Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallYou can usually recover a VPS without its old private key. Generate a replacement key pair on a trusted computer, obtain out-of-band access through your provider’s rescue system, recovery console, or documented password fallback, and add the new public key to the installed system’s authorized_keys file. Reboot into the normal operating system, test the new private key, then remove the lost key.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The private key never belongs on the server. Only the matching public key goes in authorized_keys. If password login is disabled and your provider offers no console, rescue environment, API recovery path, backup administrator, or other out-of-band method, the VPS may be unrecoverable without restoring from a backup or disk image.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choose the recovery path first
Your next step depends on what access remains:
- Another shell, administrator account, or console session still works: append the replacement public key directly to the target account’s
~/.ssh/authorized_keys. - Your provider has rescue or recovery mode: boot that temporary environment, mount the installed system disk, and edit the installed account’s key file.
- Your provider exposes a documented password fallback: use it only through the provider’s console and only if it is enabled for that instance.
- No alternate access exists: contact the provider or use its documented recovery API, snapshot, or reinstall process. Do not assume that a normal SSH password prompt will appear when password authentication was disabled in
sshd_config.
Rescue systems are temporary operating environments. Editing /root/.ssh/authorized_keys inside the rescue system instead of on the mounted VPS disk will not repair normal boot access.
Prepare a replacement key safely
Generate the pair on a trusted device
On your own computer, create an Ed25519 key with a new filename so you do not overwrite another credential:
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
ssh-keygen -t ed25519 -f ~/.ssh/vps-recovery -C "vps-recovery-2026-10-15"Choose a strong passphrase when prompted. The private key is ~/.ssh/vps-recovery; the public key is ~/.ssh/vps-recovery.pub. Keep the private file secret and backed up securely. Never paste its contents into a server account, support ticket, or chat.
Inspect the public key before copying
cat ~/.ssh/vps-recovery.pubA normal line begins with a key type such as ssh-ed25519, continues with a long base64 string, and may end with the comment you supplied. Copy the entire line without wrapping it or adding quotation marks. The server needs this public line; your SSH client needs the private file.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Path 1: you still have an alternative session
If a second administrator, an existing terminal, or a working provider console is available, this is the least disruptive method. Log in through that channel and add the key to the account that you will use for SSH.
Add the key for the current account
install -d -m 700 "$HOME/.ssh"
cat /path/to/vps-recovery.pub >> "$HOME/.ssh/authorized_keys"
chmod 600 "$HOME/.ssh/authorized_keys"Replace /path/to/vps-recovery.pub with the location of the public-key file on the session host. If you pasted the line instead of copying a file, use an editor and keep it on one line.
Add the key for another user
When repairing another account, write to that user’s home directory and preserve ownership. DigitalOcean specifically warns that the file must remain owned by the intended user when you add a key for someone else.
install -d -m 700 /home/USER_NAME/.ssh
cat /tmp/vps-recovery.pub >> /home/USER_NAME/.ssh/authorized_keys
chown -R USER_NAME:USER_NAME /home/USER_NAME/.ssh
chmod 600 /home/USER_NAME/.ssh/authorized_keysUse the account’s actual primary group if it differs from the username. Do not change ownership of the entire home directory merely to fix the key file.
Check for accidental duplicates
Appending is safe, but repeated attempts can create duplicate lines. Duplicates do not normally prevent login, yet they make later key rotation confusing. After access is restored, keep one copy of the replacement line and remove obsolete entries deliberately.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Path 2: recover through rescue or recovery mode
Provider interfaces differ, but the filesystem work is the same: boot the temporary environment, identify the installed root partition, mount it, optionally enter a chroot when the provider requires that, edit the installed account’s file, then return to normal boot.
1. Generate the key before opening rescue mode
Finish the local key-generation steps first. Rescue access may be time-limited or may require a reboot, so do not begin until the public key is ready to paste.
2. Enable the provider’s rescue system
Use the VPS control panel’s Rescue, Recovery, or similar function. Follow the provider’s instructions for a power cycle or reboot and for the temporary root credentials. A rescue boot does not automatically modify the installed disk.
