Bitcoin Core 0.21 - RPC credentials going bad

[darkv0rt3x]

Hello.

I have tried to upgrade to bitcoin core 0.21 but things are not going good. I need some help.

I'm using Debian Buster.
I was using bitcoin core 0.20.1 before.

The folder locations are as I have in my config file:

dbbatchsize=4294967000
dbcache=12288
par=1 -daemon
server=1
maxtxfee=0.00002000
mintxfee=0.00000002

# Options only for mainnet
[main]
conf=/media/WdElements/blockchain-backup/bitcoin.conf
datadir=/media/WdElements/blockchain-backup
debug=net
debug=rpc
debuglogfile=/media/WdElements/blockchain-backup/debug.log
addresstype=bech32
changetype=bech32
txindex=1
listen=1

When I start bitcoin daemon I see the following output:
https://pastebin.com/kAtbvbuV

I already tried to generate my RPC credentials from ./share/rpcauth/ python plugin like this:

Code:

$ python3 rpcauth.py btc-user
String to be appended to bitcoin.conf:
rpcauth=btc-user:[REPLACEDHASH]
Your password:
[REPLACEDPSSWD]

and paste the first line into bitcoin.conf  like this:

dbbatchsize=4294967000
dbcache=12288
par=1 -daemon
server=1
rpcauth=btc-user:[REPLACEDHASH]
maxtxfee=0.00002000
mintxfee=0.00000002

# Options only for mainnet
[main]
conf=/media/WdElements/blockchain-backup/bitcoin.conf
datadir=/media/WdElements/blockchain-backup
debug=net
debug=rpc
debuglogfile=/media/WdElements/blockchain-backup/debug.log
addresstype=bech32
changetype=bech32
txindex=1
listen=1

but I still get the same crappy output when I start bitcoind as bitcoind:
https://pastebin.com/Tcd5Vwbr

Anyone can help me figuring out what might I be doing wrong?

Edit:

I'll also post this in bitcoin stack exchange to enlarge my possibilities of getting help!

[1715672074]

1715672074

[1715672074]

1715672074

[1715672074]

1715672074

[achow101]

What command are you using to interact with bitcoind (e.g. if you use bitcoin-cli, what are you entering into the terminal)?

What are the contents of /media/WdElements/blockchain-backup/bitcoin.conf?

[darkv0rt3x]

What command are you using to interact with bitcoind (e.g. if you use bitcoin-cli, what are you entering into the terminal)?

I tried several, such as:

Code:

bitcoin-cli -rpcuser=btc-user -rpcpassword=[REPLACED] getnetworkinfo

Code:

bitcoin-cli -rpcauth=btc-user:[REPLACEDHASH] getnetworkinfo

Code:

bitcoin-cli getnetworkinfo

But of course it complains about incorrect user or password or credentials not found.

What are the contents of /media/WdElements/blockchain-backup/bitcoin.conf?

It's the one I have in my OP.
But I paste it here again. This is how I have it now to be able to run it, but I can't run any RPC commands because I set server=0.

Code:

dbbatchsize=4294967000
dbcache=12288
par=1 -daemon
server=0
# rpcauth=btc-user:[REPLACEDHASH]
# rpcuser=psysc0rpi0n
# rpcpassword=[REPLACED]
maxtxfee=0.00002000
mintxfee=0.00000002

# Options only for mainnet
[main]
conf=/media/WdElements/blockchain-backup/bitcoin.conf
datadir=/media/WdElements/blockchain-backup
debug=net
debug=rpc
debuglogfile=/media/WdElements/blockchain-backup/debug.log
addresstype=bech32
changetype=bech32
txindex=1
listen=1

[achow101]

Try

Code:

bitcoin-cli -datadir=/media/WdElements/blockchain-backup getnetworkinfo

[darkv0rt3x]

Try

Code:

bitcoin-cli -datadir=/media/WdElements/blockchain-backup getnetworkinfo

Ok, it will take a while because I went to my previous folder and previous Bitcoin Core version. So now, I have t change things back, and I also have a LN node running, so, it will take some minutes.

I'll report back when I have the output.

[darkv0rt3x]

@achow101, somehow it's working now, even without the "-datadir" switch, but 2 notes:

note 1 - I still see the RPC error messages in daemon log. It keeps showing up all the time. I presume it shows up everytime some RPC command is called internally by the daemon??

