October 2019 - tor-commits - lists.torproject.org

[community/master] Redirect users to get-in-touch IRC help
by gus＠torproject.org 03 Oct '19

03 Oct '19

commit 2cd3dbef03beeec1b7fdf972a1a9e8b5a89feb66 Author: Gustavo Gus <gusgustavo(a)users.noreply.github.com> Date: Thu Oct 3 21:54:14 2019 +0000 Redirect users to get-in-touch IRC help --- content/relay-operations/getting-help/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/relay-operations/getting-help/contents.lr b/content/relay-operations/getting-help/contents.lr index cb72875..1ef463b 100644 --- a/content/relay-operations/getting-help/contents.lr +++ b/content/relay-operations/getting-help/contents.lr @@ -8,7 +8,7 @@ body: If you run into problems while setting up your relay, you can ask your questions on the public [tor-relays mailing list](https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays). The list is a great resource for asking (and answering) questions, and for getting to know other relay operators. Make sure to check out the archives! -You can also get help by joining the IRC channel #tor-relays in the network [irc.oftc.net](https://www.oftc.net). +You can also get help by joining the IRC channel #tor-relays in the network [irc.oftc.net](https://support.torproject.org/get-in-touch/#irc-help). --- html: two-columns-page.html

1 0

[bridgedb/develop] Add specification for BridgeDB's metrics format.
by phw＠torproject.org 03 Oct '19

