Skip to content

How to boot into rescue mode

A system doesn't boot normally: it stops at "You are in emergency mode", a service hangs the boot, a bad /etc/fstab line or a broken configuration file keeps it from reaching a login prompt, or you've lost the root password. This guide gets you a root shell with as little of the system running as possible, so you can repair it and boot normally again.

Work down the options in order. Each one depends on less of the system than the one before; why that matters is explained in The Linux boot process.

Option Use it when
Switch a running system to rescue mode You can still log in, but need the system quiet to work on it
Rescue target Boot fails or hangs while starting services
Emergency target Boot fails while mounting filesystems, or rescue mode fails too
Break into the initramfs The installed system's init can't start, or you've lost the root password
init=/bin/bash Last resort when nothing else gives you a shell

What has been verified

The preparation steps, the commands in Repair the system that also work on a running system, and the final checks were run on Debian 13, Ubuntu 26.04, AlmaLinux 10, Rocky Linux 10, Arch and Gentoo with OpenRC. The boot-time procedures (editing the kernel command line in the GRUB menu for the rescue and emergency targets, the initramfs breaks, init=/bin/bash and OpenRC's single-user mode) and the commands run inside those shells have not been verified by running them: the verification labs are driven over SSH and can't yet operate a console while the machine boots.

Before you begin

  • You need console access: a physical keyboard and screen, a remote console (IPMI, iDRAC, iLO), or your hypervisor's or cloud provider's serial or VNC console. Rescue and emergency mode don't start the network, so you can't use SSH.
  • The rescue and emergency shells ask for the root password. Many cloud images ship with the root account locked. On systemd, adding SYSTEMD_SULOGIN_FORCE=1 to the kernel command line makes these shells start without a password when root is locked; otherwise use the initramfs or init=/bin/bash.

While the system still works, prepare it:

  1. Check whether root has a usable password. In the second field, L means the account is locked, NP that it has no password, and P that it has a usable password:

    $ sudo passwd -S root
root L 2026-11-03 0 99999 7 -1

    To set one, run sudo passwd root.

    Warning

    A root password is a credential that can log in on the console and, depending on your SSH configuration, over the network. Use a strong one and store it where your team keeps emergency credentials.

  2. Check that the rescue and emergency modes are available, and what the system boots into normally:

    systemctl cat rescue.target emergency.target
systemctl get-default

    systemctl cat rescue.target emergency.target
systemctl get-default

    systemctl cat rescue.target emergency.target
systemctl get-default

    With OpenRC, list the runlevels and check which one sysvinit starts by default (3, which /etc/inittab maps to OpenRC's default runlevel), and that runlevel S runs openrc single and sulogin:

    $ ls /etc/runlevels/
boot  default  nonetwork  shutdown  sysinit
$ grep -E 'initdefault|^l[12]:|^su' /etc/inittab
id:3:initdefault:
l1:1:wait:/sbin/openrc single
l2:2:wait:/sbin/openrc nonetwork
su0:S:wait:/sbin/openrc single
su1:S:wait:/sbin/sulogin

    Runlevel 1 only runs openrc single; runlevel S also starts sulogin, which gives you the root shell. With a systemd profile, use the commands from the other tabs (systemd profile, not verified).

    On systemd, both targets ship in /usr/lib/systemd/system/. rescue.target pulls in sysinit.target and rescue.service, and emergency.target pulls in only emergency.service; both services run systemd-sulogin-shell, which asks for the root password. systemctl get-default prints the normal target, usually multi-user.target on servers or graphical.target on desktops.

  3. Make sure the GRUB menu appears at boot. With a timeout of 0, GRUB boots straight away and you never get the chance to edit an entry.

    Settings in /etc/default/grub.d/*.cfg override /etc/default/grub, and cloud images use them: Debian 13's cloud image sets GRUB_TIMEOUT=0 in 15_timeout.cfg, Ubuntu 26.04's sets it in 50-cloudimg-settings.cfg.