Code:

2021-01-26T00:00:27Z Switching active chainstate to Chainstate [ibd] @ height -1 (null)
2021-01-26T00:00:27Z Opening LevelDB in /media/WdElements/blockchain-backup/blocks/index
2021-01-26T00:00:27Z Opened LevelDB successfully
2021-01-26T00:00:27Z Using obfuscation key for /media/WdElements/blockchain-backup/blocks/index: 0000000000000000
2021-01-26T00:00:28Z ThreadRPCServer incorrect password attempt from [::1]:36124
2021-01-26T00:00:29Z ThreadRPCServer incorrect password attempt from [::1]:36124
2021-01-26T00:00:32Z ThreadRPCServer incorrect password attempt from [::1]:36124
2021-01-26T00:00:33Z ThreadRPCServer incorrect password attempt from [::1]:36124
2021-01-26T00:00:36Z ThreadRPCServer incorrect password attempt from [::1]:36124
2021-01-26T00:00:37Z ThreadRPCServer incorrect password attempt from [::1]:36124
2021-01-26T00:00:40Z ThreadRPCServer incorrect password attempt from [::1]:36124
2021-01-26T00:00:42Z ThreadRPCServer incorrect password attempt from [::1]:36124
2021-01-26T00:00:45Z ThreadRPCServer incorrect password attempt from [::1]:36124
2021-01-26T00:00:46Z ThreadRPCServer incorrect password attempt from [::1]:36124
2021-01-26T00:00:49Z ThreadRPCServer incorrect password attempt from [::1]:36124
2021-01-26T00:00:50Z ThreadRPCServer incorrect password attempt from [::1]:36124
2021-01-26T00:00:53Z ThreadRPCServer incorrect password attempt from [::1]:36124
2021-01-26T00:00:54Z ThreadRPCServer incorrect password attempt from [::1]:36124
2021-01-26T00:00:57Z LoadBlockIndexDB: last block file = 2424
2021-01-26T00:00:57Z LoadBlockIndexDB: last block file info: CBlockFileInfo(blocks=52, size=69158456, heights=667613...667664, time=2021-01-25...2021-01-25)

and further down in the debug file, the error keeps coming up:

Code:

2021-01-26T00:00:59Z Verifying last 6 blocks at level 3
2021-01-26T00:00:59Z [0%]...ThreadRPCServer incorrect password attempt from [::1]:36124
2021-01-26T00:01:03Z ThreadRPCServer incorrect password attempt from [::1]:36124
2021-01-26T00:01:06Z ThreadRPCServer incorrect password attempt from [::1]:36124
2021-01-26T00:01:07Z ThreadRPCServer incorrect password attempt from [::1]:36124
2021-01-26T00:01:10Z ThreadRPCServer incorrect password attempt from [::1]:36124
2021-01-26T00:01:12Z ThreadRPCServer incorrect password attempt from [::1]:36124
2021-01-26T00:01:15Z ThreadRPCServer incorrect password attempt from [::1]:36124
2021-01-26T00:01:16Z ThreadRPCServer incorrect password attempt from [::1]:36124
2021-01-26T00:01:19Z ThreadRPCServer incorrect password attempt from [::1]:36124
2021-01-26T00:01:20Z ThreadRPCServer incorrect password attempt from [::1]:36124
2021-01-26T00:01:22Z [16%]...ThreadRPCServer incorrect password attempt from [::1]:36124

and more. This is when the node is already fully running:

Code:

2021-01-26T00:07:51Z Requesting tx 8fd9e71967b464420d571f6130137c92a5a6e85584bed805fa14e171be171ffd peer=4
2021-01-26T00:07:51Z Requesting tx a6382515c17cc46f460f4dc4a799d6a629415fb7384f6a3038c59a776083e73f peer=4
2021-01-26T00:07:51Z Requesting tx ba0d967103bb8f4caea4f42db653108549ba1f4fa501915de08988f83a9de96b peer=4
2021-01-26T00:07:51Z Requesting tx c8ee904925ea3a2640996ee9d6833317903202768c27411732aaae180935a648 peer=4
2021-01-26T00:07:51Z sending getdata (145 bytes) peer=4
2021-01-26T00:07:51Z ThreadRPCServer incorrect password attempt from [::1]:36124
2021-01-26T00:07:52Z sending inv (37 bytes) peer=5
2021-01-26T00:07:52Z received: tx (381 bytes) peer=6
2021-01-26T00:07:52Z received: tx (223 bytes) peer=7

This is my actual bitcoin.conf file:

