How to Recover Access After Lost SSH Keys (DigitalOcean)

This guide will walk you through the process of restoring access to your Droplet if you no longer have your old SSH keys. This applies strictly to DigitalOcean and you must have access to your account.

If you had setup SSH-based login, chances are root user and password authentication are disabled.

Reset Root Password

Log into your DigitalOcean account. Select your Droplet > Access. From there, you will see Console Access and Reset root password.

Click on Reset root password. The new password will be sent to you via email.

Click on < Launch Console > under Console Access.

Type root on the login prompt and the password is the one you received via email.

You’ll be asked to enter this password one more time before you are allowed to change the password.

Choose something you’ll remember as this is temporary.

Enable Root and Password Authentication

You’ve gained access to your Droplet but any attempts to ssh into your server and you’ll receive Permission denied (publickey) error.

We need to modify 2 settings. Type the following :

nano /etc/ssh/sshd_config

# Change PermitRootLogin to Yes (if you don’t have any other users) and PasswordAuthentication to Yes

Press these keys simultaneously [CTRL][O] to write to the file and [CTRL][X] to Exit.

Restart the ssh daemon for changes to take effect.

systemctl restart ssh

Copy Existing SSH Key

Note: I’m using Ubuntu LTS 18.04

Do not ssh into your server. On your local machine, type the following command:

ssh-copy-id root@123.123.11.123

Note: Append correct username and server address.

You’ll be asked for the password.

You’ll receive an output such as 1 Key added.

Go ahead and ssh into your server with the following command:

ssh root@123.123.11.123

If the key was added successfully, no password will be necessary.

Delete Old Keys

If you no longer have access to the old ssh keys, it’s time to remove them.

Type the following command:

nano ~/.ssh/authorized_keys

The keys start with ssh-rsa and the last line will be the key you just added. You will need to figure out which are the old keys.

Press [CTRL][K] simultaneously to remove a particular line, making sure your cursor marks the start of your line.

Once all the old keys are removed, overwrite the file and exit.

Verify that you can ssh without a password before proceeding with the next step.

Disable Root Login and Password Authentication

nano /etc/ssh/sshd_config

# Change PermitRootLogin to No (If you have another user) and PasswordAuthentication to No.

Confirm and exit.

# Restart ssh daemon:

systemctl restart ssh

Exit out of your server and re-enter. You should be able to automatically ssh into your server.

If you try to ssh into your root account, you should get a permission denied error which is what we want.