tor-commits July 2019

tor-commits@lists.torproject.org

19 participants
1200 discussions

[community/master] fixed page layout freebsd page
by hiro＠torproject.org 05 Jul '19

05 Jul '19

commit 1edd37959c50d2915ddc3f6d3e8b71a36fbefae2 Author: gus <gus(a)torproject.org> Date: Thu Jul 4 10:26:04 2019 -0400 fixed page layout freebsd page --- content/relay-operations/technical-setup/freebsd/contents.lr | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/relay-operations/technical-setup/freebsd/contents.lr b/content/relay-operations/technical-setup/freebsd/contents.lr index c03b579..3323fd5 100644 --- a/content/relay-operations/technical-setup/freebsd/contents.lr +++ b/content/relay-operations/technical-setup/freebsd/contents.lr @@ -70,6 +70,6 @@ FreeBSDlatest: { ``` --- -_template: +_template: layout.html --- -color: primary +color:

1 0

[community/master] add Fedora relay instructions
by hiro＠torproject.org 05 Jul '19

05 Jul '19

commit 825ed1beaa2e2154e5419ac1e3d789c83366a87c Author: gus <gus(a)torproject.org> Date: Thu Jul 4 09:54:36 2019 -0400 add Fedora relay instructions --- .../technical-setup/fedora/contents.lr | 26 ++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/content/relay-operations/technical-setup/fedora/contents.lr b/content/relay-operations/technical-setup/fedora/contents.lr index ba5cfdb..0a561f8 100644 --- a/content/relay-operations/technical-setup/fedora/contents.lr +++ b/content/relay-operations/technical-setup/fedora/contents.lr @@ -9,3 +9,29 @@ key: 3 section: relay operations --- section_id: relay-operations +--- +_template: layout.html +--- +body: + +# 1. Install the tor package: + +`dnf install tor` + +# 2. Put the tor configuration file `/etc/tor/torrc` in place: + +``` +#change the nickname "myNiceRelay" to a name that you like +Nickname myNiceRelay +ORPort 9001 +ExitRelay 0 +# Change the email address bellow and be aware that it will be published +ContactInfo tor-operator@your-emailaddress-domain +``` + +# 3. Start the tor daemon and make sure it starts at boot: + +``` +systemctl enable tor +systemctl start tor +```

1 0

[community/master] Imported bridges obfs4 deployment guide for debian, centos, freebsd, openbsd
by hiro＠torproject.org 05 Jul '19

