DEV Community

Seamoon Pandey
Seamoon Pandey

Posted on

I Forgot My Linux Password — And Reset It in 5 Minutes

#linux #opensource #ubuntu

Most Linux users assume their login password is the primary barrier protecting their system. Then one day they forget it.

The surprising part? On many Linux distributions, resetting a forgotten password is remarkably easy if you have physical access to the machine.

This isn't a vulnerability. It's a fundamental aspect of how local system administration works on Linux.

Let's explore why password recovery works, how it's done, and what it teaches us about Linux security.

The Situation

Imagine you've been away from your laptop for a few weeks.

You boot into your favorite Linux distribution, confidently type what you think is your password, and get:

Authentication failure
Enter fullscreen mode Exit fullscreen mode

You try again.

Still wrong.

A few more attempts later, you realize you've forgotten your password.

Many people panic at this point, assuming they need to reinstall the operating system. Fortunately, that's rarely necessary.

Why Password Recovery Is Possible

Linux separates several security concepts:

  1. User account passwords
  2. Root (administrator) privileges
  3. Physical access to the machine
  4. Disk encryption

If someone can boot the operating system and obtain a root shell, they can change any user's password.

The key insight is that Linux trusts administrators to manage user accounts.

When you boot into recovery mode, you're effectively entering a maintenance environment where administrative actions are allowed.

Recovery Mode on Ubuntu-Based Distributions

On distributions such as Ubuntu, Lubuntu, Kubuntu, Xubuntu, and Linux Mint, the process is straightforward.

Step 1: Access GRUB

During boot:

  • Hold Shift on BIOS systems
  • Press Esc repeatedly on UEFI systems

This should display the GRUB menu.

Step 2: Enter Recovery Mode

Navigate to:

Advanced options for Ubuntu
Enter fullscreen mode Exit fullscreen mode

Then select:

(recovery mode)
Enter fullscreen mode Exit fullscreen mode

Step 3: Open a Root Shell

Choose:

root - Drop to root shell prompt
Enter fullscreen mode Exit fullscreen mode

You now have administrative access.

Step 4: Remount the Filesystem

The root filesystem is usually mounted read-only.

Remount it as writable:

mount -o remount,rw /
Enter fullscreen mode Exit fullscreen mode

Step 5: Reset the Password

First, identify the username if necessary:

ls /home
Enter fullscreen mode Exit fullscreen mode

Then change the password:

passwd username
Enter fullscreen mode Exit fullscreen mode

Example:

passwd john
Enter fullscreen mode Exit fullscreen mode

Enter a new password twice.

Step 6: Reboot 

reboot
Enter fullscreen mode Exit fullscreen mode

You're done.

What About Other Linux Distributions?

The same principle applies across most Linux systems.

Distribution Typical Recovery Method
Ubuntu Family Recovery Mode
Debian Single User Mode
Fedora Emergency Mode
Arch Linux Recovery Shell or Live USB
EndeavourOS Same as Arch
openSUSE Rescue Mode

The interface differs, but the idea remains identical:

  1. Obtain root access
  2. Run passwd
  3. Set a new password

The Security Lesson

Many new Linux users assume:

"If someone doesn't know my password, they can't access my computer."

That's only partially true.

If an attacker has:

  • Physical access
  • The ability to boot the system
  • An unencrypted drive

Then they can often reset passwords without knowing the original one.

This is expected behavior, not a bug.

Full-Disk Encryption Changes Everything

Now consider a system protected by LUKS full-disk encryption.

Before Linux even starts booting, you'll see something similar to:

Please unlock disk...
Enter fullscreen mode Exit fullscreen mode

Without the encryption passphrase:

  • Recovery mode is inaccessible
  • User data remains unreadable
  • Password reset procedures become ineffective

This is why security professionals often say:

Your real protection isn't your login password—it's disk encryption.

The login password protects your account.

Disk encryption protects your data.

Why Linux Allows This

At first glance, being able to reset passwords seems insecure.

In reality, it solves a practical problem.

System administrators occasionally forget passwords. Machines become inaccessible. Recovery tools are necessary.

Linux follows a long-standing philosophy:

Physical access usually implies administrative control.

If you want stronger protection against physical attacks, encryption—not account passwords—is the answer.

Final Thoughts

Resetting a forgotten Linux password is surprisingly simple across most distributions.

The process demonstrates an important security principle:

  • Passwords protect accounts.
  • Root access controls the system.
  • Physical access is powerful.
  • Encryption protects data.

The next time someone asks, "What happens if I forget my Linux password?" the answer is usually:

"Boot into recovery mode, reset it, and carry on."

The more interesting question is:

"What protects the machine if someone else does the same thing?"

The answer is full-disk encryption.

Top comments (0)