Complete Guide to Obtaining and Configuring Root Password in Google Cloud Engine VM

Root Password Management Mechanism in Google Cloud Engine VM

In the Google Cloud Engine (GCE) environment, virtual machine instance security design follows the principle of least privilege. By default, Linux VMs created from public images do not have pre-set root user passwords, a design choice that significantly enhances system security. When users need to log in as root through cPanel or other management panels, they must first understand GCE's authentication mechanism.

Core Steps for Setting Root Password

To obtain the server's root password, users need to connect to the VM instance via SSH and then use sudo privileges to execute the password change command. The specific operation process is as follows:

user@server[~]# sudo passwd
Changing password for user root.
New password: 
Retype new password: 
passwd: all authentication tokens updated successfully.

This process involves several key points: first, the user must have sudo privileges; second, the new password must meet the system's password policy requirements; finally, after successful password modification, the system updates all relevant authentication tokens.

SSH Configuration and Root Login Enablement

Even after setting the root password, the default SSH configuration may still prohibit root login via password. According to Google's official documentation, the PermitRootLogin parameter in the /etc/ssh/sshd_config file needs to be modified:

sudo sed -i 's/PermitRootLogin no/PermitRootLogin prohibit-password/g' /etc/ssh/sshd_config

This command changes PermitRootLogin from no to prohibit-password, allowing root login using key authentication. For scenarios requiring password authentication, it can be further modified to yes, but this reduces security.

SSH Key Configuration Best Practices

For VM instances with OS Login enabled, SSH keys need to be configured to support root login:

sudo mkdir /root/.ssh
sudo chmod 700 /root/.ssh
sudo touch /root/.ssh/authorized_keys
sudo chmod 600 /root/.ssh/authorized_keys

These commands create the SSH directory structure for the root user and set appropriate permissions. Then add the public key to the authorized_keys file, ensuring only authorized keys can access.

Service Restart and Connection Testing

After completing configuration modifications, the SSH service needs to be restarted for changes to take effect:

sudo systemctl restart sshd

Or by restarting the entire VM instance. After restart, root connection can be tested using gcloud CLI or third-party SSH tools:

gcloud compute ssh --project=PROJECT_ID --zone=ZONE root@VM_NAME

Security Considerations and Alternatives

While direct use of the root account is necessary in some scenarios, Google recommends prioritizing the use of sudo for executing privileged commands. This approach provides better audit tracking and permission control. For login requirements of management panels like cPanel, it is recommended to evaluate whether root privileges are truly needed or if appropriate sudo rules can be configured to meet the requirements.

Troubleshooting and Best Practices

If connection issues are encountered, first check if the SSH configuration file syntax is correct, ensuring the PermitRootLogin parameter setting meets expectations. Also verify whether firewall rules and network configurations allow SSH connections. It is recommended to use key authentication instead of password authentication in production environments and regularly rotate keys to maintain security.