Here is how to reset the root password on AlmaLinux when you are locked out and SSH is not an option. AlmaLinux inherits SELinux from its RHEL heritage, which adds one extra step compared to other distributions, so this guide covers that too. The fix does not need a reinstall. It needs about five minutes with the console.
What you need
- A Hostner dedicated server running AlmaLinux
- Access to your Hostner KVM/IPMI console (this only works through the console, not SSH)
- A few minutes where the server can reboot
Step 1: Open the console and reboot
Log into your Hostner dashboard and open the KVM/IPMI console for your server. With the console window open, trigger a reboot from the dashboard’s power controls. Watch the console closely. The GRUB boot menu only shows for a few seconds before it boots automatically.
Step 2: Edit the boot line in GRUB
When the GRUB menu appears, use the arrow keys to highlight your AlmaLinux boot entry (do not press Enter yet). Press e to edit it. You will see a block of boot parameters. Find the line starting with linux. At the end of that line, add:
~ $ rd.break
Press Ctrl+X to boot with this change.
Step 3: Reset the root password on AlmaLinux
You should now land in an emergency shell, a minimal environment SELinux and the rest of the system have not fully loaded into yet. Remount the filesystem as writable:
~ $ mount -o remount,rw /sysroot
Change into the new root and set a new password:
~ $ chroot /sysroot ~ $ passwd root
Type the new password twice when asked.
Step 4: Handle SELinux and reboot
Because AlmaLinux runs SELinux by default, the password file needs to be relabeled on next boot, or you risk getting locked out again by a mismatched security context. Run:
~ $ touch /.autorelabel ~ $ exit ~ $ exit
The server will reboot and take a bit longer than usual while it relabels the filesystem. That is expected, let it finish. Log in with the new password once it comes back up.
If it does not work
If the GRUB menu does not appear at all, you likely missed the short window before autoboot. Reboot again and press a key (any key) the moment the console shows POST output, then try again. If the relabel takes an unusually long time or the server does not come back up, give it a few extra minutes before assuming something failed, a full SELinux relabel on a large disk genuinely takes longer than a normal boot. The Red Hat documentation on SELinux explains what relabeling actually does, since AlmaLinux follows the same SELinux model.
No ticket for this one. A few minutes in the console, one extra step for SELinux, and you are back in as root.
Prevent this next time
Write down that your server runs SELinux in enforcing mode somewhere your future self (or the next admin) will actually see it. The relabel step in this guide only matters because SELinux is active, and that detail is easy to forget when it is not the thing currently causing you a headache. The same applies to anyone else who manages this server after you, a short note in your documentation saves them the same five minutes of confusion.