RHCSA Practical Lab Series – Resetting the Root Password

🔍 Lab 16: Resetting the Root Password in RHEL 9

📌 Objective

In this lab, you will:

✔ Reset the root password on a RHEL 9 system
✔ Use emergency mode to gain access
✔ Ensure that SELinux relabeling is triggered to prevent login issues

📌 Step 1: Boot into Emergency Mode

🔹 Start the system and interrupt the boot process:

1. Reboot the system and press e when the GRUB menu appears.
2. Locate the line starting with linux or linux16.
3. Press Ctrl+X to boot into emergency mode.

Modify the boot parameters by appending the following at the end of the line:

rd.break

✅ You should now have access to a minimal rescue shell.

📌 Step 2: Remount the Filesystem in Read-Write Mode

🔹 By default, the root filesystem is mounted as read-only. Remount it as read-write:

switch_root:/# mount -o remount,rw /sysroot

✅ Verify the change:

switch_root:/# mount | grep sysroot

🔹 Expected Output:

/dev/mapper/rhel-root on /sysroot type xfs (rw,relatime)

📌 Step 3: Access the System and Reset the Root Password

🔹 Change the root directory to /sysroot:

switch_root:/# chroot /sysroot

🔹 Reset the root password to SecurePass123:

sh-4.4# echo SecurePass123 | passwd --stdin root

📌 Explanation:

• chroot /sysroot → Switches into the installed system environment.
• passwd --stdin root → Sets the new password for root.

✅ If successful, you will see:

passwd: all authentication tokens updated successfully.

📌 Step 4: Trigger SELinux Relabeling

🔹 Create a file to ensure SELinux relabeling occurs on reboot:

sh-4.4# touch /.autorelabel

📌 Why?

• Without relabeling, you might face login failures due to incorrect SELinux contexts.

✅ If the command executes without errors, proceed to the final step.

📌 Step 5: Reboot the System and Verify

🔹 Exit the chroot environment and reboot the system:

sh-4.4# sync
sh-4.4# exit
switch_root:/# exit

🔹 After the system reboots, log in as root with the new password:

login: root
Password: SecurePass123

✅ If login is successful, the password reset was successful!

📌 Step 6: Confirm SELinux Relabeling (Optional)

🔹 Check if SELinux relabeling was performed:

[root@node2 ~]# ls -Z /

📌 Expected Output:

drwxr-xr-x. root root system_u:object_r:root_t:s0 /

✅ If SELinux labels are correct, the reset process is complete.

✅ Final Summary

✔ Booted into emergency mode and remounted the filesystem
✔ Used chroot to reset the root password
✔ Ensured SELinux relabeling to avoid login failures
✔ Successfully logged in with the new password

📌 Next Lab: Setting Up Default Package Repositories in RHEL 9

📩 Subscribe for more RHCSA exam labs and hands-on tutorials!