    $ grep -sE '^GRUB_(TIMEOUT|TIMEOUT_STYLE|CMDLINE_LINUX|CMDLINE_LINUX_DEFAULT)=' /etc/default/grub /etc/default/grub.d/*.cfg
/etc/default/grub:GRUB_TIMEOUT=5
/etc/default/grub:GRUB_CMDLINE_LINUX_DEFAULT=""
/etc/default/grub:GRUB_CMDLINE_LINUX="console=tty0 console=ttyS0,115200 earlyprintk=ttyS0,115200 consoleblank=0"
/etc/default/grub.d/15_timeout.cfg:GRUB_TIMEOUT=0

    The last value read wins, so this Debian 13 system boots without showing the menu. Add a file that's read last and regenerate /boot/grub/grub.cfg:

    printf 'GRUB_TIMEOUT=5\nGRUB_TIMEOUT_STYLE=menu\n' | sudo tee /etc/default/grub.d/99-menu-timeout.cfg
sudo grub-mkconfig -o /boot/grub/grub.cfg

    GRUB reads one Boot Loader Specification entry per kernel from /boot/loader/entries/; grubby shows and changes them:

    $ grep -E '^GRUB_(TIMEOUT|CMDLINE_LINUX|CMDLINE_LINUX_DEFAULT|ENABLE_BLSCFG)=' /etc/default/grub
GRUB_TIMEOUT=0
GRUB_CMDLINE_LINUX="console=tty0 console=ttyS0,115200n8 no_timer_check biosdevname=0 net.ifnames=0"
GRUB_ENABLE_BLSCFG=true
$ sudo ls /boot/loader/entries/
$ sudo grubby --info=DEFAULT

    Set a timeout, make sure the menu isn't automatically hidden, and regenerate /boot/grub2/grub.cfg:

    sudo sed -i 's/^GRUB_TIMEOUT=.*/GRUB_TIMEOUT=5/' /etc/default/grub
sudo grub2-editenv - unset menu_auto_hide
sudo grub2-mkconfig -o /boot/grub2/grub.cfg

    $ grep -E '^GRUB_(TIMEOUT|TIMEOUT_STYLE|CMDLINE_LINUX|CMDLINE_LINUX_DEFAULT)=' /etc/default/grub
GRUB_TIMEOUT=1
GRUB_CMDLINE_LINUX_DEFAULT="rootflags=compress=zstd:1 console=tty0 console=ttyS0,115200"
GRUB_CMDLINE_LINUX="net.ifnames=0"
GRUB_TIMEOUT_STYLE=menu

    Give yourself enough time to press a key, and regenerate /boot/grub/grub.cfg:

    sudo sed -i 's/^GRUB_TIMEOUT=.*/GRUB_TIMEOUT=5/' /etc/default/grub
sudo grub-mkconfig -o /boot/grub/grub.cfg

    With systemd-boot instead of GRUB, set timeout 5 in loader/loader.conf on the EFI system partition; press e on an entry in its menu to edit its parameters for one boot.

    $ grep -E '^#?GRUB_(TIMEOUT|TIMEOUT_STYLE|CMDLINE_LINUX)=' /etc/default/grub
#GRUB_TIMEOUT=5
#GRUB_TIMEOUT_STYLE=menu
GRUB_CMDLINE_LINUX="console=ttyS0 console=tty0"

    Gentoo's /etc/default/grub ships with most settings commented out, and GRUB's built-in default is a 5-second menu. To make that explicit, so a later change elsewhere can't hide the menu, set it and regenerate /boot/grub/grub.cfg:

    sudo sed -i 's/^#\?GRUB_TIMEOUT=.*/GRUB_TIMEOUT=5/' /etc/default/grub
sudo grub-mkconfig -o /boot/grub/grub.cfg

    If you can't change the timeout in advance, hold Shift (BIOS) or press Esc (UEFI) repeatedly as GRUB starts; whether that works depends on the firmware and on how quickly GRUB starts.

  4. Make sure the log of a failed boot will still be there after you reboot to repair it:

    $ ls -d /var/log/journal
/var/log/journal

    The directory exists, so the journal of each boot is kept on disk.

    Some images, such as the AlmaLinux 10 cloud image, have no /var/log/journal/, so the journal is kept only in memory and lost at every reboot. Make it persistent, and move the current boot's log to disk:

    sudo mkdir -p /etc/systemd/journald.conf.d
printf '[Journal]\nStorage=persistent\n' | sudo tee /etc/systemd/journald.conf.d/50-persistent.conf
sudo systemctl restart systemd-journald
sudo journalctl --flush
ls -d /var/log/journal

    $ ls -d /var/log/journal
/var/log/journal

    The directory exists, so the journal of each boot is kept on disk.

    With OpenRC, logs go to your syslog daemon, usually /var/log/messages. To also keep OpenRC's own log of starting and stopping services, enable rc_logger in /etc/rc.conf; it's written to /var/log/rc.log:

    sudo sed -i 's/^#\?rc_logger=.*/rc_logger="YES"/' /etc/rc.conf
grep '^rc_logger=' /etc/rc.conf

  5. Note how the root filesystem is mounted when everything works, so you can compare later:

    $ findmnt /
TARGET SOURCE    FSTYPE OPTIONS
/      /dev/vda1 ext4   rw,relatime,discard,errors=remount-ro

Switch a running system to rescue mode

If you can still log in on the console, switch to rescue mode without rebooting. All services except a minimal set are stopped, including networking and SSH, and a root shell starts on the console.

