I recently started using a VPS hosting service, that offers unmanaged VPS. It allows me to reinstall the VM at any point in time, choosing from a number of OS ISO files (doesn't have to be the same OS as before). You are probably already familiar with this kind of service.
When I first created the VM instance I had to enter a desired username and password and, optionally, a public key, for SSH access.
The thing that worries me, is that, upon reinstalling (through a web-based management environment), it shows me this password of the "root" account (not really root, but the main sudo account, that I had to create for the VPS instance), in plain text. Perhaps as a reminder for me, because they figure I may have forgotten it, because I am reinstalling the VPS. However, the more I think about it: why not just let me enter a completely new password?
Now, since they offer SSH access with public key access, as well, I figured, perhaps they have some nifty way to encrypt my password with that (or perhaps some secure master key of theirs), such that they can decrypt my password and only show me the password in my web-browser, when I want to reinstall the VM. But something tell me that that's probably wishful thinking, at best, or simply not at all the case, at worst.
What's more, is that they also offer shell access through web-based consoles (xterm and noVNC), presumably using the same public key I had to enter upon purchasing the VPS instance. Which made me frown a bit, as well.
What do you make of all this? Is this common practice and still reasonably secure, or are my intuitions correct in that it is considered bad practice and not possibly secure, at all?
