It happens. No judging here. You created a 32-character password chock full of special character goodness and you thought you’d made a note in your password manager but somehow, you didn’t. You didn’t setup sudo or doas, and now you need to do something as root and you can’t.
Oh no!
But not all is lost. There’s at least two ways to fix the issue.
Using Your Panel
The first thing to check is if the provider’s panel supports root password resets. It’s almost like hosting companies get so many requests to reset root passwords that the hosting panel providers built it in to save them headaches…hmmm.
I logged into Solus on RackNerd and here is what I see:
So let’s try that.
After clicking change, you get this message:
And then after clicking Yes:
(Don’t worry – I’ll change it before this article is published!)
After a little processing, it’s successful:
Now in my case, there was only one problem. As part of my VPS setup, my Ansible scripts put this in /etc/ssh/sshd_config:
So it actually was not possible for me to login as root. In this particular case, losing the root password didn’t actually matter because I could login with my ssh key, but you get the point. If I’d lost the ssh key, I’d have been hosed.
Using Rescue
Let’s look at the SolusVM rescue mode:
Clicking that gives a warning:
I clicked “Enable Rescue Mode” and SolusVM politely asked me to confirm:
Yes, please.
After clicking Yes:
I let it boot a bit, and then was able to login from my PC:
Whoa…what’s up with all those -o flags? If you don’t use them, you’ll get the dramatic warning that “IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!”
The reason is that the IP is in my hosts file as associated with a certain host key, and when I boot in rescue mode, its’s a completely different OS image. So my ssh client gets a totally different host key and throws the flag. The -o flags I listed ignore that temporarily, without having to go in and modify the known_hosts file.
Now after logging in, it’s important to note that I am not logged into my VPS per se. I’m logged into a rescue image. For example:
If I was to run passwd root now, I’d be changing the rescue image password, which is pointless.
So we have a little work to do. First, find the actual root partition of your VPS:
OK, so the rescue environment is /dev/vdb1. /dev/vda1 is my actual root. So let’s prep a chroot environment for that.
And then enter the chroot environment:
Now I am in my actual VPS. For example:
And now I can reset the root password: