Locked out of your server? Use the console, rescue mode or a root password reset

Sooner or later everyone locks themselves out of a server: a firewall rule that drops your own session, an sshd_config typo, a kernel update that will not boot. None of these need a support ticket. The console gives you three recovery tools, and picking the right one first saves a lot of time.

Which tool to use

The browser console (VNC)

In the console, open your server and choose Open Console. A browser window opens showing the server's screen and keyboard, exactly as if a monitor were plugged into it.

Its value is that it does not depend on SSH or on the network inside the server. If those are broken, the console still works. That makes it the right tool when:

• you blocked yourself with ufw or iptables;
• SSH will not start after a config change;
• the server boots but never comes up on the network.

Allow popups for the console page if the window does not appear.

Working in the console

It is a raw console, so expect some friction:

• No clipboard. Long commands must be typed.
• Keyboard layout may differ from yours, which matters for symbols in passwords. If a password keeps failing, try one without special characters.
• It is slower than SSH. Fix the problem, then go back to SSH for real work.

Common fixes from the console

A firewall that locked you out:

ufw status numberedufw allow OpenSSH# or, to start overufw disable

An SSH daemon that will not start:

sshd -t                 # prints the line with the syntax errorsystemctl restart sshjournalctl -u ssh -n 50 # recent log lines if it still fails

Rescue mode

Rescue mode boots the server into a small recovery system instead of your installed operating system, with your disk available to mount. Use it when the server will not boot at all: a broken /etc/fstab, a failed kernel or bootloader update, or a full root disk.

Rescue mode is available from the server's browser console (Open Console). Once the recovery system is running, find and mount your disk:

lsblkmount /dev/vda1 /mnt

Your disk name may differ; lsblk shows it. Then repair what is wrong. For example, to comment out a bad fstab line:

nano /mnt/etc/fstab

Or, to fix things as if you were booted normally, change root into the installed system:

for d in dev proc sys; do mount --bind /$d /mnt/$d; donechroot /mnt# e.g. reinstall a kernel or free disk spaceexit

Unmount and reboot back into your own system when you are done:

umount -R /mntreboot

Rescue mode does not change your disk on its own. Nothing is modified unless you modify it.

Reset the root password

If you simply cannot remember the root password, open the server in the console and choose Reset root password. A new password is generated and shown once. Copy it into your password manager before closing the dialog.

Then log in and, ideally, switch to key authentication so you never need that password again. See SSH keys.

Close the console when you are finished

The console session is a live keyboard on your server. Log out of any shell you opened in it and close the window once SSH is working again. Never type passwords into it on a network you do not trust.

Still stuck?

If none of these get you in, open a ticket from Support in the console or email [email protected]. Tell us what you changed last and what the console shows on screen; a photo or the text of the error helps.

Next steps

• Starting over is sometimes faster: see Reinstalling a server's operating system.
• Use a Floating IP so a replacement server can take over the same address.
• Browse more guides in the Help Center.