0

I have multiple hidden services which are SSH servers.

They do give unstable connections, and drop out all the time (after a couple seconds). Sometimes with a SOCKS error 1 or with packet_write_wait: Connection to UNKNOWN port 65535: Broken pipe

A couple specifics

  • I use openssh as the server
  • HidServAuth is properly configured on all client
  • I use netcat-openbsd to connect to the socks 5 proxy (configured through ProxyCommand)
  • Compression Yes in the client .ssh/config file

Anybody any suggestions to overcome this kind of behavior?

EDIT: I tried every ProxyCommand, but I feel like it is the Socks proxy of tor (or tor itself) that drops the packet or stops working. I'm running in a chroot, can this make a difference?

Improve this question

2 Answers 2

Reset to default
1

The problem was the server was hosted on a non-standard ssh port (2022). Solutions:

  • Use the LongLivedPorts to add your port in your torrc and make more stable connections for certain ports
  • If the ssh server is a hidden service, 22 127.0.0.1:2022 in your torrc will redirect this to a port in LongLivedPorts
Improve this answer
0

Well, post your client and service's config file to clarify it. The step-by-step checklist answers are:

  • I'm using OpenSSH as a server too, also tried WinSSHD - works fine too
  • Haven't used it, I'm using a bit different security scheme
  • Please post your ProxyCommand value - maybe here is the problem. I've used either a PRoxyCommand or TransPort+firewall+NAT - no problems so far
  • It does matter only if you're using windows clients like PuTTY - sometimes they will behave exactly like this. BitwiseSSH works perfect with compression under windows, PuTTY does have a problem here. In case of Linux or Unix(FreeBSD, Solaris) clients I've tried - no problem with compression level at all

So post your configs and we will try to figure it out deeper.

UPDATE: Chroot should cause no problem at all, it either breaks all things apart or it just works. Do you use keepalives in SSH and SSHD configs?

UPDATE#2: Then we'll try a different setup:

add this on tor installations client side:

VirtualAddrNetworkIPv4 10.192.0.0/10
AutomapHostsOnResolve 1
TransPort 9040
TransListenAddress 127.0.0.1
DNSPort 53
DNSListenAddress 127.0.0.1

and divert all the traffic to this subnet into 127.0.0.1 port 9040 via your nat/firewall. Remove the ProxyCommand from ssh configs and use 127.0.0.1:53 as a resolver dns. After that try connecting this way

Improve this answer
27
  • I used ProxyCommand nc -X 5 -x 127.0.0.1:9050 %h %p, This was with netcat-openbsd. Could Socks5 Be the problem?
    – Polarsbear
    Commented Jan 25, 2017 at 15:23
  • From testing with socat (socks4), SOCKS protocol version can be excluded.
    – Polarsbear
    Commented Jan 25, 2017 at 15:30
  • Another thing, If I have multiple sessions open, they all close at the same time, I think it has to do with tor, or the SOCKS port
    – Polarsbear
    Commented Jan 25, 2017 at 16:10
  • No neither, but when I researched more in the tor log, I find this error trac.torproject.org/projects/tor/ticket/19711 . It is an active bug
    – Polarsbear
    Commented Jan 25, 2017 at 17:54
  • hmm, not really - I used to use SOCKS for quite a long time. Add keepalives and add port 22 to LongLivingPorts - let's see what's happen
    – Alexey Vesnin ♦
    Commented Jan 25, 2017 at 17:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .