Change/reset password WITHOUT monitor/keyboard

Question

I forgot the password to my Pi, but don't have access to a compatible monitor/keyboard. I've seen methods like these but they all involve editing cmdline.txt and then booting with a monitor and keyboard attached to run passwd pi from the main console. Is there a way I could do a similar thing (or something completely different to the same effect) but where I can interact via SSH/console cable?

Answer 1

The password isn't actually stored anywhere on the system, a one way hash of it is. This means even if you have the hash, you won't be able to deduce the password.

The hash itself is stored in /etc/shadow. Take the SD card out and stick it in another linux system; any common distro (ubuntu, fedora, arch, etc.) should do. On that system, create a new temporary user -- do all this via sudo or as root:

> useradd tmpuser
> grep tmpuser /etc/shadow
tmpuser:!:16406:0:99999:7:::

The last line of output is just an example but that's more or less what you should see. There might be two exclamation marks. Now open /etc/shadow, find that line (the one starting with tmpuser, or whatever name you used) and remove the ! (or two) from between the first two colons, so it is tmuser::16406.... This makes this a passwordless account. Now:

> su tmpuser
> passwd
Enter new UNIX password:

Go ahead and enter a password. This creates a hash in /etc/shadow; if you run grep tmpuser /etc/shadow you'll now see a long string between the first two colons; it probably begins with $6$,, eg.

tmpuser:$6$jlBY96dq$V7tFs2xEv.a3kXArkyTEcEbGDX43d6UpzMcy/aplV8khxUFJKPMg0ugGBfWVZMpJRpaMXAATEAb5inu7/G.Iz1:16406:0:99999:7:::

If that's not there try sudo pwconv and check again (man pwconv explains this).

Now open the /etc/shadow file on the second partition of the SD card, i.e., the one used on the pi. In there you'll find a line beginning with pi or whatever user it is you are interested in. It will have a long string between the first two colons as above. Erase that (only the stuff between the first two colons!) and replace it with the string from tmpuser on the current system.

You could just remove it and leave the account passwordless, but I think you may then have problems with ssh. Whereas this method is pretty foolproof.

Unmount the partition, take the card out, boot it in the pi, and the password will be whatever you created above. You can then change that with passwd if you want.

To remove the temporary user you created for this purpose on the other system (n.b., you could always skip that and just use the hash from an account you know the password for):

> userdel tmpuser

Answer 2

You don't have to create a temporary user on a different system to generate a password hash. You can do it without root access by running:

openssl passwd -salt "salt" "password"

That gives you the hash string (using CRYPT) which you'll need to somehow put in /etc/shadow file on the SD card. If you want to use a different hash function (CRYPT is very old and insecure by now), passing -1 as an extra argument will generate an MD5 password (also insecure), -5 a SHA256 and -6 SHA512.

Another solution is to simply take the complete /etc/shadow from a working Raspbian image. This is only viable if you didn't create new users though.

Answer 3

A "similar thing" that comes to my mind:

1. Unplug SD card (data loss may occur...)
2. Put SD card into another machine running Linux
3. Access the SD card and open /etc/shadow
4. Replace the password hash for root
5. ???
6. profit

Answer 4

Another easy thing you can do is leave the password empty on /etc/passwd mounted on your laptop e.g. by modifying a pre-existing pi user line to be:

pi::1000:1000:,,,:/home/pi:/bin/bash

This then allows you to login without a password, it just logs in automatically after typing the username pi. You can then add a password if you want after logging into the pi with passwd.

Tested on Raspberry Pi 3, Raspbian 9.4.