飞牛开启 root 账户远程登录完整教程

陈鱼宴

在 Linux 生态中，​root 账户是系统的最高权限账户​—— 几乎所有 Linux 发行版（包括飞牛 OS 这类基于 Debian 构建的系统）都默认预装并启用 root 账户，它拥有对系统文件、配置参数、软件权限的完全控制能力，是进行深度系统配置的核心账户。

但飞牛 OS 为了提升默认安全性，将 SSH 远程登录的 root 权限默认禁用。这就导致很多用户在使用带文件管理功能的 SSH 工具（如 Xshell、WinSCP、FinalShell 等）时，只能先通过普通账户登录，再用 sudo -i 手动提权，后续修改系统文件还得依赖 vim、nano 等命令行编辑器，操作繁琐且容易出错，尤其对需要频繁管理系统文件的用户来说，效率极低。

一、前置准备

步骤 1：设置 / 重置 root 账户密码

飞牛 OS 默认可能未设置 root 密码（或用户忘记密码），需先为 root 账户配置密码，否则无法通过 root 登录：

# 执行以下命令，按提示输入新的 root 密码（输入时密码不显示，按回车确认） 
sudo passwd root

• 验证：设置完成后，可通过 su - root 命令切换到 root 账户，测试密码是否生效。

步骤 2：修改 SSH 配置文件（sshd_config）

飞牛 OS 禁止 root 远程登录的核心限制在 SSH 配置文件中，需修改以下参数：

# 用 nano 编辑器打开 SSH 配置文件（新手推荐 nano，操作更简单） 
sudo nano /etc/ssh/sshd_config

（1）修改 PermitRootLogin 参数

• 打开文件后，找到以下关键配置项，按要求修改：

PermitRootLogin no  # 完全禁止 root 远程登录

• 修改为：

PermitRootLogin yes  # 允许 root 账户通过密码远程登录

（2）修改 PasswordAuthentication

PasswordAuthentication yes  # 这行取消注释

保存并退出 nano 编辑器

• 按 Ctrl + O（字母 O）保存文件；
• 按 Enter 确认保存路径；
• 按 Ctrl + X 退出编辑器。

# 重启 SSH 服务（飞牛OS兼容 Debian 命令） 
sudo systemctl restart sshd

然后断开ssh，重新连接即可。

光头佬幺

试过了，一切如楼主说的ok。谢谢分享

brianzhang

sed -i 's/PermitRootLogin no/PermitRootLogin yes/g' /etc/ssh/sshd_config

sudo passwd

sudo systemctl restart sshd

A+🐍🐍

小白请教：步骤1从哪里入手啊，找不到入口……

陈鱼宴

A+🐍🐍 发表于 2025-11-26 09:47
小白请教：步骤1从哪里入手啊，找不到入口……

连上SSH输入或者在主机里插上键盘输入都行

泽9167

求助 arm 1.1.24 没有PermitRootLogin no这一项，
有个PermitRootLogin prohibit-password，不敢乱改，请大神解惑

This is the sshd server system-wide configuration file. See

sshd_config(5) for more information.

This sshd was compiled with PATH=/usr/local/bin:/usr/bin:/bin:/usr/games

The strategy used for options in the default sshd_config shipped with

OpenSSH is to specify options with their default value where

possible, but leave them commented. Uncommented options override the

default value.

Include /etc/ssh/sshd_config.d/*.conf

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key

Ciphers and keying

#RekeyLimit default none

Logging

#SyslogFacility AUTH
#LogLevel INFO

Authentication:

#LoginGraceTime 2m
#PermitRootLogin prohibit-password
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

#PubkeyAuthentication yes

Expect .ssh/authorized_keys2 to be disregarded by default in future.

#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

For this to work you will also need host keys in /etc/ssh/ssh_known_hosts

#HostbasedAuthentication no

Change to yes if you don't trust ~/.ssh/known_hosts for

HostbasedAuthentication

#IgnoreUserKnownHosts no

Don't read the user's ~/.rhosts and ~/.shosts files

#IgnoreRhosts yes

To disable tunneled clear text passwords, change to no here!

PasswordAuthentication yes
#PermitEmptyPasswords no

Change to yes to enable challenge-response passwords (beware issues with

some PAM modules and threads)

KbdInteractiveAuthentication no

Kerberos options

#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

GSSAPI options

#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no

Set this to 'yes' to enable PAM authentication, account processing,

and session processing. If this is enabled, PAM authentication will

be allowed through the KbdInteractiveAuthentication and

PasswordAuthentication. Depending on your PAM configuration,

PAM authentication via KbdInteractiveAuthentication may bypass

the setting of "PermitRootLogin prohibit-password".

If you just want the PAM account and session checks to run without

PAM authentication, then enable this but set PasswordAuthentication

and KbdInteractiveAuthentication to 'no'.

UsePAM yes

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
PrintMotd no
#PrintLastLog yes
#TCPKeepAlive yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
#PidFile /run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

no default banner path

#Banner none

Allow client to pass locale environment variables

AcceptEnv LANG LC_*

override default of no subsystems

Subsystem sftp /usr/lib/openssh/sftp-server

Example of overriding settings on a per-user basis

#Match User anoncvs

X11Forwarding no

AllowTcpForwarding no

PermitTTY no

ForceCommand cvs server