05 Jul '19

commit 303d780bdadd4837b44b74c80add451cc7bf8887 Author: gus <gus(a)torproject.org> Date: Thu Jul 4 14:47:49 2019 -0400 Imported bridges obfs4 deployment guide for debian, centos, freebsd, openbsd --- .../centos-rhel-opensuse/contents.lr | 101 +++++++++++++++++++++ .../bridge-deployment-guide/contents.lr | 19 ++++ .../debian-ubuntu/contents.lr | 80 ++++++++++++++++ .../bridge-deployment-guide/freebsd/contents.lr | 98 ++++++++++++++++++++ .../bridge-deployment-guide/openbsd/contents.lr | 7 ++ .../post-install/contents.lr | 22 +++++ 6 files changed, 327 insertions(+) diff --git a/content/relay-operations/technical-setup/bridge-deployment-guide/centos-rhel-opensuse/contents.lr b/content/relay-operations/technical-setup/bridge-deployment-guide/centos-rhel-opensuse/contents.lr new file mode 100644 index 0000000..22d0f46 --- /dev/null +++ b/content/relay-operations/technical-setup/bridge-deployment-guide/centos-rhel-opensuse/contents.lr @@ -0,0 +1,101 @@ +_model: page +--- +title: CentOS / RHEL / OpenSUSE +--- +body: + +# 1. Install tor and dependencies + +* Redhat / RHEL: + +``` +yum install epel-release +yum install git golang tor +``` + +* OpenSUSE: + +``` +zypper install tor go git +``` + +# 2. Build obfs4proxy and move it into place. + +Heavily outdated versions of git can make `go get` fail, so try upgrading to a more recent git version if you're running into this problem. + +* CentOS / RHEL: + +``` +export GOPATH=`mktemp -d` +go get gitlab.com/yawning/obfs4.git/obfs4proxy +sudo cp $GOPATH/bin/obfs4proxy /usr/local/bin/ +chcon --reference=/usr/bin/tor /usr/local/bin/obfs4proxy +``` + +* OpenSUSE: + +``` +export GOPATH=`mktemp -d` +go get gitlab.com/yawning/obfs4.git/obfs4proxy +sudo cp $GOPATH/bin/obfs4proxy /usr/local/bin/ +``` + +# 3. Edit your Tor config file, usually located at `/etc/tor/torrc` and add the following lines: + +``` +#Bridge config +RunAsDaemon 1 +ORPort auto +BridgeRelay 1 +ServerTransportPlugin obfs4 exec /usr/local/bin/obfs4proxy +# For a fixed obfs4 port (e.g. 34176), uncomment the following line. +#ServerTransportListenAddr obfs4 0.0.0.0:34176 +# Local communication port between Tor and obfs4. Always set this to "auto". "Ext" means +# "extended", not "external". Don't try to set a specific port number, nor listen on 0.0.0.0. +ExtORPort auto + +# Contact information that allows us to get in touch with you in case of +# critical updates or problems with your bridge. This is optional, so you +# don't have to provide an email address if you don't want to. +ContactInfo <address(a)email.com> +# Pick a nickname that you like for your bridge. +Nickname PickANickname +``` + +Don't forget to change the ContactInfo and Nickname options. + +* Note that both Tor's OR port **and** its obfs4 port must be reachable. If your bridge is behind a firewall or NAT, make sure to open both ports. + +# 4. Restart tor + +`systemctl restart tor` + +# 5. Monitor your logs (usually in your syslog) + +To confirm your bridge is running with no issues, you should see something like this: + +``` +[notice] Your Tor server's identity key fingerprint is '<NICKNAME> <FINGERPRINT>' +[notice] Your Tor bridge's hashed identity key fingerprint is '<NICKNAME> <HASHED FINGERPRINT>' +[notice] Registered server transport 'obfs4' at '[::]:46396' +[notice] Tor has successfully opened a circuit. Looks like client functionality is working. +[notice] Bootstrapped 100%: Done +[notice] Now checking whether ORPort <redacted>:9001 is reachable... (this may take up to 20 minutes -- look for log messages indicating success) +[notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor. +``` + +Remember to open the random port associated with your bridge. You can find it in your tor log; in the above example it is 46396. To use a fixed port, uncomment the [ServerTransportListenAddr](https://www.torproject.org/docs/tor-manual.html.… option in your torrc. You can use [our reachability test](https://bridges.torproject.org/scan/) to see if your obfs4 port is reachable from the Internet. + + +--- +html: two-columns-page.html +--- +key: + +2 +--- +color: primary +--- +subtitle: How to deploy obfs4proxy on CentOS / RHEL +--- +_template: layout.html diff --git a/content/relay-operations/technical-setup/bridge-deployment-guide/contents.lr b/content/relay-operations/technical-setup/bridge-deployment-guide/contents.lr new file mode 100644 index 0000000..b542590 --- /dev/null +++ b/content/relay-operations/technical-setup/bridge-deployment-guide/contents.lr @@ -0,0 +1,19 @@ +_model: page +--- +title: + + Bridge deployment +--- +body: + +This guide will help you run an obfs4 bridge to help censored users connect to the Tor network. The requirements are 1) 24/7 Internet connectivity and 2) the ability to expose TCP ports to the Internet (make sure that NAT doesn't get in the way). +--- +html: two-columns-page.html +--- +key: 1 +--- +section: Bridge operations +--- +section_id: bridge-operations +--- +subtitle: