I recently started using a VPS hosting service, that offers unmanaged VPS. It allows me to reinstall the VM at any point in time, choosing from a number of OS ISO files (doesn't have to be the same OS as before). You are probably already familiar with this kind of service.

When I first created the VM instance I had to enter a desired username and password and, optionally, a public key, for SSH access.

The thing that worries me, is that, upon reinstalling (through a web-based management environment), it shows me this password of the "root" account (not really root, but the main sudo account, that I had to create for the VPS instance), in plain text. Perhaps as a reminder for me, because they figure I may have forgotten it, because I am reinstalling the VPS. However, the more I think about it: why not just let me enter a completely new password?

Now, since they offer SSH access with public key access, as well, I figured, perhaps they have some nifty way to encrypt my password with that (or perhaps some secure master key of theirs), such that they can decrypt my password and only show me the password in my web-browser, when I want to reinstall the VM. But something tell me that that's probably wishful thinking, at best, or simply not at all the case, at worst.

What's more, is that they also offer shell access through web-based consoles (xterm and noVNC), presumably using the same public key I had to enter upon purchasing the VPS instance. Which made me frown a bit, as well.

What do you make of all this? Is this common practice and still reasonably secure, or are my intuitions correct in that it is considered bad practice and not possibly secure, at all?

1 Answer 1


If somebody wants to access your virtual server via SSH, they need the server's IP address and your password. However, if there is no password in place, they could immediately set a password and misuse your server. You assume that you will log in earlier than an attacker.

However, if your VPS provider already set a password, then the attacker also needs to guess it. There shouldn't be a problem if you change your root password.

  • The thing is, and I apologize if I didn't make that clear enough in my question: it shows the same original password in the web-based environment, time and time again, when I want to reinstall a new image. So: I chose one "root" account name and password when I originally ordered the VPS instance and then it keeps using these exact same credentials as the "root" account, each time I reinstall the image. However, I just discovered I can always change the password right before installing a new image, as well as (and that's the take-away I got from your answer, which I clumsily overlooked)... Commented Jan 30, 2021 at 11:37
  • (Cont.) ...change it immediately after booting the new image. So thank you for that pointer. Commented Jan 30, 2021 at 11:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .