# Get back into a server you're locked out of

> Locked out of your server? Pick the right way back in, from an open SSH session to the serial console or rescue mode, without erasing the disk.

Source: https://rack4.io/help/recover-server-access · Updated: 2026-11-06

If you can't log in to your server, first work out which login is failing, then use the first route below that fits. Every route on this page keeps your files; only a reinstall, the last one, erases the disk.

## Which login is it?

- **You can't log in to the Rack4 panel** (my.rack4.io). That's your account, not the server. Use [forgot your password?](https://rack4.io/help/reset-password#forgot-it), or if you lost your phone, [your 2FA recovery codes](https://rack4.io/help/two-factor-authentication#if-you-lose-your-phone). Your servers keep running meanwhile.
- **The panel works, but SSH to the server doesn't.** Read on.

If SSH says `Connection timed out` or `Connection refused`, the server may be down or blocking the port rather than refusing you, so go through [the unreachable checklist](https://rack4.io/help/server-unreachable-checklist) first. If it says `Permission denied`, the server answered and turned down your key or password: the routes below fix that.

## 1. Use a session that's still open

If you still have an SSH session open somewhere, on another computer or in another terminal tab, keep it open and fix things from there: [add your new key](https://rack4.io/help/add-or-replace-server-ssh-key) to `~/.ssh/authorized_keys`, undo the firewall rule, or set a password with `passwd root`. Test with a second, new connection before you close the old one.

## 2. Check the panel firewall

If you changed the server's [panel firewall](https://rack4.io/help/server-firewall) rules just before you were locked out, fix the rule in the panel. That needs no login on the server at all.

## 3. Log in on the serial console

The [serial console](https://rack4.io/help/serial-console) is the server's own screen in your browser. It doesn't use the network, so it still works after a broken `ufw` rule, a bad `sshd_config` or a network change. It logs in with a password, not a key, so it only helps if root (or your own user) has one.

On the console you can fix what's wrong: [the console's common fixes](https://rack4.io/help/serial-console#common-fixes) cover firewalls, sshd and network settings. To let your key in again, add it to `/root/.ssh/authorized_keys`.

## 4. Boot into rescue mode

If there's no password, or the server won't boot, use [rescue mode](https://rack4.io/help/rescue-mode). It shuts the server down and starts a small Debian system with your disk attached, untouched, and gives you a one-time password. From there you can:

- [set a new root password](https://rack4.io/help/rescue-mode#reset-the-root-password) with `chroot`;
- add your public key to `/mnt/root/.ssh/authorized_keys` after mounting the disk;
- fix `/etc/fstab`, free up a full disk or [check the filesystem](https://rack4.io/help/rescue-mode#check-the-filesystem).

Then [leave rescue](https://rack4.io/help/rescue-mode#leave-rescue) and the server boots from its own disk. If you forget, rescue ends by itself after 24 hours. A suspended server can't boot into rescue; pay its open invoice first.

## 5. Revert a snapshot

If a change you made broke the server and you took a [snapshot](https://rack4.io/help/snapshots) before it, reverting puts the whole disk back to that moment. Anything written since is lost, so use it when the snapshot is recent or the lost changes don't matter.

## 6. Reinstall, as a last resort

A [reinstall](https://rack4.io/help/reinstall-a-server) gives you a fresh system with the key or password you choose, on the same IP addresses. It erases the disk and every snapshot, so copy off what you need first, from rescue mode if that's the only way in.

## When to ask us

Open a [support ticket](https://my.rack4.io/support/new?category=technical) if the console stays blank after a reboot from the panel, rescue mode won't start or leave, or the server shows **error**. Say which of the steps above you tried and what each one showed; we can look at the host side, which you can't see.