03 Oct '19

commit 39b6285b28e2826af09bce6a3563f0b1138eac7e Author: Philipp Winter <phw(a)nymity.ch> Date: Wed Sep 18 13:42:47 2019 -0700 Add specification for BridgeDB's metrics format. We implemented BridgeDB's metrics in <https://bugs.torproject.org/9316> but haven't specified its format until this patch. This patch also makes our implementation consistent with our (slightly updated) specification. In particular: * For naming consistency, we changed "bridgedb-stats-version" to "bridgedb-metrics-version" and "bridgedb-stats-end" to "bridgedb-metrics-end". * For simplicity, we also changed our version from a major and minor number to a single number. * Instead of appending to our metrics file, we now overwrite the file because our specification requires "bridgedb-metrics-end" and "bridgedb-metrics-version" to be there exactly once. --- CHANGELOG | 8 +++++ bridgedb/main.py | 2 +- bridgedb/metrics.py | 13 ++++---- bridgedb/test/test_metrics.py | 4 +-- doc/bridgedb-metrics-spec.txt | 74 +++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 91 insertions(+), 10 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 06968d2..c2fca89 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,3 +1,11 @@ +Changes in version A.B.C - YYYY-MM-DD + + * FIXES https://bugs.torproject.org/31780 + We implemented BridgeDB's metrics in #9316 but haven't specified its + format until now. In addition to adding a specification, this patch + also makes our implementation consistent with our (slightly updated) + specification. + Changes in version 0.8.2 - 2019-09-20 Updated translations for the following languages: diff --git a/bridgedb/main.py b/bridgedb/main.py index 94f4921..7c2df6d 100644 --- a/bridgedb/main.py +++ b/bridgedb/main.py @@ -85,7 +85,7 @@ def writeMetrics(filename, measurementInterval): logging.debug("Dumping metrics to file: '%s'" % filename) try: - with open(filename, 'a') as fh: + with open(filename, 'w') as fh: metrics.export(fh, measurementInterval) except IOError as err: logging.error("Failed to write metrics to '%s': %s" % (filename, err)) diff --git a/bridgedb/metrics.py b/bridgedb/metrics.py index 4e1c880..5e14146 100644 --- a/bridgedb/metrics.py +++ b/bridgedb/metrics.py @@ -9,7 +9,7 @@ # :license: see LICENSE for licensing information # _____________________________________________________________________________ -"""API for keeping track of BridgeDB statistics, e.g., the demand for bridges +"""API for keeping track of BridgeDB metrics, e.g., the demand for bridges over time. """ @@ -53,9 +53,9 @@ SUBNET_CTR_PREFIX_LEN = 20 # All of the pluggable transports BridgeDB currently supports. SUPPORTED_TRANSPORTS = None -# Major and minor version number for our statistics format. -METRICS_MAJOR_VERSION = 1 -METRICS_MINOR_VERSION = 0 +# Version number for our metrics format. We increment the version if our +# format changes. +METRICS_VERSION = 1 def setProxies(proxies): @@ -120,11 +120,10 @@ def export(fh, measurementInterval): logging.debug("Metrics module knows about %d proxies." % numProxies) now = datetime.datetime.utcnow() - fh.write("bridgedb-stats-end %s (%d s)\n" % ( + fh.write("bridgedb-metrics-end %s (%d s)\n" % ( now.strftime("%Y-%m-%d %H:%M:%S"), measurementInterval)) - fh.write("bridgedb-stats-version %d.%d\n" % (METRICS_MAJOR_VERSION, - METRICS_MINOR_VERSION)) + fh.write("bridgedb-metrics-version %d\n" % METRICS_VERSION) httpsLines = httpsMetrix.getMetrics() for line in httpsLines: diff --git a/bridgedb/test/test_metrics.py b/bridgedb/test/test_metrics.py index a870fc2..a27431c 100644 --- a/bridgedb/test/test_metrics.py +++ b/bridgedb/test/test_metrics.py @@ -110,8 +110,8 @@ class StateTest(unittest.TestCase): self.assertTrue(len(pseudo_fh.getvalue()) > 0) lines = pseudo_fh.getvalue().split("\n") - self.assertTrue(lines[0].startswith("bridgedb-stats-end")) - self.assertTrue(lines[1].startswith("bridgedb-stats-version")) + self.assertTrue(lines[0].startswith("bridgedb-metrics-end")) + self.assertTrue(lines[1].startswith("bridgedb-metrics-version")) self.assertTrue(lines[2] == "bridgedb-metric-count https.obfs4.de.success.None 10") diff --git a/doc/bridgedb-metrics-spec.txt b/doc/bridgedb-metrics-spec.txt new file mode 100644 index 0000000..14c38f9 --- /dev/null +++ b/doc/bridgedb-metrics-spec.txt @@ -0,0 +1,74 @@ + BridgeDB metrics (version 1) + +BridgeDB exports usage metrics once every 24 hours. These metrics +encode how many approximate successful/failed requests BridgeDB has seen +per distribution mechanism, per pluggable transport, per country code or +email provider. For example, one of these metrics lines can tell us +that over the last 24 hours, BridgeDB has seen between 21 and 30 +successful requests for obfs4 over moat from Zimbabwe. + +This section specifies the format of BridgeDB's metrics. Each metrics +file is formatted as follows: + + "bridgedb-metrics-end" YYYY-MM-DD HH:MM:SS (NSEC s) NL + [At start, exactly once.] + + YYYY-MM-DD HH:MM:SS defines the end (in UTC) of the included + measurement interval of length NSEC seconds (86400 seconds by + default). + + Example: + bridgedb-metrics-end 2019-09-18 00:33:44 (86400 s) + + "bridgedb-metrics-version" VERSION NL + [Exactly once.] + + VERSION determines the version of the metrics format. As the + format changes over time, we will increment VERSION. The latest + version is 1 -- the first iteration of the metrics format. + + Example: + bridgedb-metrics-version 1 + + "bridgedb-metric-count" METRIC_KEY COUNT NL + [Any number.] + + METRIC_KEY determines a metrics key, which consists of several + fields, separated by a period: + + DISTRIBUTION "." TRANSPORT "." CC/EMAIL "." "success" | "fail" "." RESERVED + + DISTRIBUTION is BridgeDB's distribution mechanism, which includes + "https", "email", and "moat". These distribution mechanisms may + change in the future. + + TRANSPORT refers to a pluggable transport protocol. This includes + "obfs2", "obfs3", "obfs4", "scramblesuit", and "fte". These + pluggable transports will change in the future. + + CC/EMAIL refers to a two-letter country code of the user's IP + address iff DISTRIBUTION is "moat" or "https"; or to an email + provider iff DISTRIBUTION is "email". We use two reserved country + codes, "??" and "zz". "??" denotes that we couldn't map an IP + address to its country, e.g., because our geolocation API was + unable to. "zz" denotes a proxy IP address, e.g., Tor exit + relays. The two allowed email providers are "gmail" and "riseup". + + The next field is either "success" or "fail", depending on if the + BridgeDB request was successful or not. A request is successful + if BridgeDB attempts to provide the user with bridges, even if + BridgeDB currently has no bridges available. A request has failed + if BridgeDB won't provide the user with bridges, for example, if + the user could not solve the CAPTCHA. + + The field RESERVED is reserved for an anomaly score. It is + currently set to "none" and should be ignored by implementations. + + COUNT is the approximate number of user requests for the given + METRIC_KEY. We round up the number of requests to the next + multiple of 10 to preserve some user privacy. + + Examples: + bridgedb-metric-count https.scramblesuit.zz.fail.none 100 + bridgedb-metric-count moat.obfs4.??.success.none 3550 + bridgedb-metric-count email.fte.gmail.fail.none 10

1 0

[bridgedb/develop] Merge branch 'task/31780' into develop
by phw＠torproject.org 03 Oct '19

03 Oct '19

commit 0751ad7148447f30df7c015c77853d58b6077f71 Merge: e5f83a4 39b6285 Author: Philipp Winter <phw(a)nymity.ch> Date: Thu Oct 3 14:28:02 2019 -0700 Merge branch 'task/31780' into develop CHANGELOG | 8 +++++ bridgedb/main.py | 2 +- bridgedb/metrics.py | 13 ++++---- bridgedb/test/test_metrics.py | 4 +-- doc/bridgedb-metrics-spec.txt | 74 +++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 91 insertions(+), 10 deletions(-)

1 0

[community/master] Merge branch 'patch-5'
by gus＠torproject.org 03 Oct '19

03 Oct '19

commit 74e3edb5fcc12d7830749dc21b3aae303e3df3e6 Merge: 6910083 4cbe0a2 Author: gus <gus(a)torproject.org> Date: Thu Oct 3 17:11:15 2019 -0400 Merge branch 'patch-5' .../relay-operations/technical-setup/bridge/debian-ubuntu/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

1 0

[community/master] Replace Debian repository instructions to Support portal
by gus＠torproject.org 03 Oct '19

03 Oct '19

commit 4cbe0a2a48d5845b2f44f4001ed9cff12d901611 Author: Gustavo Gus <gusgustavo(a)users.noreply.github.com> Date: Fri Sep 27 17:49:45 2019 +0000 Replace Debian repository instructions to Support portal --- .../relay-operations/technical-setup/bridge/debian-ubuntu/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/relay-operations/technical-setup/bridge/debian-ubuntu/contents.lr b/content/relay-operations/technical-setup/bridge/debian-ubuntu/contents.lr index b97259c..9596a38 100644 --- a/content/relay-operations/technical-setup/bridge/debian-ubuntu/contents.lr +++ b/content/relay-operations/technical-setup/bridge/debian-ubuntu/contents.lr @@ -10,7 +10,7 @@ body: Get the latest version of Tor. If you're on Debian stable, `sudo apt-get install tor` should give you the latest stable version of Tor. -* Note: **Ubuntu users need to get it from Tor repository. Please see** [Download instructions for Ubuntu](https://www.torproject.org/docs/debian.html.en#ubuntu). +* Note: **Ubuntu users need to get it from Tor repository. Please see** [Download instructions for Ubuntu](https://support.torproject.org/apt/tor-deb-repo/). ### 2. Install obfs4proxy

