Reset your VPS root password or boot into rescue mode

Password reset, console or rescue mode: pick the right tool

Option A: Reset the root password

1. Open the VPS in the client area

   Go to Servicesyour VPSReset root password. Applying the new password can involve a quick restart, so do it when a minute of downtime is acceptable.

2. Choose a strong password and save it

   Use at least 16 characters, or accept the generated one, and store it in a password manager. We never ask for it, in tickets or anywhere else.

3. Log in

   ssh root@203.0.113.42

# on the server, in the browser console
echo 'PasswordAuthentication yes' > /etc/ssh/sshd_config.d/00-allow-passwords.conf
systemctl reload ssh        # AlmaLinux / Rocky: systemctl reload sshd

# on your computer: your sudo user, or root if root login is still allowed
ssh-copy-id deploy@203.0.113.42

# back on the server: remove the exception
rm /etc/ssh/sshd_config.d/00-allow-passwords.conf && systemctl reload ssh

The file is named 00-allow-… so it sorts ahead of 00-hardening.conf: SSH uses the first value it reads, and files in that folder are read in alphabetical order. AlmaLinux and Rocky 8 don't read the folder, so on those change the PasswordAuthentication line in /etc/ssh/sshd_config instead.

Option B: Use the browser console

Servicesyour VPSConsole opens the server's screen and keyboard in a browser tab, as if a monitor were plugged in. It doesn't use SSH or the network, so it works when a firewall rule or a broken SSH config has shut you out.

• Log in as root with the password. SSH keys don't apply at the console.
• The console uses a US keyboard layout. If pasting doesn't work, type the command.
• A black screen is usually just blanking: press Enter.

Then undo whatever locked you out. These commands cover the usual culprits:

# firewall: is SSH allowed?
ufw status numbered
ufw allow 22/tcp

# SSH config valid? then restart and check the service
sshd -t && systemctl restart ssh
systemctl status ssh --no-pager

# banned by fail2ban? (your own public IP)
fail2ban-client set sshd unbanip 198.51.100.7

# firewall: is SSH allowed?
firewall-cmd --list-all
firewall-cmd --permanent --add-service=ssh && firewall-cmd --reload

# SSH config valid? then restart and check the service
sshd -t && systemctl restart sshd
systemctl status sshd --no-pager

# custom SSH port? SELinux must allow it too
semanage port -a -t ssh_port_t -p tcp 2222

# banned by fail2ban? (your own public IP)
fail2ban-client set sshd unbanip 198.51.100.7

Option C: Boot into rescue mode

Rescue mode starts the VPS from a small temporary Linux system, with your own disk attached but not in use. From there you can repair files the broken system won't let you reach.

1. Enable rescue and connect

   Choose Servicesyour VPSRescue. The VPS restarts, and the panel shows the temporary root password. Connect as usual. SSH will warn that the host key has changed, which is expected here, so clear the old key first:

   ssh-keygen -R 203.0.113.42
   ssh root@203.0.113.42

2. Find your disk

   lsblk -o NAME,FSTYPE,LABEL,SIZE
   NAME     FSTYPE  LABEL            SIZE
   vda                                80G
   ├─vda1   ext4    cloudimg-rootfs  79.9G   ← your system
   ├─vda14                            4M
   └─vda15  vfat    UEFI             106M

   Your system is the largest ext4 or xfs partition. If its type is LVM2_member, run vgchange -ay and use the /dev/mapper/…-root volume that lvs lists.

3. Mount it and step inside

   mount /dev/vda1 /mnt
   for d in dev proc sys run; do mount --rbind /$d /mnt/$d; done
   chroot /mnt /bin/bash

   Your prompt now acts on the installed system, so commands such as passwd and nano change your server, not the rescue system.

4. Fix the problem

   # forgotten password
   passwd root
   touch /.autorelabel          # AlmaLinux / Rocky only: SELinux relabels on next boot
   
   # boots into emergency mode: check fstab against the real UUIDs
   blkid
   nano /etc/fstab              # fix or comment out the bad line, or add "nofail"
   findmnt --verify
   
   # SSH won't start: show the broken line
   sshd -t
   
   # disk full: find what filled it
   df -h /
   du -xh --max-depth=1 / | sort -h | tail

5. Leave rescue mode

   exit
   umount -R /mnt

   Then turn rescue off from the same Rescue page so the VPS boots from its own disk. Run ssh-keygen -R once more before reconnecting, because the host key changes back.

Option D: Rebuild (reinstall) the OS

Go to Servicesyour VPSRebuild, choose one of the 12 OS images (Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS Stream, Fedora or Windows Server), set a new root password and confirm. The server is usually ready within minutes. Then work through Secure a new Linux VPS before you restore your data.

If you pay for the backups add-on (+20%, daily copies kept for 14 days), you can also roll back to one of those instead of rebuilding from scratch.

On a dedicated server

Dedicated servers include IPMI, which gives you the machine's own console (KVM-over-IP), power control and virtual media. The same ideas apply:

Troubleshooting