Root access means having the highest level of permission on a Linux server. The root user can read and change every file, install any software, change kernel parameters, manage users, and control every service. It’s one of the main differences between a VPS and shared hosting, and also the main reason a VPS needs careful handling.

What full root lets you do

  • Install any software and versions: Docker, Redis, Node.js, Python, databases, VPN servers, game servers.
  • Configure the web server, PHP, the firewall and system services exactly as you want.
  • Tune kernel settings with sysctl (on KVM, where you have your own kernel). See what is KVM virtualization.
  • Create users, set permissions, schedule cron jobs, mount storage.
  • Reinstall or rebuild the system as you see fit.

All VPS.DO VPS plans come with full root access on KVM virtualization. See KVM VPS.

Root vs sudo

root account Regular user with sudo
Permissions Everything, always Admin rights only when you run sudo
Mistakes One typo can break the system You consciously elevate per command
Audit trail Hard to attribute actions sudo logs who ran what
Brute-force target Username is known to every attacker Username is unknown

Best practice: log in as a normal user, and use sudo for administrative commands.

adduser alice
usermod -aG sudo alice        # Debian/Ubuntu (wheel on RHEL-family)

See create a user on Linux and sudo and sudoers.

Log in safely

  1. Use SSH keys instead of passwords. See SSH keys.
ssh-copy-id [email protected]
  1. Disable root login over SSH once your sudo user works:
# /etc/ssh/sshd_config (or a file in /etc/ssh/sshd_config.d/)
PermitRootLogin no
PasswordAuthentication no
sudo sshd -t && sudo systemctl reload ssh

Keep your current session open while you test a new login in a second terminal. See disable root SSH login.

  1. Add a firewall and Fail2ban. See UFW and Fail2ban.

Locked out? Use the VNC console

If you lock yourself out (wrong firewall rule, broken SSH config, lost key), the VNC console in the VPS control panel gives you direct console access to the server, independent of SSH and networking. Log in there with a local password, and fix the problem. As a last resort, you can reinstall the OS from the panel (this erases the disk). See VPS VNC console and reinstalling the OS.

Tip: keep a strong local password set for your sudo user (even with SSH password login disabled), so the console login works when you need it.

Good habits with root power

  • Think before rm -rf, chmod -R, chown -R and dd. Double-check paths, especially with variables.
  • Back up config files before editing: sudo cp file file.bak.
  • Test config changes before applying them (nginx -t, sshd -t, apachectl configtest).
  • Don’t run services as root. Web servers, databases and apps should run as their own users. See Linux file permissions explained.
  • Keep the system updated. See automatic security updates.
  • Don’t run untrusted scripts with curl … | sudo bash without reading them first.

Managed vs unmanaged

With root access comes responsibility: on an unmanaged VPS, you are the system administrator. If you’d rather not handle that, consider a control panel, or a managed service. See managed vs unmanaged VPS and cPanel alternatives.

Quick reference

Task Command
Become root temporarily sudo -i
Run one command as root sudo <command>
Add a sudo user adduser alice && usermod -aG sudo alice
Disable root SSH PermitRootLogin no
Locked out VNC console in the control panel

Related: Linux server hardening checklist and what is a VPS.

  • VPS Guide
  • Linux
  • Security