Change Root and User Passwords on a Linux VPS

A strong, regularly updated password is the first line of defence of your VPS Linux Infrawire. From your customer area you find the IP and the root password of the VPS, and you should change that password after the first login. This guide covers changing passwords, enforcing expiry and policy, locking accounts and recovering a lost root password.

📋 Prerequisites

A Linux VPS (Ubuntu 24.04, Debian 12, AlmaLinux 9 or Rocky Linux 9)
SSH access as root or as a user with sudo
For recovery: access to the VPS console (VNC) or a rescue mode

1. Change the root password

Logged in as root:

Bash
1passwd

With sudo:

Bash
1sudo passwd root

Type the new password twice; nothing is displayed while you type. Use at least 14 characters or, better, a passphrase from a password manager.

2. Change another user's password

Bash
1sudo passwd USER

A regular user changes their own password with passwd alone, which asks for the current password first. To force a user to choose a new one at the next login:

Bash
1sudo passwd -e USER

3. Set passwords in a script with chpasswd

chpasswd reads user:password lines from standard input, which is useful for automation:

Bash
1read -r -s -p "New password: " PW; echo
2echo "USER:$PW" | sudo chpasswd
3unset PW

Avoid typing the password directly in the command: it would stay in ~/.bash_history and be visible in the process list.

4. Expiry and password policy

View and set the ageing rules with chage:

Bash
1sudo chage -l USER                  # show current policy
2sudo chage -M 90 -W 7 USER          # max age 90 days, warning 7 days before

To enforce complexity, install the quality module:

Bash
1# Ubuntu / Debian
2sudo apt install -y libpam-pwquality
3
4# AlmaLinux / Rocky
5sudo dnf install -y libpwquality

Then edit /etc/security/pwquality.conf:

INI
minlen = 12
minclass = 3
retry = 3

The rules apply to ordinary users. Root can bypass them, so stay disciplined.

5. Lock and unlock an account

Bash
1sudo passwd -l USER       # lock the password
2sudo passwd -u USER       # unlock it
3sudo chage -E 0 USER      # expire the account immediately
4sudo chage -E -1 USER     # remove the expiry date

Locking the password does not block SSH key logins. To fully disable a login, also set the shell to /usr/sbin/nologin with sudo usermod -s /usr/sbin/nologin USER.

6. Recover a forgotten root password

Open the VNC console of the VPS (or boot the rescue mode) and reboot. In the GRUB menu press e, find the line starting with linux and add at its end:

Bash
1init=/bin/bash

Press Ctrl+X to boot, then:

Bash
1mount -o remount,rw /
2passwd root
3sync
4exec /sbin/init

On AlmaLinux and Rocky, add rd.break instead, then run mount -o remount,rw /sysroot, chroot /sysroot, passwd root, touch /.autorelabel, and exit twice. In rescue mode, mount the system disk, run chroot /mnt and then passwd root.

7. Verify

Bash
1sudo passwd -S USER
2sudo chage -l USER

P means a usable password, L a locked one. Open a second SSH session to confirm the new password works before closing the first one.

🔧 Troubleshooting

"Authentication token manipulation error"
The filesystem is read-only, typically in recovery mode. Run mount -o remount,rw / and try again.

"BAD PASSWORD: The password fails the dictionary check"
The policy rejects a weak password. Choose a longer one with several character classes.

SSH still refuses the new root password
Check sudo grep -E 'PermitRootLogin|PasswordAuthentication' /etc/ssh/sshd_config and the files in /etc/ssh/sshd_config.d/. Password login may be disabled in favour of keys.

Locked out after a SELinux system recovery
On AlmaLinux or Rocky, forgetting touch /.autorelabel makes login fail. Redo the recovery and create the file.

🔒 Your accounts are now protected with strong passwords, sensible expiry and a recovery path you know how to use.