1 0

[community/master] hello DragonFlyBSD!
by gus＠torproject.org 03 Oct '19

03 Oct '19

commit dbfe843d265cb7df664104898fd3f24a0ccded34 Author: Vinicius Zavam <egypcio(a)googlemail.com> Date: Thu Oct 3 18:43:34 2019 +0000 hello DragonFlyBSD! - avoid pushing people to use DPorts, as we have `pkg` :) --- .../technical-setup/guard/dragonflybsd/contents.lr | 99 ++++++++++++++++++++++ 1 file changed, 99 insertions(+) diff --git a/content/relay-operations/technical-setup/guard/dragonflybsd/contents.lr b/content/relay-operations/technical-setup/guard/dragonflybsd/contents.lr new file mode 100644 index 0000000..8218178 --- /dev/null +++ b/content/relay-operations/technical-setup/guard/dragonflybsd/contents.lr @@ -0,0 +1,99 @@ +_model: page +--- +color: primary +--- +title: DragonflyBSD +--- +body: + +# 1. Bootstrap `pkg` + +DragonFlyBSD's daily snapshots and releases (starting with 3.4) come with `pkg` already installed. Upgrades from earlier releases, however, will not have it. + +If `pkg` is missing on the system for any reason, it can be quickly bootstrapped without having to build it from source or even having **DPorts** installed: + +``` +cd /usr +make pkg-bootstrap +rehash +pkg-static install -y pkg +rehash +``` + +### 1.1. Recommended Steps to Setup `pkg` + +Here, it will be similar to what we have on a **FreeBSD** system, and we are going to use HTTPS to fetch our packages, and updates - so here we also need an extra package to help us out (ca_root_nss). + +Installing the `ca_root_nss` package: + +``` +pkg install ca_root_nss +``` + +For fresh installations, the file `/usr/local/etc/pkg/repos/df-latest.conf.sample` is copied to `/usr/local/etc/pkg/repos/df-latest`. The files ending in the ".sample" extension are ignored; pkg(8) only reads files that end in ".conf" and it will read as many as it finds. + +DragonflyBSD has 2 packages repositories: + + - Avalon (mirror-master.dragonflybsd.org) + - Wolfpond (pkg.wolfpond.org) + +We can simply edit the **URL** used to point out the repositories on `/usr/local/etc/pkg/repos/df-latest` and that's it! Remember to use **pkg+https://** for Avalon. + +After applying all these changes, we update the packages list again and try to check if there's already a new update to apply: + +``` +pkg update -f +pkg upgrade -y -f +``` + +# 2. Install `tor` DragonflyBSD's Package + +Here we can choose to install the latest stable version, like: + +``` +pkg install tor +``` + + ... or install an alpha release: + + +``` +pkg install tor-devel +``` + +# 3. Configure `/usr/local/etc/tor/torrc` + +This is a very simple version of the `torrc` configuration file in order to run a Middle/Guard relay on the Tor network: + +``` +Nickname myBSDRelay # Change your relay's nickname to something you like +ContactInfo your@email # Please write your email address and be aware that it will be published +ORPort 443 # You might want to use/try a different port, should you want to +ExitRelay 0 +SocksPort 0 +Log notice syslog +``` + +# 4. Start `tor`: + +Here we set `tor` to start at boot time and use the setuid feature, in order to bind to lower ports like 443 (the daemon itself will still run as a regular non-privileged user). + +``` +echo "tor_setuid=YES" >> /etc/rc.conf +echo "tor_enable=YES" >> /etc/rc.conf +service tor start +``` + +# 5. Final Notes + +If you are having troubles setting up your relay, have a look at our [help section](/relay/getting-help/). If your relay is now running, check out the [post-install](/relay/setup/post-install/) notes. +--- +html: two-columns-page.html +--- +key: 2 +--- +section: Middle/Guard relay +--- +section_id: relay-operations +--- +subtitle: How to deploy a Middle/Guard relay on DragonflyBSD

1 0

[community/master] present NetBSD to awesome people willing to support Tor :)
by gus＠torproject.org 03 Oct '19

