Forgot your Ubuntu password? Reset it from GRUB recovery mode: hold Shift during boot to get the GRUB menu, pick ‘Advanced options for Ubuntu’, boot into recovery mode, drop to root shell, then passwd username and reboot. The fix takes 2 minutes and works on any Ubuntu install where you have physical/console access (or cloud serial console).
Table of contents
- Access GRUB menu
- Boot to recovery mode
- Remount filesystem read-write
- Reset the password
- Reboot
- Cloud-specific paths
- FAQ
Access GRUB menu
On a local machine: hold Shift during boot to get the GRUB menu. On UEFI systems: usually Esc or Shift. On cloud instances: the cloud provider’s serial/console access (AWS EC2 Serial Console, GCP Serial Console, Azure Boot Diagnostics) gets you to the GRUB menu or similar.
The team that has console access has the recovery path. The team that doesn’t (no KVM, no serial console) needs the cloud provider’s recovery flow.
Boot to recovery mode
In GRUB:
- Select ‘Advanced options for Ubuntu’.
- Select the recovery mode entry (the one with ‘(recovery mode)’ suffix).
- Wait for the recovery menu to load.
The recovery menu has options: resume, clean, dpkg, fsck, grub, network, root. The team that picks ‘root’ gets a root shell with the filesystem potentially mounted read-only.
Remount filesystem read-write
The root filesystem in recovery mode is usually mounted read-only. To make changes:
mount -o remount,rw /
mount -a # mount all other filesystems defined in fstabThe team that skips this and runs passwd gets Authentication token manipulation error because the filesystem isn’t writable.
Reset the password
With the filesystem writable:
passwd username
# Enter new password twiceIf the user is in LDAP or another remote auth (less common for Ubuntu), passwd doesn’t work - the team that uses passwd on local users succeeds.
For the root user specifically:
passwd rootThe team that has forgotten their own user password uses passwd <their-username> (run as root in the recovery shell).
Reboot
After resetting the password:
reboot
# or
shutdown -r nowThe new password works immediately. The team that reboots cleanly has the fix done.
If the GRUB menu is password-protected (rare on Ubuntu but possible), the recovery path is harder - the team that set a GRUB password needs to know it.
Cloud-specific paths
On cloud instances:
AWS EC2: Use EC2 Serial Console (no SSH needed). Or detach the EBS volume, attach to another instance, mount, chroot, change password, reattach.
GCP: Use Serial Console (no SSH needed). Same workflow.
Azure: Use Boot Diagnostics Serial Console. Same workflow.
DigitalOcean / Linode / Vultr: Use the VNC/rescue mode in the control panel. Mount the disk, chroot, change password.
The team that uses the cloud provider’s serial console has the cleanest path.
FAQ
Can I reset Ubuntu password without recovery mode?
Yes - via the cloud provider’s serial console (works like recovery mode), or by mounting the disk on another instance. The team that has either path doesn’t need physical access.
What if the user account uses LDAP or SSO?
The local passwd doesn’t help. The team that uses LDAP/SSO needs to reset the password in the directory (Active Directory, LDAP server, Okta, etc.). The local recovery shell only resets local user passwords.
Can I prevent password resets this way?
Yes - set a GRUB password and enable Secure Boot + UEFI password. The team that has BIOS/UEFI password + GRUB password + disk encryption (LUKS) has layered protection against this attack vector.
What about LUKS-encrypted disks?
You need the LUKS passphrase to unlock the disk at boot. If you’ve forgotten both the LUKS passphrase AND the user password, the data is essentially unrecoverable without the LUKS key. The team that stores the LUKS passphrase in a password manager avoids this scenario.
Is there a way to reset from the login screen?
No - the login screen requires the password you don’t have. Recovery mode is the standard path. The team that sets up automatic login (not recommended for production) at least avoids the password prompt, but at the cost of security.
If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.
Useful related references: