Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsGenerate a replacement key pair, then use an existing session, your provider’s recovery console, rescue mode, or a documented console-password fallback to reach the installed system. Mount the VPS disk, add the new public key to the correct user’s authorized_keys file, reboot normally, test the new private key, and only then remove the lost key.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Choose the recovery route before changing anything
Your private key is never recoverable from a VPS. The practical goal is to create a new key pair and place its public half on the server through a channel that does not depend on the missing private key. Use the first route available in this order.
As an Amazon Associate I earn from qualifying purchases.
You still have another administrator session
If a second administrator, an already-open SSH session, a control-panel shell, or a local console is available, do not reboot into rescue mode. Log in through that session and edit the target account’s ~/.ssh/authorized_keys. Add the new public key as a complete single line, preserve the file’s existing owner and permissions, and test the replacement connection before closing the working session. DigitalOcean specifically warns that ownership must remain correct when you add a key for another user.
Your provider has rescue or recovery mode
Enable Rescue, Recovery, or a similar boot option in the provider panel. Reboot or power-cycle the VPS if the panel requires it, connect with the rescue root credentials, identify the installed system disk, mount its root partition, and use the provider’s documented chroot procedure when required. The rescue operating system is temporary; editing its own /root/.ssh/authorized_keys will not repair the installed VPS.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
A recovery console supplies a password
Some providers expose a browser console and a temporary or existing root password even when normal SSH password authentication is disabled. Vultr’s support guidance describes using the root or linuxuser password shown in its Console when the private key is lost. Treat this as provider-specific: confirm that the password fallback is enabled for your instance and that you are changing the installed system, not merely logging into a temporary environment.
No alternative channel exists
If SSH password login is disabled and the provider offers no recovery console, rescue system, API-based key replacement, backup administrator, or other out-of-band method, the VPS may be inaccessible. OVHcloud states that losing the private key means losing access when no alternative access method was configured. In that situation, contact provider support, use an available backup or snapshot according to the provider’s policy, or rebuild only after deciding how to preserve required data.
Create and protect the replacement key
- Use a trusted device. Generate the pair on a computer you control and that is free of suspected malware. The private key must remain on that device or in an encrypted password manager; it is not something to paste into a rescue shell.
- Generate a modern pair. For example, run
ssh-keygen -t ed25519 -f ~/.ssh/vps_recoveryand set a strong passphrase when prompted. If your environment does not support Ed25519, use the key type supported by both your SSH client and server. - Identify the two files. The private key is
~/.ssh/vps_recovery; the public key is~/.ssh/vps_recovery.pub. Open the public file and copy its entire line, including the key type, base64 body, and optional comment. - Never disclose the private half. Do not paste the file without the
.pubsuffix into a control panel, terminal, ticket, orauthorized_keys. Anyone who obtains it can authenticate as the associated account until the key is removed. - Keep the old key temporarily. Do not delete old credentials before the replacement login succeeds. You need the old entry for rollback if the new line is malformed or was added to the wrong account.
Repair access through rescue mode
The labels differ by provider, but the sequence is consistent: boot a temporary system, mount the installed disk, edit the installed account’s key file, then return to normal boot.
1. Enable Rescue or Recovery
Open the VPS control panel and select its rescue, recovery, or emergency boot option. Read whether the panel requires a reboot or power cycle and note the rescue credentials it displays. Do not assume the password used by the normal operating system will work in the rescue environment.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
2. Connect to the temporary system
Connect as the rescue root user using the provider’s console or the temporary SSH endpoint. Confirm that you are in the rescue environment by checking its login banner and mounted filesystems. Do not edit the rescue system’s own key file unless the provider explicitly says that it is the installed disk.
3. Identify the installed root partition
List disks and filesystems, then identify the partition containing the VPS installation. A typical first check is:
Free tools Windows power users keep installed
One-click scans. No signup required.
lsblk -fUse the filesystem labels, sizes, and directory contents to distinguish the installed root partition from swap, boot, data, and the rescue operating system. Never guess a device name from another server; selecting the wrong partition can make you edit an empty filesystem or damage data.
4. Mount the installed filesystem
Create or use the mount point specified by your provider and mount the identified root partition, for example:
mount /dev/DEVICE /mntReplace /dev/DEVICE with the partition you identified. Check that /mnt contains the installed system’s directories such as etc, home, and var. If the VPS uses separate boot, home, or data partitions, follow the provider’s layout instructions so that the account’s home directory is visible.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
5. Chroot when the provider requires it
A chroot makes the mounted installation appear as the running root filesystem. Hetzner documents the sequence using chroot-prepare followed by chroot; OVHcloud documents mounting followed by chroot. Use the exact command order supplied for your provider rather than copying a command intended for a different rescue image. If you do not chroot, use the mounted paths explicitly in the following steps.
Recommended Free Tools
6. Locate the correct account file
The key belongs to the account that will log in, not necessarily to root. For a root login inside a chroot, Hetzner identifies /root/.ssh/authorized_keys. For a regular account on a mounted disk, OVHcloud gives the form /mnt/home/USER_NAME/.ssh/authorized_keys. Substitute the real account name and verify that the directory belongs to the installed disk.
7. Make a recovery copy
Before editing, create a backup of the existing authorized_keys content on the installed disk. Preserve its owner, group, and permissions; a rescue tool that creates a new file as root can leave the file unreadable to the intended account after reboot. Keep the backup on the VPS only if it is protected from unintended SSH use, and remove it when recovery is complete if it contains obsolete keys.
8. Append the public key as one line
Open the target file with a text editor or append the copied public-key line using a shell command. The line must retain its key type, base64 body, and optional comment. A generic append looks like this:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
printf '%sn' 'ssh-ed25519 AAAA... comment' >> /path/to/authorized_keysThe example’s key text is illustrative; use the exact contents of your .pub file. Do not wrap the line, add quotation marks to the file, paste the private key, or insert extra spaces inside the base64 body. If the file does not exist, create the .ssh directory and file for the intended account, then assign ownership and permissions consistent with the account’s other SSH files.
9. Check ownership and permissions
SSH commonly refuses a key file that is owned by the wrong user or writable by other users. Compare the repaired account’s home directory, .ssh directory, and authorized_keys with a known-good account on the same installation. Correct the owner and group to the login account and retain restrictive permissions. DigitalOcean’s guidance makes ownership preservation explicit when adding a key for another user.
10. Leave rescue mode cleanly
Exit the chroot if you entered one, unmount the installed filesystem as directed by the provider, disable Rescue or Recovery in the control panel, and reboot into the normal disk. A server left in rescue mode will continue booting the temporary operating system, so a successful rescue login alone does not prove that normal SSH access has been fixed.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Provider-specific recovery paths
| Provider | Documented access route | Key-file detail | Other facts established in the guidance |
|---|---|---|---|
| Hetzner | Enable Rescue, log in as root, identify and mount the root partition, run the documented chroot preparation and chroot steps, edit the installed system, then reboot. | /root/.ssh/authorized_keys for a root login inside the chroot. |
The procedure is specifically intended for a lost key when password authentication is blocked. Rescue reboot requirements are provider-controlled. |
| OVHcloud | Create a new pair, enter rescue mode, mount the system partition, chroot when required, edit the account file, remove the obsolete key, and return to normal boot. | The mounted-disk example for a regular user is /mnt/home/USER_NAME/.ssh/authorized_keys. |
The documented method preserves the existing installation rather than reinstalling it. Password fallback details are not stated in the cited guidance. |
| DigitalOcean | Use the Droplet Recovery Console to restore SSH access and add a replacement key. | The exact path depends on the user being repaired; preserve that user’s ownership when writing the file. | The cited guidance emphasizes ownership when adding a key for another user. Rescue reboot and password-fallback behavior are not stated. |
| Vultr | Use the Vultr Console and the root or linuxuser password described by its support guidance, if that fallback is available for the instance. |
Not stated in the cited provider guidance; edit the target account’s normal authorized_keys after logging in. |
Confirm that the console password fallback is enabled. A normal SSH configuration may still have password authentication disabled. |
Hetzner: Rescue plus chroot
Hetzner’s documented answer for a blocked-password, lost-key situation is Rescue, root access to the rescue system, root-partition identification, mounting, the documented chroot-prepare and chroot sequence, editing /root/.ssh/authorized_keys, and rebooting. The critical distinction is that the file must be on the installed root filesystem exposed by the chroot.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →OVHcloud: Mount the system partition and remove the old entry
OVHcloud’s procedure starts with a newly generated pair, then uses rescue mode to mount the system partition and edit the relevant account. Its example for a regular account is under /mnt/home/USER_NAME/.ssh/authorized_keys. After the new key works, delete the obsolete key string and switch the instance back to normal boot.
