Password and access recovery

Locked out of something? Take a breath — for the things you own, getting back in is usually quick, and you can do all of it yourself. There are three logins in your world, and each has its own way back:

  • A Drupal login on one of your sites — the admin (or any user) on a site you host.
  • Your control panel login — the account you use to sign in to Aegir/Hostmaster.
  • Your shell / SFTP password — the oN.ftp account you connect to the server with.

This page walks through each one. Pick the login you're stuck on and jump to its section. None of these needs the server owner; you can do them from your control panel or your own shell.

One thing that isn't yours: the server's own root password, or getting back into the machine itself. That belongs to whoever runs your server — if the whole box is unreachable, that's a support request, not something on this page.

Reset a Drupal user's password on your site

This is the everyday one — the admin account (or any user) on a site you host. You have two easy routes.

The friendly way: Drupal's own password reset

Every Drupal site has a built-in "forgot password" link. In your browser, go to:

https://your-site.example.com/user/password

Enter the username or the email address on the account, and Drupal emails a one-time login link. Click it and you're in — then set a fresh password from your user profile.

This works whenever the site can send email and you can reach the inbox for that account. If the email never arrives (a wrong or unusual address on the account, or mail that isn't getting through), don't keep retrying — use the shell route below instead, which doesn't rely on email at all.

The reliable way: a one-time login link from your shell

If email is being unhelpful, you can mint the same one-time login link yourself with Drush. Connect to your shell as your oN.ftp account, cd into the site you want, and run:

drush uli

drush uli prints a one-time login URL straight to your terminal. Copy it into your browser and you land logged in as the admin user — no password needed — then change the password from the user-edit form.

A couple of notes:

  • Make sure you cd'd into the right site's directory first, or point Drush at the site with its alias (for example drush @your-site.example.com uli). Your aliases are set up for you — see Site aliases and redirects.
  • On an older Drupal 6 or 7 site, drush uli works just the same.

This is the surest way back into a site's admin, because it sidesteps email entirely. For a refresher on running Drush in your account, see Drush basics.

Reset your control panel (Aegir/Hostmaster) login

Your control panel — the Aegir/Hostmaster site where you manage your sites — doesn't offer a self-service password reset. The usual Drupal "Request new password" link is switched off here on purpose: the control panel deliberately can't send password-reset email, so a reset link would only lead to a message that never arrives.

If you're locked out of your control panel, ask your host to reset it for you. It's a routine request — they'll set a new password (or confirm which email address your account uses) and get you back in.

Tip: keep the email address on your control-panel account one you actually check, so your host can reach you quickly if anything needs confirming.

Reset your shell / SFTP password (the oN.ftp account)

This is the password you use to connect over SSH, SFTP or FTPS as your oN.ftp account. Two things are worth knowing about it.

It refreshes on a schedule (about every 90 days)

For security, your account password is refreshed automatically roughly every 90 days (you get a few days' warning first). This is normal and automatic — not a sign anything is broken. When it happens, a fresh password is generated for you and emailed to the address on file for your account.

So if a password that worked yesterday is suddenly rejected today, this is almost always why:

  1. Check your email — including the spam/junk folder — for the latest reset notice, which contains your new password.
  2. Update the saved password in your SSH client and your SFTP/FTPS program, then reconnect.

If that notice never arrives, or the address on file is out of date, don't keep retrying — contact your host and ask them to re-send or reset your login details. That's a routine request for them.

You can also change it yourself, any time

You don't have to wait for the 90-day refresh. From inside your shell, just run:

passwd

It asks for your current password, then a new one twice, and the change takes effect shortly after. Handy if you want to set something memorable, or you suspect your password has been seen by someone else.

The trick that ends password headaches: use an SSH key

The single best fix for shell/SFTP lock-outs is to stop depending on the password at all by setting up an SSH key. With a key in place:

  • You connect without typing a password.
  • The 90-day refresh stops interrupting you — key logins don't rely on the password, so your access simply keeps working through every refresh.

It's a one-time bit of setup, walked through step by step (with the one wrinkle that, because yours is a limited shell, ssh-copy-id can't install the key for you — you add it by hand or send the public half to your host) in Shell and SFTP access. If you're locked out right now with no key to fall back on, see When you can't connect for the full recovery walkthrough.

When it's the server, not your login

Everything above is yours to fix. But a couple of situations look like a password problem and aren't:

  • You're sure the password is right, there's no reset email, and you have no key — and re-sending hasn't helped. Getting a shell password set on the server is something that happens on the machine itself, so ask your host to reset it for you.
  • The server's own root login, or the machine being unreachable entirely — that's never yours to recover, and there's nothing to fix from your account. Open a support request with your host and describe what you see.

In short: your Drupal logins, your control-panel login, and your own shell password are all things you can put right yourself. Anything to do with the server's root access or the box itself is a message to your host.

Related