Code:

dbbatchsize=4294967000
dbcache=12288
par=1 -daemon
server=1
rpcauth=btc-user:[REPLACEDHASH]
# rpcuser=btc-user
# rpcpassword=[REPLACEDPASSWORD]
maxtxfee=0.00002000
mintxfee=0.00000002

# Options only for mainnet
[main]
conf=/media/WdElements/blockchain-backup/bitcoin.conf
datadir=/media/WdElements/blockchain-backup
debug=net
debug=rpc
debuglogfile=/media/WdElements/blockchain-backup/debug.log
addresstype=bech32
changetype=bech32
txindex=1
listen=1

And note 2 is that with this config file, my node says it's running behind tor and using a V3 Onion address. Is this expected???
getnetworkinfo output:

Code:

$ ./bitcoin-cli getnetworkinfo
{
  "version": 219900,
  "subversion": "/Satoshi:21.99.0/",
  "protocolversion": 70016,
  "localservices": "0000000000000409",
  "localservicesnames": [
    "NETWORK",
    "WITNESS",
    "NETWORK_LIMITED"
  ],
  "localrelay": true,
  "timeoffset": -3,
  "networkactive": true,
  "connections": 10,
  "connections_in": 0,
  "connections_out": 10,
  "networks": [
    {
      "name": "ipv4",
      "limited": false,
      "reachable": true,
      "proxy": "",
      "proxy_randomize_credentials": false
    },
    {
      "name": "ipv6",
      "limited": false,
      "reachable": true,
      "proxy": "",
      "proxy_randomize_credentials": false
    },
    {
      "name": "onion",
      "limited": false,
      "reachable": true,
      "proxy": "127.0.0.1:9050",
      "proxy_randomize_credentials": true
    }
  ],
  "relayfee": 0.00001000,
  "incrementalfee": 0.00001000,
  "localaddresses": [
    {
      "address": "[REPLACED].onion",
      "port": 8333,
      "score": 4
    }
  ],
  "warnings": "This is a pre-release test build - use at your own risk - do not use for mining or merchant applications"
}

[achow101]

note 1 - I still see the RPC error messages in daemon log. It keeps showing up all the time. I presume it shows up everytime some RPC command is called internally by the daemon??

No, there is no internal RPC use. This is unusual behavior.

Are you sure you don't have something else that is constantly checking the RPC?

And note 2 is that with this config file, my node says it's running behind tor and using a V3 Onion address. Is this expected???

No, that is not expected. It is only expected if your bitcoin.conf specifies to enable tor, which yours does not

I would guess that you are using the incorrect datadir or incorrect conf file right now.

[gmaxwell]

I'd make a bet that they managed to expose their RPC port on their Tor hs and someone is trying to hack them over the network.

[Foxpup]

I'd make a bet that they managed to expose their RPC port on their Tor hs and someone is trying to hack them over the network.

It does look that way. But surely that should be impossible to do by accident? OP seems smart enough to have mentioned it if he was intentionally running a non-standard Tor configuration.

[darkv0rt3x]

note 1 - I still see the RPC error messages in daemon log. It keeps showing up all the time. I presume it shows up everytime some RPC command is called internally by the daemon??

No, there is no internal RPC use. This is unusual behavior.

Are you sure you don't have something else that is constantly checking the RPC?

The only thing I run in my computer related to bitcoin core, is bitcoin core itself and a lightning ndoe. I don't have web services or any other apps using bitcoin core.
So, I think there is nothing else using/checking the RPC.

And note 2 is that with this config file, my node says it's running behind tor and using a V3 Onion address. Is this expected???

No, that is not expected. It is only expected if your bitcoin.conf specifies to enable tor, which yours does not

I would guess that you are using the incorrect datadir or incorrect conf file right now.

Well, I have run bitcoin core behind tor in the past, but in this case, it was not supposed to be running behind it. However, I may have let configuration (for the Tor daemon to control the hidden service) in the respective folders. Despite this, if the config file doesn't mention to use that, then it shouldn't be using it, I guess.

I'd make a bet that they managed to expose their RPC port on their Tor hs and someone is trying to hack them over the network.

I truly hope this is not the case, because when I go back to previous release I was using, I don't see these failling RPC attempts. I see the attempt to succeed.
In any case, I don't have any PKs in this online node, so I think even if I get hacked, it wont be so easy (or even worth) the time and the work spent. I don't have huge amounts of bitcoin, so, one would get truly disappointed if he can hack into my computer to try to steal PKs and bitcoin.

