EN Reset Guest Password

Reset a guest's password

中文版：重置客户机口令

Resetting the password of a user inside a virtual machine or container, rather than a panel account. The panel picks the channel automatically and, when it cannot, says what is missing instead of leaving you guessing.

Virtual machines

Two channels, chosen by what is available:

• QEMU guest agent: immediate, no reboot. It uses guest-set-user-password; with an agent too old to support that command it falls back to running chpasswd inside the guest.
• cloud-init: writes cipassword and regenerates the config drive. A running guest is then rebooted; a stopped one applies it on the next boot. Skipping the regeneration step is the classic "I changed the password and still cannot log in", because without a fresh config drive cloud-init does not re-run its per-instance modules.

If neither channel is available, the dialog lists exactly what is missing.

Containers

Host SSH

Proxmox's API has no endpoint for running a command inside a container. There is no exec and no set-password under lxc/{vmid}, termproxy only takes node and vmid, and container configuration has none of the ci* keys. So the panel borrows the host's credentials from SSH → Managed hosts and runs this on the host:

printf %s <base64> | base64 -d | pct exec <vmid> -- chpasswd

The password goes over base64 stdin rather than the command line, because quotes, backslashes and $ almost always break a concatenated command. Without managed-host credentials configured, the dialog says so and suggests using the container console and running passwd yourself.

Things to keep in mind

• Password strength follows the panel's own rule (at least 8 characters with both letters and digits), stricter than PVE's own 5-character minimum, because a guest password is the highest privilege credential on that machine.
• Step-up confirmation and audit: the action requires re-entering your password (plus a TOTP code with 2FA on), and the audit log records who, which machine, which account and which channel, never the password itself.
• Permission: vm.config.
• The cloud-init channel reboots the guest, so pick a maintenance window if it is running something.
• Tell whoever uses that machine the new password through a secure channel. The panel will not remember it for them.

Troubleshooting

Symptom	Cause
Both channels are greyed out (VM)	The machine is not running, so the agent will not answer, and no cloud-init drive is attached
Choosing the guest agent reports "failed to change the password inside the guest"	The username does not exist in the guest, or the agent is not running as root there
A container asks for a managed host to be configured	The host is not listed under SSH → Managed hosts, or the account lacks privileges (needs root or passwordless sudo)
Reports that the container was not found	The container is not on that host; check the connection in multi-host setups
Reports the password is too weak	At least 8 characters, with both letters and digits