First things first, let’s get some great passwords setup for our
root and custom user.
None of this 12-character, numbers and letter nonsense… we want 64-character monster passwords that God can’t even remember.
Of course I strongly suggest adopting a password manager (like Bitwarden) to help you manage these as manually typing them in will be a nightmare.
Important: Password wallets are amazing, but can also become a single point of failure in your security effort if you don’t secure the wallet itself with a sufficiently complex password.
Don’t go through all the work of generating huge passwords and storing them, only to lock down the Password wallet with “password123“.
Be sure to make the wallet password some long passphrase, like “My favorite time when I was a kid was swimming in the lake“.
And also NEVER access/unlock your wallet from a compute environment you don’t trust (i.e. on a public computer).
Generating a new password
If you are using Bitwarden, LastPass or some other password wallet, they have password generators built in.
If you aren’t using them, you can try a simple online one like this one.
The most important setting for the password you are trying to generate is the Length – you’ll want something 32+ characters in length. Beyond that, enabling numeric and special characters is also a good idea.
Using Bitwarden, this is an example of the settings I’m using:
Setting new passwords
Now that we know how to generate new/monster passwords, let’s update our
root and non-
root account with them.
First, login to your server (if you aren’t already) as your non-
Tip: If you have been following the guide up to here, it should be impossible for you to login remotely as
Setting non-root user password
Now, using the
passwd command, we will get prompted to enter our current password (to make sure it’s us) and then our new password… twice!
$ passwd Changing password for rkalla. Current password: New password: Retype new password: passwd: password updated successfully
You’ll notice the old and new passwords are never echo’ed back to the terminal, so you don’t see anything being entered or confirmed as you type the passwords.
After you are done, leaving your current terminal connected, open a new terminal window and attempt to connect to your server with the same non-
root user and your new password.
Tip: We are leaving the current session connected instead of disconnecting and immediately trying to connect with our new password just in case we got something wrong and may end up locking ourselves out of the machine.
Staying connected with the current terminal is an insurance policy against misconfiguration locking ourselves out.
Once you have confirmed that your password has been successfully changed, go ahead and stay logged in on the new terminal and logout the old session where you began.
Setting the root user password
Now we want to use
passwd to change the password for the
First, log into the
root account using
su, like so:
$ su - Password:
Again, you won’t see the
root password when you type it in.
After hitting enter, you can confirm you are logged in as
root using the
$ whoami root
Good, we are in the right account context, so just use the command like we did above for the non-
# passwd New password: Retype new password: passwd: password updated successfully
Nice, the password is updated!
It might be a good idea to leave this terminal open, open another one and try and login to
root account again with the new password to make sure you captured it correctly.
Important: Remember to store these passwords someplace secure; printed and stored offline in a safe, on cold/air-gapped storage, in a special digital wallet just for your server, etc.
Alright, now your most critical accounts on your server (
root and your non-
root account that – that may be in the
sudo group) have strong passwords set on them.
You are one step closer to sleeping better at night!