在企业代理中尝试 SSH 时连接被未知端口 65535 关闭

Question

我一直在尝试设置一个 SSH 跳转服务器，以便在工作时连接到我的服务器，它使用了一个非常烦人（且缓慢）的公司代理，并阻止除端口 443 和 80 之外的所有外部连接。

我已经设置了一个测试服务器，如果可行的话，我将使用它作为跳转服务器，以接受端口 443 上的 SSH 连接。

这就是我尝试连接的方式

ssh -vvv ubuntu@jump-ssh-server -p 443 -o ProxyCommand="ncat --proxy proxy_server:3128 --proxy-auth proxy_user:proxy_password -C %h %p"

如果我尝试仅ProxyCommand在终端中运行它就可以了。但是，当我尝试使用 ssh 连接运行它时，出现错误

OpenSSH_8.6p1, LibreSSL 3.3.5
debug1: Reading configuration data /Users/user/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 21: include /etc/ssh/ssh_config.d/* matched no files
debug1: /etc/ssh/ssh_config line 54: Applying options for *
debug2: resolve_canonicalize: hostname jump_server is address
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/Users/user/.ssh/known_hosts'
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/Users/user/.ssh/known_hosts2'
debug1: Authenticator provider $SSH_SK_PROVIDER did not resolve; disabling
debug1: Executing proxy command: exec ncat --proxy proxy_server:3128 --proxy-auth user:password -C jump_server 443
debug1: identity file /Users/user/.ssh/id_rsa type 0
debug1: identity file /Users/user/.ssh/id_rsa-cert type -1
debug1: identity file /Users/user/.ssh/id_dsa type -1
debug1: identity file /Users/user/.ssh/id_dsa-cert type -1
debug1: identity file /Users/user/.ssh/id_ecdsa type -1
debug1: identity file /Users/user/.ssh/id_ecdsa-cert type -1
debug1: identity file /Users/user/.ssh/id_ecdsa_sk type -1
debug1: identity file /Users/user/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /Users/user/.ssh/id_ed25519 type -1
debug1: identity file /Users/user/.ssh/id_ed25519-cert type -1
debug1: identity file /Users/user/.ssh/id_ed25519_sk type -1
debug1: identity file /Users/user/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /Users/user/.ssh/id_xmss type -1
debug1: identity file /Users/user/.ssh/id_xmss-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.6
debug1: Remote protocol version 2.0, remote software version OpenSSH_8.2p1 Ubuntu-4ubuntu0.5
debug1: compat_banner: match: OpenSSH_8.2p1 Ubuntu-4ubuntu0.5 pat OpenSSH* compat 0x04000000
debug2: fd 5 setting O_NONBLOCK
debug2: fd 4 setting O_NONBLOCK
debug1: Authenticating to jump_server:443 as 'ubuntu'
debug3: put_host_port: [jump_server]:443
debug1: load_hostkeys: fopen /Users/user/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug3: order_hostkeyalgs: no algorithms matched; accept original
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug3: receive packet: type 3
debug1: Received SSH2_MSG_UNIMPLEMENTED for 0
Connection closed by UNKNOWN port 65535

这是由于我的公司防火墙试图阻止连接造成的吗？有什么办法解决吗？

Answer 1

我在 ssh 方面也遇到了类似的问题，我的问题是 Kex 算法不匹配。我在客户端和目标服务器上添加了相同的 Kex 算法并修复了它。

/etc/ssh/ssh_config我在其中添加了：

Host *
    KexAlgorithms curve25519-sha256,ecdh-sha2-nistp521

你可以在这里看到我的详细调查：

https://blog.adnanebrahimi.com/gitlab-cicd-strange-ssh-issue-on-ssh2msgkexecdhreply