Losing access to an Oracle Cloud Infrastructure (OCI) Compute instance due to a misplaced or corrupted SSH key can disrupt operations. Fortunately, OCI provides reliable methods to recover access without losing your data. This guide walks you through two proven approaches to recover your user SSH keys: using a secondary recovery instance to modify the boot volume, or booting into single-user mode via a serial console connection.
Method 1: Boot Volume Detachment and Modification
Prepare the Volume
- Stop the instance that you can’t connect to. In the Oracle Cloud Infrastructure Console, go to the details page for the instance and click Stop.
- Detach the boot volume. In the Boot Volume section, click the Actions icon and choose Detach. See “Detaching a Boot Volume” for additional details if needed.
- Attach the boot volume to another Linux instance by going to the details page of a different VM, clicking Attach Block Volume, and then selecting the boot volume that you just detached in the previous step. Be sure to select Read/Write access.
- After the boot volume attachment is completed (the BV icon is green), connect through SSH in the running VM and run the iSCSI commands to make that new disk available and visible by the OS.
Mount the Drive
Make /dev/sdb3, which is the root (/) partition where you can recover the opc SSH key file, available to the local operating system using “mount” command. Be sure to use the -o nouuid option; otherwise, you will see the “mount: wrong fs type, bad option, bad superblock on /dev/sdb3” error message.
sudo mount -o nouuid /dev/sdb3 /mnt
Replace the Key
Fix the opc SSH key by editing the /mnt/home/opc/.ssh/authorized_keys file and adding your SSH key public file.
sudo vi /mnt/home/opc/.ssh/authorized_keys
Unmount The Drive
After you add or change the SSH public key you need to use, save and exit it.
sudo umount /mnt
Remount the Drive to Original Instance
- Detach the iSCSI boot volume by running the detach iSCSI commands.
- Ensure that the /dev/sdb disk is no longer available or visible through the SSH connection, and then detach it.
- Reattach the boot volume to the instance where you wanted to recover the SSH key, wait for it to become operational and start it.
Method 2: Serial Console Connection and Single User Mode
Create Console Connection
To create a console connection on Oracle Cloud follow this guild
- Console Connection Article: Link
Boot into Single User Mode
To boot into a single user mode on Oracle Cloud follow this guild
- Single User Mode Article: Link
Replace SSH Key
- Go to the .SSH folder on appropriate user
cd ~opc/.ssh
- Open authorized_keys file and replace the new ssh key
vi authorized_keys”
- Change the file ownership
chown opc:opc authorized_keys
- Set the permision
chmod 600 authorized_keys
Exit from the Single User Mode
- Remount File System with Read Only Mode
mount -o remount,ro /
- Reboot
/usr/sbin/reboot -f
Conclusion
By following either the boot volume attachment method or leveraging the OCI serial console for single-user mode access, you can safely restore access to your compute instances without destroying your underlying environment. For security best practices, always ensure that your authorized_keys files maintain restricted permissions (600) and that you keep secure backups of your private SSH keys to prevent future lockouts.