Kali "su: Authentication Failure": Fix Root Login & the Password You Never Set

If su or su - throws "Authentication failure" on a fresh Kali install, it is almost never a typo — Kali's root account doesn't have a password set at all, so no password you type will ever work with plain su. The fix is to either stop using su and use sudo su or sudo -i instead (which asks for your own account's password), or to run sudo passwd once to actually give root a password of its own.

Why "su: Authentication Failure" Happens on a Fresh Kali Install

Jake had just installed Kali for the first time to try scanning his shop's own guest Wi-Fi before a customer complained about it. He typed su, hit enter at the password prompt without typing anything (because he didn't have a root password to type), and got su: Authentication failure. He tried his login password. Same error. He tried "toor," a phrase he'd seen in an old forum post. Same error.

Here's the part almost nobody explains clearly: on current Kali, the root account has no password set at all — not a hidden one, not "toor," none. When su checks a password against an account that has none configured, the check fails every single time, regardless of what you type. This is not a bug and it is not something you broke during setup. It is the intended state of every Kali install since Kali switched away from the old root-by-default model. Kali's own sudo documentation states it plainly: root has no password set, and the account created during installation is the one to use.

Who Actually Runs Into This, and Why It's So Confusing

This error catches two groups almost exclusively. The first is anyone coming from Ubuntu, Debian, or an older Kali tutorial where root either had a password already or the video simply says "type su" without mentioning that Kali is different now. The second is anyone following coursework — an ethical hacking class, a CTF walkthrough, a certification prep guide — written before 2020, where every command block starts with root@kali:~# because that used to be the default prompt.

Method 1: Skip su Entirely — Use sudo su or sudo -i

This is the fix that requires changing nothing on the system. Because your installation-time user account already has administrative rights (it was added to the sudo group during setup), you can reach a root shell immediately using your own password — the one you already know.

Steps

1. Open a terminal as your normal Kali user (the one you created during install).
2. Type sudo su and press enter.
3. At the [sudo] password for <yourname>: prompt, type your own login password — not a root password, because there isn't one — and press enter. Nothing will appear on screen as you type; that's normal.
4. Your prompt changes to root@kali:~#, meaning you now have a root shell.
5. When finished, type exit or press Ctrl+D to drop back to your normal user.

sudo -i does the same job with one difference worth knowing: it starts a full login shell, loading root's own environment and starting directory, rather than carrying your current shell's environment into a root context the way sudo su does. For day-to-day admin work on Kali, either is fine.

Method 2: Give Root an Actual Password (So su - Works)

If you specifically want su - to keep working — because muscle memory, a script, or an old course walks through it — set root a password directly. Kali's documentation for enabling root walks through this exact command.

Steps

1. Open a terminal as your normal user.
2. Type sudo passwd and press enter.
3. Enter your own password at the [sudo] password for <yourname>: prompt.
4. At New password:, type a root password — one different from your login password — and press enter.
5. Retype it at Retype new password:. You'll see passwd: password updated successfully.

From this point on, su - will accept that password. Root still can't log in through the graphical login screen or over SSH yet — that's a separate step, covered further down — this only fixes the terminal su/su - command.

Ruling Out the Ordinary Typo Causes First

Before assuming it's the no-password-set situation above, rule out the boring causes — they account for a real share of "authentication failure" reports:

• Caps Lock is on. The password field shows nothing as you type, so there's no visual clue.
• Wrong keyboard layout. A live-boot or freshly installed VM sometimes defaults to a US layout even if you selected another one; symbols and punctuation in a password land on different keys than expected.
• You're typing the wrong account's password. su username without a target defaults to root; su otheruser asks for that specific user's password, and it's easy to forget which one you ran.
• You changed your password recently and a terminal window opened before the change is still using a cached, expired credential in your head, not on disk — this one's a you problem, not a system problem, but it happens constantly.

If none of those apply and you're specifically running plain su or su - against the root account, the no-password-set explanation above is almost certainly it.

