---
title: "Troubleshooting node security and access"
description: "How to get back into a node after losing its password or SSH key, and why key or security group changes are blocked."
content_type: "troubleshooting"
product: "node"
platform: "MyAccount"
url: "/myaccount/node/troubleshooting/security-and-access/"
relationships: {"troubleshooting-for":["/myaccount/node/how-to/enable-recovery-mode/","/myaccount/node/how-to/change-the-node-password/","/myaccount/node/how-to/add-an-ssh-key-to-a-node/"]}
---

# Troubleshooting node security and access

You can get back into a node after losing its password or SSH key, and clear the block when adding
a key or changing a security group is refused. If adding or removing an SSH key, or changing a
Windows password, is refused, first check whether the node is locked.

## I forgot my node's root password, or lost my SSH key

Only Windows nodes have an in-portal password change. On any other node, you get back in with a
saved SSH key instead, so the fix depends on which one you are locked out of.

**On a Windows node**: change the password from the node's **Node Security** tab. A new
password needs 16 to 30 characters, with a number, an uppercase letter, a lowercase letter, and
a special character. If the node is locked, the change is
blocked and the portal shows the reason. Remove the lock from the node, then try again. See
[Change a node's password](/myaccount/node/how-to/change-the-node-password/) for the full
steps.

**On a Linux node, if you have not changed the password since the node was created**: the
username and password were emailed to you when the node was created, so that email still has
them.

**On a Linux node, or if you have lost an SSH key's private key**: there is no in-portal reset,
and losing a private key means you cannot get back in through that key on any node it is
attached to.

Instead, choose **Enable Recovery Mode** from the **Actions** menu; the steps are in
[Enable recovery mode on a node](/myaccount/node/how-to/enable-recovery-mode/). The node must be
**Powered off** first. Recovery mode works for CentOS, Debian, Ubuntu, openSUSE, CloudLinux,
Red Hat, AlmaLinux, and Rocky Linux, but not for Windows,
[FortiGate, or spot nodes](/myaccount/node/faq/#what-are-spot-nodes-and-fortigate-firewall-nodes).

Once it is running, open **Access Console**. It shows the node's screen in your browser, like VNC,
so you can reach the node when SSH or RDP will not connect. From the rescue disk, mount the node's
disk at `/mnt/sysroot`, run `chroot /mnt/sysroot`, then run `passwd` to set a new password.

## Adding or removing SSH keys is blocked

A locked node holds its SSH keys fixed: the lock blocks every change. Remove the lock with
**Unlock Node** in the node's **Actions** menu, then make the change from the node's
**Node Security** tab.

The **Add SSH Key** form takes a public key. If it rejects what you pasted, check that you copied
the `.pub` file's contents. A key name must start with a letter, have no spaces, and be 50
characters or fewer, and the key text can be up to 1,000 characters. The steps are in [Add an SSH key to a
node](/myaccount/node/how-to/add-an-ssh-key-to-a-node/).

## Security group will not detach

A node always needs at least one security group attached; **Detach** on the last one is
blocked. Attach a replacement group first, then detach the one you meant to remove.

## BitNinja does not start protecting the node

Buying BitNinja from the portal is the first half; the second half runs on the node. Open the
activation email E2E sent after you turned it on, sign in to the node over SSH, and run the
activation steps from that email exactly as given. If you turned BitNinja off and its software
is still on the node, that is expected: turning it off stops the license only, so uninstall
the software yourself. See
[Activate BitNinja on a node](/myaccount/node/how-to/activate-bitninja-on-a-node/).

## The Security Compliance agent does not connect

The node's details page shows a warning until the agent connects. Check, in order:

1. You ran the commands this node's own page showed you, not a copy from another node. If you
   are not sure, run them again inside the node, over SSH, or over RDP on a Windows node.
2. Reload the node's page. Once the agent connects, the warning is replaced by
   **Security Compliance is active on your Node.**

For more help with the agent, see
[Troubleshooting Security Compliance](/myaccount/security-compliance/troubleshooting/security-compliance/).

To stop Security Compliance, and its billing, open **Actions**, then **Security**, and click
**Disable Security Compliance**. See
[Enable Security Compliance on a node](/myaccount/node/how-to/enable-security-compliance/).

If you still cannot sign in or make the change, contact support with the node's name, IP address,
and CRN, the exact error text, and when it happened.