Run an obfs4 bridge to help censored users connect to the Tor network diff --git a/content/relay-operations/technical-setup/bridge-deployment-guide/debian-ubuntu/contents.lr b/content/relay-operations/technical-setup/bridge-deployment-guide/debian-ubuntu/contents.lr new file mode 100644 index 0000000..6bb7b79 --- /dev/null +++ b/content/relay-operations/technical-setup/bridge-deployment-guide/debian-ubuntu/contents.lr @@ -0,0 +1,80 @@ +_model: page +--- +title: Debian / Ubuntu +--- +body: + +# 1. Install Tor + +Get the latest version of Tor. If you're on Debian stable, `sudo apt-get install tor` should give you the latest stable version of Tor. + +* Note:''' Ubuntu users need to get it from Tor repository. Please see [Download instructions for Ubuntu](https://www.torproject.org/docs/debian.html.en#ubuntu). + +# 2. Install obfs4proxy + +On [Debian](https://packages.debian.org/search?keywords=obfs4proxy), the `obfs4proxy` package is available in sid, buster, and stretch. On [https://packages.ubuntu.com/search?keywords=obfs4proxy Ubuntu], bionic, cosmic, disco, and eoan have the package. If you're running any of them, `sudo apt-get install obfs4proxy` should work. + +If not, you can [build it from source](https://gitlab.com/yawning/obfs4#installation). + +# 3. Edit your Tor config file, usually located at `/etc/tor/torrc` and add the following lines: + +``` +#Bridge config +RunAsDaemon 1 +ORPort auto +BridgeRelay 1 +ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy +# For a fixed obfs4 port (e.g. 34176), uncomment the following line. +#ServerTransportListenAddr obfs4 0.0.0.0:34176 +# Local communication port between Tor and obfs4. Always set this to "auto". "Ext" means +# "extended", not "external". Don't try to set a specific port number, nor listen on 0.0.0.0. +ExtORPort auto + +# Contact information that allows us to get in touch with you in case of +# critical updates or problems with your bridge. This is optional, so you +# don't have to provide an email address if you don't want to. +ContactInfo <address(a)email.com> +# Pick a nickname that you like for your bridge. +Nickname PickANickname +``` + +Don't forget to change the ContactInfo and Nickname options. + +* If you decide to use a fixed obfs4 port smaller than 1024 (for example 80 or 443), you will need to give obfs4 `CAP_NET_BIND_SERVICE` capabilities to bind the port with a non-root user: + +``` +sudo setcap cap_net_bind_service=+ep /usr/bin/obfs4proxy +``` + +* Under Debian, you will also need to set `NoNewPrivileges=no` in `/lib/systemd/system/tor(a)default.service` and `/lib/systemd/system/tor@.service` and then run `systemctl daemon-reload`. [bug #18356](https://trac.torproject.org/projects/tor/ticket/18356) + +* Note that both Tor's OR port **and** its obfs4 port must be reachable. If your bridge is behind a firewall or NAT, make sure to open both ports. + +# 4. Restart tor + +`systemctl restart tor` + +# 5. Monitor your logs + +To confirm your bridge is running with no issues, you should see something like this (usually in `/var/log/tor/log` or `/var/log/syslog`): + + +``` +[notice] Your Tor server's identity key fingerprint is '<NICKNAME> <FINGERPRINT>' +[notice] Your Tor bridge's hashed identity key fingerprint is '<NICKNAME> <HASHED FINGERPRINT>' +[notice] Registered server transport 'obfs4' at '[::]:46396' +[notice] Tor has successfully opened a circuit. Looks like client functionality is working. +[notice] Bootstrapped 100%: Done +[notice] Now checking whether ORPort <redacted>:9001 is reachable... (this may take up to 20 minutes -- look for log messages indicating success) +[notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor. +``` + +Remember to open the random port associated with your bridge. You can find it in your tor log; in the above example it is 46396. To use a fixed port, uncomment the [ServerTransportListenAddr](https://www.torproject.org/docs/tor-manual.html.… option in your torrc. You can use [our reachability test](https://bridges.torproject.org/scan/) to see if your obfs4 port is reachable from the Internet. + + +--- +key: 1 +--- +html: two-columns-page.html +--- +subtitle: Follow the steps below to deploy obfs4proxy on Debian / Ubuntu diff --git a/content/relay-operations/technical-setup/bridge-deployment-guide/freebsd/contents.lr b/content/relay-operations/technical-setup/bridge-deployment-guide/freebsd/contents.lr new file mode 100644 index 0000000..e14737e --- /dev/null +++ b/content/relay-operations/technical-setup/bridge-deployment-guide/freebsd/contents.lr @@ -0,0 +1,98 @@ +_model: page +--- +title: FreeBSD +--- +html: two-columns-page.html +--- +key: 3 +--- +body: + +# 1. Install packages + +``` +pkg install obfs4proxy-tor tor ca_root_nss +``` + +# 2. Edit your Tor config file, usually located at `/usr/local/etc/tor` and add the following lines + +``` +#Bridge config +RunAsDaemon 1 +ORPort auto +BridgeRelay 1 +ServerTransportPlugin obfs4 exec /usr/local/bin/obfs4proxy +# For a fixed obfs4 port (e.g. 34176), uncomment the following line. +#ServerTransportListenAddr obfs4 0.0.0.0:34176 +# Local communication port between Tor and obfs4. Always set this to "auto". "Ext" means +# "extended", not "external". Don't try to set a specific port number, nor listen on 0.0.0.0. +ExtORPort auto + +# Contact information that allows us to get in touch with you in case of +# critical updates or problems with your bridge. This is optional, so you +# don't have to provide an email address if you don't want to. +ContactInfo <address(a)email.com> +# Pick a nickname that you like for your bridge. +Nickname PickANickname + +Log notice file /var/log/tor/notices.log +``` + +Don't forget to change the ContactInfo and Nickname options. + +* Note that both Tor's OR port **and** its obfs4 port must be reachable. If your bridge is behind a firewall or NAT, make sure to open both ports. + +# 3. Ensure that the `random_id` sysctl setting is enabled: + +``` +echo "net.inet.ip.random_id=1" >> /etc/sysctl.conf +sysctl net.inet.ip.random_id=1 +``` + +# 4. Start the tor daemon and make sure it starts at boot: + +``` +sysrc tor_enable=YES +service tor start +``` + +# 5. Monitor your logs + +To confirm your bridge is running with no issues, you should see something like this in `/var/log/tor/notices.log`: + +``` +[notice] Your Tor server's identity key fingerprint is '<NICKNAME> <FINGERPRINT>' +[notice] Your Tor bridge's hashed identity key fingerprint is '<NICKNAME> <HASHED FINGERPRINT>' +[notice] Registered server transport 'obfs4' at '[::]:46396' +[notice] Tor has successfully opened a circuit. Looks like client functionality is working. +[notice] Bootstrapped 100%: Done +[notice] Now checking whether ORPort <redacted>:9001 is reachable... (this may take up to 20 minutes -- look for log messages indicating success) +[notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor. +``` + +Remember to open the random port associated with your bridge. You can find it in your tor log; in the above example it is 46396. To use a fixed port, uncomment the [ ServerTransportListenAddr](https://www.torproject.org/docs/tor-manual.html.… option in your torrc. You can use[our reachability test] (https://bridges.torproject.org/scan/) to see if your obfs4 port is reachable from the Internet. + +# 6. To get the fastest package updates, switch from the "quarterly" package repo to the "latest" repo. + +Create the following folder: + +``` +mkdir -p /usr/local/etc/pkg/repos +``` + +Create the file `/usr/local/etc/pkg/repos/FreeBSD.conf` with the following content: + +``` +FreeBSD: { enabled: no } + +FreeBSDlatest: { + url: "pkg+https://pkg.FreeBSD.org/${ABI}/latest", + mirror_type: "srv", + signature_type: "fingerprints", + fingerprints: "/usr/share/keys/pkg", + enabled: yes +} +``` + +--- +subtitle: Follow the steps below to deploy obfs4proxy on FreeBSD diff --git a/content/relay-operations/technical-setup/bridge-deployment-guide/openbsd/contents.lr b/content/relay-operations/technical-setup/bridge-deployment-guide/openbsd/contents.lr new file mode 100644 index 0000000..24f1601 --- /dev/null +++ b/content/relay-operations/technical-setup/bridge-deployment-guide/openbsd/contents.lr @@ -0,0 +1,7 @@ +_model: page +--- +title: OpenBSD +--- +html: two-columns-page.html +--- +key: 4 diff --git a/content/relay-operations/technical-setup/bridge-deployment-guide/post-install/contents.lr b/content/relay-operations/technical-setup/bridge-deployment-guide/post-install/contents.lr new file mode 100644 index 0000000..e7f19cd --- /dev/null +++ b/content/relay-operations/technical-setup/bridge-deployment-guide/post-install/contents.lr @@ -0,0 +1,22 @@ +_model: page +--- +title: Post-install +--- +body: + +Congrats! If you get to this point, it means that your obfs4 bridge is running and is being distributed by BridgeDB to censored users. If you want to connect to your bridge manually, you will need to know the bridge's obfs4 certificate. See the file `/var/lib/tor/pt_state/obfs4_bridgeline.txt` and paste the entire bridge line into Tor Browser: + +``` +Bridge obfs4 <IP ADDRESS>:<PORT> <FINGERPRINT> cert=<CERTIFICATE> iat-mode=0 +``` + +You'll need to replace `<IP ADDRESS>`, `<PORT>`, and `<FINGERPRINT>` with the actual values, which you can find in the tor log. Make sure to use `<FINGERPRINT>`, not `<HASHED FINGERPRINT>`; and that `<PORT>` is the one from the log line `Registered server transport 'obfs4'`, not the one from the line `Now checking whether ORPort ... is reachable`. + +Finally, you can monitor your obfs4 bridge's usage on [Relay Search](https://metrics.torproject.org/rs.html#search). Just enter your bridge's `<HASHED FINGERPRINT>` in the form and click "Search". After having set up the bridge, it takes approximately three hours for the bridge to show up in Relay Search. + +--- +html: two-columns-page.html +--- +key: 5 +--- +subtitle: How to find your Bridge in Relay Search and connect manually

