There are a few times where my computer will "forget" my root password. This effects my ability to use sudo as well using the login manager (ie. locking the computer and trying the password there also fails).

Keep in mind, I am 100% confident that I'm not making a typo; I've typed it out to ensure I'm typing it correctly, copy-pasted it, even verified that I remembered the password correctly by using it on a different device that I know uses identical passwords.

I can fix it "easily" by resetting the computer (though it's obviously annoying). It's only happened two or three times in the past-year, but it's still a really odd thing to happen.

Any idea why the computer "forgets" the root password?

The only thing I can think of is a bit flip in memory, but that's assuming that the root password is stored in memory (not sure if that's true or not) and for the bit-flip itself to happen (which is exceedingly rare from what I can tell).

If distribution is of any consequence, I'm running Manjaro-i3.

  • Is it possible that something modifies /etc/shadow or /etc/passwd? Jan 9 '21 at 21:16
  • Maybe. The most recent one (a few minutes ago) was on a software update using yay. Said software update was building MPICH, which took about 15 or so minutes to do (at 100% CPU usage). I don't see why/how that process would be able edit those files. Jan 9 '21 at 21:19
  • 1
    You've set up sudo to use the root password? Jan 9 '21 at 21:54
  • 1
    @MichaelHomer I'm not sure. I may be conflating root password and the password I use to get root permissions. Jan 9 '21 at 22:59
  • 2
    If you're using sudo, you're supplying your login password. sudo remembers that you have authenticated for a while, and, for convenience, doesn't require reauthorization. If the time since your previous sudo command is greater than this time, sudo requires reauthorization. See man sudoers
    – waltinator
    Jan 10 '21 at 1:17

If your system "forgets" the root password, it means that something has written over the root password in /etc/shadow. It's rare for any software (other than user-administration applications) to touch /etc/shadow. I've never seen it. Instead, I think it's worth clarifying when you may need to enter your root or user password. Here's a brief explanation that might help:

For a basic install, you'll generally have two non-system users: root and yourself james. Each non-system user has its own password.

  • If you ever switch users (i.e. su root or su james), you need to enter the password of the user you are switching to.
  • If you use sudo, you need to enter the password of the current user. /etc/sudoers defines the rules about who you are allowed to pretend to be, but other users (including root) do not need to share their passwords with you.
  • If you use pollkit/pkexec (often used by gui applications) a GUI dialog will appear and tell you which user you need to authenticate as. If it says something like: "Enter the administrator's password", it's asking you for the root password, not your user's password. To make it ask for your user's password, there needs to be some pollkit rules to define what your user is allowed to do (similar to sudo's /etc/sudoers).

If you are sure that /etc/shadow is actually being changed without your authorization, that could be a sign of malice software which already has root privileges.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.