Troubleshooting node security and access

You can get back into a node after losing its password or SSH key, and clear the block when adding a key or changing a security group is refused. If adding or removing an SSH key, or changing a Windows password, is refused, first check whether the node is locked.

I forgot my node’s root password, or lost my SSH key

Only Windows nodes have an in-portal password change. On any other node, you get back in with a saved SSH key instead, so the fix depends on which one you are locked out of.

On a Windows node: change the password from the node’s Node Security tab. A new password needs 16 to 30 characters, with a number, an uppercase letter, a lowercase letter, and a special character. If the node is locked, the change is blocked and the portal shows the reason. Remove the lock from the node, then try again. See Change a node’s password for the full steps.

On a Linux node, if you have not changed the password since the node was created: the username and password were emailed to you when the node was created, so that email still has them.

On a Linux node, or if you have lost an SSH key’s private key: there is no in-portal reset, and losing a private key means you cannot get back in through that key on any node it is attached to.

Instead, choose Enable Recovery Mode from the Actions menu; the steps are in Enable recovery mode on a node. The node must be Powered off first. Recovery mode works for CentOS, Debian, Ubuntu, openSUSE, CloudLinux, Red Hat, AlmaLinux, and Rocky Linux, but not for Windows, FortiGate, or spot nodes.

Once it is running, open Access Console. It shows the node’s screen in your browser, like VNC, so you can reach the node when SSH or RDP will not connect. From the rescue disk, mount the node’s disk at /mnt/sysroot, run chroot /mnt/sysroot, then run passwd to set a new password.

Adding or removing SSH keys is blocked

A locked node holds its SSH keys fixed: the lock blocks every change. Remove the lock with Unlock Node in the node’s Actions menu, then make the change from the node’s Node Security tab.

The Add SSH Key form takes a public key. If it rejects what you pasted, check that you copied the .pub file’s contents. A key name must start with a letter, have no spaces, and be 50 characters or fewer, and the key text can be up to 1,000 characters. The steps are in Add an SSH key to a node.

Security group will not detach

A node always needs at least one security group attached; Detach on the last one is blocked. Attach a replacement group first, then detach the one you meant to remove.

BitNinja does not start protecting the node

Buying BitNinja from the portal is the first half; the second half runs on the node. Open the activation email E2E sent after you turned it on, sign in to the node over SSH, and run the activation steps from that email exactly as given. If you turned BitNinja off and its software is still on the node, that is expected: turning it off stops the license only, so uninstall the software yourself. See Activate BitNinja on a node.

The Security Compliance agent does not connect

The node’s details page shows a warning until the agent connects. Check, in order:

1. You ran the commands this node’s own page showed you, not a copy from another node. If you are not sure, run them again inside the node, over SSH, or over RDP on a Windows node.
2. Reload the node’s page. Once the agent connects, the warning is replaced by Security Compliance is active on your Node.

For more help with the agent, see Troubleshooting Security Compliance.

To stop Security Compliance, and its billing, open Actions, then Security, and click Disable Security Compliance. See Enable Security Compliance on a node.

If you still cannot sign in or make the change, contact support with the node’s name, IP address, and CRN, the exact error text, and when it happened.