If you can still open a privileged shell, reset the password immediately with passwd (or sudo passwd root), enter the new password twice, and verify the success message. If SSH access is gone, use your VPS provider’s control-panel reset when available. If there is no panel reset, boot the server into Rescue Mode, identify the installed system with lsblk, mount it, chroot into that installation, run passwd root, then unmount everything and reboot. A changed password does not necessarily enable root-password logins over SSH: many current images disable that method by default.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Choose the recovery route that matches your access
Do not start by mounting disks if you already have an administrative shell. The safest order is the least invasive option that can reach the account.
As an Amazon Associate I earn from qualifying purchases.
| What you still have | Recommended route | Operational risk | What it changes |
|---|---|---|---|
| Root shell or a sudo-capable user over SSH or the provider console | Run passwd or sudo passwd root |
Lowest; the running system is changed directly | The selected local account’s password |
| Provider control-panel access but no normal login | Use the provider’s “reset root password” action | Low; the provider handles the disk operation | The root credential according to the provider’s implementation |
| No login, but Rescue Mode or an emergency console is available | Mount the installed system, enter it with chroot, and run passwd |
Higher; choosing or mounting the wrong partition can damage the installation | The password in the mounted VPS installation |
| No panel, rescue image, console, or privileged account | Ask the provider for account recovery | Depends on provider identity checks and support policy | Provider-assisted recovery |
Panel reset is generally less error-prone than a manual mount and chroot. IONOS warns that incorrect recovery commands can cause data loss and says to create a backup before resetting the root password. Take a provider snapshot or backup first whenever the control panel permits it.
Reset the password from an existing privileged session
Set the root password from a root shell
- Open an SSH session or emergency console as
root. - Run
passwd. - Type the new password when prompted, then type it again. Linux does not display characters while you type.
- Look for the confirmation that the password was updated successfully.
passwdSet it from an Ubuntu sudo account
Ubuntu’s installer normally places the initial user in the sudo group. From that account, run:
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
sudo passwd rootEnter your own sudo password if requested, then enter and confirm the new root password. This changes the local root account; it does not automatically alter SSH policy, firewall rules, or provider-console credentials.
Lock root again after administrative work
If you only needed a temporary root password and want Ubuntu’s root account locked again, run:
sudo passwd -l rootKeep a tested sudo account and an SSH key before locking the account. Locking root without another working administrative path can leave you locked out.
Use the provider control panel when normal login is unavailable
Look for an action named Reset Root Password, Reset password, or a similar recovery control in the VPS console. Hetzner, for example, labels the action “Reset Root Password” in its Console. Victus Cloud documents a comparable panel workflow. Labels, whether the server reboots, and whether the new password is shown once or delivered through the console vary by provider.
- Sign in to the provider account with permission to administer the VPS.
- Open the VPS or server details page and locate the console, recovery, or password section.
- Create a snapshot or backup if the panel offers one.
- Choose the root-password reset action and follow the confirmation prompts.
- Record the new credential in a password manager, then test it through the provider’s emergency console before relying on SSH.
- Check whether the reset caused a reboot and wait for the normal operating-system boot to complete.
A panel reset can succeed even when an SSH password login still fails. Treat the panel result as proof that the local credential changed, not proof that root is permitted to authenticate with a password on port 22.
Reset it from Rescue Mode with mount and chroot
This provider-neutral method changes the password on the installed disk while the VPS is booted into a separate recovery environment. Device names differ between virtual machines: documentation examples include /dev/sda1, /dev/vda1, and /dev/xvdb1. Never substitute one because it appeared in a guide; verify the layout on your own VPS.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
1. Make a backup and record the normal boot settings
Create a snapshot or backup before touching the mounted filesystem. Also note whether the provider expects you to deactivate Rescue Mode through a panel control, a command, or a reboot option. IONOS explicitly warns that the procedure can cause data loss when performed incorrectly.
2. Activate Rescue Mode and connect
Enable Rescue Mode or the provider’s recovery image in the control panel. Connect through the emergency console or the rescue environment’s SSH details. The rescue shell is not the installed operating system; commands such as passwd affect the rescue image until you mount and enter the VPS installation.
