[gentoo-amd64] Re: Netstat showing localhost to localhost connections

[Duncan]

"Julien Cassette" <hazynrg@×××××.com> posted
5c4f3a5c0804061351o7ab513d3u3934e26bf11104b8@××××××××××.com, excerpted
below, on  Sun, 06 Apr 2008 22:51:47 +0200:

[reordered this part first]
> Regards.Hi,<br>I see many lines similar to these ones in my
> netstat:<br><br>tcp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
> 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0
> localhost:9050&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;

Please kill the crap HTML.  /That/ is a security issue, and folks aware 
of it won't be using a (local at least) client that parses it let alone 
spits it out, for that reason.  The raw HTML then looks like crap, as the 
above should demonstrate.

Really, gmail or not, one would expect that someone interested enough in 
security to be running tor would know not to post that HTML crap (altho I 
guess it's easy to have it reset to html, as it's not uncommon even for 
folks that know not to post html).

> I see many lines similar to these ones in my netstat:

[whitespace reformatted for better non-wrap posting]

> tcp   0  0  localhost:9050   localhost:48065  TIME_WAIT  -
> tcp   0  0  localhost:8118   localhost:35457  TIME_WAIT  -
> tcp   0  0  localhost:9050   localhost:48043  TIME_WAIT  -
> tcp   0  0  localhost:48059  localhost:9050   TIME_WAIT  -
> tcp   0  0  localhost:8118   localhost:35521  TIME_WAIT  -
>
> Is it a security issue?

> The ports are TOR's but this stuff also appear when I use an application
> like Azureus for example.
> BTW, my machine is set as DMZ in the router, dunno if this may cause
> something...

localhost normally indicates connections from your computer to itself on 
the "loopback" (lo) interface.  Assuming you trust the stuff running on 
your own computer, it SHOULDN'T be an issue, PROVIDED the localhost isn't 
somehow faked, possible but relatively unlikely.  You can double-check by 
using the --numeric (-n) or --numeric-hosts netstat commandline options.  
The reported IPs should then be 127/8, that is, 127.x.y.z, which is 
reserved as localhost.  However, of that entire /8 block only 127.0.0.1 
is normally used, so most likely they'll all be 127.0.0.1.

Kyle already mentioned the --program (-p) option, which is good, but note 
that it'll only report the programs if you own them -- unless you run the 
netstat as root, of course.

Normally you'd not have so many localhost entries, but when you run a 
local proxy (FWIW, I run privoxy here, but not tor, so am used to seeing 
them from that), you do tend to get more as other things run thru it.  If 
you run a privoxy/tor chain, you'll have even more as you'll have both the
app/privoxy and the privoxy/tor connections, all on localhost (with the 
tor/world connections as well, but those aren't localhost and would be 
the same as direct app/world connections where no local proxy is used).

Then there's the connection status.  TIME_WAIT indicates a connection 
that has been completed and mostly torn down, except the system has a 
timeout on the final piece of the tear-down to keep anything else from 
trying to use the same socket during the period packets may still be in 
transit, thus keeping any potential new connection from getting mixed up 
by packets arriving for the old one.  That's why the sent/received count 
is zero -- the connection is already torn down and the sent/received 
information lost -- it's just waiting for the timeout.  (This paragraph 
may not be absolutely correct and definitely lacks detail, but it should 
be sufficient from a security aware sysadmin's point of view, the way I 
and presumably you approach it.  If you want technically correct, the 
RFCs are freely available. =8^)

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman

-- 
gentoo-amd64@l.g.o mailing list