Updated: 22 October 2026 · Applies to: Ucartz KVM VPS managed with Virtualizor; SSH checks tested with OpenSSH 10.0 on Debian 13, OpenSSH 10.2 on Ubuntu 26.04 and OpenSSH 9.9 on AlmaLinux 10.2, Fail2Ban 1.1.0
If Virtualizor said the root password was changed but the VPS still rejects it, the VPS has usually not booted since the change, or the SSH server is set to refuse root logins with a password. Restart the VPS from the panel, then test the new password on the VNC console: if the console accepts it, the password is fine and the cause is the SSH configuration, a locked or expired account, or a brute force block, all covered below.
This article is for a reset that seemed to work but still does not let you in. For the reset itself, see How to Reset Your VPS Root or Admin Password Using Virtualizor (panel and rescue mode) or How to change the VPS root password using Ucartz client area?. If it is your cPanel login that fails, see cPanel Password Reset Not Working: Causes and Fixes instead.
1. Make sure the VPS has really restarted
According to Virtualizor, on a KVM VPS the new root password is applied only after the VPS reboots; until then the old password keeps working. Click Restart on the VPS page in the client area. If the old password still works afterwards, the VPS did not boot again: shut it down, wait until the panel shows it as stopped, and start it again.
2. Test the password on the VNC console
Open the VNC console from the VPS page (How to Access Your VPS via VNC in Virtualizor) and log in as root with the new password. The console does not use SSH, so it tells you where the problem is:
- The console accepts the password: the reset worked. Go to step 3.
- The console rejects it too: the panel could not change the password. According to Virtualizor, this happens with operating systems installed from your own ISO and, on Windows, when the administrator account is not named Administrator. Reset it through rescue mode as shown in How to Reset Your VPS Root or Admin Password Using Virtualizor.
If your password contains symbols, the browser console may not type them the way you expect. Set a temporary password of letters and numbers only, log in, and change it with passwd once you are in.
3. Check whether SSH allows root passwords
Logged in on the console, ask the SSH server which settings are really in effect:
sshd -T | grep -E '^(permitrootlogin|passwordauthentication)'
Output on our Ubuntu 26.04 test system (Debian 13 prints without-password, which means the same):
permitrootlogin prohibit-password passwordauthentication yes
prohibit-password is the OpenSSH default: root may log in with an SSH key, but never with a password. passwordauthentication no blocks passwords for every user. Either one explains a correct password being refused.
The SSH log does not make this obvious. In our tests, a correct root password refused because of prohibit-password was logged exactly like a wrong one. Read the log with journalctl -u ssh -n 20 on Debian and Ubuntu:
journalctl -u sshd -n 20
Output on AlmaLinux 10.2 with the correct password (shortened, host name and address replaced):
unix_chkpwd[191]: password check failed for user (root) sshd-session[189]: pam_unix(sshd:auth): authentication failure; logname=root uid=0 euid=0 tty=ssh ruser= rhost=203.0.113.10 user=root sshd-session[189]: Failed password for root from 203.0.113.10 port 47208 ssh2
To find the file that sets the value, search the main configuration file and the drop-in folder:
grep -rEi '^\s*(PermitRootLogin|PasswordAuthentication)' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/
Output on AlmaLinux 10.2, where the package itself adds a drop-in file that allows root passwords:
/etc/ssh/sshd_config.d/25-permitrootlogin.conf:PermitRootLogin yes
The safest fix is to keep root on SSH keys and log in with a normal user that has sudo, or with your key. If you do want root to log in with a password, change PermitRootLogin as shown in How to Allow or Disable Root Login over SSH (PermitRootLogin), check the syntax and reload SSH:
sshd -t
systemctl reload ssh
On AlmaLinux and Rocky Linux the service is called sshd, so use systemctl reload sshd there.
4. Check whether the root account is locked or expired
A locked password is refused everywhere, including SSH:
passwd -S root
Output on our Debian 13 test system with a locked account (the second field is L for locked, P for a usable password):
root L 2026-10-22 0 99999 7 -1
Unlock it with:
passwd -u root
Then check the expiry dates:
chage -l root
Output on Debian 13 with an expired account (shortened):
Last password change : Oct 22, 2026 Password expires : never Password inactive : never Account expires : Jan 01, 1970
An Account expires date in the past blocks every login. Remove it with:
chage -E -1 root
If only the password has expired, the login still works but you are asked to choose a new password straight away (WARNING: Your password has expired.). More on these settings: Linux Password Expiration: Check, Set or Disable with chage.
5. Check for a brute force block
Tries with the old password before the restart can get your IP address banned. With Fail2Ban, SSH then refuses or times out before any password is asked. On the console, list the banned addresses:
fail2ban-client status sshd
Output (shortened, documentation address):
`- Actions |- Currently banned: 1 |- Total banned: 1 `- Banned IP list: 203.0.113.10
Remove the ban for your own address:
fail2ban-client set sshd unbanip 203.0.113.10
Fail2Ban prints 1 when the address was unbanned. See How to Install and Configure Fail2Ban on a Linux Server to add your address to the ignore list. On a VPS with cPanel and WHM, cPHulk can block SSH logins in the same way, according to cPanel.
Still not working
Open a Technical Support ticket from the client area with the VPS IP address and what the console shows. For the other passwords on a VPS (the Virtualizor account and the VNC console), see How to Update Your Virtualizor Account Password and How to Change the VNC Password for Your VPS in Virtualizor. Reseller and cPanel hosting logins are covered in WHM Reseller Password Reset: Your Login and Client Accounts.
Official documentation: sshd_config(5) and passwd(1).