3. Identify the installed root filesystem
List disks, partitions, filesystems, and labels:
lsblk
lsblk -fLook for the partition containing the normal system’s directories, especially a filesystem that can contain /etc, /var, /home, and /usr. A disk may have several partitions, and the root filesystem might not be the first partition. If the listing is unclear, stop and use the provider’s recovery documentation rather than guessing.
4. Mount the verified root partition
Create a mount point and replace the example device with the partition you identified:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →mkdir -p /mnt
mount /dev/sda1 /mntFor a different layout, the command could use /dev/vda1 or /dev/xvdb1 instead. Confirm that /mnt now contains the installed system’s directories before continuing:
ls /mntIf you see only an empty directory, the partition is probably not the root filesystem or it was not mounted successfully. Do not run passwd yet.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
5. Bind the virtual filesystems
The chroot needs access to device, process, and system interfaces. A portable pattern is:
for d in dev proc sys; do mount --bind /$d /mnt/$d; done
mount --bind /dev/pts /mnt/dev/ptsSome rescue environments or provider instructions use slightly different bind options. Follow the provider’s documented preparation if it differs, and make sure the target directories exist inside /mnt.
6. Enter the installed system
Change the apparent root directory to the mounted installation:
chroot /mntYour prompt may change. From this point, /etc/passwd, the account database, and the password utilities refer to the VPS installation under /mnt, not to the temporary rescue image. This is why chroot is essential: running passwd before it would change the wrong environment.
7. Set root or another local account’s password
Set root’s password with:
passwd rootTo recover a named local administrator instead, use:
passwd usernameEnter the new password twice. If the command reports that the filesystem is read-only or cannot update the authentication token, leave the chroot, correct the mount state, and re-enter; do not repeatedly force the command.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
8. Prepare SELinux systems for the next boot
AlmaLinux, Rocky Linux, CentOS Stream, and Fedora images can require SELinux contexts to be relabeled after offline changes. When the provider’s rescue instructions call for it, create the marker file inside the chroot:
touch /.autorelabelBecause this command is run after chroot /mnt, the file is created at the installed system’s root. The next normal boot can then restore the expected SELinux labels. Do not create the file in the rescue environment before entering the chroot.
9. Exit, unmount, and return to the normal disk
Leave the installed system first:
exitUnmount the separately bound pseudo-filesystems, then the root filesystem. One explicit sequence matching the mounts above is:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →umount /mnt/dev/pts
for d in dev proc sys; do umount /mnt/$d; done
umount /mntIf an unmount reports that the target is busy, close any shell whose current directory is under /mnt and stop commands that are still using the mounted tree. Use the provider’s documented cleanup procedure rather than rebooting with mounts left active. Finally, deactivate Rescue Mode in the panel and reboot into the normal VPS disk. Connect through the provider console first if you need to distinguish an operating-system boot problem from an SSH policy problem.
Distribution-specific recovery paths
Ubuntu
When a sudo-capable installer user still works, sudo passwd root is the shortest route. If you only need elevated commands, leaving root locked with sudo passwd -l root preserves Ubuntu’s usual sudo workflow. In rescue mode, the Debian/Ubuntu mount, bind, chroot, passwd root, cleanup, and reboot sequence applies.
Debian and Ubuntu provider rescue images
IONOS and Gandi document the same core pattern: identify the partition, mount it under a temporary directory, bind the virtual filesystems, chroot, run passwd root, exit, unmount, and reboot. Their device examples are not universal; use lsblk on the actual VPS.
