OpenSnitch indicated an outgoing request from sshd. Is this background traffic or is my system compromised?

[E8y2FqZE]

I got an OpenSnitch popup indicating sshd (not ssh) wanting to make an outgoing connection to an abusive Chinese IP address. This machine is exposed to the internet and has logs for lots of failed SSH login attempts in the past, but this is the first time I've ever seen OpenSnitch give me an option to do something about it.

I'm a bit paranoid now because OpenSnitch has never given me a notification on this before. Any idea how this could have been triggered?

[gustavo-iniguez-goya]

I'd say that it's a reply of a SSH connection. Right click on the row and open the details window, and see if the source port is 22.

[E8y2FqZE]

Thanks for taking the time to answer.

I'm afraid it won't let me right-click on an entry, nothing happens. I also rebooted since this event, so I can't access the event any more.

As a sanity check I'm trying to recreate this popup. I've removed the rule, but when connecting from outside via SSH, I don't get the popup. As I understand it, OpenSnitch is for blocking outgoing connections, not incoming. So is there some way to open an SSH connection that triggers an outgoing connection too?

[E8y2FqZE]

I have just figured out that providing the -W <dest_ip>:<port> flag when using ssh to connect will cause the host machine to make an outgoing connection after successful authentication. If this happens after auth, that means I'm cooked. Are there any other flags that could cause an outgoing connection before successful authentication?

[gustavo-iniguez-goya]

-W <dest_ip>:<port>
Requests that standard input and output on the client be forwarded to host on port over the secure channel

Yeah, I guess that all these flags will cause sshd to open an outgoing connection. Also -L srcport:remote_ip:remote_port and others