I'd make a bet that they managed to expose their RPC port on their Tor hs and someone is trying to hack them over the network.

It does look that way. But surely that should be impossible to do by accident? OP seems smart enough to have mentioned it if he was intentionally running a non-standard Tor configuration.

I used Tor in the past. Actually I had some problems with Tor and lately I was running bitcoin core in the simplest Tor configuration possible.
There are at least 3 possible configurations I can remember from docs:
1 - completely automated config by just setting the proxy option in config file which creates the minimum setup possible for Tor.
2 - a config where you can setup a random onion address every time bitcoin daemon starts up and an hidden service, controlled by bitcoin daemon
3 - a config where you can setup a persistent onion address and hidden service, controlled by Tor daemon.

I tried the 3 option in the past but then I think something was wrong because the parameter score shown by getnetworkinfo refused to increase over time as it would happen with clear net and therefore I tried setup 2. But I think the same was happening. So I went to scenario 1 and in this case that parameter would increase over time. And that was the last configuration I was using before starting to use bitcoin core v0.21.

But later today, when I get home from work, I'll double check for leftovers of Tor configuration files or settings and will also paste here more detailed logs and even pictures just to make sure I'm not messing things anywhere.

[NotATether]

The layman's answer would be to try shutting off Tor and see if bitcoin core starts successfully. If it complains about not being able to connect to a proxy, look for proxy=IP:port entries in your bitcoin.conf files and remove them.

[achow101]

The only thing I run in my computer related to bitcoin core, is bitcoin core itself and a lightning ndoe. I don't have web services or any other apps using bitcoin core.
So, I think there is nothing else using/checking the RPC.

It could be the lightning node. What lightning software are you running?

Well, I have run bitcoin core behind tor in the past, but in this case, it was not supposed to be running behind it. However, I may have let configuration (for the Tor daemon to control the hidden service) in the respective folders. Despite this, if the config file doesn't mention to use that, then it shouldn't be using it, I guess.

I looked at the Tor startup code and it looks like it actually will connect to Tor automatically by default if all of the right files (e.g. onion_v3_private_key) are there and Tor is already running. So actually this is expected behavior, although not well documented. You don't need to have Tor enabled in the bitcoin.conf to connect to Tor.

[darkv0rt3x]

The layman's answer would be to try shutting off Tor and see if bitcoin core starts successfully. If it complains about not being able to connect to a proxy, look for proxy=IP:port entries in your bitcoin.conf files and remove them.

I did that. The result is further down in my reply.
An no, I don't have any entries like that in my config file. My config file is posted here somewhere in the above posts.

The only thing I run in my computer related to bitcoin core, is bitcoin core itself and a lightning ndoe. I don't have web services or any other apps using bitcoin core.
So, I think there is nothing else using/checking the RPC.

It could be the lightning node. What lightning software are you running?

I'm running c-lightning. And c-lightning is running behind Tor, yes.

Well, I have run bitcoin core behind tor in the past, but in this case, it was not supposed to be running behind it. However, I may have let configuration (for the Tor daemon to control the hidden service) in the respective folders. Despite this, if the config file doesn't mention to use that, then it shouldn't be using it, I guess.

I looked at the Tor startup code and it looks like it actually will connect to Tor automatically by default if all of the right files (e.g. onion_v3_private_key) are there and Tor is already running. So actually this is expected behavior, although not well documented. You don't need to have Tor enabled in the bitcoin.conf to connect to Tor.

Ohh ok. So that's ok. No problem with that, once ones knows it is expected


And about the RPC thing problem, I disabled Tor and started bitcoind and the initial output looks pretty much the same with the same error messages. I pasted it online so that I don'tm ess up here with a long output log.

https://pastebin.com/meyAVhzQ


----------------- Edited-----------------
@achow101, I'm not sure if this is of any importance, but I can see this every now and then in my bitcoin daemon logs:

Code:

2021-01-26T19:18:57Z ThreadRPCServer method=getblockhash user=__cookie__

[achow101]

I'm running c-lightning. And c-lightning is running behind Tor, yes.

That's probably what is trying to access the RPC and failing.

@achow101, I'm not sure if this is of any importance, but I can see this every now and then in my bitcoin daemon logs:

Code:

2021-01-26T19:18:57Z ThreadRPCServer method=getblockhash user=__cookie__

__cookie__ is the an automatically created user. It's credentials are stored in the .cookie file in the datadir. If bitcoin-cli is using the correct datadir, it will read that file in order to access the RPC. Some other software, if they know the datadir, may also do this.

