New VPSes come with a sudo user, not a root login

A server whose only account is root, reachable over SSH with a password, is the single most scanned target on the internet. New VPSes no longer ship that way.

Each new server is created with a candor user that has sudo, its own generated password, and your SSH key already installed if you gave us one when ordering. Direct SSH access as root is disabled as part of the first boot, so there is never a window where the server is reachable that way.

Root keeps its own password on purpose. If you ever lock yourself out of SSH, the console in your client area still gets you in — security should not mean losing access to your own machine.

The account to log in as, and its password, are on the service page under Information.