Warning

This ends every SSH session and stops all network services. Only do it from a console.

sudo systemctl rescue

When you've finished, return with systemctl default (from the rescue shell) or reboot.

Warning

This ends every SSH session and stops all network services. Only do it from a console.

sudo systemctl rescue

When you've finished, return with systemctl default (from the rescue shell) or reboot.

Warning

This ends every SSH session and stops all network services. Only do it from a console.

sudo systemctl rescue

When you've finished, return with systemctl default (from the rescue shell) or reboot.

With OpenRC, where sysvinit is PID 1, switch to single-user mode, runlevel S. This stops the services in the default runlevel and starts sulogin on the console.

Warning

This ends every SSH session and stops all network services. Only do it from a console.

sudo telinit S

Return with telinit 3 from the single-user shell, or reboot.

Edit the kernel command line for one boot

The following options are one-time changes to the kernel command line, made in the GRUB menu. They aren't saved: the next boot is normal again.

  1. Reboot and wait for the GRUB menu.
  2. Select the entry you normally boot, and press e. If GRUB asks for a user name and password, the menu is password-protected and you need those credentials.
  3. Find the line that starts with linux (or linuxefi). It ends with parameters such as ro quiet or rw console=ttyS0.
  4. Move to the end of that line and add the parameter, separated by a space.
  5. Press Ctrl+X or F10 to boot with the change.

An edited linux line looks like this:

linux /vmlinuz-6.12.0-211.el10.x86_64 root=UUID=<ROOT-UUID> ro console=ttyS0,115200n8 systemd.unit=rescue.target

<ROOT-UUID> stands for whatever your entry already contains; change nothing but the end of the line. Remove quiet and rhgb or splash while you're there, to see the boot messages.

Boot into the rescue target

On systemd, add:

systemd.unit=rescue.target

systemd mounts the local filesystems, starts no services or network, and asks for the root password. Add SYSTEMD_SULOGIN_FORCE=1 as well if the root account is locked.

Debian's GRUB menu has "(recovery mode)" entries under "Advanced options"; they add single, which systemd treats the same as systemd.unit=rescue.target.

Ubuntu's recovery entry is different: it adds recovery nomodeset dis_ucode_ldr and starts Ubuntu's recovery menu (friendly-recovery), from which the root option opens a root shell. To reach rescue.target on Ubuntu, add systemd.unit=rescue.target yourself.

There's no recovery entry: GRUB_DISABLE_RECOVERY="true" is set. An entry whose title contains 0-rescue, where present, boots a kernel with a generic initramfs for hardware changes; it starts the normal target, not rescue mode.

There's no recovery entry (GRUB_DISABLE_RECOVERY=true in the default configuration).

With OpenRC, add single instead. sysvinit enters runlevel S, which runs openrc single and then sulogin; GRUB's "(recovery mode)" entry under "Advanced options" adds the same parameter.

Two other OpenRC options help when one service breaks the boot:

  • softlevel=<RUNLEVEL> boots into the named runlevel instead of default. <RUNLEVEL> is the name of a directory in /etc/runlevels/: one you created without the problem service, or the stock nonetwork runlevel, which contains only local.
  • With rc_interactive="YES" in /etc/rc.conf (set before the problem happens), pressing I early in the boot makes OpenRC ask before starting each service, so you can skip the broken one.

Boot into the emergency target

If rescue mode fails, usually because a filesystem in /etc/fstab can't be mounted, use the emergency target. Only a root shell starts. The root filesystem is mounted, often read-only, and nothing else from /etc/fstab is. A system that drops to "You are in emergency mode" by itself is already in this state.

Add systemd.unit=emergency.target instead.

Add systemd.unit=emergency.target instead.

Add systemd.unit=emergency.target instead.

OpenRC has no separate emergency level. Use init=/bin/bash.

Break into the initramfs

This stops the boot inside the initramfs, before the installed system's init runs. With dracut's rd.break and initramfs-tools' break=, you don't need a password.

On Ubuntu 26.04, whose initramfs is built with dracut, add rd.break. You get a switch_root:/# prompt, with the installed root filesystem mounted read-only at /sysroot. Make it writable, make /proc, /sys and /dev available inside it (needed by tools such as grub-mkconfig and update-initramfs), and change into it:

mount -o remount,rw /sysroot
for d in proc sys dev; do mount --rbind /$d /sysroot/$d; done
chroot /sysroot

On Debian 13, whose initramfs is built with initramfs-tools, add break=bottom. You get an (initramfs) prompt after the root filesystem has been mounted read-only at /root:

mount -o remount,rw /root
for d in proc sys dev; do mount --rbind /$d /root/$d; done
chroot /root

Make your fix (see Repair the system), then type exit twice: once to leave the chroot, once to let the boot continue.

