I have multiple hidden services which are SSH servers.

They do give unstable connections, and drop out all the time (after a couple seconds). Sometimes with a SOCKS error 1 or with packet_write_wait: Connection to UNKNOWN port 65535: Broken pipe

A couple specifics

  • I use openssh as the server
  • HidServAuth is properly configured on all client
  • I use netcat-openbsd to connect to the socks 5 proxy (configured through ProxyCommand)
  • Compression Yes in the client .ssh/config file

Anybody any suggestions to overcome this kind of behavior?

EDIT: I tried every ProxyCommand, but I feel like it is the Socks proxy of tor (or tor itself) that drops the packet or stops working. I'm running in a chroot, can this make a difference?

2 Answers 2


The problem was the server was hosted on a non-standard ssh port (2022). Solutions:

  • Use the LongLivedPorts to add your port in your torrc and make more stable connections for certain ports
  • If the ssh server is a hidden service, 22 in your torrc will redirect this to a port in LongLivedPorts

Well, post your client and service's config file to clarify it. The step-by-step checklist answers are:

  • I'm using OpenSSH as a server too, also tried WinSSHD - works fine too
  • Haven't used it, I'm using a bit different security scheme
  • Please post your ProxyCommand value - maybe here is the problem. I've used either a PRoxyCommand or TransPort+firewall+NAT - no problems so far
  • It does matter only if you're using windows clients like PuTTY - sometimes they will behave exactly like this. BitwiseSSH works perfect with compression under windows, PuTTY does have a problem here. In case of Linux or Unix(FreeBSD, Solaris) clients I've tried - no problem with compression level at all

So post your configs and we will try to figure it out deeper.

UPDATE: Chroot should cause no problem at all, it either breaks all things apart or it just works. Do you use keepalives in SSH and SSHD configs?

UPDATE#2: Then we'll try a different setup:

add this on tor installations client side:

AutomapHostsOnResolve 1
TransPort 9040
DNSPort 53

and divert all the traffic to this subnet into port 9040 via your nat/firewall. Remove the ProxyCommand from ssh configs and use as a resolver dns. After that try connecting this way

  • I used ProxyCommand nc -X 5 -x %h %p, This was with netcat-openbsd. Could Socks5 Be the problem?
    – Polarsbear
    Jan 25, 2017 at 15:23
  • From testing with socat (socks4), SOCKS protocol version can be excluded.
    – Polarsbear
    Jan 25, 2017 at 15:30
  • Another thing, If I have multiple sessions open, they all close at the same time, I think it has to do with tor, or the SOCKS port
    – Polarsbear
    Jan 25, 2017 at 16:10
  • No neither, but when I researched more in the tor log, I find this error trac.torproject.org/projects/tor/ticket/19711 . It is an active bug
    – Polarsbear
    Jan 25, 2017 at 17:54
  • hmm, not really - I used to use SOCKS for quite a long time. Add keepalives and add port 22 to LongLivingPorts - let's see what's happen
    – Alexey Vesnin
    Jan 25, 2017 at 17:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.