DigitalOcean: Recovery Console and ownership
The Droplet Recovery Console is the out-of-band route described for restoring SSH access. When repairing another user’s account, check that the account still owns its home directory, .ssh directory, and key file; a root-created file with unsuitable ownership can cause authentication to fail after reboot.
Vultr: Console password fallback
Vultr’s guidance describes using a root or linuxuser password available through its Console when the private key is unavailable. This is not proof that every instance has password login enabled over SSH. Use the console to reach the operating system, add the new public key, and then continue using key authentication.
Test the new key before deleting anything
- Confirm normal boot. Make sure Rescue or Recovery is disabled and the VPS has restarted from its installed disk.
- Use the intended account and private key. For example, run
ssh -i ~/.ssh/vps_recovery user@server. Replace the account and address with the values for your VPS. - Force the test to use only that key when necessary. If your SSH agent contains many identities, add the client option
IdentitiesOnly=yesso a failed test does not accidentally succeed with an unrelated key. - Check the host fingerprint. Compare the fingerprint shown by your SSH client with the fingerprint you recorded from the provider console or a trusted previous session. Do not blindly accept a changed fingerprint after a rescue reboot; investigate whether the address now points to a different machine.
- Verify the account and privileges. Once logged in, confirm the username, home directory, hostname, and expected administrative privileges. A successful login to the wrong account is not a complete recovery.
Remove the lost key and close the security gap
After the replacement login succeeds from a separate terminal, edit the installed account’s authorized_keys and delete the exact line associated with the lost private key. OVHcloud explicitly recommends removing the obsolete key. If the old key was reused on other servers, revoke it everywhere and rotate passwords, API tokens, deployment keys, or certificates that may have been stored with it. Keep the new private key protected by its passphrase and maintain an encrypted backup.
Do not remove every existing key in a single cleanup operation unless you have verified each administrator’s replacement. Retain at least one tested second administrator or break-glass method, and record the provider’s rescue-console procedure while you still have access.
Quick Recap
Troubleshoot the common failure points
| Symptom | Likely cause | Recovery action |
|---|---|---|
| The key works in rescue but not after reboot. | The key was appended to the rescue system or the wrong mounted partition. | Boot rescue again, verify the installed directories under the mount point, and edit the installed account’s file. |
| SSH says permission denied even though the line looks correct. | Wrong user, wrong owner or group, overly broad permissions, or an unreadable home directory. | Check the login username and restore ownership and restrictive permissions to match the account’s existing SSH files. |
| The key appears split across several lines. | Line wrapping or an editor inserted a newline into the key body. | Replace it with one exact line copied from the public-key file. |
| The new key is rejected while another key still works. | The public key was copied incorrectly, added to a different account, or blocked by SSH server configuration. | Compare the public file byte-for-byte with the server entry, test the intended account, and inspect the server’s authentication logs from the working session. |
| The control panel asks for a password you do not know. | Rescue credentials are separate from the normal VPS password, or the provider fallback is not enabled. | Use the credentials displayed for the rescue environment or select the documented recovery-console route. |
| The VPS cannot be reached after changing boot mode. | Rescue mode remains enabled, the reboot did not complete, or the wrong disk was selected. | Open the provider console, restore normal boot, and recheck the disk and mount steps before editing again. |
| The SSH client reports a host-key warning. | The address presents a different host fingerprint after recovery, or the VPS was rebuilt. | Verify the fingerprint through a trusted provider or console source before accepting or removing any known_hosts entry. |
Prevent the next lockout
- Keep two independently stored administrator keys, each protected by a passphrase, rather than relying on one private file.
- Test the provider’s recovery console or rescue workflow before an emergency and record the exact panel labels and reboot requirements.
- Maintain a second administrator or break-glass account with carefully limited privileges and a documented ownership model for its
.sshfiles. - Store encrypted backups of private keys and recovery codes separately from the VPS. Do not leave an unencrypted private key in a shared project directory.
- Review
authorized_keysperiodically, remove departed administrators, and add comments that identify each key without putting secrets in the comment. - After any recovery, rotate credentials related to the lost key and verify that normal boot, monitoring, backups, and scheduled jobs still operate.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