Add rd.break. You get a switch_root:/# prompt, with the installed root filesystem mounted read-only at /sysroot. Make it writable, make /proc, /sys and /dev available inside it, and change into it:

mount -o remount,rw /sysroot
for d in proc sys dev; do mount --rbind /$d /sysroot/$d; done
chroot /sysroot

Make your fix (see Repair the system). No SELinux policy is loaded at this point, so files you create or change get no SELinux label or the wrong one; a changed /etc/shadow, for example, then stops every login. Whenever you've changed any file, schedule a relabel before leaving:

touch /.autorelabel

Then type exit twice: once to leave the chroot, once to let the boot continue. The next boot relabels the filesystem, which takes a few minutes, and reboots once more.

rd.break is a dracut option and doesn't apply to mkinitcpio images. The default mkinitcpio configuration runs systemd in the initramfs, so add:

rd.systemd.unit=emergency.target SYSTEMD_SULOGIN_FORCE=1

mkinitcpio's systemd hook puts a locked root account into the initramfs, so the emergency shell would refuse to start even if your root account has a password; SYSTEMD_SULOGIN_FORCE=1 tells it to start anyway. The root filesystem isn't mounted yet. Mount it at /sysroot, read-write, and change into it:

mount -o rw <ROOT-DEVICE> /sysroot
for d in proc sys dev; do mount --rbind /$d /sysroot/$d; done
chroot /sysroot

<ROOT-DEVICE> is the full path of the root device, for example /dev/vda3 or /dev/mapper/vg-root, or a UUID=… value as in the root= kernel parameter. On Btrfs, add the subvolume option the system normally uses, for example -o rw,subvol=@. Make your fix, then exit and reboot with systemctl reboot --force.

With an older busybox-based image (base and udev hooks instead of systemd), add break=postmount instead: you get a shell after root has been mounted at /new_root. Otherwise use init=/bin/bash.

If the initramfs was built with dracut, the common case, add rd.break. You get a switch_root:/# prompt, with the installed root filesystem mounted read-only at /sysroot:

mount -o remount,rw /sysroot
for d in proc sys dev; do mount --rbind /$d /sysroot/$d; done
chroot /sysroot

Make your fix (see Repair the system), then type exit twice. If you use a different initramfs generator, or none, use init=/bin/bash.

Start a shell instead of init

As a last resort, replace the init system with a shell. Add:

init=/bin/bash

The kernel starts bash as PID 1: no services, no other mounts, no password prompt, and usually a read-only root filesystem. Because bash is PID 1, the normal reboot and poweroff commands don't work, and exiting the shell makes the kernel panic. On RHEL, AlmaLinux and Rocky Linux, no SELinux policy is loaded in this shell either: whenever you change a file, run touch /.autorelabel before leaving, as after rd.break. Leave this mode as described at the end of Repair the system.

Warning

Anyone with console access can do this, unless the GRUB menu is password-protected or the disk is encrypted. That's a reason to protect consoles, not a reason to avoid the technique in an emergency.

Repair the system

In a rescue or emergency shell, or after init=/bin/bash, you're root. After an initramfs break, you're root inside the chroot, and the root filesystem is already writable.

  1. Check how the root filesystem is mounted. ro in the options means you can't change anything yet:

    # findmnt -no OPTIONS /
ro,relatime,errors=remount-ro

  2. Make it writable:

    # mount -o remount,rw /
# findmnt -no OPTIONS /
rw,relatime,errors=remount-ro

    In emergency mode, mount any other filesystem you need, for example mount /boot, or mount -a once /etc/fstab is fixed.

  3. Find the cause.

    Read the errors from the boot that failed, and list the units that failed:

    # journalctl -b -1 -p err --no-pager
# systemctl --failed --no-pager

    -b -1 is the previous boot; use -b for the current one if the failing boot dropped you into emergency mode by itself.

    Read the errors from the boot that failed, and list the units that failed:

    # journalctl -b -1 -p err --no-pager
# systemctl --failed --no-pager

    -b -1 is the previous boot; use -b for the current one if the failing boot dropped you into emergency mode by itself.

    Read the errors from the boot that failed, and list the units that failed:

    # journalctl -b -1 -p err --no-pager
# systemctl --failed --no-pager

    -b -1 is the previous boot; use -b for the current one if the failing boot dropped you into emergency mode by itself.

