1 00:00:00,000 --> 00:00:11,800 In this video, you'll learn how to reset a lost root user password. 2 00:00:11,800 --> 00:00:15,640 So on Red Hat, you do the following. 3 00:00:15,640 --> 00:00:20,959 Most startup states prompt for a password, and that is why you cannot use systemd unit 4 00:00:20,959 --> 00:00:26,160 is emergency.target or systemd unit is rescue.target. 5 00:00:26,160 --> 00:00:32,599 You can use two options, either you use init is bin bash or you use rd.break as a kernel 6 00:00:32,599 --> 00:00:35,680 boot argument from the grub prompt. 7 00:00:35,680 --> 00:00:40,320 Now is bin bash is more generic of these two, and that is why I'm going to show you init 8 00:00:40,320 --> 00:00:41,320 is bin bash. 9 00:00:41,320 --> 00:00:49,200 rd.break is interesting, but it will boot into your init ramfs, and it's Red Hat specific, 10 00:00:49,200 --> 00:00:53,000 and I rather teach you something that works on all distributions. 11 00:00:53,000 --> 00:00:58,000 After getting into your troubleshooting mode using init is bin bash, you have the root 12 00:00:58,000 --> 00:01:02,119 file system, but the root file system is in read-only state. 13 00:01:02,119 --> 00:01:06,800 So the next command is mount-o remount,rw on slash. 14 00:01:06,800 --> 00:01:10,120 That will make it read-writable, and from there, it's very easy. 15 00:01:10,120 --> 00:01:14,320 You can just reset the password using passwd. 16 00:01:14,320 --> 00:01:18,599 But there is one thing that you cannot forget about, and that is selinux. 17 00:01:18,599 --> 00:01:24,120 Red Hat is protected by using selinux, and in order to make sure that selinux is handled 18 00:01:24,120 --> 00:01:31,800 correctly, you use the command touch-slash.auto-relabel to properly apply selinux context labels while 19 00:01:31,800 --> 00:01:32,800 you are rebooting. 20 00:01:32,800 --> 00:01:37,040 Otherwise, your system will be inaccessible. 21 00:01:37,040 --> 00:01:39,160 On Ubuntu, it's a little bit easier. 22 00:01:39,160 --> 00:01:45,320 You can even use systemd.unit is emergency.target, but alternatively, you can also use init is 23 00:01:45,320 --> 00:01:46,320 bin bash. 24 00:01:46,320 --> 00:01:47,320 It both works. 25 00:01:48,040 --> 00:01:54,680 Next, you need to remount the root file system in read-write mount using mount-o remount-rw 26 00:01:54,680 --> 00:02:01,680 slash, and then you simply use passwd to change the password, and you reboot, and that's all. 27 00:02:01,680 --> 00:02:05,599 Let me show you, and I'm going to show you on Red Hat for the simple reason that this 28 00:02:05,599 --> 00:02:08,880 is the more complex situation. 29 00:02:08,880 --> 00:02:12,759 So here I'm back on my CentOS machine, and I'm going to reboot it. 30 00:02:12,759 --> 00:02:16,520 Oops, and I was a little bit too eager. 31 00:02:16,720 --> 00:02:20,520 I'm in my boot manager now, so what do I want in my boot manager? 32 00:02:20,520 --> 00:02:25,559 Well, I want to go to CentOS Linux, and then I need my GRUB boot prompt. 33 00:02:25,559 --> 00:02:27,559 Oh, no, I failed it. 34 00:02:27,559 --> 00:02:33,479 Now, the trick is, if you want access to the GRUB boot prompt and it doesn't work out well, 35 00:02:33,479 --> 00:02:36,119 reboot your machine while it is booting. 36 00:02:36,119 --> 00:02:41,160 The next time it boots, it will detect that the last time it didn't complete booting successfully, 37 00:02:41,160 --> 00:02:44,039 and you automatically get access to the GRUB boot prompt. 38 00:02:44,199 --> 00:02:50,679 Then I'm pressing E for edit on my default line, and there I'm removing RHDB and QUIET, 39 00:02:50,679 --> 00:02:55,240 and I'm adding in it is slash bin slash bash. 40 00:02:55,240 --> 00:02:58,919 Control X to start with this option, and there it goes. 41 00:02:59,800 --> 00:03:05,000 So as you can see, I'm on a root prompt, and I haven't entered any password at all. 42 00:03:05,639 --> 00:03:10,039 Also, when you type mount on the top line, you can see that the root file system is mounted, 43 00:03:10,039 --> 00:03:12,199 but it is RO, read only. 44 00:03:12,199 --> 00:03:17,240 And that's why I need mount minus O remount comma RW on slash. 45 00:03:18,119 --> 00:03:23,800 Now I can use passwd and set my new password once and twice. 46 00:03:24,360 --> 00:03:30,119 But as this is a CentOS system, and CentOS, like every Red Hat family distribution, 47 00:03:30,119 --> 00:03:35,880 has SQLinux by default, I do need touch slash dot auto relabel. 48 00:03:36,759 --> 00:03:41,320 That will make sure that SQLinux context labels are going to be fixed. 49 00:03:42,119 --> 00:03:43,720 Next, we need to restart. 50 00:03:43,720 --> 00:03:48,119 Now I started in init is bin bash, and how do you restart from here? 51 00:03:48,119 --> 00:03:49,320 Well, two options. 52 00:03:49,320 --> 00:03:52,039 Either you are just going to reset your virtual machine. 53 00:03:52,039 --> 00:03:52,919 That works. 54 00:03:52,919 --> 00:03:59,160 What also works is if you use exec slash user lib systemd systemd. 55 00:03:59,160 --> 00:04:02,039 That's kind of a funny way to start systemd, 56 00:04:02,039 --> 00:04:06,039 but that is because right now PID1 is the bash shell. 57 00:04:06,600 --> 00:04:10,039 And systemd cannot be a child of the bash shell. 58 00:04:10,039 --> 00:04:16,359 And that is why the normal fork procedure for running your processes is not valid here. 59 00:04:16,359 --> 00:04:22,440 We need to replace the current bash PID1 with systemd. 60 00:04:22,440 --> 00:04:23,959 And that is what exec is doing. 61 00:04:24,760 --> 00:04:29,000 At this moment, you can see the SQLinux context labeling is happening. 62 00:04:29,000 --> 00:04:31,000 You need to wait until that completes. 63 00:04:31,000 --> 00:04:33,239 Once complete, it will reboot again. 64 00:04:33,239 --> 00:04:35,959 That is expected behavior and nothing to worry about. 65 00:04:36,600 --> 00:04:38,200 So give it a moment. 66 00:04:38,200 --> 00:04:42,920 Normally on demo systems like this, it's done within a minute or so. 67 00:04:43,559 --> 00:04:44,760 Here goes the reboot. 68 00:04:45,320 --> 00:04:50,600 And now that it is rebooting again, well, once you have access to the prompt, 69 00:04:50,600 --> 00:04:52,440 you can log in as the root user.