Question

Is DigitalOcean's console access safe? Can I disable it?

After successfully setting up SSH Key Authentication and disabling password access to my server, I can still log in as either ‘newuser’ or root using DigitalOcean’s console access. Is this normal? It seems very risky.

Show comments

Submit an answer


This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Sign In or Sign Up to Answer

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Accepted Answer

The console of your droplet is the virtual server equivalent of being directly attached to the server’s physical keyboard and monitor ports - it is not an SSH interface.

This tutorial describes its use:

https://www.digitalocean.com/community/tutorials/how-to-use-the-digitalocean-console-to-access-your-droplet

alexdo
Site Moderator
Site Moderator badge
December 9, 2020

Hello, all

The web console is intended to access your droplet in a case of emergency in order to sort out the issue. Most users manage their DigitalOcean Droplets using SSH, PuTTY, or a control panel they’ve installed themselves. However, changes to your network or service configuration files could leave you unable to log in remotely using these methods.

The Droplet console provides out-of-band access and is available regardless of your network settings. It emulates the access you would have if you were sitting down with a keyboard and monitor attached to the actual server. You can use this feature to log in and revert bad settings to regain normal access.

I will highly recommend to use a ssh-client in order to access and manage your droplet.

You can also check our docs on How to Connect to Droplets with SSH:

https://www.digitalocean.com/docs/droplets/how-to/connect-with-ssh/

There are two options at the bottom of the doc: Connect with OpenSSH and Connect with PuTTY

Hope that this helps! Regards, Alex

I know this is over a year old, but I wanted to leave this here if you or some other future Googler finds it useful.

Someone recently-ish gained access to my saved passwords in Google and was thus able to access my DigitalOcean account, reset my root password, and login via the console.

As a result I decided to implement this: https://github.com/shitchell/response-test

It detects if the login session is coming from a physical TTY (which the online console appears to be), and if so, presents a customizable challenge phrase/response (glorified second password). If they get it wrong, they’re dropped into a pseudo shell that mimics /bin/sh but with broken commands so that it appears not that they’ve been locked out, but that the system is just horribly broken.

Try DigitalOcean for free

Click below to sign up and get $200 of credit to try our products over 60 days!

Sign up

Become a contributor for community

Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.

DigitalOcean Documentation

Full documentation for every DigitalOcean product.

Resources for startups and SMBs

The Wave has everything you need to know about building a business, from raising funding to marketing your product.

Get our newsletter

Stay up to date by signing up for DigitalOcean’s Infrastructure as a Newsletter.

New accounts only. By submitting your email you agree to our Privacy Policy

The developer cloud

Scale up as you grow — whether you're running one virtual machine or ten thousand.

Get started for free

Sign up and get $200 in credit for your first 60 days with DigitalOcean.*

*This promotional offer applies to new accounts only.