    With OpenRC, read the system log (/var/log/messages with sysklogd and most other syslog daemons), OpenRC's own log if you enabled rc_logger, and list services that died:

    # tail -n 50 /var/log/messages
# tail -n 50 /var/log/rc.log

    rc-status --crashed lists services that died; when there are none, it prints nothing and exits with status 1:

    # rc-status --crashed

  4. Fix it. Common repairs:

    • A bad /etc/fstab line: correct it, or add nofail to its options so a missing filesystem doesn't stop the boot. Check the file with findmnt --verify, and on systemd run systemctl daemon-reload afterwards.
    • A service that hangs or breaks the boot: systemctl disable <SERVICE>, or rc-update del <SERVICE> default on OpenRC. <SERVICE> is the service name.
    • A lost root password: passwd root. On RHEL, AlmaLinux and Rocky Linux, after rd.break or init=/bin/bash, also touch /.autorelabel.

  5. Return to a normal boot.

    From the rescue or emergency target, continue to the normal target, or reboot:

    systemctl default

    From the rescue or emergency target, continue to the normal target, or reboot:

    systemctl default

    From the rescue or emergency target, continue to the normal target, or reboot:

    systemctl default

    With OpenRC, from single-user mode, return to the default runlevel (runlevel 3 in Gentoo's /etc/inittab), or reboot:

    telinit 3

    After init=/bin/bash, there's no init to hand back to. Write everything to disk, make the root filesystem read-only again, and force a reboot:

    sync
mount -o remount,ro /
echo b > /proc/sysrq-trigger

    Alternatively, exec /sbin/init starts the normal init system from the shell, continuing the boot.

Verify

After the system boots normally, check that nothing failed and that root is mounted read-write:

$ systemctl --failed --no-pager
  UNIT LOAD ACTIVE SUB DESCRIPTION

0 loaded units listed.
$ findmnt -no OPTIONS /
rw,relatime,errors=remount-ro

systemctl is-system-running --wait waits for the boot to finish and then prints running; degraded instead means the system booted, but at least one unit failed, which systemctl --failed lists.

$ systemctl --failed --no-pager
  UNIT LOAD ACTIVE SUB DESCRIPTION

0 loaded units listed.
$ findmnt -no OPTIONS /
rw,relatime,errors=remount-ro

systemctl is-system-running --wait waits for the boot to finish and then prints running; degraded instead means the system booted, but at least one unit failed, which systemctl --failed lists.

$ systemctl --failed --no-pager
  UNIT LOAD ACTIVE SUB DESCRIPTION

0 loaded units listed.
$ findmnt -no OPTIONS /
rw,relatime,errors=remount-ro

systemctl is-system-running --wait waits for the boot to finish and then prints running; degraded instead means the system booted, but at least one unit failed, which systemctl --failed lists.

$ rc-status default
Runlevel: default
 sshd                                                              [  started  ]
 sysklogd                                                          [  started  ]
$ findmnt -no OPTIONS /
rw,noatime,inode64,logbufs=8,logbsize=32k,noquota

Check that no service has died; rc-status --crashed prints nothing and exits with status 1 when there are none:

$ rc-status --crashed

Troubleshooting

"Cannot open access to console, the root account is locked." The rescue and emergency shells need a root password. On systemd, boot again with SYSTEMD_SULOGIN_FORCE=1 added to the kernel command line, or use an initramfs break or init=/bin/bash; then set a root password with passwd root. On Arch, the emergency shell inside the initramfs always needs SYSTEMD_SULOGIN_FORCE=1, because the initramfs has its own locked root account.

The edited parameter has no effect. Check that you added it to the line starting with linux, not to the initrd line, and that the line didn't wrap into a new line. On a system booting a unified kernel image or with Secure Boot and a locked command line, the parameters can't be changed at boot; boot from installation or rescue media instead, mount the root filesystem and chroot into it.

mount -o remount,rw / fails with "cannot remount … read-write, is write-protected" or a filesystem error. The filesystem needs checking, and that has to happen while it isn't mounted. In rescue and emergency mode the root filesystem is mounted, and xfs_repair refuses to work on a mounted filesystem. Boot from rescue media, or with dracut stop before root is mounted with rd.break=pre-mount, and check the device with the tool for its filesystem (fsck for ext4, xfs_repair for XFS, btrfs check for Btrfs), read-only first.

The system drops back into emergency mode on every boot. A unit the boot depends on keeps failing, most often a filesystem in /etc/fstab. journalctl -xb in the emergency shell shows which unit failed and why.