[tor-relays] Re: Security incident affecting some relay operators

[Toralf Förster via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>]

On 05/10/2026 19:50, hiro via tor-relays wrote:
> Over the weekend we received reports 
> that relays of some of our operators were intercepting SSH connections. 
> According to the operators their servers were hacked, the tor config had 
> been edited and the relays were intercepting SSH connections.

But to avoid panic reactions, something like e.g. this

tfoerste@p14s ~  $ ssh i30 ss -4tnp | grep ':22 '
SYN-RECV   0      0       194.164.53.4:22      81.162.210.95:47267 

ESTAB      0      0       194.164.53.4:36330   94.142.244.24:22 
users:(("tor",pid=603,fd=299))

is totally harmless:
The usual port 22 hammering, and a re,mote relay which has its ORPort 
configured at port 22.

;)

--
Toralf
_______________________________________________
tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx