Raspbian by default is configured so that the root account can't be logged into using a password. This is done by starting with an entry in /etc/password
which begins:
root:x:0:0:
The fields are separated by colons and explained in man 5 passwd
(note the 5
, since man passwd
will give you the man page for the command passwd
; section 5 is for configuration files, and in this case they have the same name). Here the first one is the name (root
), the third and fourth are the numerical uid and gid (both 0
), and the second is for the password. For most entries this will be x
, indicating the actual password is in another file, /etc/shadow
.
Note that "the actual password" is not really stored anywhere. What's stored in shadow
is a one-way hash of the actual password. A one way hash is the result of a process which will always produce the same thing (allowing your password to be verified), but is irreversible. In other words, if someone gets their hands on shadow
, there is no way to deduce the password from the hash. However, if they can modify shadow
, obviously they can disable or change what will work as a password. But they will never be able to discover your passwords. This is why even root
cannot do that (although root can always change them to something else without needing the original).
In root's case, the entry in shadow
starts like this, as it does for most other system accounts:
root:*:
The *
indicates there is currently no possible password which could be used for this account.
The root user can change this, however, using the passwd
command to set a new password, which will replace the *
with the hash mentioned earlier (these always begin $n$
where n
is some random value that's used as the "salt" for the hash, but you don't need to understand that).
Anyway, when I set up a card from a fresh image the first thing I do is go into /etc/passwd
and remove the x
so root's entry now starts:
root::0:0
Notice there's now no second field. This means there's no password and all you have to do is type root
at a login prompt and you are logged in as root
. You can then use passwd
to set one.
So, you have two choices here but they both require you take the card out of the pi and access the second partition from another system (that can read/write ext4 partitions).
Restore sudoers
. If you have a reference image this is easy, you can just put it back the way it was by replacing it. Otherwise it is the more complicated option since you must know what you are doing (and your track record with sudoers
is not so good...).
Edit /etc/passwd
and remove that x
as described above, put the card back in, log in as root
, create a password. Of course, you'll still need to fix sudoers
, but trial and error will be made easier since if you are really root
, you will always be able to access it.
If you don't have a system that can access ext4 filesystems (a Debian "live CD" is a good choice here), then you're stuck. You'll have to reflash the card and start again.