[darkv0rt3x]

I'm running c-lightning. And c-lightning is running behind Tor, yes.

That's probably what is trying to access the RPC and failing.

So, is there any "correct" way of fixing it? I already added rpcallowip=127.0.0.1 to my bitcoin.conf file.

@achow101, I'm not sure if this is of any importance, but I can see this every now and then in my bitcoin daemon logs:

Code:

2021-01-26T19:18:57Z ThreadRPCServer method=getblockhash user=__cookie__

__cookie__ is the an automatically created user. It's credentials are stored in the .cookie file in the datadir. If bitcoin-cli is using the correct datadir, it will read that file in order to access the RPC. Some other software, if they know the datadir, may also do this.

So that means there are 2 users using RPC? I mean, I have my own credentials created by the python plugin and that I added to bitcoin.conf and if you say this is an automatically created user, so we have 2 users? Is that is?
And if c-lightning is using the RPC interface, then it is the only application using it. I have no other related applications using bitcoin daemon.

[achow101]

So, is there any "correct" way of fixing it? I already added rpcallowip=127.0.0.1 to my bitcoin.conf file.

The way to fix it is to check your c-lightning configuration. It is successfully connecting to bitcoind. It's just using the wrong password so it is failing the authentication.

There are a few command line options for specifying the bitcoind datadir, rpc user, and rpc password. Check that those are using the correct values to connect to your current bitcoind.

So that means there are 2 users using RPC? I mean, I have my own credentials created by the python plugin and that I added to bitcoin.conf and if you say this is an automatically created user, so we have 2 users? Is that is?
And if c-lightning is using the RPC interface, then it is the only application using it. I have no other related applications using bitcoin daemon.

Yes.

[darkv0rt3x]

So, is there any "correct" way of fixing it? I already added rpcallowip=127.0.0.1 to my bitcoin.conf file.

The way to fix it is to check your c-lightning configuration. It is successfully connecting to bitcoind. It's just using the wrong password so it is failing the authentication.

I know I have a small problem with c-lightning but I think it has nothing to do with RPC of bitcoind.
I could never fix an error message that says:

Code:

 2020-11-07T14:29:03.300Z DEBUG   connectd: Error connecting to 127.0.0.1: Tor server reply: general SOCKS server failure

But other than thos, my c-lightning node works well. I can issue all commands and I think it's all fine.

There are a few command line options for specifying the bitcoind datadir, rpc user, and rpc password. Check that those are using the correct values to connect to your current bitcoind.

You mean -datadir, -rpcuser, -rpcpassword (or simply -rpcauth)? I have them inside bitcoin.conf as you can see above in my bitcoin.conf file I posted.


Edited;
Also, the RPC error happens when I start bitcoin daemon, so c-lightning is not running yet. So I presume that at this point, c-lightning cannot be the culprit for the error.



Edited 2;
I end up running netstat to try to understand what was connecting to what, but I don't have much knowledge to interpret the output of netstat. But I can find in netstat some of the ports I see in bitcoin log. I'm not sure what it means though.

Without c-lightning running, I can see this, for example, I can see that 51346 port in bitcoin daemon logs:

Code:

tcp        0      0 localhost:8332          localhost:53130         ESTABLISHED 23139/bitcoind
tcp6       0      0 localhost:8332          [::]:*                  LISTEN      23139/bitcoind      
tcp6       0      0 [::]:8333               [::]:*                  LISTEN      23139/bitcoind      
tcp6       0      0 localhost:8332          localhost:51346         ESTABLISHED 23139/bitcoind      
tcp6       0      0 localhost:51346         localhost:8332          ESTABLISHED 22351/python3

Edited 3;
I stopped bitcoin core and started to check which were the ports being denied and I noticed that seems to be some interaction between python and the bitcoin daemon.

I can see now that the ports are actually these 2, from netstat:

tcp        0      0 localhost:58420         localhost:8332          ESTABLISHED 22351/python3
...
tcp        0      0 localhost:8332          localhost:58420         ESTABLISHED 24485/bitcoind
...
tcp6       0      0 localhost:8332          localhost:56636         ESTABLISHED 24485/bitcoind      
tcp6       0      0 localhost:56636         localhost:8332          ESTABLISHED 22351/python3

Not sure if this is of any importance!

[darkv0rt3x]

@achow101, any other suggestions?
I ran out of knowledge!

Not sure what else can I provide so that people can help me.
Anyone using last version that is experiencing the same messages?

