> ## Documentation Index
> Fetch the complete documentation index at: https://vastai-80aa3a82-docs-host-security-hardening.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Recovery

> Undo a change that locked you out of a host machine: SSH configuration, removed keys, firewall rules, and locked accounts.

Each section reverses one step from the setup pages. Use your fallback access
— the BMC console, or a monitor and keyboard — to run them.

## Locked out over SSH

Restore every saved copy and remove the file you added:

```bash theme={null}
sudo sh -c 'for f in /etc/ssh/sshd_config.orig /etc/ssh/sshd_config.d/*.orig; do [ -e "$f" ] && cp "$f" "${f%.orig}"; done'
sudo rm -f /etc/ssh/sshd_config.d/01-vast-hardening.conf
sudo sshd -t && sudo systemctl restart ssh.service
```

Restoring only `/etc/ssh/sshd_config` is not sufficient. The files in
`/etc/ssh/sshd_config.d/` are read first and keep your settings in force until
they are restored as well.

Log in with your password, fix your key, and start again at step 2 of
[SSH Access](/host/security/ssh-access). Password login must be disabled again
before the machine will verify.

## Removed a key you still needed

Restore the backup taken before pruning:

```bash theme={null}
sudo sh -c 'for f in /root/.ssh/authorized_keys.bak /home/*/.ssh/authorized_keys.bak; do [ -e "$f" ] && cp "$f" "${f%.bak}"; done'
```

## Firewall blocking access

```bash theme={null}
sudo ufw disable
```

To clear every rule and start [The Host Firewall](/host/security/host-firewall)
again:

```bash theme={null}
sudo ufw --force reset
```

This leaves ufw disabled with no rules, which is the state the machine started
in.

## Locked an account by mistake

```bash theme={null}
sudo usermod -U -e '' oldadmin
```

Both flags are required. `-U` alone leaves the expiry date set, and the account
still refuses logins.