> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gcore.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Recover SSH access in recovery mode

> Recover SSH access in recovery mode by installing a public key on a Linux VM or Bare Metal server when the private key is lost.

Recovery mode opens a root shell on a Linux Virtual Machine or Bare Metal server from the console when the private key is lost and no console password is set. [Install a public key](#install-a-public-key) when SSH must accept a new key.

**1. Open the server**

**Virtual Machine**

Log in to the [Gcore Customer Portal](https://portal.gcore.com) and navigate to **Cloud** > **Virtual Instances**. Open the Virtual Machine.

![Virtual Instance page with Access to Console and the ubuntu login](https://mintcdn.com/gcore/Fvzh2QEH6v_ao85Z/images/docs/cloud/virtual-instances/troubleshooting/recover-ssh-access-via-recovery-mode/access-to-console.png?fit=max\&auto=format\&n=Fvzh2QEH6v_ao85Z\&q=85\&s=a84d67c828d47b60fff056fab6ba01c9)

**Bare Metal**

Log in to the [Gcore Customer Portal](https://portal.gcore.com) and navigate to **Cloud** > **Bare Metal**. Open the Bare Metal server.

![Bare Metal page with Access to Console and the ubuntu login](https://mintcdn.com/gcore/Fvzh2QEH6v_ao85Z/images/docs/cloud/virtual-instances/troubleshooting/recover-ssh-access-via-recovery-mode/bare-metal-access-to-console.png?fit=max\&auto=format\&n=Fvzh2QEH6v_ao85Z\&q=85\&s=1b9c5756d3a4f70e598f83c3489118a2)

The login beside **Access to Console** is the account SSH accepts. On the Ubuntu image that account is `ubuntu`.

**2. Open the console**

![Bare Metal server page with Access to Console beside the IP address](https://mintcdn.com/gcore/Fvzh2QEH6v_ao85Z/images/docs/cloud/virtual-instances/troubleshooting/recover-ssh-access-via-recovery-mode/server-page-access-to-console.png?fit=max\&auto=format\&n=Fvzh2QEH6v_ao85Z\&q=85\&s=2bbd703fb150bb2f9da79c5ceadad518)

Click **Access to Console** to open the console in a browser tab, with **Send CtrlAltDel** at the top right.

> [!NOTE]
>
> Not every Bare Metal platform provides **Access to Console**.

![VNC console with Send CtrlAltDel and the Ubuntu login](https://mintcdn.com/gcore/Fvzh2QEH6v_ao85Z/images/docs/cloud/virtual-instances/troubleshooting/recover-ssh-access-via-recovery-mode/console-connected.png?fit=max\&auto=format\&n=Fvzh2QEH6v_ao85Z\&q=85\&s=8f6f0c6911f1bed143ebf3a012611631)

**3. Open the GRUB menu**

Open the boot menu before the login prompt:

1. Click the console screen so keystrokes reach the server.
2. Click **Send CtrlAltDel**.
3. Press Escape until **GNU GRUB** appears.

> [!WARNING]
>
> The GRUB menu stays hidden, and Escape registers only during `Booting from Hard Disk...`. If the Ubuntu login prompt appears, Escape missed the menu, so click the console screen and repeat this step.

![GNU GRUB menu with Ubuntu and Advanced options for Ubuntu](https://mintcdn.com/gcore/Fvzh2QEH6v_ao85Z/images/docs/cloud/virtual-instances/troubleshooting/recover-ssh-access-via-recovery-mode/grub-menu.png?fit=max\&auto=format\&n=Fvzh2QEH6v_ao85Z\&q=85\&s=654ad00715f744cefb5ece3f4b1b035f)

**4. Boot recovery mode**

On an Ubuntu cloud image, select **Advanced options for Ubuntu** and press Enter. Then select the entry that ends with `(recovery mode)` and press Enter.

![GRUB advanced options with the recovery mode entry highlighted](https://mintcdn.com/gcore/Fvzh2QEH6v_ao85Z/images/docs/cloud/virtual-instances/troubleshooting/recover-ssh-access-via-recovery-mode/grub-recovery.png?fit=max\&auto=format\&n=Fvzh2QEH6v_ao85Z\&q=85\&s=e23c5919303c1fc58c2e3b3231711076)

**5. Open a root shell**

In **Recovery Menu (filesystem state: read-only)**, select **root** (**Drop to root shell prompt**) and press Enter.

![Recovery menu with Drop to root shell prompt highlighted](https://mintcdn.com/gcore/Fvzh2QEH6v_ao85Z/images/docs/cloud/virtual-instances/troubleshooting/recover-ssh-access-via-recovery-mode/recovery-menu-root.png?fit=max\&auto=format\&n=Fvzh2QEH6v_ao85Z\&q=85\&s=4d2777cc699978b0e54026acd58f99e1)

At `Press Enter for system maintenance (or press Control-D to continue):`, press Enter. The menu frame can remain on screen after the shell starts, while the shell is active once a prompt ending in `~#` appears at the bottom.

## Install a public key

Use this section when the server must accept a new SSH key. The root shell from the procedure above is already open.

**1. Remount the root filesystem**

Recovery mounts the root filesystem read-only, so remount it before writing the key:

```bash theme={null}
mount -o remount,rw /
```

When the command returns to the prompt without an error, the root filesystem accepts writes.

![Root shell after remounting the filesystem read-write](https://mintcdn.com/gcore/Fvzh2QEH6v_ao85Z/images/docs/cloud/virtual-instances/troubleshooting/recover-ssh-access-via-recovery-mode/remount-read-write.png?fit=max\&auto=format\&n=Fvzh2QEH6v_ao85Z\&q=85\&s=055f35ef6eca8f8a7c5aa3a37502f76b)

**2. Install the public key**

Write the new public key for the login beside **Access to Console** into `authorized_keys` on the local disk. On Ubuntu the file is `/home/ubuntu/.ssh/authorized_keys`, and when the login label names another account, use that account's home directory.

```bash theme={null}
printf '%s\n' 'PUBLIC_KEY' > /home/ubuntu/.ssh/authorized_keys
```

Replace `PUBLIC_KEY` with the OpenSSH public key on one line.

> [!WARNING]
>
> The `>` operator replaces the file, so keys already in it stop authenticating.

**3. Set ownership and permissions**

Set ownership and modes, then run `sync` before the reboot:

```bash theme={null}
chown ubuntu:ubuntu /home/ubuntu/.ssh /home/ubuntu/.ssh/authorized_keys
chmod 700 /home/ubuntu/.ssh
chmod 600 /home/ubuntu/.ssh/authorized_keys
sync
```

Keep `/home/ubuntu` at mode `750`, because SSH succeeded with that mode on the Ubuntu image.

**4. Reboot the server**

Reboot into the default GRUB entry:

```bash theme={null}
reboot
```

**5. Confirm SSH access**

From a client that holds the matching private key, connect with the login from the server page:

```bash theme={null}
ssh -i /path/to/private_key ubuntu@INSTANCE_IP
```

Replacing `authorized_keys` makes the previous private key fail with `Permission denied (publickey)`.

> [!TIP]
>
> Add [multiple SSH keys](/cloud/virtual-instances/troubleshooting/troubleshoot-issues-with-ssh-connection#lost-ssh-key-and-cannot-connect) at creation time. Set a console password in user data for a [Virtual Machine](/cloud/virtual-instances/customize-initial-setup-for-your-instance#set-a-password-for-a-virtual-machine) or a [Bare Metal server](/cloud/bare-metal-servers/connect-to-your-bare-metal-server-via-ssh#connect-with-a-password) so the console opens without the SSH key.