Lost access to your server (password or key)

What to do if you forgot the root password, lost your private key, or locked yourself out with the firewall or the SSH configuration.

How to get back into your server when you forgot the root password, lost your private SSH key, or locked yourself out with the firewall or the SSH configuration. You can solve most of these situations on the server card on the “My Servers” page of the app.blackbox.md panel (app.blackbox.md/my-servers, left menu “Infrastructure” → “My Servers”). From blackbox.md, you open the panel through “Contul meu” (My account) → “Panou de administrare” (Admin panel).

Available to: the owner of the blackbox.md account that ordered the server. Cards with the “Managed” badge don't have the buttons described below: write to support.

The blackbox.md website is available in Romanian and Russian; this article quotes the Romanian labels with their English meaning.

Warning Customers have no web or VNC console. The “Reset password” and “Add SSH key” buttons and the password login buttons connect to the server over SSH with the BLACKBOX management key, “Management key (blackbox.md)”. They work only if the server is running and its SSH accepts this key.

What to do, in short

Situation	What to do
You forgot the root password, and the card has the “Password + key” badge	“Reveal credentials”; if the password shown doesn't work, “Reset password” and connect with the new password
You changed the password with `passwd` (as the “Serverul dvs. este gata” (Your server is ready) email recommends) and forgot it	“Reset password”: “Reveal credentials” shows the old password
You lost your private key, and the card has “Password + key”	connect with the password, then add a new key
You lost your private key, and the card has “Key-only”	create a new key on your computer → “Add SSH key” → “Paste a new key”; or “Enable password login” + “Reset password”
You locked yourself out with the firewall (`ufw`, `firewalld`) or broke the SSH configuration	“Reset password” and the key buttons fail too; “Reboot” helps only if the change was not saved permanently; otherwise write to support
You deleted “Management key (blackbox.md)” from the server	key management and the password login buttons stop working: write to support

You forgot the root password

On the server card, click “Reveal credentials” and confirm “Reveal stored credentials for SERVER_NAME? This access is logged.” A box with “Username” and “Password” appears on the card.
Try to connect with this password. If you have changed it since then with passwd, the box shows the old password, which no longer works.
If the password doesn't work, click “Reset password” and confirm “Reset the password for SERVER_NAME? The current password stops working immediately.” The panel sets a new 20-character password on the server and shows it in the same box.
Connect with the new password:
```
ssh root@SERVER_IP
```

You can reset the password at most 3 times in 5 minutes. Details: Resetting the root password.

On a “Key-only” server, the new password does not get you in over SSH: password login stays disabled. Follow option B in the next section.

You lost your private key

The private key exists only on your computer: your account and the server hold only public keys, so a lost private key cannot be recovered. Create a new one.

If the server has “Password + key”, you can connect with the password (see the section above), then create a new key following option A.

Option A: a new key (“Key-only” server)

Create a new key pair on your computer (Windows, macOS or Linux). Instructions: Generating an SSH key (Windows, macOS, Linux).
```
ssh-keygen -t ed25519
```
The command creates id_ed25519 (the private key, which stays with you) and id_ed25519.pub (the public key) in your user's .ssh folder.
On the server card, click “Add SSH key” and choose “Paste a new key”.
Paste the contents of the id_ed25519.pub file into the field: a single line that starts with ssh-ed25519.
Click “Add key”. The message “Key added.” appears on the card, and the new key shows up in the “Installed keys” list.
Connect from the computer that has the new key:
```
ssh root@SERVER_IP
```
In “Installed keys”, click “Remove” next to the lost key and confirm “Remove key SHA256:… from this server?”. The message “Key removed.” appears. If the key was also saved in “Contul meu” (My account) → “Chei SSH” (SSH keys), delete it there too: deleting a key from your account doesn't remove it from servers, and vice versa.

If you saved the new key in “Contul meu” → “Chei SSH”, choose “Use a saved key” in step 2. Details: Adding and removing SSH keys on the server.

Option B: temporarily with a password

On the card, click “Enable password login” and confirm “Re-enable SSH password login on SERVER_NAME?”. The badge changes to “Password + key”.
Click “Reset password” and confirm. The new password appears on the card.
Connect with the password and add a new key (option A).
Once you can connect with the key, click “Disable password login” so that the server is “Key-only” again: Enabling and disabling SSH password login.

You locked yourself out with the firewall or the SSH configuration

Typical causes: you enabled ufw or firewalld without allowing port 22, moved SSH to another port, broke the SSH configuration file, or set PermitRootLogin no. The panel also connects over SSH, on port 22, as root, so “Reset password”, “Add SSH key” and the password login buttons fail.