03 Oct '19

commit d01fcd5fe64822fc1fd50fa3b9e778ac5295b207 Author: Vinicius Zavam <egypcio(a)googlemail.com> Date: Thu Oct 3 18:14:35 2019 +0000 present NetBSD to awesome people willing to support Tor :) - this commit kinda mirrors the up to date wiki page to the new community portal; - all fine from 'wiki/TorRelayGuide/NetBSD'; - keeping the standards for all *BSD guides, working out of the box for vanilla systems. --- .../technical-setup/guard/netbsd/contents.lr | 51 ++++++++++++++++++++++ 1 file changed, 51 insertions(+) diff --git a/content/relay-operations/technical-setup/guard/netbsd/contents.lr b/content/relay-operations/technical-setup/guard/netbsd/contents.lr new file mode 100644 index 0000000..688cbce --- /dev/null +++ b/content/relay-operations/technical-setup/guard/netbsd/contents.lr @@ -0,0 +1,51 @@ +_model: page +--- +color: primary +--- +title: NetBSD +--- +body: + +# 1. Setup `pkg_add` + +``` +echo "PKG_PATH=http://cdn.netbsd.org/pub/pkgsrc/packages/NetBSD/$(uname -m)/$(uname -r)/All" > /etc/pkg_install.conf +``` + +# 2. Install `tor` NetBSD's package + +``` +pkg_add tor +``` + +# 3. Configure `/usr/pkg/etc/tor/torrc` + +``` +Nickname myBSDRelay # Change your relay's nickname to something you like +ContactInfo your@email # Please write your email address and be aware that it will be published +ORPort 443 # You might want to use/try a different port, should you want to +ExitRelay 0 +SocksPort 0 +Log notice syslog +``` + +# 6. Start `tor`: + +Here we set `tor` to start during boot and call it for the first time: + +``` +ln -sf /usr/pkg/share/examples/rc.d/tor /etc/rc.d/tor +echo "tor=YES" >> /etc/rc.conf +/etc/rc.d/tor start +``` + +--- +html: two-columns-page.html +--- +key: 2 +--- +section: Middle/Guard relay +--- +section_id: relay-operations +--- +subtitle: How to deploy a Middle/Guard relay on NetBSD

1 0

[community/master] update FreeBSD setup guide for middle/guard relays;
by gus＠torproject.org 03 Oct '19