Try to add debug=rpc and debuglogfile=~/bitocin.log to see if anyone else can find these messages, please.

[achow101]

You mean -datadir, -rpcuser, -rpcpassword (or simply -rpcauth)? I have them inside bitcoin.conf as you can see above in my bitcoin.conf file I posted.

No, in c-lightning. But that's moot since your edits indicate that something else is causing the problem.

Edited 2;
I end up running netstat to try to understand what was connecting to what, but I don't have much knowledge to interpret the output of netstat. But I can find in netstat some of the ports I see in bitcoin log. I'm not sure what it means though.

Without c-lightning running, I can see this, for example, I can see that 51346 port in bitcoin daemon logs:

Code:

tcp        0      0 localhost:8332          localhost:53130         ESTABLISHED 23139/bitcoind
tcp6       0      0 localhost:8332          [::]:*                  LISTEN      23139/bitcoind      
tcp6       0      0 [::]:8333               [::]:*                  LISTEN      23139/bitcoind      
tcp6       0      0 localhost:8332          localhost:51346         ESTABLISHED 23139/bitcoind      
tcp6       0      0 localhost:51346         localhost:8332          ESTABLISHED 22351/python3

Edited 3;
I stopped bitcoin core and started to check which were the ports being denied and I noticed that seems to be some interaction between python and the bitcoin daemon.

I can see now that the ports are actually these 2, from netstat:

tcp        0      0 localhost:58420         localhost:8332          ESTABLISHED 22351/python3
...
tcp        0      0 localhost:8332          localhost:58420         ESTABLISHED 24485/bitcoind
...
tcp6       0      0 localhost:8332          localhost:56636         ESTABLISHED 24485/bitcoind      
tcp6       0      0 localhost:56636         localhost:8332          ESTABLISHED 22351/python3

Not sure if this is of any importance!

It looks like you have a python script that is trying to access the RPC. The last part of the lines in netstat include the PID. In this case, a python3 program with PID 22351 is trying to access the RPC. You can then look up what that PID is by doing ps -ef | grep 22351. This will give you the full program invocation for that program so you can see what is actually running.

[darkv0rt3x]

You mean -datadir, -rpcuser, -rpcpassword (or simply -rpcauth)? I have them inside bitcoin.conf as you can see above in my bitcoin.conf file I posted.

No, in c-lightning. But that's moot since your edits indicate that something else is causing the problem.

Edited 2;
I end up running netstat to try to understand what was connecting to what, but I don't have much knowledge to interpret the output of netstat. But I can find in netstat some of the ports I see in bitcoin log. I'm not sure what it means though.

Without c-lightning running, I can see this, for example, I can see that 51346 port in bitcoin daemon logs:

Code:

tcp        0      0 localhost:8332          localhost:53130         ESTABLISHED 23139/bitcoind
tcp6       0      0 localhost:8332          [::]:*                  LISTEN      23139/bitcoind      
tcp6       0      0 [::]:8333               [::]:*                  LISTEN      23139/bitcoind      
tcp6       0      0 localhost:8332          localhost:51346         ESTABLISHED 23139/bitcoind      
tcp6       0      0 localhost:51346         localhost:8332          ESTABLISHED 22351/python3

Edited 3;
I stopped bitcoin core and started to check which were the ports being denied and I noticed that seems to be some interaction between python and the bitcoin daemon.

I can see now that the ports are actually these 2, from netstat:

tcp        0      0 localhost:58420         localhost:8332          ESTABLISHED 22351/python3
...
tcp        0      0 localhost:8332          localhost:58420         ESTABLISHED 24485/bitcoind
...
tcp6       0      0 localhost:8332          localhost:56636         ESTABLISHED 24485/bitcoind      
tcp6       0      0 localhost:56636         localhost:8332          ESTABLISHED 22351/python3

Not sure if this is of any importance!

It looks like you have a python script that is trying to access the RPC. The last part of the lines in netstat include the PID. In this case, a python3 program with PID 22351 is trying to access the RPC. You can then look up what that PID is by doing ps -ef | grep 22351. This will give you the full program invocation for that program so you can see what is actually running.

Ok, I think I found the culprit. I have electrum_server running and I didn't even remember it. And that's what the ps -ef returns. I guess I have to set it up accordingly to use the correct RPC credentials.

So, I can assume that nothing is actually wrong with bitcoin core, right?
Other than be running behind Tor by default and that in this situation that parameter score from getnetowrkinfo command, seems not to change, everything seems to be working as expected, I guess!