When sudo Itself Refuses Your Password

A different, related problem is when sudo su itself fails — not with "Authentication failure" but with something like <user> is not in the sudoers file. This incident will be reported. That's not a password problem at all; it means the account isn't a member of the sudo group, which normally only happens if a user account was created after installation with a tool that doesn't grant administrative rights by default, or if group membership was edited by hand.

Ethan's take: "People conflate these two errors constantly, and they're opposites. 'Authentication failure' means the account exists and needs the right password. 'Not in the sudoers file' means the password would be accepted fine — the account just was never given permission to use sudo in the first place. Fixing one doesn't touch the other." If you hit the sudoers version, you'll need access to an account that already has sudo rights (or root) to add the affected user to the sudo group — a genuinely separate fix, and outside the scope of a straightforward password reset.

Completely Locked Out? Resetting a Forgotten User Password via GRUB

Everything above assumes you can still log in as your original user and just need root access. If you've forgotten your actual login password too — the one from installation — you need local access to the machine's boot menu, not just a terminal trick. This is the same general GRUB recovery approach used across Debian-based systems; the broad strokes are consistent, though exact menu wording and key bindings can vary slightly by release and firmware.

1. Restart the machine. When the GRUB menu appears, interrupt the countdown before it auto-boots.
2. Select the "Advanced options for Kali GNU/Linux" entry and open it for editing.
3. Find the line starting with linux. Add init=/bin/bash to the end of that line, and remount the filesystem read-write once you reach a shell.
4. Boot with the edited line.
5. At the resulting root shell, run passwd <yourusername>, set a new password, then reboot normally.

Because this method boots straight to a root prompt without any authentication, it only works with physical (or console) access to the machine — which is exactly why it's a legitimate recovery path and not a security hole: anyone who can already interrupt your boot loader can already do far worse than reset a password.

Making Root Login Permanent (GUI and SSH)

Setting a root password with sudo passwd fixes su - in the terminal, but it does not let you pick "root" at the graphical login screen or SSH in directly as root — those are gated separately, on purpose, per Kali's own documentation.

Graphical login (GDM3/KDE)

Install the package that reconfigures the login manager for it: sudo apt -y install kali-root-login. This diverts several PAM and login-manager configuration files so the desktop login screen accepts root. Log out, and root becomes selectable at the login prompt using the password you set with sudo passwd.

SSH

Check /etc/ssh/sshd_config for the PermitRootLogin line. Its default is prohibit-password, which disables password-based root logins over SSH (key-based root login still works if you've set that up). Changing it to yes allows a password-based root SSH login, then restart the service with sudo systemctl restart ssh.

The Other Direction: Making sudo Stop Asking for a Password

Some readers land here for the opposite annoyance: they've accepted using sudo, but they're tired of typing a password for every single command. Kali packages a specific tool for this: sudo apt install -y kali-grant-root && sudo dpkg-reconfigure kali-grant-root. This adds your user to a trusted group that skips the password prompt for sudo commands. It does not restore root login by itself — those remain two separate settings.

Default Credentials by Image Type

Which password you're even supposed to log in with depends on how you got Kali running in the first place. This trips people up constantly when following a VirtualBox walkthrough — including our own guide to installing Kali in VirtualBox — since a pre-built VM image and a from-scratch amd64 install don't behave the same way at first boot.

None of these rows are a root password, and in every case, root itself starts with no password at all — which loops straight back to the same fix from the top of this post.

A Different Prompt That Looks Related but Isn't: "Configuring Kerberos Authentication"

Some readers searching for this su error also run into a blue text screen titled "Configuring Kerberos Authentication," asking for a "Default Kerberos version 5 realm." These are unrelated problems that just happen to surface around the same time — usually while installing an unrelated tool that pulls in a Kerberos-related package as a dependency. It has nothing to do with your Linux user or root password.

Ethan's take: "That screen is a package asking a setup question before it finishes installing — it shows up because of something you're installing that depends on Kerberos support, whether or not you actually use Kerberos yourself." If you don't run a Kerberos realm — and almost nobody using Kali for local pentesting does — leaving the field as-is and continuing is generally fine. It won't create any password, lock you out of anything, or affect su or sudo in any way.

Frequently Asked Questions

Why does su say "Authentication failure" even when I'm sure of the password?