03 Oct '19

commit 6910083da66d719b880069e6a3a21c3ef00677a1 Author: Vinicius Zavam <egypcio(a)googlemail.com> Date: Thu Oct 3 17:49:49 2019 +0000 update FreeBSD setup guide for middle/guard relays; - ensure we cover also pkg's bootstrap (for vanila systems w/o any available package); - track the 'latest' branch used by pkg to get more frequent packages updates; - use HTTPS:// on the repository url (needs extra package, ca_root_nss); - cover starting our daemon on port 443, but still as '_tor' non-root user. --- .../technical-setup/guard/freebsd/contents.lr | 104 ++++++++++++++------- 1 file changed, 69 insertions(+), 35 deletions(-) diff --git a/content/relay-operations/technical-setup/guard/freebsd/contents.lr b/content/relay-operations/technical-setup/guard/freebsd/contents.lr index b442ca8..8744d31 100644 --- a/content/relay-operations/technical-setup/guard/freebsd/contents.lr +++ b/content/relay-operations/technical-setup/guard/freebsd/contents.lr @@ -6,68 +6,102 @@ title: FreeBSD --- body: -# 1. Enable Automatic Software Updates +# 1. Enable Automatic Updates for Packages One of the most imported things to keeps your relay secure is to install security updates timely and ideally automatically so you can not forget about it. Follow the instructions to enable [automatic software updates](updates) for your operating system. -# 2. Install the tor package +# 2. Bootstrap `pkg` -`pkg install tor ca_root_nss` +This article considers we have already a base installation of FreeBSD running, and only the base system (here, we are running 12.0-RELEASE). That means we do not have any packages installed neither the `pkg` packages manager itself (there's no `sudo` available - we are running commands as root). -or for alpha releases: +To bootstrap and install `pkg` we should run the following command: -`pkg install tor-devel ca_root_nss` +``` +pkg bootstrap +pkg update -f +``` + +### 2.1. Recommended Steps to Setup `pkg` + +To follow upstream updates in a "faster way" we recommend changing the 'quarterly' branch used by `pkg` to its 'latest' branch. + +One additional step is to prefer using HTTPS to fetch our packages, and updates - so here we also need an extra package to help us out (ca_root_nss). -# 3. Put the configuration file `/usr/local/etc/tor/torrc` in place +Installing the `ca_root_nss` package: ``` -#change the nickname "myNiceRelay" to a name that you like -Nickname myNiceRelay -ORPort 9001 -ExitRelay 0 -SocksPort 0 -# Change the email address bellow and be aware that it will be published -ContactInfo tor-operator@your-emailaddress-domain -Log notice syslog +pkg install ca_root_nss ``` -# 4. Ensure that the `random_id` sysctl setting is enabled: +We are keeping the original setting used by `pkg` but setting a new one that will override it, so we set up a new directory and than create a configuration file to override what we need. This configuration file will be `/usr/local/etc/pkg/repos/FreeBSD.conf`. + +Creating the new directory: ``` -echo "net.inet.ip.random_id=1" >> /etc/sysctl.conf -sysctl net.inet.ip.random_id=1 +mkdir -p /usr/local/etc/pkg/repos ``` -# 5. Start the tor daemon and make sure it starts at boot: +This is how the new configuration file `/usr/local/etc/pkg/repos/FreeBSD.conf` must look like: ``` -sysrc tor_enable=YES -service tor start +FreeBSD: { + url: pkg+https://pkg.freebsd.org/${ABI}/latest +} ``` -### Optional but recommended +After applying all these changes, we update the packages list again and try to check if there's already a new update to apply: -To get package updates faster after they have been build it is best to switch from the "quarterly" with "latest" repository. +``` +pkg update -f +pkg upgrade -y -f +``` -Create the following folder: +# 3. Install `tor` FreeBSD's Package -`mkdir -p /usr/local/etc/pkg/repos` +Here we can choose to install the latest stable version, like: -and create the file `/usr/local/etc/pkg/repos/FreeBSD.conf` with the following content: +``` +pkg install tor +``` + + ... or install an alpha release: + +``` +pkg install tor-devel ``` -FreeBSD: { enabled: no } -FreeBSDlatest: { - url: "pkg+https://pkg.FreeBSD.org/${ABI}/latest", - mirror_type: "srv", - signature_type: "fingerprints", - fingerprints: "/usr/share/keys/pkg", - enabled: yes -} +# 4. Configure `/usr/local/etc/tor/torrc` + +This is a very simple version of the `torrc` configuration file in order to run a Middle/Guard relay on the Tor network: + +``` +Nickname myBSDRelay # Change your relay's nickname to something you like +ContactInfo your@email # Please write your email address and be aware that it will be published +ORPort 443 # You might want to use/try a different port, should you want to +ExitRelay 0 +SocksPort 0 +Log notice syslog +``` + +# 5. Ensure `net.inet.ip.random_id` is enabled: + +``` +echo "net.inet.ip.random_id=1" >> /etc/sysctl.conf +sysctl net.inet.ip.random_id=1 +``` + +# 6. Start `tor`: + +Here we set `tor` to start at boot time and use the setuid feature, in order to bind to lower ports like 443 (the daemon itself will still run as a regular non-privileged user). + +``` +sysrc tor_setuid=YES +sysrc tor_enable=YES +service tor start ``` -# 6. Final notes +# 7. Final Notes If you are having troubles setting up your relay, have a look at our [help section](/relay/getting-help/). If your relay is now running, check out the [post-install](/relay/setup/post-install/) notes. --- @@ -79,4 +113,4 @@ section: Middle/Guard relay --- section_id: relay-operations --- -subtitle: How to deploy a middle/Guard relay on FreeBSD +subtitle: How to deploy a Middle/Guard relay on FreeBSD

1 0

[community/master] add OpenBSD setup for middle/guard relays (@)<
by gus＠torproject.org 03 Oct '19

