Name: 在 Oracle Linux 上使用 SSH 進行遠程訪問 (Remote Access Using SSH on Oracle Linux)
Uploaded: 2025-11-04T17:27:04.000Z
Duration: 8 min 35 s

情態副詞

Often the system we need to connect to is physically somewhere else, so we have to connect remotely.

很多時候我們需要連接的系統其實在別的地方，所以我們必須遠端連線。

There are several different ways to do this, but

分詞構句

in this video I'll show you one of the most common methods by connecting remotely using ssh, also known as Secure Shell.

不過在這支影片裡，我會教大家一個最常見的方法，也就是透過 SSH，也就是 Secure Shell 來遠端連線。

In this demo, I'll be working on two systems, the server that I want to connect to and the client I'll be connecting from.

在這個示範裡，我會操作兩個系統，一個是我想要連接的伺服器，另一個是我要從哪裡連接的客戶端。

這兩個系統都執行 Oracle Linux 8。

Let's get started by opening a terminal session on the server system.

我們就從在伺服器系統上開啟終端機對話開始吧。

We'll need to make sure that the system has OpenSSH server installed and configured.

我們需要確認系統已經安裝並設定好 OpenSSH 伺服器。

Oracle Linux has this installed out of the box, and

we can verify that by using dnf list installed and then piping it to grep ssh and we see openssh Server listed here.

我們可以用 `dnf list installed` 然後 `grep ssh` 來確認，可以看到 openssh-server 已經列在這裡了。

However, if you needed to install it, you'd use sudo dnf install openssh server after installation, you would then need to enable and start the sshd daemon which listens for client connections using sudo systemctl enable now sshd with the OpenSSH server installed, let's look at configuring it by editing the sshdconfig file.

不過，如果需要安裝的話，你會用 `sudo dnf install openssh-server`。安裝完之後，你還需要啟用並啟動 sshd daemon，它會監聽客戶端的連線，指令是 `sudo systemctl enable --now sshd`。既然 OpenSSH 伺服器已經安裝好了，接下來我們就來編輯 sshd_config 檔案來設定它吧。

So I'll open it up with sudo vi etc ssh sshdconfig There are a lot of settings you can adjust here, but

所以我會用 sudo vi etc ssh sshdconfig 打開它，這裡有很多設定可以調整，但是

Near the top, you can set the port that SSH listens on.

在上面附近，你可以設定 SSH 監聽的 port。

If I wanted to change it, I'd uncomment the line and adjust the port number, but

如果我想改的話，我會取消該行的註解並調整 port 號，但是

the default works for my setup, so I'll leave it as is.

預設設定對我來說已經夠用了，所以我會保持原樣。

If we page down, there's a line that permits root access.

如果我們按 page down，會有一行允許 root 存取。

Generally you'll want this to be set to no.

一般來說，你會希望將它設為 no。

To make the system more secure, if you needed root access remotely, you would log in with a less privileged user and then elevate your privileges after you connect, which is what I'm going to do.

為了讓系統更安全，如果你需要遠端 root 存取，你會用權限較低的帳號登入，然後在連線後提升權限，這也是我接下來要做的。

So I'll set this to no scrolling down we see a line for allowing key authentication, which would allow users to use key pairs to log in instead of passwords.

所以我會將它設為 no，捲動下來我們看到一行是允許金鑰認證，這會讓使用者可以使用金鑰配對登入，而不是密碼。

I'll show you how to do this later, so make sure this is set to yes.

我稍後會示範如何操作，所以請確保這裡設為 yes。

If we continue down the file, there's a line for password authentication.

如果我們繼續往下看，會有一行是關於密碼驗證的。

This allows clients to log in with the username and password defined on the server system.

這允許客戶端使用伺服器系統上定義的使用者名稱和密碼來登入。

If we set it to no, users would have to log in using a key instead.

如果我們將它設為 no，使用者就必須改用金鑰來登入。

As I mentioned, we'll look at keys later, so for now I'll leave password authentication set to yes and change it once we get keys configured.

正如我剛才提到的，我們稍後會討論金鑰，所以目前我會將密碼驗證保留為 yes，等我們設定好金鑰後再更改。

好的，我會儲存並離開這個檔案。

Since we made changes, we'll need to restart the daemon with sudo systemctl rest restart sshd now that we have SSH server up and running, we'll need to configure the firewall to allow SSH connections.

