How to Boot into Single User Mode on RHEL 8, 9 and 10

Updated: 17 October 2026 · Applies to: RHEL, AlmaLinux and Rocky Linux 8, 9 and 10 (rescue and emergency targets tested with systemd 252 on AlmaLinux 9.8 and systemd 257 on AlmaLinux 10.2; dracut 057 and 107 checked)

On RHEL 8, 9 and 10, single user mode is called rescue mode (the systemd rescue.target). To boot into it, stop the GRUB menu, press e, add systemd.unit=rescue.target to the end of the line that starts with linux, press Ctrl+X and enter the root password. The old keyword single at the end of that line does the same; we tested both with systemd on AlmaLinux 9 and 10. The same steps work on AlmaLinux and Rocky Linux.

CentOS 7 and CentOS Linux 8 are end of life and get no more updates. The steps are the same there, except that on CentOS and RHEL 7 the kernel line can start with linux16 instead of linux.

Rescue mode or emergency mode?

• Rescue mode (systemd.unit=rescue.target): according to Red Hat, the system mounts the local file systems and starts only essential services, without network. Use it to fix a broken service, /etc/fstab entry or configuration file.
• Emergency mode (systemd.unit=emergency.target): the most minimal mode. Only the root file system is mounted, read-only, and nothing else starts. Use it when rescue mode fails, for example because a disk in /etc/fstab cannot be mounted. Run mount -o remount,rw / before you edit files.

Both modes ask for the root password. They do not help if you have forgotten it: for that, see the last section.

1. Open the console and reach the GRUB menu

Single user mode has no network, so you need a console that shows the server's screen, not SSH.

1. On a Ucartz VPS, open the VNC console of your VPS from the client area (Services > My Services > your VPS). The steps are in how to access your VPS via VNC. On a dedicated server, use the IPMI or KVM console if your server has one, or ask our support team.
2. Restart the server, for example with reboot in the console or as described in rebooting your VPS from the client area.
3. Watch the console. When the GRUB menu appears, press an arrow key to stop the countdown. If the menu flashes past too quickly, see how to change GRUB settings before booting.

2. Boot into single user (rescue) mode

1. Select the kernel entry you normally boot (usually the first) and press e.
2. Move to the line that starts with linux and press Ctrl+E to jump to its end.
3. Type a space and systemd.unit=rescue.target (or systemd.unit=emergency.target for emergency mode).
4. Press Ctrl+X to boot. The change is for this boot only; GRUB forgets it afterwards.
5. Enter the root password. On AlmaLinux 10.2 our test showed:

   You are in rescue mode. After logging in, type "journalctl -xb" to view
   system logs, "systemctl reboot" to reboot, or "exit"
   to continue bootup.
   Give root password for maintenance
   (or press Control-D to continue):

   On AlmaLinux 9.8 the second and third lines read "systemctl default" or "exit" to boot into default mode.
6. Do your repair, then run systemctl reboot to restart normally, or systemctl default to continue to the normal system.

You can also switch a running server into these modes with systemctl rescue or systemctl emergency. This stops the network and your SSH session, so run it only from the console. It worked the same way in our tests.

3. "Cannot open access to console, the root account is locked"

If your server has no root password (root login disabled, SSH keys and sudo only), rescue mode stops with:

Cannot open access to console, the root account is locked.
See sulogin(8) man page for more details.

Press Enter to continue.

Pressing Enter just continues the boot. To get a root shell anyway, add both options to the linux line:

systemd.unit=rescue.target systemd.setenv=SYSTEMD_SULOGIN_FORCE=1

According to the systemd documentation, SYSTEMD_SULOGIN_FORCE=1 skips the password question when the root password is not available. In our tests on AlmaLinux 9.8 and 10.2, the prompt changed to Press Enter for maintenance and gave a root shell without a password. It only works when root is locked, not when root has a password you have forgotten.

4. Reset a forgotten root password

On a Ucartz VPS, the quickest way is from the client area: see how to change the VPS root password using the client area. To do it from the boot menu instead:

RHEL, AlmaLinux and Rocky Linux 8 and 9: rd.break

1. At the GRUB menu, press e and add rd.break to the end of the linux line. Press Ctrl+X.
2. You get a switch_root:/# shell before the real system starts. Run:

   mount -o remount,rw /sysroot
   chroot /sysroot
   passwd root
   touch /.autorelabel
   exit
   exit

3. The server relabels its files for SELinux and reboots by itself, which can take several minutes on a large disk. Log in with the new password.

These are Red Hat's steps for RHEL 9. We read the emergency shell script in AlmaLinux 9.8's dracut 057: it starts a plain shell, so no password is asked.

RHEL, AlmaLinux and Rocky Linux 10: init=/bin/bash

On version 10, the rd.break shell asks for the root password first (Give root password for maintenance), which is no help when the password is lost. We checked why on AlmaLinux 10.2: dracut 107 starts its emergency shell through sulogin, and an initramfs built in the default host-only mode contains a copy of root's password entry from /etc/shadow. Use init=/bin/bash instead, which the dracut manual describes as the program to start after the initramfs has finished:

1. At the GRUB menu, press e, add init=/bin/bash to the end of the linux line and press Ctrl+X.
2. You get a root shell with the disk still read-only. Run:

   mount -o remount,rw /
   passwd root
   touch /.autorelabel
   exec /usr/sbin/init

3. The last command hands over to systemd, which continues the boot (we checked that this hand-over from a bash shell works), relabels the files because of /.autorelabel and reboots once by itself.

Do not skip touch /.autorelabel: without it, the new /etc/shadow can carry the wrong SELinux label and the login can fail.

Other options

• If GRUB itself is broken or the server does not boot at all, boot a rescue system: on a Ucartz VPS see how to enable rescue mode in Virtualizor, and for GRUB repairs reinstall GRUB2 from rescue mode.
• For Ubuntu and Debian recovery mode and more about emergency mode, see booting into emergency and recovery mode.
• Anyone with console access can use these steps. If that is a concern, protect GRUB with a password as described in Red Hat's kernel documentation.

Official documentation: Red Hat: managing systemd (rescue and emergency mode) and systemd environment variables.