03 Oct '19

commit db2e96faa6e7c70388ffaf898e5e4752d1730538 Author: Vinicius Zavam <egypcio(a)googlemail.com> Date: Thu Oct 3 18:02:58 2019 +0000 add OpenBSD setup for middle/guard relays (@)< - recommend using more recent package, from M:Tier; - cover the use of 'openup' to update packages; - tune system's limits to operate a fine relay (fix trac ticket 27489 [0]). [0] https://trac.torproject.org/projects/tor/ticket/27489 --- .../technical-setup/guard/openbsd/contents.lr | 94 ++++++++++++++++++++++ 1 file changed, 94 insertions(+) diff --git a/content/relay-operations/technical-setup/guard/openbsd/contents.lr b/content/relay-operations/technical-setup/guard/openbsd/contents.lr new file mode 100644 index 0000000..24a5dd7 --- /dev/null +++ b/content/relay-operations/technical-setup/guard/openbsd/contents.lr @@ -0,0 +1,94 @@ +_model: page +--- +color: primary +--- +title: OpenBSD +--- +body: + +# 1. Install `tor` OpenBSD's Package + +Recent OpenBSD systems, like 6.5/amd64, already have the repository configured on `/etc/installurl` so we do not need to bother changing it. + +Should that's not your case, please adjust the `installurl` configuration file like this: + +``` +echo "https://cdn.openbsd.org/pub/OpenBSD" > /etc/installurl +``` + +Proceed with `pkg_add` to install the package: + +``` +pkg_add tor +``` + +### 2.1. Recommended Steps to Install `tor` on OpenBSD + +If you want to install a newer version of the `tor` OpenBSD's package, you can use M:Tier's binary packages: + +``` +ftp https://stable.mtier.org/openup +``` + +Right after fetching `openup` you can run it to sync M:Tier's repository and update your packages; it's an alternative to `pkg_add -u`. + +Here is how you proceed with these steps: + +``` +openup +``` + +# 3. Configure `/etc/tor/torrc` + +This is a very simple version of the `torrc` configuration file in order to run a Middle/Guard relay on the Tor network: + +``` +Nickname myBSDRelay # Change your relay's nickname to something you like +ContactInfo your@email # Please write your email address and be aware that it will be published +ORPort 443 # You might want to use/try a different port, should you want to +ExitRelay 0 +SocksPort 0 +Log notice syslog +User _tor +``` + +# 4. Change `openfiles-max` and `maxfiles` Tweaks + +By default, OpenBSD maintains a rather low limit on the maximum number of open files for a process. For a daemon such as Tor's, that opens a connection to each and every other relay (currently around 7000 relays), these limits should be raised. + +Append the following section to `/etc/login.conf`: + +``` +tor:\ + :openfiles-max=13500:\ + :tc=daemon: +``` + +OpenBSD also stores a kernel-level file descriptor limit in the sysctl variable `kern.maxfiles`. + +Increase it from the default of 7030 to 16000: + +``` +echo "kern.maxfiles=16000" >> /etc/sysctl.conf +sysctl kern.maxfiles=16000 +``` + +# 6. Start `tor`: + +Here we set `tor` to start during boot and call it for the first time: + +``` +rcctl enable tor +rcctl start tor +``` + +--- +html: two-columns-page.html +--- +key: 2 +--- +section: Middle/Guard relay +--- +section_id: relay-operations +--- +subtitle: How to deploy a Middle/Guard relay on OpenBSD

1 0

[tor-browser/tor-browser-68.1.0esr-9.0-2] Bug 31935: Disable profile downgrade protection.
by gk＠torproject.org 03 Oct '19

03 Oct '19

commit d375c811357fc32f7f0d2e399ebb9edb2764eb76 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Thu Oct 3 15:27:00 2019 -0400 Bug 31935: Disable profile downgrade protection. Since Tor Browser does not support more than one profile, disable the prompt and associated code that offers to create one when a version downgrade situation is detected. --- browser/moz.configure | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/browser/moz.configure b/browser/moz.configure index 43bc0c1fe59b..f0f0f07e23f3 100644 --- a/browser/moz.configure +++ b/browser/moz.configure @@ -8,7 +8,7 @@ imply_option('MOZ_PLACES', True) imply_option('MOZ_SERVICES_HEALTHREPORT', True) imply_option('MOZ_SERVICES_SYNC', True) imply_option('MOZ_DEDICATED_PROFILES', False) -imply_option('MOZ_BLOCK_PROFILE_DOWNGRADE', True) +imply_option('MOZ_BLOCK_PROFILE_DOWNGRADE', False) with only_when(target_is_linux & compile_environment): option(env='MOZ_NO_PIE_COMPAT',

1 0