3. Identify the installed root partition
After connecting to the rescue shell, list disks and filesystems:
lsblk -fLook for the partition containing the installed operating system. Do not guess from a device name alone; VPS layouts vary, and the rescue OS may have its own root filesystem. If the provider supplies a disk-identification procedure, use it exactly.
4. Mount the installed system
Create a mount point and mount the partition identified in the previous step:
mkdir -p /mnt
mount /dev/ROOT_PARTITION /mntReplace /dev/ROOT_PARTITION with the real device. If the VPS uses separate boot, home, or volume partitions, mount them according to the provider’s recovery instructions. Verify that /mnt/etc, the expected home directories, and the installed hostname are present. If you see only the rescue system’s files, stop and correct the mount before editing anything.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
5. Prepare a chroot only when required
Some providers require you to enter the installed system with chroot; others allow direct editing under /mnt. Hetzner documents its chroot-prepare and chroot helpers. OVHcloud documents mounting followed by chroot. Use the provider’s sequence rather than improvising bind mounts or boot commands.
6. Edit the correct account’s file
For root on a mounted installation, the file is commonly:
/mnt/root/.ssh/authorized_keysFor a regular account, OVHcloud gives this mounted-disk pattern:
/mnt/home/USER_NAME/.ssh/authorized_keysIf you are already inside a chroot, remove the /mnt prefix and use /root/.ssh/authorized_keys or /home/USER_NAME/.ssh/authorized_keys.
7. Append the public key as one complete line
Use an editor available in the rescue system, or append from a copied file:
install -d -m 700 /mnt/home/USER_NAME/.ssh
cat /path/to/vps-recovery.pub >> /mnt/home/USER_NAME/.ssh/authorized_keys
chown -R USER_NAME:USER_NAME /mnt/home/USER_NAME/.ssh
chmod 600 /mnt/home/USER_NAME/.ssh/authorized_keysFor root, use /mnt/root/.ssh and root:root. If you are operating inside a chroot, run the same commands without /mnt. Preserve any existing lines unless you are certain they belong to the lost credential.
8. Leave rescue mode and boot the installed OS
Exit the chroot if you entered one, unmount filesystems as required by the provider, disable Rescue or Recovery in the control panel, and reboot or power-cycle into the normal disk. Hetzner and OVHcloud both document returning to normal boot after the key edit. Do not test the new key while the server is still running the temporary rescue image.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Provider-specific recovery routes
Hetzner
Hetzner’s documented route applies when password authentication is blocked and the SSH key is lost: enable Rescue, log in as the rescue root user, identify the root partition, mount it, run the documented chroot-prepare and chroot steps when required, and edit /root/.ssh/authorized_keys. Add the replacement public key, exit the chroot, disable Rescue, and reboot normally. The important distinction is that the root key file belongs to the installed disk, not the temporary rescue root.
OVHcloud
OVHcloud documents creating a new pair, entering rescue mode, mounting the system partition, and editing the relevant user file. For a regular account, its example path is /mnt/home/USER_NAME/.ssh/authorized_keys. After adding the new line, remove the obsolete key string, switch back to normal boot, and test the replacement private key.
DigitalOcean
DigitalOcean directs users to its Droplet Recovery Console to restore SSH access and re-add keys. If you write a key for another user, preserve that user’s ownership and normal SSH permissions. The console is an alternative session, so you can use the direct-account procedure rather than mounting a separate rescue disk.
Vultr
Vultr’s support guidance describes using the root or linuxuser password shown in the Vultr Console when the private key is lost. Treat this as provider- and instance-specific: verify that the password fallback is available and enabled before relying on it. Once logged in, append the new public key, test key-based access, and then disable or rotate any temporary password access your security policy does not require.
Free tools Windows power users keep installed
One-click scans. No signup required.
