How to Change the Root Password on a Linux Server

This guide changes the password of the root account on a Linux server, on a VPS or a dedicated server. The commands are the same on Ubuntu, Debian and Red Hat-family systems such as RHEL, AlmaLinux and Rocky Linux. It also covers changing your own user's password, and why SSH keys are the better way to log in.

When a LyraHosting server is deployed or reinstalled, its root account is given a generated password. Replace it with a password of your own before you start to use the server. A reinstall sets a new generated password, so change it again after each reinstall. On a Storage VPS, you choose the root password yourself when you order.

Before you start

• Log in as root, or as a user who can run commands with sudo.
• Have a password manager ready to create and store the new password.
• Know what to do if you lose it. On a LyraHosting Linux VPS, the control panel can reset the root password. On a dedicated server, open a support ticket in the client area (see Contact us).

Change the root password

1. When you are logged in as root, run passwd without a user name:

   passwd

   As a user with sudo rights, name the root account:

   sudo passwd root

2. Type the new password, then type it again to confirm.
3. Store the new password in your password manager before you close your session.

The superuser can change any password without knowing the old one, so as root you aren't asked for it. Through sudo, you first enter your own password, the one sudo asks for. When the change is done, passwd reports that the password was updated.

Choose a strong password

Length counts for more than unusual characters. The passwd manual advises a long, random password, and shows that 32 random lowercase letters already give about 2 to the power of 150 combinations. Avoid dictionary words, names, birth dates, addresses and anything else someone could guess about you. A password manager can generate a random password and remember it for you.

Don't use the root password anywhere else, and don't give it out. Debian's installation guide tells you to be extremely wary of anyone who says they need it.

Root on Ubuntu and Debian: locked or not

A standard Ubuntu installation locks the root account: root has a password that matches nothing, and administrators use sudo with their own password instead. Debian does the same when no root password is set during installation, and lets the first user use sudo. Check the state of root on your server:

sudo passwd -S root

The second field shows L for a locked password, NP for no password and P for a usable one.

If root is locked and you manage the server with sudo, you don't need a root password, and you can leave it locked. Setting one with sudo passwd root enables the account. To lock it again, run sudo passwd -l root. A locked password doesn't stop logins with an SSH key.

Change your own user's password

Any user can change their own password with passwd. It asks for the current password first, then for the new one twice:

passwd

As root, or with sudo, you can set another user's password with sudo passwd username. If you work through sudo, your own password is the one that guards root access, so give it the same care as a root password.

Log in with SSH keys instead

Ubuntu's documentation points out that many successful break-ins use simple brute-force and dictionary attacks against weak passwords. SSH keys avoid that. Create a key pair on your own computer, then copy the public key to the server:

ssh-keygen -t ed25519
ssh-copy-id youruser@203.0.113.10

Once you can log in with the key, you can turn off password logins over SSH: set PasswordAuthentication no in /etc/ssh/sshd_config, check it with sudo sshd -T | grep -i passwordauthentication, and restart SSH (sudo systemctl restart ssh on Ubuntu and Debian, sudo systemctl restart sshd on RHEL, AlmaLinux and Rocky Linux). Test a key login from a second terminal before you close your session. Our guide on changing the SSH port covers the same safety steps.

For root, OpenSSH's default setting PermitRootLogin prohibit-password refuses password logins and allows keys, but your server's configuration may set it differently. Check it with sudo sshd -T | grep -i permitrootlogin.

A new password doesn't remove keys. Anyone whose public key is in /root/.ssh/authorized_keys can still log in as root. If you're changing the password because someone else had access, check that file too, along with the .ssh/authorized_keys file of each user.