由於我們做了變更，需要重新啟動守護程式，使用 sudo systemctl rest restart sshd，現在 SSH 伺服器已經啟動並運行，我們需要設定防火牆以允許 SSH 連線。

To do that, we'll need to open the port that SSH is using.

要做到這一點，我們需要開啟 SSH 使用的連接埠。

In this case it's using the default port 22.

在這種情況下，它使用的是預設的連接埠 22。

So we can simply add the SSH service to the firewall with sudo firewall cmd permanent add service ssh then reload the firewall with sudo firewall cmd reload and we can verify the firewall settings with sudo firewall cmd list all and we see SSH listed as a service.

所以我們可以簡單地使用 sudo firewall cmd permanent add service ssh 將 SSH 服務加入防火牆，然後使用 sudo firewall cmd reload 重新載入防火牆，接著我們可以使用 sudo firewall cmd list all 來驗證防火牆設定，可以看到 SSH 已被列為一項服務。

If you are using a different port, you'd have to specifically open that port with the add port option and depending on your system settings, you would also have to tell Selinux about the port change.

如果你使用的是不同的連接埠，你就必須使用 add port 選項來明確開啟該連接埠，並且根據你的系統設定，你還需要告知 Selinux 連接埠的變更。

Okay, that's it for configuring the server.

So let's take a look at connecting to it from the client system.

那我們來看看如何從客戶端系統連接到它。

We'll need to make sure that the System has the OpenSSH clients package installed and configured.

我們需要確保系統已安裝並設定好 OpenSSH clients 套件。

Most distros have this installed by default and again we can verify using dnf list installed and then pipe it to grep ssh and we see it's installed on the system.

大多數發行版預設都會安裝，我們一樣可以用 dnf list installed 然後透過 grep ssh 來驗證，可以看到它已安裝在系統上。

But if you needed to install it, you could use sudo-dnf install OpenSSH clients the config file for the client side is in etc ssh sshconfig and I'll take a look at it with vi.

但如果你需要安裝，可以使用 sudo dnf install OpenSSH clients，客戶端設定檔位於 etc ssh sshconfig，我會用 vi 來看看。

This file allows you to set system wide options.

這個檔案可以讓你設定全域選項。

just know that the ssh config file is for the client side and the sshdconfig file that we looked at previously is for the server settings.

要知道 ssh config 檔案是用於客戶端，而我們之前看過的 sshdconfig 檔案是用於伺服器設定。

Now let's connect from the client to the server.

現在我們就從客戶端連線到伺服器。

The server already has a user matching my username and password, so I can use that.

伺服器上已經有一個使用者跟我目前的帳號密碼相符，所以我可以直接使用。

To connect I'll enter ssh my username and then the IP address or host name of the server.

要連線的話，我會輸入 ssh 然後是我的使用者名稱，接著是伺服器的 IP 位址或主機名稱。

If I left it like this, it would assume the default port of 22, but

如果我只打到這裡，它會預設使用 port 22，但是

to specify a port I could use the p option followed by the port number.

如果我要指定 port，我可以使用 p 選項，後面加上 port 編號。

Then it'll ask if I want to accept the server's key.

接著它會問我要不要接受伺服器的金鑰。

When installing OpenSSH server, I'll enter yes to accept the key and then it'll ask me for my password.

安裝 OpenSSH server 的時候，我會輸入 yes 來接受金鑰，然後它會要求我輸入密碼。

And now we're logged into the server system's terminal, the same as if I were logged in and sitting in front of it.

這樣我們就登入到伺服器系統的終端機了，就像我人坐在那邊操作一樣。

For instance, maybe I'll run LS LA and we see those files.

例如，我可能會執行 LS LA，然後我們就會看到這些檔案。

This connection will stay open as long as network connectivity is maintained.

只要網路連線正常，這個連線就會一直保持開啟。

So once I'm done working, I can type exit to disconnect and it'll return me to the prompt on my client system.

所以我工作告一段落後，就可以輸入 exit 來中斷連線，然後就會回到我客戶端系統的提示符號。

In that example, I used a username and password.

在這個例子裡，我用了使用者名稱和密碼。

The other way to authenticate remote connections is using key pairs, which is more secure, because unlike passwords, a key can't be guessed.

另一種驗證遠端連線的方式是使用金鑰對，這樣更安全，因為不像密碼，金鑰是猜不到的。

It also frees the user from having to remember complicated passwords.

這也讓使用者不用記住複雜的密碼。

那麼我們要怎麼設定金鑰驗證呢？

We'll generate a key pair on our client system using SSH keygen.

我們會在客戶端系統上使用 SSH keygen 來產生一組金鑰對。

This creates a private key and a corresponding public key.

這會產生一個私鑰和一個對應的公鑰。

We'll copy the public key over to the server and keep the private key securely on the client.

我們會把公鑰複製到伺服器上，然後把私鑰安全地保存在客戶端。

Then, when we try to connect the system, we'll present our private key.

然後，當我們嘗試連線系統時，就會出示我們的私鑰。

The server will verify that it corresponds to the public key that's already on the server.

伺服器會驗證它是否與伺服器上已有的公鑰相符。

And if it does, the server will allow us to connect.

如果相符，伺服器就會允許我們連線。

所以我們來我的客戶端系統上試試看。

If I don't specify anything, it'll save it to the default SSH folder within my home directory and call the key idrsa.

如果我沒指定任何東西，它就會儲存在我 home 目錄裡的預設 SSH 資料夾，並將金鑰命名為 idrsa。

if you had several different systems you were connecting to, you'd probably want to specify something more specific.

如果你要連線好幾個不同的系統，你可能會想指定一個比較特別的名稱。

I'm not going to add a passphrase, so I'll hit Enter and it generates the keys.

我不會加入密碼，所以按 Enter，它就會產生金鑰。

And if I run LS L ssh, we see the IDRSA file, which is the private key, and

如果我執行 LS L ssh，我們就會看到 IDRSA 檔案，也就是私鑰，還有

the idrsa pub file, which is the public key.

idrsa pub 檔案，也就是公開金鑰。

Now that we have the key pair, we need to copy the public key over to the server.

既然我們有了金鑰對，接下來就要把公開金鑰複製到伺服器上。

To do that, I can use SSH Copy id, then the I option, followed by the path to the identity file or key.

要做到這點，我可以用 SSH Copy id，然後是 I 選項，接著是身分檔或金鑰的路徑。

So in my case, it's my home directory SSH idrsa pub, then my username, and

所以對我來說，就是我的 home 目錄 SSH idrsa pub，然後是我的使用者名稱，

then it adds the key to the SSH authorizedkeys file within my home directory on the server.

它就會把金鑰加到伺服器上的 SSH authorizedkeys 檔案裡，就在我的 home 目錄裡。

Now let's connect to the server with SSH my username at the IP address.

現在我們用 SSH 使用者名稱 at IP 位址來連線到伺服器。

this time notice that it doesn't ask for my password.

這次你會注意到它沒有問我的密碼。

That's because it's using key authentication.

這是因為它正在使用金鑰驗證。

Now that we've added a key, let's disable password authentication by opening up the sshdconfig file and changing the password authentication line to no.

現在我們已經加入金鑰了，就來關閉密碼驗證，打開 sshdconfig 檔案，並將密碼驗證那一行改成 no。

Since we made changes to the file, we'll need to restart the daemon with sudo systemctl restartsshd and let's exit out of my session then return to the client.

既然我們更改了檔案，就需要用 sudo systemctl restart sshd 重啟守護行程，然後我們退出我的連線，再回到客戶端。

Let's test out that password authentication change by trying to login with a different user that hasn't set up a key pair yet.

我們來測試一下密碼驗證的更改，試著登入一個還沒設定金鑰對的新使用者。

So I'll try to login as sam, who's a defined user on the server with ssh sam the IP address and we see that it denies access again.

所以我會試著以 sam 的身份登入，sam 是伺服器上已定義的使用者，用 ssh sam IP 位址，我們看到它再次拒絕存取。

That's because this user doesn't have key authentication for the server and we've just turned off password authentication.

這是因為這個使用者沒有伺服器的金鑰驗證，而我們剛剛關閉了密碼驗證。

But if we try to connect with my user, sure enough it allows me to do it.

但如果我們試著用我的使用者連線，果然它就允許我這麼做了。

I think that covers the basics of connecting remotely using ssh.

我想這就涵蓋了使用 ssh 遠端連線的基本操作。