SUSE Support

Here When You Need Us

Avoid inconsistent root password between OS and Dracut

This document (000020318) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server 12

Situation

In some situations, the system does not boot and stops at the dracut shell (e.g. dracut is not able to find the root disk or rd.break is used on the boot options line):  
Entering emergency mode. Exit the shell to continue.
Type "journalctl" to view system logs.
You might want to save "/run/initramfs/rdsosreport.txt" to a USB stick or /boot
after mounting them and attach it to a bug report.


Give root password for maintenance
(or press Control-D to continue):

Login incorrect

Give root password for maintenance
(or press Control-D to continue:
sh-4.4#
The system will ask for the root password for debugging, however the password could be rejected and system prints Login incorrect

Resolution

To avoid the problem, run mkinitrd every time the root password is changed. This command will recreate the initrd file and update the password for the dracut shell.

If you'll get the "Login incorrect" message and don't know the correct root password, chroot the installed system and run mkinitrd to update root's password in the ramdisk.
  1. Boot into rescue mode from the installation media
  2. Mount the root device to /mnt
    1. # mount /dev/root/device /mnt
  3. Rebind proc, sys, dev and run 
    1. # for i in dev proc sys run ; do mount -o bind /$i /mnt/$i ; done
  4. Run chroot /mnt
  5. Make sure all system devices are mounted. Most of the time, you can simply run:
    1. # mount -a
  6. Run mkinitrd
  7. Confirm the root password is the same
    1. # grep root /etc/shadow
    2. # lsinitrd /boot/initrd /etc/shadow
  8. Exit and reboot
NOTE: While you have chrooted the installed system, it would be a good time to resolve the root cause of the server dropping into the dracut shell.
 

Cause

The root password in /etc/shadow and the /boot/initrd ramdisk do not match. The initrd file has a copy of the root password. You can compare root's password with the following commands. The output for both commands should be the same.
server:~ # grep root /etc/shadow
server:~ # lsinitrd /boot/initrd /etc/shadow
The problem usually happens when the system has remained outdated. Long running, unpatched systems with regular root password changes will cause above behaviour. However, changing root's password once without updating the ramdisk will also cause the issue.

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.

  • Document ID:000020318
  • Creation Date: 02-Jul-2021
  • Modified Date:08-Jul-2021
    • SUSE Linux Enterprise Server

< Back to Support Search

For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback[at]suse.com

tick icon

SUSE Support Forums

Get your questions answered by experienced Sys Ops or interact with other SUSE community experts.

tick icon

Support Resources

Learn how to get the most from the technical support you receive with your SUSE Subscription, Premium Support, Academic Program, or Partner Program.

tick icon

Open an Incident

Open an incident with SUSE Technical Support, manage your subscriptions, download patches, or manage user access.