银河麒麟 SSH Vscode连接

SSH连接错误：

[20:04:32.376] Failed to set up socket for dynamic port forward to remote port 38671: Socket closed. TCP port forwarding may be disabled, or the remote server may have crashed. See the VS Code Server log above for details.
[20:04:32.376] Failed to set up socket for dynamic port forward to remote port 38671: Socket closed. TCP port forwarding may be disabled, or the remote server may have crashed. See the VS Code Server log above for details.
[20:04:32.401] > channel 3: open failed: administratively prohibited: open failed
> channel 4: open failed: administratively prohibited: open failed
[20:04:32.402] ERROR: TCP port forwarding appears to be disabled on the remote host. Ensure that the sshd_config has AllowTcpForwarding yes. Contact your system administrator if needed.

一、 检查 sshd_config 配置文件

sudo vi /etc/ssh/sshd_config

1. 以下参数正确设置，并且配置已生效。

AllowTcpForwarding yes # 启用端口转发
X11Forwarding yes
PermitTunnel yes
ListenAddress 0.0.0.0

# 让 SSH 同时监听端口 22 和 42717
Port 22
Port 42717

# PermitOpen none

请确保 PermitOpen 没有限制端口的开放：
你的配置文件中有 PermitOpen none，这会禁用所有端口的转发。
你可以尝试注释掉这行或修改为允许特定端口的转发。

2. 修改配置后，需要重启 SSH 服务，使更改生效：

sudo systemctl restart sshd

3. 全部代码为：

#	$OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

Include /etc/ssh/sshd_config.d/*.conf

Port 22
Port 42717
#AddressFamily any
ListenAddress 0.0.0.0
#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
PermitRootLogin yes
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

#PubkeyAuthentication yes

# Expect .ssh/authorized_keys2 to be disregarded by default in future.
#AuthorizedKeysFile	.ssh/authorized_keys .ssh/authorized_keys2

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

# AllowAgentForwarding yes
AllowTcpForwarding yes
GatewayPorts yes
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
PrintMotd no
#PrintLastLog yes
#TCPKeepAlive yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
PermitTunnel yes
#ChrootDirectory none
#VersionAddendum none

# no default banner path
Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

# override default of no subsystems
Subsystem	sftp	/usr/lib/openssh/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
X11Forwarding yes
AllowTcpForwarding yes
#	PermitTTY no
#	ForceCommand cvs server
# PermitOpen none

二、检查防火墙设置

确保防火墙没有阻止端口转发。可以使用以下命令查看防火墙规则（以 firewalld 为例）：

sudo firewall-cmd --list-all

如果防火墙阻止了 SSH 或特定端口的流量，你可以打开相应的端口，例

sudo firewall-cmd --add-service=ssh --permanent
sudo firewall-cmd --reload

1. 添加端口转发规则

如果你需要将特定的端口转发到本地或其他端口，可以使用 --add-forward-port 添加端口转发。例如，如果你要将本地的某个端口转发到远程服务器的端口，可以按如下方式添加：

sudo firewall-cmd --add-forward-port=port=42717:proto=tcp:toport=42717 --permanent
sudo firewall-cmd --reload

这将转发本地端口 42717 到远程端口 42717。

2. 启用 masquerading (NAT)

如果你需要使用端口转发或 NAT，建议启用 masquerading（网络地址转换）。这对于某些类型的端口转发是必要的，尤其是当防火墙位于 NAT 路由器或具有多个网络接口的服务器时：

sudo firewall-cmd --add-masquerade --permanent
sudo firewall-cmd --reload

3. 确保防火墙允许其他必需端口

如果需要转发其他特定端口（如在 VS Code 中使用的端口），确保它们也被防火墙允许。例如，如果你需要 42717 端口在防火墙中开放，可以添加：

sudo firewall-cmd --add-port=42717/tcp --permanent
sudo firewall-cmd --reload

4. 检查防火墙规则是否生效

更改配置后，使用以下命令检查防火墙的当前规则是否正确：

sudo firewall-cmd --list-all

总结

根据当前的防火墙配置，ssh 端口（22/tcp）是开放的，但是没有设置端口转发和 masquerading。如果你需要进行端口转发，务必添加相关规则并启用 masquerading，然后重新加载防火墙配置。

确保 AllowTcpForwarding 被启用： 如果防火墙是启用的，可以通过 firewall-cmd 来允许端口 42717 的转发。

例如，启用端口转发：

sudo firewall-cmd --zone=public --add-port=42717/tcp --permanent
sudo firewall-cmd --reload

检查端口转发规则是否生效： 使用 ss 或 netstat 确认服务器是否正确监听了所需的端口。

sudo ss -tuln | grep 42717

检查防火墙是否有特殊限制： 确认是否有 rich rules 或其他更细粒度的限制，阻止了端口转发。你可以使用以下命令查看详细的 rich rules 配置：

sudo firewall-cmd --list-rich-rules