tor outbound ssh connection visible in netstat

Question

When applying netstat on a machine (Kali Linux 2016.2) running tor, I can observe an always established outbound ssh connection - see third line below. Could anyone confirm why this ssh connection is required? I thought Tor only makes HTTPS connection to nodes - it shouldn't require a consistent SSH connection.

The commands I ran were:

$ service tor start
$ netstat -atnp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.1:9040          0.0.0.0:*               LISTEN      1604/tor            
tcp        0      0 127.0.0.1:9050          0.0.0.0:*               LISTEN      1604/tor            
tcp        0      0 10.0.0.2:40794         91.121.155.33:22        ESTABLISHED

Tor version in use is as below:

$ tor --version
Tor version 0.2.8.8 (git-8d8a099454d994bd).

Answer 1

The IP address you posted belongs to the relay c4k3KS1. As you can see at the Atlas page it listens at port 22 for Tor connections. So in your netstat view there is no real SSH session, but a Tor connection on port 22. You'll find several relays which listen on other ports. Usually port 80 or 443 are quite common. This helps to circumvent firewall settings on the client side.

Answer 2

No problem here - it's a foreign address, i.e. remote relay uses port 22 for it's operations. The local address is a column you should worry about in such suspicions. The pluggable transports jobs are also much more efficient if they're bounded to port 443 and mimicing a HTTPS connection.