<html><head></head><body> <div dir="auto">Hello,</div><div dir="auto"><br></div><div dir="auto"><caret></caret>It is honestly still puzzling to me considering that the relay wasn’t compromised or misconfigured.</div><div dir="auto"><br></div><div dir="auto">If you or anyone wants to check out the reports</div><div dir="auto"><a href="https://www.abuseipdb.com/check/23.132.184.31" dir="auto">https://www.abuseipdb.com/check/23.132.184.31</a><br></div> <div><br></div><div><br></div>On Wed, Jul 26, 2023 at 2:16 PM, mpan - tor-1qnuaylp at mpan.pl <<a class="" href="mailto:On Wed, Jul 26, 2023 at 2:16 PM, mpan - tor-1qnuaylp at mpan.pl <<a href=">tor-1qnuaylp_at_mpan_pl_zcbqwoytkh@simplelogin.co</a>> wrote:<blockquote type="cite" class="protonmail_quote"> > In the past 24 hrs, I have been receiving complaints from my hosting provider that they're receiving hundreds of abuse reports related to port scanning. I have no clue why I'm all of the sudden receiving abuse reports when this non-exit relay has been online for months without issues. In addition, I have other non-exit relays hosted by the same provider with no issues and more across other providers.<br>><br>> I proceeded to reinstall the OS and reconfigure Tor. I was then quickly notified by my hosting provider again of more abuse reports all showing port 22 as target port.<br>><br>> I have not changed my torrc at all and it's still setup as a non-exit relay. No other applications/services were installed alongside Tor. Tor Metrics does not show the relay as Exit either.<br>><br>> It feels like Tor Exit Traffic is leaking through my non-exit relay?<br>Hello,<br><br> To me it seems like bogus or invalid reports. With certainity over 19<br>in 20. The picture simply does not fit port scanning.<br><br> 1. Not only middle relays, but exit nodes can only perform complete<br>TCP connections. Port scanning usually involves a SYN or UDP scan, which<br>is technically not possible to be done using any Tor node.<br><br> 2. Even if we assume somebody is hurting oneself by performing a<br>full-connection TCP scan, you mention only one port is being reported. A<br>port scan involves many ports. And this is not merely pedanticism<br>regarding naming. The detection of a port scan relies on this. In other<br>words: there is no way to classify traffic as a port scan, if only one<br>port is affected.<br><br> Since only port 22 is affected and 22 is not a common port for Tor<br>relays, you may simply block egress traffic to this port altogether. The<br>same as IP address ranges for which reports come. If the reports<br>continue coming, you can be almost sure they are false. The little<br>uncertainity remains for some attacker having root (or above-root)<br>access to your machine, but this is not coming from your Tor relay.<br><br> Before blocking IP address ranges, check if they are not relays. I do<br>not want to make positive statements about one trying to affect Tor<br>network, but such a possibility should also not be excluded without<br>checking.<br><br>Cheers<br>_______________________________________________<br>tor-relays mailing list<br>tor-relays@lists.torproject.org<br>https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays<br></blockquote></body></html>