Assuming you have no root access, here is a solution based on Alexis Murzeau’s answer, which works in environments where there is a server in a cluster but its users lack root access and AllowTcpForwarding is disabled.

This solution involves creating an SSH tunnel through a public cloud virtual machine. Therefore, please only use it if you understand its security implications and consider additional security measures (e.g. limiting the IP ranges that can access the cloud instance).

As prerequisites for this solution, you must be able to:

• Start a cloud instance in AWS EC2, GCP, Azure, etc. (any small instance, e.g. an EC2 free-tier instance, works).

• Start an SSHD process on your cluster machine without root access.

• Open an SSH tunnel from your cluster machine. (Certain SELinux rules can prevent you from doing this.)

The following is an overview figure with your local computer (where the VS Code desktop application runs),
the cloud instance (used as a proxy), and
the cluster machine (where you’d like to run VS Code server but cannot enable AllowTcpForwarding for the default SSH process).

The steps to configure this setup are the following. Values between guillemets, e.g. «cloud_instance_username», must be substituted according to your configuration.

1. Start a cloud instance (e.g. with Ubuntu 22.04).

2. SSH into the cloud instance and configure its SSHD to enable AllowTcpForwarding:

   sudo vim /etc/ssh/sshd_config
   

   Uncomment the line: AllowTcpForwarding yes

   Restart the SSH service with:

   sudo service sshd restart
   

3. Add the public SSH keys of your local computer and of the cluster machine to the ~/.ssh/authorized_keys file on the cloud machine.

4. Setup an SSHD server on the cluster machine:

   mkdir ${HOME}/custom_ssh
   ssh-keygen -f ${HOME}/custom_ssh/ssh_host_rsa_key -N '' -t rsa
   ssh-keygen -f ${HOME}/custom_ssh/ssh_host_dsa_key -N '' -t dsa
   
   cat << EOF > ${HOME}/custom_ssh/sshd_config
   Port 2222
   HostKey ${HOME}/custom_ssh/ssh_host_rsa_key
   HostKey ${HOME}/custom_ssh/ssh_host_dsa_key
   AuthorizedKeysFile  .ssh/authorized_keys
   ChallengeResponseAuthentication no
   PubkeyAuthentication yes
   PasswordAuthentication yes
   UsePAM yes
   X11Forwarding yes
   Subsystem   sftp    /usr/lib/ssh/sftp-server
   PidFile ${HOME}/custom_ssh/sshd.pid"
   EOF
   
   /usr/bin/sshd -f ${HOME}/custom_ssh/sshd_config
   echo "Process ID file: ${HOME}/custom_ssh/sshd.pid"
   echo "Process ID: $(cat ${HOME}/custom_ssh/sshd.pid)"
   

   If you want to kill this SSHD server later, run:

   kill $(cat ${HOME}/custom_ssh/sshd.pid)
   

5. On the cluster machine, create a reverse SSH tunnel to the cloud instance. Note that this command stays in the foreground. Use tmux to keep the session open or the -f flag to run it in the background.

   ssh -R 8081:localhost:2222 
     «cloud_instance_username»@«cloud_instance_ip_address»
   

6. On the local machine, test the access with:

   ssh -J 
     «cloud_instance_username»@«cloud_instance_ip_address» 
     «cluster_machine_username»@localhost -p 8081
   

7. If this works, edit the ~/.ssh/config file on your local computer:

   Host proxy_cloud_instance
       HostName «cloud_instance_ip_address»
       User «cloud_instance_username»
   
   Host vscode_ssh_host
       HostName localhost
       User «cluster_machine_username»
       Port 8081
       ProxyJump proxy_cloud_instance
   

8. Test the SSH configuration by issuing:

   ssh vscode_ssh_host
   

9. Try starting a remote SSH session in VS Code to vscode_ssh_host.