Because with plain su or su -, Kali is checking against the root account's password — and by default that account has no password set at all, so every attempt fails regardless of what you type. Use sudo su or sudo -i with your own login password instead, or set a root password with sudo passwd first.

What is Kali's default root password?

There isn't one. Since the 2020.1 release, Kali ships with the root account intentionally left without a password, and the account you create at install time is the one meant for daily use.

How do I set a root password on Kali?

Open a terminal and run sudo passwd, enter your own password when prompted, then type and confirm a new password for root. After that, su - will accept it.

What's the difference between sudo su, sudo -i, and su -?

sudo su and sudo -i both use your own account's password to reach a root shell and work with no extra setup. sudo -i starts a clean login shell using root's environment; sudo su carries more of your current shell's environment along. su - uses root's own password and only works once you've set one with sudo passwd.

Is enabling full root login in Kali a bad idea?

It's discouraged, not forbidden. Kali's own documentation calls re-enabling the root account "not recommended," because it adds a second full-privilege login on the machine that has to be secured. For most daily work, sudo su or sudo -i covers everything root login would, without that extra exposure.

Why does sudo ask for a password too — is that the same as root's?

No — sudo asks for the password of the account you're currently logged in as, to confirm it's really you before granting elevated privileges. It's separate from any root account password, and by default there isn't one of those to compare it against.

I forgot my Kali user account password completely — now what?

You'll need physical or console access to the machine to interrupt the GRUB boot menu, edit the boot line to load a root shell directly, and reset the password with passwd <yourusername> before rebooting normally.

Why do I see "kali is not in the sudoers file. This incident will be reported"?

That's a different problem from an authentication failure — it means the account isn't a member of the sudo group at all, so no password would be accepted. It usually happens with an account created after the initial install without administrative rights granted, and needs a separate fix using another account that already has sudo access.

What's the default login for the Kali VirtualBox/VMware images?

Pre-built virtual machine and live-boot images use username kali and password kali. That's a login for your regular user account, not for root, which still has no password of its own.

How do I make sudo stop asking for a password every time?

Install and configure the kali-grant-root package with sudo apt install -y kali-grant-root && sudo dpkg-reconfigure kali-grant-root, which adds your account to a trusted group exempt from the sudo password prompt. It's a real security trade-off, so it isn't the default.

Will setting a root password change my normal Kali login password?

No. sudo passwd with no username sets root's password specifically; your own account's password is untouched. Just make sure the two passwords are different from each other.

Why did Kali get rid of root login in the first place?

Kali's developers announced the move to a non-root default with the 2020.1 release to bring Kali in line with how most other Linux distributions handle privilege, reducing the risk of tools and users running with full root access when they don't need to.

I installed a tool and got a "Configuring Kerberos Authentication" screen — is that related to my su error?

No. That's an unrelated package-configuration prompt from a Kerberos-related dependency being installed, asking for a Kerberos realm. It has no connection to your Linux user, root, or sudo passwords — leaving the field as-is and continuing is fine if you don't use Kerberos.

Can I still SSH into Kali as root?

Only after you've both set a root password with sudo passwd and changed PermitRootLogin to yes in /etc/ssh/sshd_config — its default, prohibit-password, blocks root from logging in over SSH with a password.

My password isn't showing any characters or asterisks when I type it at the su prompt — is my keyboard broken?

No, that's normal terminal behavior for password prompts across Linux — the keystrokes are still registered even though nothing appears on screen, including no placeholder characters.

If my whole Kali installation feels broken after trying to fix this, what should I check first?

Confirm you can still log in as your original user through the normal login screen — that account and its sudo group membership are what everything else depends on. If that login still works, nothing about the su/root situation above can lock you out of the system itself; it only affects which command gets you a root shell.

Revision note. Written September 2026, as our readers might have this issue when doing fresh install for 2026.3. This will need an update if a future release changes the root/sudo defaults again. If you landed here at midnight with a broken terminal and a deadline, take a breath — this one really is a two-line fix, not something you broke.But my recommendation remains the same!! Break, break your system as much as possible, thats how u will learn Kali, period!! See you next post..