我有一个定制的 Debian（使用 debootstrap 构建）
Linux debian 4.9.0-4-686 #1 SMP Debian 4.9.51-1 (2017-09-28) i686 GNU/Linux
具有只读文件系统
这是隧道配置（它在经典安装上完美运行）
Host *
# ForwardAgent no
# ForwardX11 no
# ForwardX11Trusted yes
# RhostsRSAAuthentication no
# RSAAuthentication yes
PasswordAuthentication yes
# HostbasedAuthentication no
# GSSAPIAuthentication no
# GSSAPIDelegateCredentials no
# GSSAPIKeyExchange no
# GSSAPITrustDNS no
# BatchMode no
CheckHostIP yes
# AddressFamily any
# ConnectTimeout 0
# StrictHostKeyChecking ask
# IdentityFile ~/.ssh/identity
# IdentityFile ~/.ssh/id_rsa
# IdentityFile ~/.ssh/id_dsa
# IdentityFile ~/.ssh/id_ecdsa
# IdentityFile ~/.ssh/id_ed25519
# Port 22
Protocol 2
# Cipher 3des
Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
# MACs hmac-md5,hmac-sha1,[email protected],hmac-ripemd160
# EscapeChar ~
Tunnel yes
# TunnelDevice any:any
# PermitLocalCommand no
# VisualHostKey no
# ProxyCommand ssh -q -W %h:%p gateway.example.com
# RekeyLimit 1G 1h
SendEnv LANG LC_*
HashKnownHosts yes
我安装隧道：
ssh -ND 1080 -vvv -p 443 user@server
输出看起来不错：
OpenSSH_7.4p1 Debian-10+deb9u1, OpenSSL 1.0.2l 25 May 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: resolving "xxxx" port 443
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to xxxxx [xxxx] port 443.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: SELinux support disabled
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4p1 Debian-10+deb9u1
debug1: Remote protocol version 2.0, remote software version dropbear_2012.55
debug1: no match: dropbear_2012.55
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to xxxxxxx:443 as 'xxxxxxx'
debug3: put_host_port: [xxxxxxxx]:443
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c
debug2: host key algorithms: [email protected],[email protected],[email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
debug2: ciphers stoc: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[email protected],zlib
debug2: compression stoc: none,[email protected],zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1
debug2: host key algorithms: ssh-rsa,ssh-dss
debug2: ciphers ctos: aes128-ctr,3des-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes256-cbc,twofish256-cbc,twofish-cbc,twofish128-cbc
debug2: ciphers stoc: aes128-ctr,3des-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes256-cbc,twofish256-cbc,twofish-cbc,twofish128-cbc
debug2: MACs ctos: hmac-sha1-96,hmac-sha1,hmac-md5
debug2: MACs stoc: hmac-sha1-96,hmac-sha1,hmac-md5
debug2: compression ctos: zlib,[email protected],none
debug2: compression stoc: zlib,[email protected],none
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: diffie-hellman-group14-sha1
debug1: kex: host key algorithm: ssh-rsa
debug1: kex: server->client cipher: aes128-ctr MAC: hmac-sha1 compression: none
debug1: kex: client->server cipher: aes128-ctr MAC: hmac-sha1 compression: none
debug1: sending SSH2_MSG_KEXDH_INIT
debug2: bits set: 1024/2048
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEXDH_REPLY
debug3: receive packet: type 31
debug1: Server host key: ssh-rsa SHA256:k5AHnNs87cyG5my8AcjKp6KY1tWUeGIH2b3ZWALCsnU
debug3: put_host_port: [xxx.xxx.xx.xx]:443
debug3: put_host_port: [xxxxxxxxxxx]:443
debug1: checking without port identifier
The authenticity of host '[xxxxxx]:443 ([xxx.xxx.xx.xx]:443)' can't be established.
RSA key fingerprint is SHA256:k5AHnNs87cyG5my8AcjKp6KY1tWUeGIH2b3ZWALCsnU.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[xxxxxx]:443,[xxxxxx]:443' (RSA) to the list of known hosts.
debug2: bits set: 999/2048
debug3: send packet: type 21
debug2: set_newkeys: mode 1
debug1: rekey after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey after 4294967296 blocks
debug2: key: /root/.ssh/id_rsa ((nil))
debug2: key: /root/.ssh/id_dsa ((nil))
debug2: key: /root/.ssh/id_ecdsa ((nil))
debug2: key: /root/.ssh/id_ed25519 ((nil))
debug3: send packet: type 5
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 53
debug3: input_userauth_banner
+++++++++xxxxxxxxx+++++++++
* No Reupload and Repost Your Account
* No DDOS
* No Hacking
* No Torrent
* No Fraud
* No Spam etc.
You are allowed a maximum of 3 Bitvise for using SSH account!!
