In the past 24 hrs, I have been receiving complaints from my hosting provider that they're receiving hundreds of abuse reports related to port scanning. I have no clue why I'm all of the sudden receiving abuse reports when this non-exit relay has been online for months without issues. In addition, I have other non-exit relays hosted by the same provider with no issues and more across other providers.

I proceeded to reinstall the OS and reconfigure Tor.  I was then quickly notified by my hosting provider again of more abuse reports all showing port 22 as target port.

I have not changed my torrc at all and it's still setup as a non-exit relay. No other applications/services were installed alongside Tor. Tor Metrics does not show the relay as Exit either.

It feels like Tor Exit Traffic is leaking through my non-exit relay?

Hello,

To me it seems like bogus or invalid reports. With certainity over 19 in 20. The picture simply does not fit port scanning.

1. Not only middle relays, but exit nodes can only perform complete TCP connections. Port scanning usually involves a SYN or UDP scan, which is technically not possible to be done using any Tor node.

2. Even if we assume somebody is hurting oneself by performing a full-connection TCP scan, you mention only one port is being reported. A port scan involves many ports. And this is not merely pedanticism regarding naming. The detection of a port scan relies on this. In other words: there is no way to classify traffic as a port scan, if only one port is affected.

Since only port 22 is affected and 22 is not a common port for Tor relays, you may simply block egress traffic to this port altogether. The same as IP address ranges for which reports come. If the reports continue coming, you can be almost sure they are false. The little uncertainity remains for some attacker having root (or above-root) access to your machine, but this is not coming from your Tor relay.

Before blocking IP address ranges, check if they are not relays. I do not want to make positive statements about one trying to affect Tor network, but such a possibility should also not be excluded without checking.

Cheers

Hello John,

Unfortunately I don't have an answer and are not familiar with this problem. It's not exactly clear to me what is scanning what. Are the complains about traffic coming from your relay as port scanning devices around the internet on port 22? Or lots of incoming traffic scanning your port 22 because it's open? Which OS do you use? Are they sure the IP address is your relay only? Or do you share an IP in a cluster for example?

It seems improbable that exit relay traffic is leaking through, as that would make many guard and middle relays sensitive for abuse complaints.

I hope someone has some insights about this and you can resolve your issue.

Regards,

-------- Original Message -------- From: John Crow via tor-relays tor-relays@lists.torproject.org Sent: July 24, 2023 12:07:44 AM GMT+02:00 To: tor-relays@lists.torproject.org Cc: admin@prsv.ch Subject: [tor-relays] Receiving abuse reports for Non-Exit Relay

Hello all,

In the past 24 hrs, I have been receiving complaints from my hosting provider that they're receiving hundreds of abuse reports related to port scanning. I have no clue why I'm all of the sudden receiving abuse reports when this non-exit relay has been online for months without issues. In addition, I have other non-exit relays hosted by the same provider with no issues and more across other providers.

I proceeded to reinstall the OS and reconfigure Tor.  I was then quickly notified by my hosting provider again of more abuse reports all showing port 22 as target port.

I have not changed my torrc at all and it's still setup as a non-exit relay. No other applications/services were installed alongside Tor. Tor Metrics does not show the relay as Exit either.

It feels like Tor Exit Traffic is leaking through my non-exit relay?

Has anyone else experienced any behavior similar to this? Any ideas on how to fix or prevent this?

prsv admin -- / Jonathan van der Steege

My GnuPG key is: c6f32128e7522f4acb878d6a4a9f0b50ace75416 https://keys.openpgp.org/search?q=jonathan@jonakeys.nl

As others have mentioned, this does not look like a Tor issue to me. It more seems like a compromised or misconfigured server.

You mentioned you reinstalled the OS. Did you use the same root password? My suggestion is that you go about this step by step. First reinstall the OS with a different root password and no additional software or configuration. Wait to see if you get any abuse reports. The next step, install Tor and wait to see if you get an abuse report. And the last step would be installing any additional packages that you might be currently using for anything else if any.

This method could narrow down the cause.

On 7/23/2023 6:07 PM, John Crow via tor-relays wrote:

Hello all,

In the past 24 hrs, I have been receiving complaints from my hosting provider that they're receiving hundreds of abuse reports related to port scanning. I have no clue why I'm all of the sudden receiving abuse reports when this non-exit relay has been online for months without issues. In addition, I have other non-exit relays hosted by the same provider with no issues and more across other providers.

I proceeded to reinstall the OS and reconfigure Tor.  I was then quickly notified by my hosting provider again of more abuse reports all showing port 22 as target port.

I have not changed my torrc at all and it's still setup as a non-exit relay. No other applications/services were installed alongside Tor. Tor Metrics does not show the relay as Exit either.

It feels like Tor Exit Traffic is leaking through my non-exit relay?

Has anyone else experienced any behavior similar to this? Any ideas on how to fix or prevent this?

prsv admin

---

tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays