Losing your password in Ubuntu Linux

Posted by BigWhale on April 29th, 2009 in Software | 0 comments

: Image via Wikipedia

Every now and then people lose or forget their passwords. Sometimes you’ll have this need to hack into someone’s computer. Well, this is a basic tutorial on how to change your password even if you can’t login in the system since you forgot your password.

We’ll need:

Running computer with Ubuntu and no known passwords
Ubuntu 8.10¹ Bootable Live CD
Dumb user like me who forgot his own password

So, your computer is booted and you need to enter your user name and password. The problem is that you don’t know what the latter thing is. You have absolutely no idea what your password is. You tried to enter all 50 passwords you managed to remember with all possible upper/lower case combination and nothing worked. You are getting pretty desperate, cursing outloud and from minute to minute you are turning into a nervous wreck. What now?

Fetch that Ubuntu Live Bootable CD. Put it in your CD-ROM drive and reboot your computer. If you’re running Ubuntu there will be a menu in the lower left corner of the screen. Click on it and select Reboot. Make sure you computer has CD-ROM set as bootable device. When computer reboots select language and then pick the first option. Try Ubuntu without installing.

Wait for Ubuntu to load.

Grab the mouse and start clicking on Applications | Accessories | Terminal

Don’t be afraid if this is the first time you see terminal window and you have absolutely no idea on what to do next. First you will have to figure out on which disk drive and partition is your installation and how this device is called. I’ll give few guidelines how to do this and usually it will take some experimenting. First you’ll have to become a super user – root.

$ sudo -s

You will notice that your prompt $ turned into a #.

In general if you have plain old IDE hard drives then your first hard drive is /dev/hda second is /dev/hdb and so on and so on. If you have SATA or SCSI drives then things can get a little more complicated. Run this command:

$ dmesg | grep sd[a-f]

Your output will probably look very cryptic something similar to this:

[ 9.555945] sd 2:0:0:0: [sda] 625142448 512-byte hardware sectors (320073 MB) [ 9.555962] sd 2:0:0:0: [sda] Write Protect is off [ 9.555964] sd 2:0:0:0: [sda] Mode Sense: 00 3a 00 00 [ 9.555990] sd 2:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA [ 9.556093] sd 2:0:0:0: [sda] 625142448 512-byte hardware sectors (320073 MB) [ 9.556108] sd 2:0:0:0: [sda] Write Protect is off [ 9.556110] sd 2:0:0:0: [sda] Mode Sense: 00 3a 00 00 [ 9.556137] sd 2:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA [ 9.556139] sda:<6>scsi10 : SBP-2 IEEE-1394 [ 9.569158] sda1 sda2 sda3 sda4 < sda5 sda6 sda7 > [ 9.616280] sd 2:0:0:0: [sda] Attached SCSI disk [ 9.617134] sd 4:0:0:0: [sdb] Attached SCSI removable disk [ 9.617882] sd 4:0:0:1: [sdc] Attached SCSI removable disk [ 9.618630] sd 4:0:0:2: [sdd] Attached SCSI removable disk [ 9.619379] sd 4:0:0:3: [sde] Attached SCSI removable disk [ 9.661304] sd 5:0:0:0: [sdf] 1953525168 512-byte hardware sectors (1000205 MB) [ 9.693714] sd 5:0:0:0: [sdf] Write Protect is off [ 9.693718] sd 5:0:0:0: [sdf] Mode Sense: 10 00 00 00 [ 9.713915] sd 5:0:0:0: [sdf] Cache data unavailable [ 9.713919] sd 5:0:0:0: [sdf] Assuming drive cache: write through [ 9.757831] sd 5:0:0:0: [sdf] 1953525168 512-byte hardware sectors (1000205 MB) [ 9.783676] sd 5:0:0:0: [sdf] Write Protect is off [ 9.783679] sd 5:0:0:0: [sdf] Mode Sense: 10 00 00 00 [ 9.804417] sd 5:0:0:0: [sdf] Cache data unavailable [ 9.804421] sd 5:0:0:0: [sdf] Assuming drive cache: write through

Here you can see that I have at least six SATA or SCSI drives in my computer. Pay attention to the following lines:
[ 9.616280] sd 2:0:0:0: [sda] Attached SCSI disk [ 9.617134] sd 4:0:0:0: [sdb] Attached SCSI removable disk [ 9.617882] sd 4:0:0:1: [sdc] Attached SCSI removable disk [ 9.618630] sd 4:0:0:2: [sdd] Attached SCSI removable disk [ 9.619379] sd 4:0:0:3: [sde] Attached SCSI removable disk
Here you can see that I actually have just one disk that is attached and all others are removables. These can be anything from CD/DVD drives, USB card readers and even digital cameras that are connected to the computer.
So now we know that my hard drive is a device named sda. Now we have to find out on which disk partition our linux is installed.

# fdisk /dev/sda -l

And the output:

Device Boot Start End Blocks Id System /dev/sda1 * 1 19122 153597433+ 7 HPFS/NTFS /dev/sda2 19123 23074 31744440 c W95 FAT32 (LBA) /dev/sda3 23075 23317 1951897+ 82 Linux swap / Solaris /dev/sda4 23318 38913 125274870 5 Extended /dev/sda5 23318 26755 27615703+ 83 Linux /dev/sda6 26756 27242 3911796 82 Linux swap / Solaris /dev/sda7 27243 38913 93747276 83 Linux

I have two linux partitions, /dev/sda5 and /dev/sda7. Partition has to be mounted so that we can access it. Which one? Usually in most cases² this will be first, sometimes also smaller, partition. If you have only one linux partition then you have nothing to worry about. Also, make sure that you ignore Linux swap / Solaris partitions.

# mount /dev/sda5 /mnt

If you get any errors from mounting your partition is probably already mounted. You can then use mount command with no parameters to find out where the partition is mounted. Now we can chroot to that partition and change your password. Of course you replace the bigwhale after the passwd command unless your username is bigwhale, which is highly unlikely and will make me very uncomfortable. Passwd will ask you for a new password and confirmation of it. Make sure you will remember it this time!

# chroot /mnt # passwd bigwhale Enter new UNIX password: Retype new UNIX password: passwd: password updated successfully

What is mounting? What is chrooting? We’ll explain that at some other time. Right now we’re recovering, well resetting, your password. A little more typing is needed.

# exit # umount /mnt # exit # exit

Terminal window will probably close and you can safely reboot. Remove Ubuntu Live CD from your CD-ROM and wait patiently for your system to reboot. You should be able to login with your new password now.

So, now you’ve rebooted and successfully logged in with your new password. You tried to run Evolution to check your emails and got some strange error about keyrings and their passwords? You have to remember your old keyring password which was probably³ the same as your old login password, so you are stuck again. Open Terminal and then run this command:

$ rm ~/.gnome2/keyrings/default.keyring

Now you removed your default keyring and you’ll have to create new one. If default.keyring doesn’t exist try login.keyring or just delete all files in that directory⁴

You should be all set now.

Any other similar version will also work [↩]
Not all, but most. [↩]
In most cases, but not all [↩]
At your own risk of course [↩]

You can follow any responses to this entry through the RSS 2.0 feed.

Three Wise Men