How to Reset a Forgotten Password on Ubuntu Server (Recovery Mode)
It happens: the server's been running untouched for a year, you need to log in at the console, and the password is gone. Or you removed yourself from the sudo group by accident. As long as you can get to the machine's keyboard, Ubuntu's recovery mode gives you a root shell to fix it. No reinstall, no data lost.
Quick reference
| Step | What |
|---|---|
| Get the boot menu | Hold Shift (BIOS) or tap Esc (UEFI) as it starts |
| Pick | Advanced options for Ubuntu → ... (recovery mode) |
| Get a writable root shell | root from the menu, then mount -o remount,rw / |
| Reset a password | passwd john |
| Restore sudo | usermod -aG sudo john |
| Leave | reboot |
1. Get to the GRUB menu
Reboot the server with the keyboard and monitor connected. As it starts, hold Shift (older BIOS machines) or tap Esc repeatedly (UEFI). You'll get a menu with Ubuntu and Advanced options for Ubuntu.
If it boots straight through, try again and start pressing earlier — the window is short.
2. Boot into recovery mode
Choose Advanced options for Ubuntu, then the top entry ending in (recovery mode). After a few seconds a blue Recovery Menu appears.
3. Get a root shell
Arrow down to root — Drop to root shell prompt and press Enter, then Enter again at "Press Enter for maintenance". You're now root with no password asked.
The disk is read-only at this point, so make it writable:
mount -o remount,rw /
4. Fix the problem
Forgotten password:
passwd john
Type the new one twice. (For a user whose name you've forgotten, ls /home lists them.)
Lost sudo:
usermod -aG sudo john
Locked out by SSH key changes: edit /etc/ssh/sshd_config with nano and set PasswordAuthentication yes temporarily.
Server won't boot because of a bad fstab line: nano /etc/fstab, put # in front of the offending line.
5. Reboot
reboot
Log in normally with the new password.
If there's no GRUB menu at all
Cloud servers (DigitalOcean, Hetzner, AWS) don't give you a keyboard. Each has a console or recovery option in its web dashboard that does the same thing — look for "Recovery", "Rescue mode" or "Console access". Raspberry Pi: take the SD card out, mount it on another computer, and edit /etc/shadow or add your key to /home/user/.ssh/authorized_keys directly.
Someone with physical access can do this too
Yes. Recovery mode is deliberately easy, which means anyone who can touch the machine can reset its passwords. For a server in a cupboard at home that's fine. If it matters, set a GRUB password and enable full-disk encryption at install time — but then a reboot needs someone at the keyboard to type the passphrase.
Troubleshooting
"Authentication token manipulation error" from passwd. You skipped the mount -o remount,rw / step.
Recovery mode asks for a root password. Someone set one. Try it; if unknown, add init=/bin/bash to the kernel line instead: at the GRUB menu press e on the normal entry, find the line starting linux, add init=/bin/bash to the end, press Ctrl + X. Then mount -o remount,rw / and passwd as above.
Keyboard doesn't work at the GRUB menu. USB keyboards sometimes aren't initialised that early. Use a different USB port (USB 2 ports, usually black) or enable Legacy USB in the BIOS.
Wrapping up
Shift or Esc at boot, recovery mode, root shell, remount read-write, passwd. Five minutes, and the lesson is the one you already knew: keep passwords in a password manager and SSH keys on more than one computer.
