The gateway has a lot of ports open

madaidan · June 27, 2019, 5:03pm

Running nmap 127.0.0.1 on the gateway shows all the open ports.

The output is

PORT     STATE SERVICE
9050/tcp open  tor-socks
9100/tcp open  jetdirect
9101/tcp open  jetdirect
9102/tcp open  jetdirect
9103/tcp open  jetdirect
9110/tcp open  unknown
9111/tcp open  DragonIDSConsole
9200/tcp open  wap-wsp
9207/tcp open  wap-vcal-s
9220/tcp open  unknown

Why are there so many ports open? What are they used for? They should be closed if not in use.

Patrick · June 27, 2019, 5:37pm

A lot references can be found by greping Whonix source code.

https://www.whonix.org/wiki/Dev/git#grep_Whonix_source_code

You can find most ports here:

github.com

Whonix/anon-gw-anonymizer-config/blob/master/usr/share/tor/tor-service-defaults-torrc.anondist

# Copyright (C) 2012 - 2018 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
# See the file COPYING for copying conditions.

# Please use "/usr/local/etc/torrc.d/50_user.conf" for your custom
# configuration, which will override the defaults found here.
# When this package is updated, this file may be overwritten.

# You can find the original upstream tor-service-defaults-torrc under
# /usr/share/tor/tor-service-defaults-torrc.anondist-orig

######################################################################
# DO NOT CHANGE ANYTHING BELOW, UNLESS YOU KNOW WHAT YOU ARE DOING! #
# DO NOT CHANGE ANYTHING BELOW, UNLESS YOU KNOW WHAT YOU ARE DOING! #
# DO NOT CHANGE ANYTHING BELOW, UNLESS YOU KNOW WHAT YOU ARE DOING! #
# DO NOT CHANGE ANYTHING BELOW, UNLESS YOU KNOW WHAT YOU ARE DOING! #
# DO NOT CHANGE ANYTHING BELOW, UNLESS YOU KNOW WHAT YOU ARE DOING! #
######################################################################

   ###################
### Internals torrc #

This file has been truncated. show original

And for any unknown ports still, please grep Whonix source code.

madaidan · June 27, 2019, 5:43pm

Thanks! All the ports were in the file you linked.

Patrick · June 28, 2019, 6:49am

In theory - we could save some Whonix-Gateway RAM by using a mechanism similar to https://github.com/Whonix/anon-ws-disable-stacked-tor / https://www.whonix.org/wiki/Dev/anon-ws-disable-stacked-tor using systemd-socket-proxyd (systemd listens with a stub port and starts the actual service on demand) but this clashes with Tor, which has:

usually just one global config file
usually only one Tor ControlPort
usually only one Tor state folder (which contains Tor entry guards)

Does Whonix-Gateway RAM use less RAM with less open ports by Tor?

If there is something to it, we could perhaps auto generate Tor config and only on demand add ports to Tor’s config (when an application tried to use them) and then sudo systemctl reload tor@default after config update.

Or if we want to follow https://www.whonix.org/wiki/Tor_Entry_Guards#Increase_Protection_from_Malicious_Entry_Guards:_One_Guard_per_Application we could start a new Tor instance per application on demand. Still wouldn’t know how to handle the Tor ControlPort in that case. Perhaps only ControlPort for applications where we know these are going to use it.

[Any disk space issues with that due to multiple Tor state folders? ~ 7 MB per Tor data folder.]

madaidan · June 28, 2019, 11:25am

I doubt having a few more ports open would increase RAM noticeably. Unless those ports could be used to connect to the Gateway and be used for malicious purposes, the advantages would be slim.