x0ne OS / Handbook / Run x0ne OS

First boot and your account

Works today (measured 2026-10-12). The console prompt and the credentials were tested on the qcow2, the microVM and Firecracker. Root stays locked, no SSH server.

x0ne OS ships with no default account and no default password. You create the first account, or you pass it in.

Three ways in

Where	How the account is made
Local VM, interactive	A prompt on the first boot asks for a user name and a password.
Automation and microVMs	systemd credentials: a hashed password, an SSH public key.
Cloud images	cloud-init: your SSH key from the provider. No password.

Interactive first boot

Boot the VM image. See Run the VM image.
Choose a user name.
Choose a password of at least 12 characters, twice.
Log in with it.

The account is added to the sudo group. Root stays locked.

Credentials, for automation

systemd reads credentials passed by the VM manager, for example through QEMU SMBIOS strings. You pass a password hash, never the password. The unit imports x0ne.firstboot.*:

x0ne.firstboot.user: the user name.
x0ne.firstboot.hashed-password: a crypt(5) hash, never a clear password.
x0ne.firstboot.ssh-authorized-keys: written to ~/.ssh/authorized_keys.

From the source tree, x0ne-vm and make run pass them from X0NE_USER, X0NE_PASSWORD_HASH and X0NE_SSH_KEY.

make a password hash

$ openssl passwd -6

cloud-init, on cloud images

The provider passes your SSH key. Password login stays off. See Cloud images.

How to verify

after login

$ id
$ sudo passwd --status root

id lists the sudo group. The root status shows L, for locked.

How to undo

Remove the account with sudo deluser --remove-home USER, after you created another admin. For a fresh start, boot a new copy of the image.