The document provides steps to reset a lost root password in RHEL7 or CentOS7. It involves booting into the GRUB menu and adding "rd.break" to the kernel arguments. This pauses the boot process after mounting the filesystem read-only. The filesystem can then be remounted read-write to change the root password using "echo newpassword | passwd --stdin root" and reset the root account expiration. Creating a file named ".autorelabel" ensures the filesystem is relabelled on reboot to enforce SELinux in the enforcing mode.

1.
Resetting Lost root Password in RHEL7 & CentOS7
In this howto you will learn the process of resetting the lost root password in
RHEL7 & CentOS7
In this password recovery process you should pass the ​rd.break​ parameter
as a kernel argument at the​ ​Stage2​ ​menu of ​GRUB2​ boot loader which is the
default boot loader of RHEL7 & CentOS7 systems. The documents was
created using RHEL7 VM which was running on a KVM hypervisor.
Reboot your ​Linux system​ ​ and when it display the following ​GRUB2 Stage2
menu​ ​screen press ​ESC​ ​key and then type letter ​“e”​ to edit the menu entries.
Look at the red box in this screen beloe. You have to be ultra quick here as it
passes this screen in just ​5​ seconds.
Then you will see the following screen. The ​linux16​ ​grub command is our
concern here as ​GRUB​ is using this command to load the kernel and to pass the
parameters required by the kernel at this stage.
1 | Page

2.
Delete all the additional parameters which is marked using a red color polyline
as shown in the above screen upto ​ro (read-only)​ ​parameter which is used
to mount your system's root (/) filesystem read only at this stage. The end
result should look like below.
Next you need to type​ ​rd.break​ parameter after the above ​ro​ parameter and
the end result should look like the screen below.
2 | Page

3.
Next press the ​Ctrl+x​ key sequence to continue the boot process further.
The ​rd.break​ parameter instructs the Kernel to break the boot process
before it passes the control to the ​systemd​ master process and break the boot
process after mounting initial ramdisk ​(​initrd​)​ as Linux ​/​ ​filesystem. At this
stage you can recover the lost ​root password​ and carry out other
troubleshooting tasks if required.
The system will show the following screen. At the command line type ​mount
command to view mounted file systems at this stage.
Observe the red color box below in the screen below. You will observe that
your system’s ​root (/)​ ​file system on ​/dev/vda1​ ​has been mounted on
/sysroot​ ​in read-only ​(​ro​)​ mode. The​ ​/sysroot​ mount point is a directory
in the ramdisk which is currently being used as ​/​ filesystem.
3 | Page

4.
Before we further proceed we need to remount​ ​/sysroot​ ​in read-write ​(​rw​)
mode so that we can write our modification to the disks. Observe the screen
below.
As demonstrated in the red box of the above screen execute the command to
remount​ ​/sysroot​ in ​rw​ mode.
# mount -o remount,rw /sysroot
# mount | grep sysroot
Executing ​mount | grep sysroot​ ​command you can verify that ​/sysroot​ is
now mounted in ​rw​ mode.
Observe the next screen to find out how to change your root password as
“Postroll”​. ​This command changes the root password non-interactively​.
# echo Postroll | passwd --stdin root.
4 | Page

5.
It is important to check whether your ​root​ user has expired. You can observe
the following screen to understand this process.
This is optional, but it will be useful to know how to activate an expired root
account. You do not require the following steps if the root account haven’t set
to expire.
Observe the above screen to understand that the ​root​ account has been
expired on ​1​st​
January 1970​. You can run the following command to reset
the expiry date for the root account.
# chage -E -1 root
To learn more about the syntax of the above command use​ ​man chage
command and search for option ​-E​.
Observe the following screen to find whether you have reset ​root​ account
expiry properly.
5 | Page

6.
Run ​chage -l root​ command as shown in the above screen and you will
observe that Account expiration set to ​never​ which is the default setting for
the ​root​ user account.
In this ramdisk environment SELinux in ​disabled​ mode. Observe the screen
below.
As shown in the above screen run ​getenforce​ command and you will
observe that SELinux in ​Disabled​ mode.
Running ​ls -Z /etc/shadow​ ​command as shown in the above screen you
have observed that there is no SELinux label for this file.
Running ​cat /etc/sysconfig/selinux​ ​command above you have observed
that SELinux will be in ​enforcing​ ​mode when the system is running at next
reboot. This requires a relabeling of the filesystem at next reboot. This can be
achieved by creating a blank file named ​.autorelabel​ ​in​ ​/​ ​directory. Run
the following command.
6 | Page

7. # ​touch /.autorelabel
Then type the following command to exit from the chroot environment.
# ​exit
Execute the exit command again to reboot the system.
# ​exit
Observe the following screen.
Observe the red box in the screen below. You will see that the system is
re-labeling. The time taken for this process will depend on the number of files
and directories in your system.
Once the labeling is over the system will reboot again and you should be able
to successfully login to root account with the password ​“​Postroll​”.
Author: Chinthaka Deshapriya (RHCA).
Last modified: 20​th​
May, 2017.
Inquires: +94-766-783-783 and
7 | Page

8.
8 | Page