Root access: what does it mean and what responsibilities does it entail?

‘Root’ is the administrator user on Linux and Unix-based systems, to whom the system applies no permission restrictions whatsoever. With our KVM VPS plans, you receive full root access: the server is yours, and we will email you the details required for your first login once the VPS is set up.

What can the root user do?

A root user can, in practice, do almost anything on the system:

You can install and uninstall software, and launch any service;
can modify system files, kernel parameters and network settings;
can create and delete users, and can view and edit any file;
You can configure firewall rules and monitor ports below 1024 (for example, 80 and 443).

This flexibility allows you to run your own web server, database, Docker containers or any application running on Linux on the VPS.

What responsibilities does this entail?

With root access, you will also be responsible for running the server. We provide the physical hardware, the network, daily backups and DDoS protection, but within the server itself, you are responsible for:

for updating the system and the installed software,
for the firewall and access management,
for configuring and monitoring active services,
for content stored on the server and made available from there.

According to the General Terms and Conditions, it is the customer’s responsibility to keep their usernames and passwords confidential. Spam or attacks originating from a compromised, unpatched server may also affect your service: if such activity poses a threat to other customers, the service may be restricted in accordance with the General Terms and Conditions. Prohibited activities are listed in the Terms of Use.

Why is it risky to work as a root user?

There is no safety net: a mistyped command, such as an rm -rf issued with an incorrect path or a chmod -R 777 /, can render the system unusable in a matter of minutes.
Known username: the ‘root’ username is the same on every Linux server, which is why most attempts to log in using a password are directed at this account.
Compromised application: if a service running as root is compromised, the attacker immediately gains control of the entire server.

Recommended practice

Create a separate user account for your day-to-day work and grant them sudo privileges:

# Debian, Ubuntu
adduser kovacs
usermod -aG sudo kovacs

# AlmaLinux, Rocky Linux, CloudLinux
useradd -m kovacs
passwd kovacs
usermod -aG wheel kovacs

Set up SSH key-based access for this user and check that it works.
Next, disable password-based and direct root access via SSH (set PermitRootLogin no); the steps are described in our article on SSH server security settings.
Run system administrator commands with the sudo prefix; this ensures that the commands are logged and that you are consciously elevating your privileges each time.
Run your web server, database and applications not as root, but using your own restricted user account.
Before carrying out any major changes or system updates, take a snapshot so that you can revert to the previous state in the event of an error.

If you have locked yourself out

If you are unable to log in due to a firewall rule or an incorrect SSH setting, please open a ticket via the client portal and we will help you regain access to your server.

If you do not wish to run as root

If you need a break but don’t want to deal with maintenance, our managed VPS service means that our system administrators take care of updates, security settings and monitoring.