RHEL-family systems with bootloader access
If a RHEL-family VPS has no usable login but does provide a bootloader console, an emergency-shell route can avoid a separate rescue image. Red Hat’s documented pattern uses the rd.break kernel parameter. The general sequence is to append rd.break at the boot menu, obtain the emergency shell, remount the installed root read-write, run passwd, and continue the boot. Exact menu keys and mount paths depend on the image and bootloader, so use the distribution’s recovery documentation for the remount and continuation commands. If you instead use provider Rescue Mode, the chroot method above applies and SELinux relabeling may be required.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteWhy SSH can still reject the new password
A successful passwd command proves that the local account database accepted the new credential. It does not prove that the SSH daemon will allow that account to use password authentication. Hetzner notes that newer systems such as Debian 11 and Ubuntu 22.04 disabled root password authentication by default because of brute-force risk.
After resetting the credential, check these possibilities in order:
- Root login policy: the SSH server may disallow root entirely or allow root only with a key. Inspect the
PermitRootLoginsetting. - Password authentication: the daemon may reject all password logins through
PasswordAuthentication, even though local passwords work. - Image design: the VPS may expect an initial non-root user with sudo rights and an SSH key rather than direct root access.
- Firewall and network controls: the server or provider firewall may block port 22, or a security group may allow only a management address.
- Wrong account or host: confirm that the SSH command targets the recovered VPS and uses the intended username.
Use the provider console or a working sudo account to inspect and change SSH settings. Do not disable key-based access or remove the sudo path until an alternative administrative login has been tested successfully.
Secure the account after recovery
Use a strong credential only when password access is necessary
Root is exposed to the internet whenever SSH on port 22 is reachable. Victus Cloud recommends a long random passphrase or, preferably, disabling password login entirely in favor of an SSH key. Store any temporary password in a password manager and rotate it after emergency work.
Free tools Windows power users keep installed
One-click scans. No signup required.
Prefer a sudo user and SSH key
Create or retain a named administrative user with sudo rights and verify that its key-based login works from a separate terminal. Only then consider locking root or disabling root-password authentication. Keep the provider’s emergency console enabled as a recovery path.
Quick Recap
Confirm the result before closing your session
- Open a second console or terminal without closing the first working session.
- Test the recovered account through the path you intend to use: provider console, local sudo, or SSH key.
- Check that the VPS booted from its normal disk and that expected services are running.
- Remove temporary rescue settings, disable Rescue Mode, and verify that the snapshot or backup completed.
Troubleshooting common failures
| Symptom | Likely cause | Recovery action |
|---|---|---|
passwd changes a password, but SSH still says “Permission denied” |
Root password authentication or root login is disabled | Use the console or sudo user; inspect PermitRootLogin and PasswordAuthentication without removing your working key path |
chroot /mnt says the directory or commands are missing |
The wrong partition is mounted, or the mount failed | Exit, inspect lsblk -f, remount the verified root partition, and confirm that /mnt/etc and /mnt/usr exist |
passwd reports an authentication-token or read-only error |
The installed filesystem is mounted read-only or the chroot was not prepared correctly | Check the mount state and bind mounts, then re-enter the chroot; do not operate on an unverified device |
| The system boots into Rescue Mode again | Rescue Mode remains active in the provider panel | Deactivate Rescue Mode and reboot into the normal disk |
| SELinux warnings or denials appear after an offline reset | Security contexts were not rebuilt after the mounted-system change | For supported RHEL-family images, enter the installed system and create /.autorelabel when the provider documentation requires it, then reboot |
| Unmount says the filesystem is busy | A shell or process still has a working directory or open file under /mnt |
Exit the chroot, close shells using the mount, stop the remaining recovery command, and repeat the provider’s clean unmount sequence |
| No panel reset or rescue image is available | The provider controls the only recovery path | Use the provider’s account-recovery or support process; do not attempt destructive disk changes without console access |
Final pre-reboot checklist
- A snapshot or backup exists, or you have consciously accepted the provider’s recovery risk.
- You identified the root filesystem with
lsblkrather than assuming a device name. - You ran
passwdafter entering the installed system withchroot. - On an SELinux image, you created
/.autorelabelwhen required. - You exited the chroot and unmounted the bind mounts and root filesystem cleanly.
- Rescue Mode is deactivated before rebooting.
- You tested a console, sudo, or key-based administrative path before locking root or disabling password authentication.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
