How to Change the Root Password in Linux

When to change the root password

Changing the Linux root password is one command: run passwd when logged in as root, or sudo passwd root from a user with sudo rights, and type the new password twice — it takes effect immediately, no reboot needed. If the password is lost, reset it from the hosting provider's VNC/rescue console or a GRUB root shell. Change it when an admin with root leaves, after suspected exposure, or before a handover:

1. Change it — passwd (as root) or sudo passwd root
2. Enter twice — the new password never echoes; length beats complexity
3. Other users — sudo passwd username changes any account
4. Lost password — recover via your provider's VNC/console, or GRUB recovery mode on a VPS you control
5. After the change — verify SSH keys still work, review PermitRootLogin, and keep sudo users current

Password resets are reactive; SSH key login with password auth disabled is the preventive fix. Our VPS server consoles make recovery possible even when SSH is locked out, and the fail2ban guide keeps brute-force bots from ever getting close.

Method — change when logged in (passwd, sudo)

The whole command-line change is one step. Logged in as root, run passwd; from a normal user with sudo rights, run sudo passwd root — enter your own password to authorize, then the new root password twice. Nothing echoes as you type, and the new password is active immediately, for the current session and the next login. If the new password is rejected, it failed the distribution's quality policy (pam_pwquality) — length matters more than symbol soup.

Changing another user's password

Root and any sudo user can change any account with sudo passwd username — the account's old password is not required. A user changing their own password runs plain passwd, which asks for the current one first. Admins resetting several accounts can batch them with chpasswd, which reads user:password pairs in clear text — pipe them in, and never leave them in shell history or a file behind. To force a user to pick a new password at the next login: sudo chage -d 0 username.

Forgot root — recovery via VNC or provider console

On a hosted VPS you rarely need local tricks: when SSH refuses you, open the provider's VNC or rescue console from the control panel — WebJi® VPS consoles work even when SSH is locked out. Boot the rescue image, mount the server's root partition, and set the new password without knowing the old one using passwd --root MOUNT_POINT USER_NAME (the LiveCD method the ArchWiki documents), then unmount and reboot. On managed plans the Jaipur desk does the whole reset with you; on unmanaged servers this console path is your fastest way back in.

Forgot root — GRUB recovery mode steps

On a server or PC you control, GRUB gives you a root shell without the password. Menu keys differ (hold Shift during boot on BIOS Ubuntu, Esc on most UEFI systems), and a GRUB bootloader password, if one is set, must be known or removed first.

1. Reboot, open the GRUB menu, select the default kernel entry and press e.
2. Find the line starting with linux (or linux16); change ro to rw and append init=/bin/bash at the end.
3. Press Ctrl-X (or F10) to boot into the root shell.
4. If the filesystem still reads as read-only, remount it: mount -n -o remount,rw /.
5. Run passwd and type the new root password twice.
6. On RHEL/CentOS/AlmaLinux with SELinux, create the relabel trigger: touch /.autorelabel, or policies break after reboot.
7. Reboot — reboot -f from the bare shell, or exec /sbin/init to continue a normal boot — and log in with the new password.

RHEL-family systems can instead append rd.break on the kernel line: after Ctrl-X, run mount -o remount,rw /sysroot, chroot /sysroot, passwd, then touch /.autorelabel and exit twice. Debian and Ubuntu also list a Recovery mode entry in GRUB that drops to a root shell — run passwd from there. Remember these routes work for anyone with keyboard access, which is the case for full-disk encryption on hardware you do not physically control.

After the change — SSH keys, PermitRootLogin, sudo hardening

A password change never touches SSH public-key logins — they keep working. Three settings deserve a look right after: PermitRootLogin in /etc/ssh/sshd_config (prohibit-password keeps root for keys while blocking password guessing), the sudo/wheel group membership (remove accounts of people who left), and hard-coded credentials in scripts, cron jobs and databases that still use the old root password. Note that /etc/shadow stores only the salted hash — the old password cannot be read back — and that a MySQL or phpMyAdmin root password is separate from the OS root you just changed.

Rotation best practices

Rotate the root password on events, not a blind calendar: an admin or contractor with root leaves, a credential may have been exposed, a server changes hands. Check aging with chage -l root, force a one-time change with chage -d 0 root, and prefer long passphrases over short symbol-heavy passwords. Pair the rotation with SSH-key-only login and the fail2ban guide so the password stops being the thing attackers hammer — password resets are reactive; key-based login with password auth disabled is the preventive fix.