassword), pressingedemands those credentials. Your remaining path is booting the install media into rescue mode. This is by design — see “Prevention” below. - The disk is LUKS-encrypted. You’ll be prompted for the passphrase on the way in, and there is no reset without it. That’s the encryption doing its job.
- Cloud images. Many cloud images ship with root locked and SSH password authentication disabled. Resetting the local password gets you in through the provider’s serial/VNC console, but it does not turn on SSH password login — and honestly, it shouldn’t.
After you’re back in
Treat an unexpected password reset as an incident until proven otherwise: check last, the authentication logs (/var/log/secure), and /etc/shadow‘s modification time. If you didn’t do it, someone with console access did.
Prevention
- Password-protect GRUB (
grub2-setpassword) on anything with an accessible console — this entire article is the reason why. - Encrypt the disk (LUKS) on hardware you don’t physically control.
- Stop sharing root. Named admin accounts with
sudomean a lost password is an inconvenience, not a lockout — and leaves an audit trail root never will.
Running your own server? These guides assume you have a Linux box somewhere — see our guide to choosing a VPS in 2026 for the 7 specs that actually matter before you spin one up.