6

I forgot the password to my Pi, but don't have access to a compatible monitor/keyboard. I've seen methods like these but they all involve editing cmdline.txt and then booting with a monitor and keyboard attached to run passwd pi from the main console. Is there a way I could do a similar thing (or something completely different to the same effect) but where I can interact via SSH/console cable?

11

The password isn't actually stored anywhere on the system, a one way hash of it is. This means even if you have the hash, you won't be able to deduce the password.

The hash itself is stored in /etc/shadow. Take the SD card out and stick it in another linux system; any common distro (ubuntu, fedora, arch, etc.) should do. On that system, create a new temporary user -- do all this via sudo or as root:

> useradd tmpuser
> grep tmpuser /etc/shadow
tmpuser:!:16406:0:99999:7:::

The last line of output is just an example but that's more or less what you should see. There might be two exclamation marks. Now open /etc/shadow, find that line (the one starting with tmpuser, or whatever name you used) and remove the ! (or two) from between the first two colons, so it is tmuser::16406.... This makes this a passwordless account. Now:

> su tmpuser
> passwd
Enter new UNIX password:

Go ahead and enter a password. This creates a hash in /etc/shadow; if you run grep tmpuser /etc/shadow you'll now see a long string between the first two colons; it probably begins with $6$,, eg.

tmpuser:$6$jlBY96dq$V7tFs2xEv.a3kXArkyTEcEbGDX43d6UpzMcy/aplV8khxUFJKPMg0ugGBfWVZMpJRpaMXAATEAb5inu7/G.Iz1:16406:0:99999:7:::

If that's not there try sudo pwconv and check again (man pwconv explains this).

Now open the /etc/shadow file on the second partition of the SD card, i.e., the one used on the pi. In there you'll find a line beginning with pi or whatever user it is you are interested in. It will have a long string between the first two colons as above. Erase that (only the stuff between the first two colons!) and replace it with the string from tmpuser on the current system.

You could just remove it and leave the account passwordless, but I think you may then have problems with ssh. Whereas this method is pretty foolproof.

Unmount the partition, take the card out, boot it in the pi, and the password will be whatever you created above. You can then change that with passwd if you want.

To remove the temporary user you created for this purpose on the other system (n.b., you could always skip that and just use the hash from an account you know the password for):

> userdel tmpuser
  • 2
    You sir are awesome. Thats a neat hack :) – Aniket Thakur Dec 13 '16 at 11:54
  • Upvote - great instructional answer. – SDsolar Mar 28 '17 at 21:39
  • i had tried days with everything else since i dint have a display for my pi! This is a perfect hack for those who dont have a display! @goldilocks is the best – Prashanth Benny Oct 20 '17 at 19:10
  • if there are any permission issues to etc/shadow, in console change permissions to the file by executing this line sudo chmod 777 /etc/shadow in the terminal. Also dont forget to revert the permissions by executing sudo chmod 755 /etc/shadow – Prashanth Benny Oct 20 '17 at 19:13
  • 2
    @PrashanthBenny the default flags for /etc/shadow seems to be 640, i.e. readable by root group and not visible by others. – Joël Mar 24 at 15:04
1

A "similar thing" that comes to my mind:

  1. Unplug SD card (data loss may occur...)
  2. Put SD card into another machine running Linux
  3. Access the SD card and open /etc/shadow
  4. Replace the password hash for root
  5. ???
  6. profit

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.