Don't forget to support us!! xxxxxxxx
+++++++++XXXXXXXXXX+++++++++
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,password
debug3: start over, passed a different list publickey,password
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/id_rsa
debug3: no such identity: /root/.ssh/id_rsa: No such file or directory
debug1: Trying private key: /root/.ssh/id_dsa
debug3: no such identity: /root/.ssh/id_dsa: No such file or directory
debug1: Trying private key: /root/.ssh/id_ecdsa
debug3: no such identity: /root/.ssh/id_ecdsa: No such file or directory
debug1: Trying private key: /root/.ssh/id_ed25519
debug3: no such identity: /root/.ssh/id_ed25519: No such file or directory
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred: ,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password
xxxxxxxxx password:
debug3: send packet: type 50
debug2: we sent a password packet, wait for reply
debug3: receive packet: type 52
debug1: Authentication succeeded (password).
Authenticated to xxxxx ([xxxxx]:443).
debug1: Local connections to LOCALHOST:1080 forwarded to remote address socks:0
debug3: channel_setup_fwd_listener_tcpip: type 2 wildcard 0 addr NULL
debug1: Local forwarding listening on 127.0.0.1 port 1080.
debug2: fd 4 setting O_NONBLOCK
debug3: fd 4 is O_NONBLOCK
debug1: channel 0: new [port listener]
debug3: sock_set_v6only: set socket 5 IPV6_V6ONLY
debug1: Local forwarding listening on ::1 port 1080.
bind: Cannot assign requested address
debug1: Requesting tun unit 2147483647 in mode 1
debug1: sys_tun_open: tunnel mode 1 fd 5
debug2: fd 5 setting O_NONBLOCK
debug3: fd 5 is O_NONBLOCK
debug1: channel 1: new [tun]
debug3: send packet: type 90
debug2: fd 3 setting TCP_NODELAY
debug3: ssh_packet_set_tos: set IP_TOS 0x10
debug1: Entering interactive session.
debug1: pledge: network
debug3: receive packet: type 92
channel 1: open failed: unknown channel type:
debug2: channel 1: zombie
debug2: channel 1: garbage collecting
debug1: channel 1: free: tun, nchannels 2
debug3: channel 1: status: The following connections are open:
# lsof -i :1080
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
ssh 3937 root 4u IPv4 60066 0t0 TCP localhost:socks (LISTEN)
#netstat -ltpe
tcp 0 0 127.0.0.1:1080 0.0.0.0:* LISTEN 3937/ssh
tcp 0 0 192.168.1.29:40112 xxx.xxx.xx.xx:443 ESTABLISHED 3937/ssh
然后我配置firefox-esr（Debian中iceweasel的新名称）以使用新创建的代理：手动代理配置http代理，ssl代理，ftp代理=清除“对所有协议使用此代理”=清除。 ocks 主机 127.0.0.1 端口 1080 本地主机无代理，127.0.0.1
然后，当执行 http 请求时，什么也没有发生（浏览器只是挂起）。我尝试tor（配置了Socks5Proxy 127.0.0.1:1080），它做了同样的事情，ssh隧道没有说什么（在详细模式下没有输出）
tcpdump -i wlp2s0 port 1080
-> 完全没有流量然后我尝试：
nc 127.0.0.1 1080
-> 什么也没发生
最后一次测试，但我不确定它是否相关：我杀死隧道并执行以下操作：
nc -l -p 1080
网络统计 说：
Proto Recv-Q Send-Q Local Address Foreign Address State User Inode PID/Program name
tcp 0 0 0.0.0.0:socks 0.0.0.0:* LISTEN root 65776 3985/nc
nc 127.0.0.1 1080
-> 什么也没发生
iptables 为空：
# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
结论：看起来问题不是由 ssh 或浏览器引起的，而可能是套接字（？）。
我从那里被困住了。
感谢各位的帮助！我确实需要这个才能工作！
答案1
我认为这与您的只读设置有关，以某种方式阻止您的 lo 接口启动。该测试符合以下症状：
root@stretch-amd64:~# ip link set lo down
root@stretch-amd64:~# tcpdump -n -i lo
tcpdump: lo: That device is not up
root@stretch-amd64:~# nc -l -p 1080
您只是看错了界面。 lo 用于 localhost（也可用于任何本地连接，无论 IP 是什么）。
在第二个终端上：
root@stretch-amd64:~# nc -w 5 -v -n 127.0.0.1 1080
nc: connect to 127.0.0.1 port 1080 (tcp) timed out: Operation now in progress
再次第一个终端：
ip link set lo up
nc -l -p 1080
再次第二个终端：
root@stretch-amd64:~# nc -w 5 -v -n 127.0.0.1 1080
Connection to 127.0.0.1 1080 port [tcp/*] succeeded!
验证 /etc/network/interfaces 是否已获取此条目或添加它：
auto lo
iface lo inet loopback
如果它在那里，我只能认为 ifup 由于只读系统而不起作用。有一个可以ip link set lo up在启动时在任何地方运行的脚本。