1

I have an access to my account on VPS over SSH. Some time ago, I changed my password and forgot it. But still, I can log over my SSH key. It was enough for a while, but now I need to login from another device, so it's time to recover my password. How do I change my password without knowing the old one (without root access)?

  • Are you root, or do you have the ability to perform tasks that require root privileges? – Gansheim Mar 31 '17 at 0:46
  • Who is your VPS with? They likely have a method to reset the password. – Will Mar 31 '17 at 0:47
  • I would say it depends on the type of VPS. If it's a true VPS and they have spun up a dedicated VM for that instance, I highly doubt they have direct access to the account. However, if they simply allocated an account for you to use on a shared server instance then yeah, they should be able to reset it. – Gansheim Mar 31 '17 at 1:00
  • Can you load an Live ISO, if so I'd assume the fix is relatively trivial, also depending on your kernel version look into using dirty cow – FreeSoftwareServers Mar 31 '17 at 16:46
0

The short answer is, without knowing your current password and without root/sudo access, you can't change your password. The basic *NIX security model does not allow mortal users to change passwords for accounts they lack the rights to access.

Doing what you want would requite root (sudo) access or at least read access to the passwd and shadow files if you wanted to run cracking software on them.

If you can access your account over your SSH key (not sure what you mean by that), then you will have access to your account and thus, MIGHT be able to change your password with some finagling. For example, creating a trust relationship using .rhost that will allow people with the same username access without requiring a password. Needless to say, this is a dangerous vulnerability and is discouraged.

Most distros that I am aware of require users to know their current password before they can change it. This, again, is part of the basic *NIX security model that has been in effect for around 50 years.

The moral to the story, of course, if to have some sort of a standard username/password management plan so that forgetting your password is recoverable.

  • It's actually relatively simple to change any password you want on (most) Linux systems you have physical access to. Encrypted file systems can stop it but unencrypted systems aren't that difficult to recover. If you have physical access. – Will Mar 31 '17 at 6:50
  • @Will The system in question is a VPS so your comment doesn't seem relevant... – Seth Apr 1 '17 at 15:26
  • @Seth I agree but this answer was commenting on general *nix security and not specifically SSH. Most distros that I am aware of require users to know their current password before they can change it. This, again, is part of the basic *NIX security model that has been in effect for around 50 years. That is a general statement, not about SSH, and is incorrect. If your data isn't encrypted it's usually quite simple to bypass passwords, which is why if you want true security you need to encrypt. – Will Apr 1 '17 at 17:06
  • @Will With physical access, yes. Without it, no. This answer is right. There is no easy way to change your password purely from the software standpoint (aka ssh level access) without the root/sudo password. If it were then it would be a huge attack vector. – Seth Apr 1 '17 at 22:55
  • As the answer doesn't make clear that it's ONLY under ssh that passwords cannot be bypassed, I respectfully disagree @Seth. The answer suggests that you simply cannot bypass the password in Most distros that I am aware of which isn't true. – Will Apr 1 '17 at 23:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.