Skip to main content
One of the most important recovery skills for a Linux administrator is resetting the root password. If the root password is lost or forgotten, administrative control of the entire system can be lost. This guide shows how to safely reset the root password from the boot process on RHEL 10 systems without reinstalling the OS. By the end you will be able to:
  • Boot into a limited emergency shell from GRUB.
  • Remount the root filesystem read-write.
  • Set a new root password.
  • Trigger SELinux relabeling and resume a normal boot.
Overview of the steps:
  • Edit the GRUB entry to boot a limited shell.
  • Remount the root filesystem read-write.
  • Set a new root password.
  • Trigger an SELinux filesystem relabel and continue booting.
A dark-themed slide titled "Demo — Resetting the Root Password." It lists three steps: "How to enter emergency mode," "Gain temporary administrative access," and "Safely set a new root password."
Quick summary table Prerequisites
  • Physical console or remote KVM access to the system (required to edit GRUB).
  • If the system uses full-disk LUKS encryption, be prepared to enter the passphrase during early boot.
  • Access to the system console is a powerful privilege—protect it (see warning below).
Anyone with physical or console access can gain root by booting into a rescue/emergency shell. Secure the boot process (BIOS/UEFI protections, GRUB passwords, or secure management interfaces) to prevent unauthorized access.
Step-by-step
  1. Reboot and enter GRUB edit mode
  • Reboot the server. When the GRUB menu appears, use the arrow keys to highlight the kernel entry you want to boot, then press e to edit the selected entry.
You should see GRUB output similar to:
  1. Edit the kernel command line
  • Locate the line beginning with linux (sometimes linux16 or referencing vmlinuz) and modify it:
    • Change ro to rw if you want the kernel to mount root read-write immediately. Note: even if you change this, the emergency shell often mounts read-only, so remounting may still be necessary.
    • Append init=/bin/bash to the end of the line so the kernel launches a shell as PID 1.
After editing, boot the modified entry (usually by pressing Ctrl+X). Example edited linux line (wrapped for readability):
  1. Remount, reset password, and relabel SELinux
  • The system will drop you to a bash prompt. Even if you set rw, the root filesystem is often mounted read-only in this mode. Execute the following commands from the emergency shell:
Sample interaction:
If SELinux is enabled, run touch /.autorelabel on RHEL systems after changing the root password from an emergency shell. Without relabeling, SELinux contexts may be incorrect and the system can fail to boot normally.
What happens next
  • After exec /sbin/init the normal boot process resumes. During the next boot you will see SELinux relabeling messages; this can take time depending on filesystem size. Once relabeling completes, log in as root using the new password.
Troubleshooting and common issues Notes and security considerations
  • Physical or console access is required to perform these steps; anyone with such access can gain root by booting into a rescue shell. Protect console/boot access accordingly (e.g., secure GRUB with a password or use appropriate BIOS/UEFI protections).
  • If your environment uses full-disk encryption (LUKS), you will be prompted for the passphrase during early boot. You cannot bypass disk encryption by editing GRUB.
  • Consider enabling a GRUB password or other boot-time protections in environments where physical access is not tightly controlled.
References This concludes the demo. You now know how to reset the root password on a RHEL 10 system from the boot menu and ensure SELinux relabeling so the system boots cleanly.

Watch Video