kex_exchange_identification: Connection closed by remote host

1.问题

在我的 MacBook 使用 git pull 从 Github 拉取代码时，突然报了如下错误，之前还是好好的，真让人抓狂呀😫

git pull             
kex_exchange_identification: Connection closed by remote host
Connection closed by 100.12.0.163 port 22
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

导致该问题的原因有很多，一般有如下几种：

• The socket connection between the SSH server and the client has been interrupted.
• The firewall is having too strict rules that it results in blocking even legitimate connection requests.
• Addition of faulty equipment or device to your already existing network.
• The SSH daemon could be consuming an unreasonably large amount of network resources.
• Your ports could be excessively exhausted by connection requests.

因为 Github 被墙，我这边是通过公司的 HTTP 代理来访问的。但又因为公司防火墙拦截了我与 Github 的 SSH 通信，所以我的原因就是上面的第二条。

2.办法

知道了原因，我们就可以想办法去解决。既然 HTTP 代理服务器拦截我使用 SSH 与 Github 建立通信，那么我们可以借助 corkscrew 这个工具，基于 HTTP 代理，打通 SSH 通信。

这里简单说一下 corkscrew 这个工具。

Corkscrew is a tool for tunneling SSH through HTTP proxies.
Corkscrew has been tested against several proxies requiring HTTP authentication.
Several flaws exist as only basic authentication is currently supported.
Digest authentication may be supported in the future.
NTLM authentication will most likely never be supported.

Corkscrew 是一个用于通过 HTTP 代理访问 SSH 的工具。它已经在一些需要 HTTP 认证的代理上测试过。但现在只支持 basic 认证。Digest 认证可能在将来支持。NTLM 认证最可能永远不支持。

3.具体操作

第一步：安装 corkscrew。

brew install corkscrew

第二步：配置 ~/.ssh/config。

Host github.com
     protocol 2
     IdentityFile ~/.ssh/id_rsa
     PreferredAuthentications publickey
     ProxyCommand corkscrew 127.0.0.1 12639 %h %p

其中：

• Host github.com 指明配置是针对访问 github.com 主机的。
• protocol 2 表明使用 SSH-2 协议。与 SSH-1 相比，SSH-2进行了一系列功能改进并增强了安全性；
• IdentityFile ~/.ssh/id_rsa 指明通信加密使用的认证证书文件（私钥文件），默认位置是~/.ssh/id_rsa, ~/ssh/id_dsa等。如果采用默认的证书，可以不用设置此参数，除非你的证书放在某个自定义的目录，那么你就需要设置该参数来指向你的证书；
• ProxyCommand corkscrew 127.0.0.1 12639 %h %p 指定用于连接到服务器的命令。其中 127.0.0.1 12639 为 HTTP 代理服务器的地址与端口。

关于更多配置项可参见 ssh_config(5)。

---

参考文献

kex_exchange_identification Connection Closed by Remote Host
Github Clone: Connection closed by remote host - ChenHsingYu
stackoverflow | ssh_exchange_identification: Connection closed by remote host under Git bash [closed]
Github | corkscrew
SSH 配置使用 HTTP 代理
用ssh突破公司http代理