Comparison of the documented recovery options
| Provider | Documented out-of-band route | Key-file guidance | Return to normal access |
|---|---|---|---|
| Hetzner | Rescue system with rescue-root login | /root/.ssh/authorized_keys after mounting and chroot preparation |
Disable Rescue and reboot |
| OVHcloud | Rescue mode | Mounted path such as /mnt/home/USER_NAME/.ssh/authorized_keys |
Switch back to normal boot |
| DigitalOcean | Droplet Recovery Console | Re-add the key while preserving the target user’s ownership | Not stated in the provider note |
| Vultr | Vultr Console password for root or linuxuser |
Add the public key after logging in with the documented fallback | Not stated in the provider note |
The practical differences are whether a temporary rescue boot is available, whether a console offers a direct shell, and whether a password fallback exists. In every route, the durable repair is the same: place the replacement public key in the installed account’s authorized_keys with correct ownership and permissions.
Test the replacement before deleting anything
Open a separate SSH attempt
Keep the existing session or console open while testing from a second terminal:
ssh -i ~/.ssh/vps-recovery USER_NAME@SERVER_ADDRESSSpecify the actual account you repaired. A successful connection proves that the public key, account path, permissions, and server-side SSH configuration agree.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Verify the host you reached
Confirm the server identity and host fingerprint before accepting a changed-host prompt. Check that you are on the intended VPS, not a different instance or a rescue environment. Once logged in, verify the username with whoami and inspect the hostname if needed.
Check the key fingerprint locally
ssh-keygen -lf ~/.ssh/vps-recovery.pubKeep the fingerprint in your credential record so a future recovery can distinguish this key from older entries.
Remove the lost key after successful login
Do not delete the old line until the replacement login works from a new session. Then edit the repaired account’s authorized_keys and remove only the line containing the lost public key. Keep other administrators’ keys intact.
After removal, rotate credentials that may have been exposed with the old private key, including automation keys, deployment secrets, or passwords stored on the same device. If the old private key was copied to backups or shared storage, treat it as compromised rather than merely misplaced.
Troubleshoot a failed recovery
The new key is rejected immediately
- Confirm that you copied the
.publine, not the private key. - Check that the line is complete and has no inserted newline or quotation marks.
- Verify the username in the SSH command matches the account whose file you edited.
- Check
~/.sshownership and mode700, andauthorized_keysownership and mode600.
The change disappears after reboot
You probably edited the rescue OS rather than the installed disk, or mounted the wrong partition. Boot rescue again, use lsblk -f, mount the installed filesystem, and confirm that the expected /etc and home directories are visible under the mount point before editing.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →The account path is wrong
Root uses /root/.ssh/authorized_keys. A regular account normally uses /home/USER_NAME/.ssh/authorized_keys, but custom home directories are possible. Inspect the installed system’s account configuration and use the actual home directory rather than assuming the path.
Password login still does not work
A rescue password or console credential does not automatically enable password authentication on the normal SSH service. If the server configuration disables password login, continue using the recovery console or rescue environment to install the new key. Do not weaken SSH authentication permanently just to avoid replacing a key.
No console or rescue option appears
Check the provider’s control panel, account-level API, backup administrator, and documented recovery procedures. If none exists and password authentication is disabled, access may be lost. OVHcloud explicitly warns that losing the private key means losing instance access when no alternative access method was configured.
Prevent the next lockout
- Maintain at least two independent administrator access methods, such as separate keys held by two people or a protected break-glass console.
- Store private keys in an encrypted password manager or hardware-backed credential store, with a recovery copy protected from the primary device.
- Record the exact provider steps for enabling Rescue or opening its recovery console while you still have access.
- Use distinct key files and comments for each server and purpose; do not reuse one private key across every VPS.
- Test a replacement or backup key periodically from a separate terminal instead of discovering it is invalid during an outage.
- Remove retired keys promptly and review
authorized_keysafter staff, vendors, or automation changes.
The Bottom Line
Generate a new key, use your provider’s rescue system, recovery console, or verified password fallback to reach the installed disk, add the public key to the correct account with secure ownership and permissions, reboot normally, test it, and then delete the lost key. Without any out-of-band access, a disabled-password VPS may not be recoverable.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