1 0

[community/master] Migrate content Tor Abuse Templates to lektor
by hiro＠torproject.org 05 Jul '19

05 Jul '19

commit e3d4792e9f9ce7e61686c22a58030efe3f8a51f1 Author: gus <gus(a)torproject.org> Date: Thu Jul 4 18:27:51 2019 -0400 Migrate content Tor Abuse Templates to lektor --- .../tor-abuse-templates/contents.lr | 302 +++++++++++++++++++++ 1 file changed, 302 insertions(+) diff --git a/content/relay-operations/community-resources/tor-abuse-templates/contents.lr b/content/relay-operations/community-resources/tor-abuse-templates/contents.lr new file mode 100644 index 0000000..475651b --- /dev/null +++ b/content/relay-operations/community-resources/tor-abuse-templates/contents.lr @@ -0,0 +1,302 @@ +_model: page +--- +title: Tor Abuse Templates +--- +body: + +# Before You Start + +The best way to handle abuse complaints is to set up your exit node so that they are less likely to be sent in the first place. Please see [Tips for Running an Exit Node with Minimal Harassment](https://blog.torproject.org/running-exit-node ) and [Tor Exit Guidelines](https://trac.torproject.org/projects/tor/wiki/doc/TorExitGuidel… for more info, before reading this document. + +Below are a collection of letters you can use to respond to your ISP about their complaint in regards to your Tor exit server. + +## Format and Philosophy of Templates + +The general format of these templates is to inform the complaintant about Tor, to help them to find a solution to their particular issue that works in general for the Internet at large (open wifi, open proxies, botnets, etc), and barring all else, how to block Tor. The philosophy of the Tor Project is that abuse should be handled proactively by the site administrators, rather than wasting effort and resources on seeking vengeance and chasing ghosts. + +The difference between the proactive approach and the reactive approach to abuse is the difference between decentralized fault-tolerant Internet freedom, and fragile, corruptible totalitarian control. To further preach to the choir, the identity-based Internet "driver's licenses" of South Korea and China have done nothing to curtail cybercrime and Internet abuse. In fact, all [http://boingboing.net/2011/08/12/south-korea-to-abandon-real-name-internet-… objective evidence] seems to indicate that it has only created new markets for organized crime to preside over. This is the core idea that these abuse complaint templates attempt to instil in the recipient. Feel free to improve them if you feel they fall short of this goal. + +All templates should include the Common Boilerplate below, and append some additional paragraphs depending on the specific Scenario. + +## Common Boilerplate (Tor Intro) + +``` +The IP address in question is a Tor exit node. +https://www.torproject.org/overview.html + +There is little we can do to trace this matter further. As can be seen +from the overview page, the Tor network is designed to make tracing of +users impossible. The Tor network is run by some 5000 volunteers who +use the free software provided by the Tor Project to run Tor routers. +Client connections are routed through multiple relays, and are +multiplexed together on the connections between relays. The system +does not record logs of client connections or previous hops. + +This is because the Tor network is a censorship resistance, privacy, +and anonymity system used by whistle blowers, journalists, Chinese +dissidents skirting the Great Firewall, abuse victims, stalker +targets, the US military, and law enforcement, just to name a few. +See https://www.torproject.org/about/torusers.html.en for more info. + +Unfortunately, some people misuse the network. However, compared to +the rate of legitimate use (the IP range in question processes nearly +a gigabit of traffic per second), abuse complaints are rare. +https://www.torproject.org/docs/faq-abuse.html.en +``` + +## Abuse Scenarios + +The following scenario-specific paragraphs should be appended to the Common Boilerplate paragraphs above. The common boilerplate should be abridged or be omitted if the abuse complaintant is already familiar with Tor. + +## Comment/Forum Spam + +``` +This does not mean that nothing can be done, however. + +The Tor project provides an automated DNSRBL for you to query to flag +posts coming from Tor nodes as requiring special review. You can also +use this DNSRBL to only allow Tor IPs to read but not +post comments. https://www.torproject.org/projects/tordnsel.html.en + +However, be aware that this may be just one jerk amongst many +legitimate Tor users who use your forums. You might have luck getting +rid of this jerk by temporarily limiting account creation to require +Gmail accounts before posting, or by requiring account creation be +done over non-Tor before posting. + +In general, we believe that problems like this are best solved by +improving your service to defend against the attack from the Internet +at large. Brute force login attempts can be reduced/slowed by +captchas, which is the approach taken by Gmail for this same problem. +In fact, Google provides a free captcha service, complete with code +for easy inclusion in a number of systems to help other sites deal +with this issue: https://code.google.com/apis/recaptcha/intro.html + +``` + +## PHP Relay or Exploited Webmail Account Spam + +``` +In addition, our nodes do not allow SMTP traffic to be sent using our IPs. +Upon investigation, it appears that the source of the spam is due to +an abusive or compromised webmail gateway running at: +<web server here>. Did you contact their abuse department? +``` + +## Google Groups Spam + +``` +It appears that your specific abuse complaint was generated by an +authenticated Google Groups user. Inspecting the headers reveals that +the abuse complaint address for Google Groups is +groups-abuse(a)google.com. Contacting this address will give you better +luck at actually having this abuser's Google Groups account canceled +than will chasing down Tor nodes, proxies, and open wireless access +points. + +Additionally, if your news reader supports killfiles, you may be +interested in using the Tor Bulk Exit list script to download a list of +IPs to include in your killfile for posts that match "NNTP-Posting-Host: +<ip>" https://check.torproject.org/cgi-bin/TorBulkExitList.py +``` +## DoS Attacks and Scraping Robots + +``` +We're sorry your site is experiencing this heavy load from Tor. + +However, it is possible that your rate limiting alarms simply +experienced a false positive due to the amount of traffic that flows +through the router. We provide service to almost a gigabit of traffic +per second, 98% of which is web traffic. + +If the attack is real and ongoing, however, the Tor project provides +an automated DNSRBL for you to query to block login attempts coming +from Tor nodes: https://www.torproject.org/projects/tordnsel.html.en + +It is also possible to download a list of all Tor exit IPs that will +connect to your server port: +https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=YOUR_IP&port=80 + +In general however, we believe that problems like this are best solved +by improving the service to defend against the attack from the Internet +at large. + +Scraping and robot activity can be reduced/slowed by captchas, which is +the approach taken by Gmail for this same problem. In fact, Google +provides a free captcha service, complete with code for easy inclusion +in a number of systems to help other sites deal with this issue: +https://code.google.com/apis/recaptcha/intro.html + +Slow DoS attacks aimed to consume the Apache MaxClients limit +(http://www.guerilla-ciso.com/archives/2049) can be alleviated by +reducing the httpd.conf TimeOut and KeepAliveTimeout config values +to 15-30 and raising the ServerLimit and MaxClients values to +something like 3000. + +If this fails, DoS attempts can also be solved with iptables-based rate +limiting solutions, load balancers such as nginx, and also IPS devices, +but be aware that Internet traffic is not always uniform in quantity by +IP, due to large corporate and even national outproxies, NATs, and +services like Tor. +http://kevin.vanzonneveld.net/techblog/article/block_brute_force_attacks_with_iptables/ +http://cd34.com/blog/webserver/ddos-attack-mitigation/ +http://deflate.medialayer.com/ + +``` + +## Brute Force Web Attacks + +``` +We're sorry your account has been brute forced. We can try to prevent +our node from connecting to this site, but since the Tor network +has 800 or so exits, doing so wouldn't really stop the action long +term. The attacker would probably just chain an open proxy after Tor, +or just use open wireless and/or a proxy without Tor. + +The Tor project does provide an automated DNSRBL for you to query to +flag requests from Tor nodes as requiring special treatment: +https://www.torproject.org/projects/tordnsel.html.en + +In general, we believe that problems like this are best solved by +improving the service to defend against the attack from the Internet +at large rather than specifically tailoring behavior for Tor. Brute +force login attempts can be reduced/slowed by captchas, which is the +approach taken by Gmail for this same problem. In fact, Google +provides a free captcha service, complete with code for easy inclusion +in a number of systems to help other sites deal with this issue: +https://code.google.com/apis/recaptcha/intro.html +``` + +## SSH Bruteforce Attempts + +``` +If you are concerned about SSH scans, you might consider running your +SSHD on a port other than the default of 22. Many worms, scanners, and +botnets scan the entire Internet looking for SSH logins. The fact that +a few logins happened to come from Tor is likely a small blip on your +overall login attempt rate. You might also consider a rate limiting +solution: +https://kvz.io/blog/2007/07/28/block-brute-force-attacks-with-iptables/ + +If it is in fact a serious problem specific to Tor, the Tor project +provides an automated DNSRBL for you to query to block login attempts +coming from Tor nodes: https://www.torproject.org/projects/tordnsel.html.en + +It is also possible to download a list of all Tor exit IPs that will +connect to your SSH port: +https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=YOUR_IP&port=22 + +You can use this list to create iptables rules to block the network. +However, we still recommend using the general approach, as the attack +will likely simply reappear from an open proxy or other IP once Tor +is blocked. +``` + +## Hacked Gmail, Web Forum, or Misc Account Access + +``` +With respect to your account, given that the attacker used Tor +and not a large botnet (or your machine's IP itself), it is likely +that your password was either harvested off of your machine from a +keylogger, or it was captured via a kiosk, or from open wireless. + +Our recommendation is to treat this event as though there was a login +from an open wireless access point in your city. Reset your password, +and if you don't have antivirus already, download the free AVG: +http://free.avg.com/us-en/download, Spybot SD: +http://www.safer-networking.org/nl/home/index.html, and/or AdAware: +http://www.lavasoft.com/?domain=lavasoftusa.com. Use these to scan to +check for keyloggers or spyware that someone with access to your +computer may have installed. + +To help protect yourself while using open wireless, consider using this +Firefox plugin: https://www.eff.org/https-everywhere/ and encourage the +site maintainer to support HTTPS logins. +``` + +## Hacking (PHP Webshells, XSS, SQL Injection) + +``` +This also does not mean that there is nothing that can be done. For +serious incidents, traditional police work techniques of running +stings and investigating to determine means, motive, and opportunity +are still very effective. + +Additionally, the Tor project provides an automated DNSRBL for you to +query to flag visitors coming from Tor nodes as requiring special +treatment: https://www.torproject.org/projects/tordnsel.html.en. The same list is +available through the Tor Bulk Exit List: +https://check.torproject.org/cgi-bin/TorBulkExitList.py + +However, rather than banning legitimate Tor users from using your +service in general, we recommend ensuring that such services are updated +and maintained to free of vulnerabilities that can lead to +situations such as this (PHP webshell/XSS compromise/SQL Injection +compromise). +``` + +## E-Commerce Fraud + +``` +This also does not mean that there is nothing that can be done. For +serious incidents, traditional police work techniques of running +stings and investigating to determine means, motive, and opportunity +are still very effective. + +Additionally, the Tor project provides an automated DNSRBL for you to +query to flag orders coming from Tor nodes as requiring special +review: https://www.torproject.org/projects/tordnsel.html.en + +It also provides a Bulk Exit List service for retrieving the entire list: +https://check.torproject.org/cgi-bin/TorBulkExitList.py + +You can use this list to help you take a closer look at Tor orders, or +to hold them temporarily for additional verification, without losing +legitimate customers. + +In fact, in my experience, the fraud processing teams contracted by +many ISPs simply mark all requests from Tor nodes as fraud using that +very list. So it is even possible this is a legitimate order, but was +flagged as fraud solely based on IP, especially if you contract out +fraud detection to a third party. +``` + +## Threats of Violence (Advice for Real-Time Discussion) + +If a serious abuse complaint not covered by this template set arrives, the best answer is to follow a pattern with the complaining party. This is not legal advice. This was not written or reviewed by a lawyer. It was written by someone with experience in working with various ISPs who had issues with a Tor exit node on their network. It has also been reviewed by someone who works in Abuse at a major ISP. + + * Read the [Tor Overview](https://2019.www.torproject.org/about/overview.html.en). Be prepared to summarize and answer basic questions. Assume the person with which you're going to converse knows nothing about Tor. Assume this same person isn't going to trust anything you say. + * In serious cases, such as harassment email or death threats, it is often helpful to draw an analogy to situations in the physical world where an action is perpetrated by an anonymous individual (such as delivering the notice via postal mail). + * Remind them that traditional policework can still be used to determine who had the means, motive, and opportunity to commit the crime. + * Arrange to talk with or directly email the complaintant. + * During the conversation make sure you explain a few points: + * You are not the perpetrator of the issue. + * You are a responsible server operator and concerned about the complaintant's problem. + * You are not insane. You may be insane, but we don't want the complaintant to guess this is true. + * In many cases, your ISP will be involved as a conduit for the 3rd party complaintant. Your ISP wants to know: + * Your server is not compromised. + * Your server is not a spam relay. + * Your server is not a trojan/zombie. + * You are a competent server administrator and can address the issue. Minimally, you can at least discuss and respond to the issue intelligently. + * The ISP is not at fault and not liable for your actions. This is normally the case, but the poor abuse person dealing with the issues just wants to hear it isn't the ISPs problem. They will move on after they are comfortable. + * Discuss options. Options Phobos has been offered: + * The ISP/Complaintant may very well demand to see logfiles. Fortunately, by default, nothing sensitive disclosed. You may want a new ISP if they demand access to log files ad hoc. + * The ISP/Complaintant suggests you convert to middleman. In this case, you may want to counter with a reduced exit policy, such as the one suggested in [https://blog.torproject.org/running-exit-node item #6 of the above blog post]. + * The ISP/Complaintant demands you disable Tor. You may want a new ISP as a result. + * The ISP/Complaintant states they will firewall off the traffic on the default ports. You may want a new ISP as a result. + * Update the config to disallow traffic to a certain IP range from your exit node. You may want to suggest the complaintant use the [Tor DNS RBL](https://www.torproject.org/projects/tordnsel.html.en ) instead. + * After all has been discussed, offer a follow up conversation within a week. Make sure your agreed upon changes are implemented. Neither the ISP nor Complaintant may want to do this, but the fact that you offered is in your credit. This may help them feel "comfortable" with you. + + +## Other Template Sets + + * [DMCA Response template for Tor node maintainer to ISP](FIXME) as written by the [EFF](http://www.eff.org EFF). + * Moritz Bartl, the operator of some of our fastest Tor exit nodes, has begun compiling a [set of abuse response template emails](https://www.torservers.net/wiki/abuse/templates) as well. +--- +html: two-columns-page.html +--- +key: 1 +--- +section_id: community-resources +--- +subtitle: How to handle abuse complaints

1 0

[community/master] add subtitles to technical considerations page
by hiro＠torproject.org 05 Jul '19

05 Jul '19

commit 6bd93658bd3f6d9872aa647f95d7ce6fc87db464 Author: gus <gus(a)torproject.org> Date: Thu Jul 4 11:29:38 2019 -0400 add subtitles to technical considerations page --- content/relay-operations/technical-considerations/contents.lr | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/relay-operations/technical-considerations/contents.lr b/content/relay-operations/technical-considerations/contents.lr index b9038b9..9951d45 100644 --- a/content/relay-operations/technical-considerations/contents.lr +++ b/content/relay-operations/technical-considerations/contents.lr @@ -91,3 +91,5 @@ section: relay operations section_id: relay-operations --- key: 2 +--- +subtitle: How to choose a good hosting provider, what's AS and Operating System diversity.

1 0

[community/master] Migrate content from trac.tpo to lektor
by hiro＠torproject.org 05 Jul '19

05 Jul '19

commit 0289c3bd83a8f7b78934f59381d4c70babcef513 Author: gus <gus(a)torproject.org> Date: Thu Jul 4 18:27:25 2019 -0400 Migrate content from trac.tpo to lektor --- .../community-resources/contents.lr | 54 ++++++++++++++++++++-- 1 file changed, 51 insertions(+), 3 deletions(-) diff --git a/content/relay-operations/community-resources/contents.lr b/content/relay-operations/community-resources/contents.lr index 6727391..145ee9e 100644 --- a/content/relay-operations/community-resources/contents.lr +++ b/content/relay-operations/community-resources/contents.lr @@ -6,14 +6,62 @@ color: primary --- _template: layout.html --- -title: Tor relay community resources +title: Community and legal resources --- subtitle: How to get involved with the Tor relay operator community, advice on responding to abuse complaints, and how to start an organization dedicated to relay operation. --- -key: 4 +key: 5 --- html: two-columns-page.html --- body: -text +Exit relay operators should understand the potential risks associated with running an exit relay. For the majority of operators in most countries, bridges and guard/middle relays are very low risk. Exits are the ones that present some legal concerns, but operators under most circumstances will be able to handle legal matters by having an abuse response letter, running the exit from a location that isn't their home, and reading through some of the legal resources that Tor-supportive lawyers have put together. + +# Legal resources + +The [EFF Tor Legal FAQ](https://www.torproject.org/eff/tor-legal-faq.html.en) answers many common questions about relay operation and the law. We also like Noisebridge's wiki for additional legal resources: https://www.noisebridge.net/wiki/Noisebridge_Tor/FBI. In general it's a good idea to consult with a lawyer before deciding to operate an exit relay, especially if you live in a place where exit relay operators have been harassed, or if you're the only exit relay operator in your region. Get in touch with your local digital rights organization to see if they have recommendations about legal assistance, and if you're not sure what organizations are working in your region, write to EFF and see if they can help connect you: https://www.eff.org/about/contact. + +Also see the [TorExitGuidelines Tor Exit Guidelines](FIXME). + +# Responding to abuse complaints + +Operators can put together their own abuse complaint template responses from one of many templates that Tor has created: [TorAbuseTemplates](tor-abuse-templates). + +It is important to respond to abuse complaints in a timely manner (usually within 24 hours). If the hoster gets annoyed by the amount of abuse you can reduce the amount of ports allowed in your exit policy. Please document your experience with new hosters on the following wiki page: [GoodBadISPs](FIXME) + +Other docs we like: + +* a letter Boing Boing used to respond to a US federal subpoena about their exit relay: https://boingboing.net/2015/08/04/what-happened-when-the-fbi-sub.html +* abuse response templates from Coldhak, an organization in Canada that runs multiple relays: https://github.com/coldhakca/abuse-templates/blob/master/dmca.template, https://github.com/coldhakca/abuse-templates/blob/master/generic.template + +# Running a relay with other people + +Running relays is more fun with other people! You can work with your university department, your employer or institution, or an organization like Torservers.net to run a relay. + +## Torservers.net + +Torservers is an independent, global network of organizations that help the Tor network by running high bandwidth Tor relays. Becoming a Torservers partner is a good way to become more involved in the Tor relay community, and can help you connect with dedicated relay operators around the world for solidarity and support. To start a Torservers partner, the most important thing is to have a group of people (3-5 suggested to start) interested in helping with the various activities required for running relays. There should be mutual trust between the people in the group, and members should commit to running relays for the long term. If you do not know anyone in your social network interested in running relays, one place to meet people is your local hackerspace: https://wiki.hackerspaces.org/Hackerspaces. + +Once you have a trusted group of people, depending on your region, it is often advised to create some type of non-profit corporation. This is useful for having a bank account, shared ownership, grant applications, etc. In many countries operating as a corporation instead of as an individual can also get you certain legal protections. + +The next steps are figuring out hardware, transit, and server hosting. Depending on your location and connections within the technical community of the area, the last one may be the hardest step. Small local ISPs often have extra bandwidth, and may be interested in supporting your group with some bandwidth or rackspace. It is extremely important to maintain good relationships with these ISPs. + +## At your university + +Many computer science departments, university libraries, and individual students and faculty run relays from university networks. These universities include the Massachusetts Institute of Technology (MIT CSAIL), Boston University, the University of Waterloo, the University of Washington, Northeastern University, Karlstad University, Universitaet Stuttgart, and Friedrich-Alexander University Erlangen-Nuremberg. To learn more about how to get support for a relay on your university's network, check out EFF's resources: https://www.eff.org/torchallenge/tor-on-campus.html. + +## At your company or organization + +If you work at a Tor-friendly company or organization, that's another ideal place to run a relay. Some companies running relays include Brass Horn Communications, Quintex Alliance Consulting, and OmuraVPN. Some organizations running Tor relays include Digital Courage, Access Now, Derechos Digitales, and Lebanon Libraries in New Hampshire. + +# More resources + +Congratulations, you're officially a Tor relay operator! What now? + +* You can check out traffic and other statistics for your relay at our [Relay Search](https://metrics.torproject.org/rs.html) (your relay will appear on "Relay Search" about 3 hours after you started it). + +* There is also more info about running a relay at the [Tor FAQ](https://www.torproject.org/docs/faq.html.en#HowDoIDecide). + +* And, most importantly, make sure to email tshirt(a)torproject.org and [claim your swag](https://www.torproject.org/getinvolved/tshirt.html). It's our way of saying thanks for defending privacy and free speech online. +

1 0

[community/staging] Merge remote-tracking branch 'dip/patch-1' into staging
by hiro＠torproject.org 05 Jul '19

05 Jul '19

commit 02d7ea64da47058deb4329853814ac673bc76fd4 Merge: 9f08fa9 8b14f23 Author: hiro <hiro(a)torproject.org> Date: Fri Jul 5 15:22:41 2019 +0200 Merge remote-tracking branch 'dip/patch-1' into staging content/outreach/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

1 0

[community/staging] Update contents.lr
by hiro＠torproject.org 05 Jul '19

05 Jul '19

commit 8b14f239c5b3c621664a8521068e65151b571088 Author: Stephanie A. Whited <steph(a)torproject.org> Date: Tue Jul 2 19:28:21 2019 +0000 Update contents.lr --- content/outreach/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/outreach/contents.lr b/content/outreach/contents.lr index f18da38..14fdad9 100644 --- a/content/outreach/contents.lr +++ b/content/outreach/contents.lr @@ -20,4 +20,4 @@ body: ##Tell the world about Tor -We love it when people bring information about Tor to their community events, conferences, and meetups, and so we've curated some beautiful materials for in-person and social media outreach. +We love it when people bring information about Tor to their community events, conferences, and meetups. We've curated some beautiful materials for sharing in-person and on social media we welcome you to use. \ No newline at end of file

1 0

[community/staging] Imported bridges obfs4 deployment guide for debian, centos, freebsd, openbsd
by hiro＠torproject.org 05 Jul '19

05 Jul '19

1 0

[community/staging] add Fedora relay instructions
by hiro＠torproject.org 05 Jul '19

05 Jul '19

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits July 2019