Click “Reboot” and confirm “Reboot SERVER_NAME?”. The reboot goes through the BLACKBOX infrastructure, not over SSH, so it works even when SSH is blocked (Rebooting, stopping and starting a server).
Wait a few minutes and try to connect again.
If you still can't get in, write to support (see the section “When the panel can't help”).

A reboot helps only if the change was not saved permanently: for example, a firewall-cmd rule without --permanent, an iptables rule that was not saved, or the SSH service stopped with systemctl stop. It does not help after ufw enable (the firewall stays active after a reboot), after rules saved with --permanent, or after an SSH configuration file was edited and saved.

Panel error messages and what they mean:

Message	What it means	What to do
`reset_failed`	The panel could not connect to the server, or the command failed. The password did not change.	If you stopped the server, click “Start”; otherwise click “Reboot”, then contact support.
`ssh_key_push_failed`	The key was not added.	Same as above.
`ssh_key_list_failed`	The “Installed keys” list could not be read.	Same as above.
“Failed to change password login.”	The setting stayed as it was.	Same as above.
`invalid_public_key`	The pasted text is not an accepted public key; for example, you pasted the private key.	Paste the contents of the `.pub` file.
“Rate limit exceeded — password reset is limited to 3 requests per 5 minutes”	You reset the password 3 times in 5 minutes.	Wait 5 minutes.

You deleted the management key

The panel doesn't let you delete “Management key (blackbox.md)”. If you removed it manually from /root/.ssh/authorized_keys, key management, the password login buttons and commands through the AI assistant stop working. “Reset password” succeeds only if SSH password login is enabled and the password saved in the panel has not been changed on the server. The server itself keeps working normally. To get the key back, write to support. Details: BLACKBOX keys on your server.

When the panel can't help

The BLACKBOX team helps you regain access after verifying your identity.

Write to support@blackbox.md from the email address of your blackbox.md account (we reply within 4 hours on business days), or open a support ticket from “Contul meu” (My account) → “Ajutor și suport” (Help and support). For urgent matters during business hours: +373 78 003948 (phone or WhatsApp), Monday–Friday, 09:00–18:00 (Moldova time).
Include the server's IP address and the BBX-… order number (the “IP” and “Order” fields on the card).
Describe what you changed last, for example “I enabled ufw” or “I deleted a key from authorized_keys”.

All channels: How to contact BLACKBOX support.

How to avoid getting locked out

Add two keys to the server, from two different devices.
Keep the root password in a password manager. Change it with “Reset password”, not with passwd, so that the panel knows the current password.
When you change the SSH or firewall settings, keep a second SSH session open, and close it only after a new connection succeeds.
Don't move SSH to another port, and don't allow port 22 only from your own IP address: the panel and the AI assistant connect on port 22, and the network filtering managed by BLACKBOX may block a new port. If you need a different setup, write to support first. Details: Firewall: network filtering and ufw/firewalld on the server.
Allow SSH in the firewall before you enable it or change its rules. Ubuntu and Debian:
```
ufw allow 22/tcp
ufw enable
```
AlmaLinux and CentOS Stream (the default firewalld zone already allows SSH; the commands work only while firewalld is running):
```
firewall-cmd --permanent --add-service=ssh
firewall-cmd --reload
```
After you edit the SSH configuration, check it. If the command prints nothing, the configuration is correct:
```
sshd -t
```
Only then reload the SSH service:
```
systemctl reload ssh || systemctl reload sshd
```

Important Don't delete “Management key (blackbox.md)” and don't set PermitRootLogin no: otherwise the panel can no longer connect to the server and can't help you. If you want to restrict root login, use PermitRootLogin prohibit-password. Change password login with the panel buttons, not by editing PasswordAuthentication.

Frequently asked questions

How do I know whether the problem is the password or the key, and not the network? The message Permission denied means the server responds but rejects the password or key: follow this article. Connection timed out or Connection refused means the server doesn't respond over SSH: see I can't connect over SSH.

The “Serverul dvs. este gata” (Your server is ready) email mentions a VNC console. Where do I find it? There isn't one: customers have no web or VNC console. The “Parola de consolă” (Console password) in the email, and the “console password” in panel messages, is the root password, which you can see with “Reveal credentials”.

I entered the wrong password several times, and now I can't connect at all. If you installed fail2ban, your IP address has been blocked temporarily. Wait for the block to expire, or connect from another address (for example, over mobile internet) and unblock it: Protection against password-guessing attempts with fail2ban.

I can't get into my blackbox.md account or the panel. First regain access to your account: Forgot your account password or Lost your 2FA device.

The lost key was on a stolen laptop. What else should I do? Delete the old key from every server and from “Contul meu” (My account) → “Chei SSH” (SSH keys), reset the root password, and change your account password. If you suspect someone got into the server, read Your server was hacked or is under attack: what to do.