The root account can do anything on the machine: read any file, install anything, erase anything. Its password is therefore the main lock of your server, and that lock sits on a public IP address. Bots usually start trying it within minutes of the VPS coming online.
Change it when you take the machine over, and whenever you have any doubt about its confidentiality.
Which password rule is enforced on a VPS?
By-Hoster checks the password server-side, at every entry point (order, reinstall, change from the client area). It must:
| Requirement | Value |
|---|---|
| Length | 12 to 64 characters |
| Lower case | required |
| Upper case | required |
| Digits | required |
| Symbols | required, from !@#%^&*()-_=+[]{}:;,.? |
Also rejected: common fragments (password, azerty, 123456, admin, debian…) and the hostname or username of your own VPS.
Other symbols (quotes, backslash, backtick, $) are deliberately excluded: they travel through the machine's initialisation configuration, where they cause escaping errors.
How do I change the root password from the client area?
This is the recommended route, and the only one that works if you no longer have access to the machine.
- Open your service from the client area.
- Go to the Access & Security tab.
- Enter the new password in the dedicated field and confirm.
Important: a KVM VPS must reboot
On a KVM virtual machine, this change is written to the VM's initialisation configuration (cloud-init). It is not applied to the running system: it is picked up on the next boot.
In other words: submit the form, then reboot the machine. Until you reboot, the old password remains valid and the new one does not work yet. On an LXC container, by contrast, the effect is immediate.
How do I change the root password from the command line?
If you are already connected to the machine, passwd changes the password straight away, with no reboot.
Logged in as root:
passwdLogged in as a user with sudo:
sudo passwd rootType the new password, then confirm it. Nothing is displayed while you type, not even asterisks: that is normal, the terminal hides the input entirely. The expected confirmation is:
passwd: password updated successfullyNote that this method does not inform the client area. The password stored on your service record stays the old one, and the two diverge. If you want the client area to remain the reference, use method 1.
How do I check that the new password works?
Open a second SSH session without closing the first one. If the new password is refused, you still have the current session to fix things.
ssh root@your-ipOr, from the machine itself, by going through a full authentication again:
su -What else should I do beyond a password to secure access?
Two measures: SSH keys, which replace the password with a cryptographic pair, and fail2ban, which bans addresses that keep trying.
A password, however long, is still a string that can be guessed by repeated attempts. Two measures genuinely change the picture:
- SSH keys, which replace the password with a cryptographic pair that cannot be guessed;
- fail2ban and the firewall, which ban addresses that keep trying.
If you have lost the password and no longer have access to the machine, the recovery procedure is covered in its own article.