[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-relays] Oubound Ports
Hmm, I'm getting a bit confused now over the situation and perhaps I was
off-topic for this email chain.
I was talking about my server making connections to another server's
ports 22 (destination port 22). This is what sets off monitoring at some
service providers as they will actively monitor some ports (22, 25, 53
are the three most common as far as I know). This is usually a proactive
measure to spot potential abuses before they start receiving a large
number of complaints about their customers.
When I run the netstat -p command on my relay that was flagged by my
provider, I see something like:
# netstat -p | grep :ssh
tcp 0 0 localhost:ssh 192.111.148.38:50658
ESTABLISHED
tcp 0 0 localhost:38923 42-2-24-248.static.:ssh
ESTABLISHED
tcp 0 0 localhost:38062 rainbowwarrior.tors:ssh
ESTABLISHED
tcp 0 0 localhost:43349 hosted-by.snel.com:ssh
ESTABLISHED
tcp 0 0 localhost:41585 lumumba.torservers.:ssh
ESTABLISHED
The first result is incoming to my port 22 - to be expected, this is my
own SSH session. The remainder (I'm only including a subset of these
connections) are exiting my server on a random source port and
connecting to the destination server on it's port 22 (my output says
:ssh, rather than :22 - this doesn't mean it's actually SSH traffic).
'lsof | grep :ssh' will also display the same:
~# lsof | grep :ssh
sshd 12635 root 3r IPv4 768026447 0t0
TCP localhost:ssh->192.111.148.38:50658 (ESTABLISHED)
sshd 24893 root 3u IPv4 158040 0t0
TCP *:ssh (LISTEN)
sshd 24893 root 4u IPv6 158041 0t0
TCP *:ssh (LISTEN)
tor 28193 debian-tor TCP
localhost:38062->rainbowwarrior.torservers.net:ssh (ESTABLISHED)
tor 28193 debian-tor TCP
localhost:38923->42-2-24-248.static.netvigator.com:ssh (ESTABLISHED)
tor 28193 debian-tor TCP
localhost:41585->lumumba.torservers.net:ssh (ESTABLISHED)
The part I'm still not fully understanding... just to use the two
torservers.net connections as an example, if I look at iptables, netstat
or lsof, it shows I connect to rainbowwarrior and Lumumba on those
server's port 22 (my source port is random - 22 is the destination
port). However, when I look up either server in Atlas or Globe, both
appear to be configured with OR port as 443. Therefore, I was expecting
to see something more like:
debian-tor TCP localhost:41585->lumumba.torservers.net:https
(ESTABLISHED) (for port 443)
As far as the comment on restricting what ports are available to be used
for the OR port, I cannot comment on whether ports should be restricted
or remain unrestricted. Having worked for a company that provides
hosting/dedicated servers, I have seen more and more companies begin to
implement proactive monitoring in an attempt to identify malicious
traffic being sourced from their network in recent years. While the
number of companies doing this remains small, it may be worth a larger
discussion on what would be best for Tor. I was able to keep my relay
running by proving that all of my outgoing connections to a destination
port 22 were all Tor relays and my server was not doing anything
malicious. Many other contributors of relays may have faced termination
in a similar circumstance.
Greg - my understanding from your last email is that you see traffic
exiting *your* server on it's own port 22, to a random destination port.
the lsof command above should show what process on your server is
responsible for that traffic. However, especially if you have SSH
listening on port 22, I really would not expect port 22 to be used as a
source port for outgoing traffic on your server. As grarpamp pointed
out, the first 1023 ports are usually excluded from being chosen as a
source port and this should be especially true if you have a service
configured to listen on that port.
Regards,
Ryan
On Sat, Jul 12, 2014, at 05:01 PM, Greg Moss wrote:
> When we say a process connects on port 22 we mean a process on the local
> computer tries to connect to a remote computer on its port 22, ie 22 is
> the
> "destination". The process on the local computer will use a random
> numbered
> "source" port (from 1 to 65535) on leaving the local computer.
> On the remote computer, there will be a process listening on its inbound
> port 22.
>
> I understand the dynamic port assignment computer initiating the
> connection
> to "whatever" port the remote server is listening on . What I am seeing
> is
> traffic sourced from port 22 on my relay and wondering what process or
> program is initiating that connection...... I have outbound port 22
> blocked
> and am seeing a number of hits on the ACL
>
> gm
>
> -----Original Message-----
> From: tor-relays [mailto:tor-relays-bounces@xxxxxxxxxxxxxxxxxxxx] On
> Behalf
> Of krishna e bera
> Sent: Saturday, July 12, 2014 8:32 AM
> To: tor-relays@xxxxxxxxxxxxxxxxxxxx
> Subject: Re: [tor-relays] Oubound Ports
>
> On 14-07-11 08:59 PM, Greg Moss wrote:
> > Alright - traffic is picking up a little after 24 hour. Netfow is
> > showing a bunch of outbound SSH connections but for some reason cant
> > see it in the syslog going out. Added ACL for outbound SSH and will
> > watch. Not sure WTF all the SSH traffic is all about.
>
>
> Some clarification may help regarding what ports are and how they are
> used.
> (Corrections welcome.)
>
> When we say a process connects on port 22 we mean a process on the local
> computer tries to connect to a remote computer on its port 22, ie 22 is
> the
> "destination". The process on the local computer will use a random
> numbered
> "source" port (from 1 to 65535) on leaving the local computer.
> On the remote computer, there will be a process listening on its inbound
> port 22.
>
> The local process may or may not be SSH, and the remote process may or
> may
> not be SSHD - it is up to each computer's owner how they configure the
> processes; port 22 is merely a convention for SSH that makes it easy to
> remember and setup defaults.
>
> (On Linux you can see what process is actually using each active
> connection
> with "sudo netstat -p". To see what processes are listening on which
> ports
> on your computer, it would be "sudo netstat -lp".)
>
> If you are running a Tor exit node, you specify in the torrc to which
> destination ports your Tor node will allow Tor users to connect. If your
> torrc says "ExitPolicy reject *:22" for example, it means your exit node
> will not allow Tor users to connect to port 22, so don't even try to
> route
> circuits through your node. If your torrc doesnt contain that line but
> your
> firewall blocks connections to port 22, it means Tor users might try to
> do
> their SSH via your exit node and get failed connections (and your node
> will
> eventually be labelled a BadExit).
>
> If you are running a non-exit, ie your torrc contains "ExitPolicy reject
> *:*", then circuits traversing your relay will only connect to other Tor
> nodes (on their advertised ORports); you cannot control what numbers
> those
> ports are nor choose to which relays connections are allowed. In that
> case
> you should not see any connections to port 22, except for the Tor process
> itself connnecting to other Tor relays which happen to use that as their
> ORport.
>
> _______________________________________________
> tor-relays mailing list
> tor-relays@xxxxxxxxxxxxxxxxxxxx
> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
>
> _______________________________________________
> tor-relays mailing list
> tor-relays@xxxxxxxxxxxxxxxxxxxx
> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays