July 2019 - tor-commits - lists.torproject.org

[community/staging] Small fix
by hiro＠torproject.org 05 Jul '19

05 Jul '19

commit 9f08fa924ae4aef8ad55b37743926758ded4420c Author: gus <gus(a)torproject.org> Date: Thu Jul 4 23:30:35 2019 -0400 Small fix --- content/relay-operations/relays-requirements/contents.lr | 6 ++---- content/relay-operations/types-of-relays/contents.lr | 5 +++-- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/content/relay-operations/relays-requirements/contents.lr b/content/relay-operations/relays-requirements/contents.lr index 7ee3b6b..4def53f 100644 --- a/content/relay-operations/relays-requirements/contents.lr +++ b/content/relay-operations/relays-requirements/contents.lr @@ -27,7 +27,7 @@ Fast exit relays (>=100 Mbit/s) usually have to handle a lot more concurrent con It is recommended that a relay have at least 16 Mbit/s (Mbps) upload bandwidth and 16 Mbit/s (Mbps) download bandwidth available for Tor. More is better. The minimum requirements for a relay are 10 Mbit/s (Mbps). -If you have less than 10 Mbit/s but at least 1 Mbit/s we recommend you run a [bridge with obfs4 support](https://trac.torproject.org/projects/tor/wiki/doc/PluggableTranspo…. +If you have less than 10 Mbit/s but at least 1 Mbit/s we recommend you run a [bridge with obfs4 support](relay/bridge). If you do not know your bandwidth you can use http://beta.speedtest.net to measure it. # Monthly Outbound Traffic @@ -76,6 +76,4 @@ Reboots and tor daemon restarts are fine. # Tor Version -For security reasons, Tor relays should not downgrade their tor version from a supported to an unsupported version of tor. -Some unsupported versions are insecure. -Relays that attempt to downgrade to an insecure version will be rejected from the network automatically. +For security reasons, Tor relays should not downgrade their tor version from a supported to an unsupported version of tor. Some unsupported versions are insecure. Relays that attempt to downgrade to an insecure version will be rejected from the network automatically. diff --git a/content/relay-operations/types-of-relays/contents.lr b/content/relay-operations/types-of-relays/contents.lr index bdb75dc..509db57 100644 --- a/content/relay-operations/types-of-relays/contents.lr +++ b/content/relay-operations/types-of-relays/contents.lr @@ -50,7 +50,7 @@ Because of the legal exposure that comes with running an exit relay, you should Ideal exit relay operators are affiliated with some institution, like a university, a library, a hackerspace or a privacy related organization. An institution can not only provide greater bandwidth for the exit, but is better positioned to handle abuse complaints or the rare law enforcement inquiry. -If you are considering running an exit relay, please read the [section on legal considerations](FIXME) for exit relay operators. +If you are considering running an exit relay, please read the [section on legal considerations](community-resources) for exit relay operators. # Bridge @@ -60,8 +60,9 @@ Tor bridges are nodes in the network that are not listed in the public Tor direc Bridges are useful for Tor users under oppressive regimes or for people who want an extra layer of security because they're worried somebody will recognize that they are contacting a public Tor relay IP address. Several countries, including China and Iran, have found ways to detect and block connections to Tor bridges. -Pluggable transports(https://www.torproject.org/docs/pluggable-transports.html.en), a special kind of bridge, address this by adding an additional layer of obfuscation. +[Pluggable transports](https://2019.www.torproject.org/docs/pluggable-transports.html.…, a special kind of bridge, address this by adding an additional layer of obfuscation. Bridges are relatively easy, low-risk and low bandwidth Tor nodes to operate, but they have a big impact on users. A bridge isn't likely to receive any abuse complaints, and since bridges are not listed in the public consensus, they are unlikely to be blocked by popular services. + Bridges are a great option if you can only run a Tor node from your home network, have only one static IP, and don't have a huge amount of bandwidth to donate -- we recommend giving your bridge at least 1 Mbit/sec.

1 0

[community/staging] Add community resources - tor abuse templates, exit guidelines, tor universities, goodbadisps
by hiro＠torproject.org 05 Jul '19

05 Jul '19

commit a02f1e169a60a77aa21a9b9b72201b2792fd004a Author: gus <gus(a)torproject.org> Date: Thu Jul 4 23:29:59 2019 -0400 Add community resources - tor abuse templates, exit guidelines, tor universities, goodbadisps --- .../community-resources/contents.lr | 22 ++-- .../community-resources/good-bad-isps/contents.lr | 45 ++++++++ .../tor-abuse-templates/contents.lr | 8 +- .../tor-exit-guidelines/contents.lr | 117 +++++++++++++++++++++ .../tor-relay-universities/contents.lr | 49 +++++++++ 5 files changed, 226 insertions(+), 15 deletions(-) diff --git a/content/relay-operations/community-resources/contents.lr b/content/relay-operations/community-resources/contents.lr index 145ee9e..935d20d 100644 --- a/content/relay-operations/community-resources/contents.lr +++ b/content/relay-operations/community-resources/contents.lr @@ -1,6 +1,6 @@ -section: relay operations +section: community resources --- -section_id: relay-operations +section_id: community-resources --- color: primary --- @@ -20,28 +20,28 @@ Exit relay operators should understand the potential risks associated with runni # Legal resources -The [EFF Tor Legal FAQ](https://www.torproject.org/eff/tor-legal-faq.html.en) answers many common questions about relay operation and the law. We also like Noisebridge's wiki for additional legal resources: https://www.noisebridge.net/wiki/Noisebridge_Tor/FBI. In general it's a good idea to consult with a lawyer before deciding to operate an exit relay, especially if you live in a place where exit relay operators have been harassed, or if you're the only exit relay operator in your region. Get in touch with your local digital rights organization to see if they have recommendations about legal assistance, and if you're not sure what organizations are working in your region, write to EFF and see if they can help connect you: https://www.eff.org/about/contact. +The [EFF Tor Legal FAQ](https://www.torproject.org/eff/tor-legal-faq.html.en) answers many common questions about relay operation and the law. We also like [Noisebridge's wiki](https://www.noisebridge.net/wiki/Noisebridge_Tor/FBI) for additional legal resources. In general it's a good idea to consult with a lawyer before deciding to operate an exit relay, especially if you live in a place where exit relay operators have been harassed, or if you're the only exit relay operator in your region. Get in touch with your local digital rights organization to see if they have recommendations about legal assistance, and if you're not sure what organizations are working in your region, [write to EFF](https://www.eff.org/about/contact) and see if they can help connect you. -Also see the [TorExitGuidelines Tor Exit Guidelines](FIXME). +Also see the [Tor Exit Guidelines](tor-exit-guidelines). # Responding to abuse complaints -Operators can put together their own abuse complaint template responses from one of many templates that Tor has created: [TorAbuseTemplates](tor-abuse-templates). +Operators can put together their own abuse complaint template responses from one of many templates that Tor has created: [Tor Abuse Templates](tor-abuse-templates). -It is important to respond to abuse complaints in a timely manner (usually within 24 hours). If the hoster gets annoyed by the amount of abuse you can reduce the amount of ports allowed in your exit policy. Please document your experience with new hosters on the following wiki page: [GoodBadISPs](FIXME) +It is important to respond to abuse complaints in a timely manner (usually within 24 hours). If the hoster gets annoyed by the amount of abuse you can reduce the amount of ports allowed in your exit policy. Please document your experience with new hosters on the following wiki page: [GoodBadISPs](/good-bad-isps) Other docs we like: -* a letter Boing Boing used to respond to a US federal subpoena about their exit relay: https://boingboing.net/2015/08/04/what-happened-when-the-fbi-sub.html -* abuse response templates from Coldhak, an organization in Canada that runs multiple relays: https://github.com/coldhakca/abuse-templates/blob/master/dmca.template, https://github.com/coldhakca/abuse-templates/blob/master/generic.template +* a letter Boing Boing used to respond to a US federal subpoena about their exit relay: [What happened when we got subpoenaed over our Tor exit node](https://boingboing.net/2015/08/04/what-happened-when-the-fbi-sub.html) +* abuse response templates from Coldhak, an organization in Canada that runs multiple relays: [DMCA Template](https://github.com/coldhakca/abuse-templates/blob/master/dmca.tem…, [Genetic Abuse Template](https://github.com/coldhakca/abuse-templates/blob/master/generic.…. # Running a relay with other people -Running relays is more fun with other people! You can work with your university department, your employer or institution, or an organization like Torservers.net to run a relay. +Running relays is more fun with other people! You can work with your university department, your employer or institution, or an organization like [Torservers.net](https://torservers.net) to run a relay. ## Torservers.net -Torservers is an independent, global network of organizations that help the Tor network by running high bandwidth Tor relays. Becoming a Torservers partner is a good way to become more involved in the Tor relay community, and can help you connect with dedicated relay operators around the world for solidarity and support. To start a Torservers partner, the most important thing is to have a group of people (3-5 suggested to start) interested in helping with the various activities required for running relays. There should be mutual trust between the people in the group, and members should commit to running relays for the long term. If you do not know anyone in your social network interested in running relays, one place to meet people is your local hackerspace: https://wiki.hackerspaces.org/Hackerspaces. +Torservers is an independent, global network of organizations that help the Tor network by running high bandwidth Tor relays. Becoming a Torservers partner is a good way to become more involved in the Tor relay community, and can help you connect with dedicated relay operators around the world for solidarity and support. To start a Torservers partner, the most important thing is to have a group of people (3-5 suggested to start) interested in helping with the various activities required for running relays. There should be mutual trust between the people in the group, and members should commit to running relays for the long term. If you do not know anyone in your social network interested in running relays, one place to meet people is [your local hackerspace](https://wiki.hackerspaces.org/Hackerspaces). Once you have a trusted group of people, depending on your region, it is often advised to create some type of non-profit corporation. This is useful for having a bank account, shared ownership, grant applications, etc. In many countries operating as a corporation instead of as an individual can also get you certain legal protections. @@ -49,7 +49,7 @@ The next steps are figuring out hardware, transit, and server hosting. Depending ## At your university -Many computer science departments, university libraries, and individual students and faculty run relays from university networks. These universities include the Massachusetts Institute of Technology (MIT CSAIL), Boston University, the University of Waterloo, the University of Washington, Northeastern University, Karlstad University, Universitaet Stuttgart, and Friedrich-Alexander University Erlangen-Nuremberg. To learn more about how to get support for a relay on your university's network, check out EFF's resources: https://www.eff.org/torchallenge/tor-on-campus.html. +Many computer science departments, university libraries, and individual students and faculty run relays from university networks. These universities include the Massachusetts Institute of Technology (MIT CSAIL), Boston University, the University of Waterloo, the University of Washington, Northeastern University, Karlstad University, Universitaet Stuttgart, and Friedrich-Alexander University Erlangen-Nuremberg. To learn more about how to get support for a relay on your university's network, check out EFF's resources: [Tor no campus](https://www.eff.org/torchallenge/tor-on-campus.html). ## At your company or organization diff --git a/content/relay-operations/community-resources/good-bad-isps/contents.lr b/content/relay-operations/community-resources/good-bad-isps/contents.lr new file mode 100644 index 0000000..5f614e0 --- /dev/null +++ b/content/relay-operations/community-resources/good-bad-isps/contents.lr @@ -0,0 +1,45 @@ +_model: page +--- +title: Good Bad ISPs +--- +body: + +This page aims to list community experiences with Tor and various Internet Service Providers (ISPs) around the world. Some ISPs are Tor-friendly, some are not. Some are competent and clueful about Tor or about security in general. Let us know! + +Be sure to provide useful information like how much bandwidth you pushed, whether you thought the deal was cheap or expensive, how hard you had to work to make them understand what's going on, how long your server has been running, and whether you'd recommend them to others. Also include dates. + +Since non-exits do not attract complaints, it should be fine to run them without contacting the hoster first. Make sure you understand their policies regarding bandwidth, especially on "unlimited" (fair use) contracts. For exit relays, you should read the fine Tor Exit Guidelines first. + +For network diversity and stronger anonymity, you should avoid providers and countries that already attract a lot of Tor capacity. [metrics](https://metrics.torproject.org/) is a great tool that allows you to group probabilities by country and AS (autonomous systems), so you can more easily identify networks you want to avoid. + +**Note**: This page is currently being revamped. If you would like to help out please see [#31063](https://trac.torproject.org/projects/tor/ticket/31063). + +## Proposed ISPs + +The table below contains some community-suggested ISPs which have yet to be contacted and/or evaluated on their policies towards Tor hosting of any kind. If you have seen a host and would like to suggest it to us, but do not have the time or confidence to reach out, please do leave their website information below. + + +| **Company/ISP** | **Website** | **Language** | **Tasked?** | **Comments** | +|-------------------------|------------------|--------------------|------------------|---------------------| +| [Evolution Host VPS](https://evolution-host.com/vps-hosting.php) | [Evolution Host](https://evolution-host.com/) | English | https://evolution-host.com/tos.php | "No problem at all! We certainly aren't against the use of Tor on our services. You may host any type of Tor node." | +| QuickPacket | quickpacket.com | English | ToS prohibit "any activity" related to Tor as of 2015-03-31. See prohibited use 22 http://quickpacket.com/tos.html | +| Delimiter | delimiter.com | English | https://www.delimiter.com/terms-conditions/ | +| Reliable Hosting | reliablehosting.com | English | 2015-12-31 "Sorry, we don't allow Tor exit node on our servers" | +| Dacentec | dacentec.com | English | 2015-12-29 Dacentec Support: "Tor Nodes are prohibited by our terms of service and acceptable use policy. 2 sites were given https://billing.dacentec.com/hostbill/aup.php and https://billing.dacentec.com/hostbill/terms.php | +| Joe's Datacenter | joesdatacenter.com | English | | "For abuse complaints, if we receive them while your account is still fairly new, we automatically terminate services." | +| Wholesale Internet | wholesaleinternet.com | English | 2015-12-29 Wholesale Internet sales:"We do not block traffic, but you must respond to all abuse reports within 24 hours." | Core2Duo Dedi 100Mbit connection serves only ~ 35 Mbit (1/5/16)| +| Datashack.net \\ ASN: AS33387 | datashack.net | English | 2015-11-21 DataShack Sales: "We do not appose TOR, but require to respond to all abuse reports within 24 hours." | +| !CrownCloud | crowncloud.net | English | ~~ToS dis-allow bridge, relay, or exit as of 2015-03-31.~~ As of 2015-07-22, only exits are disallowed. Entry, bridge and middle are fine. See item 17 at http://wiki.crowncloud.net/doku.php/vps_tos | +| Deepnet Solutions | deepnetsolutions.com | English | They specifically allow Tor relays (not exits) on their dedicated IPV4 VPSs NOT on any NAT or OHM packages. \\ Some of their locations have a lot of consensus weight (AS12876 and AS16276), maybe not so good for diversity. | +| Andrews & Arnold | aa.net.uk | English | UK. IPv6. Note: Very very pro-privacy, has made public their net freedom and anti-surveillance stance. Zero censorship. | + +--- +html: two-columns-page.html +--- +key: 3 +--- +section: Community Resources +--- +section_id: community-resources +--- +subtitle: Some ISPs are Tor-friendly, some are not diff --git a/content/relay-operations/community-resources/tor-abuse-templates/contents.lr b/content/relay-operations/community-resources/tor-abuse-templates/contents.lr index 475651b..b24cf79 100644 --- a/content/relay-operations/community-resources/tor-abuse-templates/contents.lr +++ b/content/relay-operations/community-resources/tor-abuse-templates/contents.lr @@ -6,7 +6,7 @@ body: # Before You Start -The best way to handle abuse complaints is to set up your exit node so that they are less likely to be sent in the first place. Please see [Tips for Running an Exit Node with Minimal Harassment](https://blog.torproject.org/running-exit-node ) and [Tor Exit Guidelines](https://trac.torproject.org/projects/tor/wiki/doc/TorExitGuidel… for more info, before reading this document. +The best way to handle abuse complaints is to set up your exit node so that they are less likely to be sent in the first place. Please see [Tips for Running an Exit Node with Minimal Harassment](https://blog.torproject.org/running-exit-node) and [Tor Exit Guidelines](/tor-exit-guidelines) for more info, before reading this document. Below are a collection of letters you can use to respond to your ISP about their complaint in regards to your Tor exit server. @@ -281,16 +281,16 @@ If a serious abuse complaint not covered by this template set arrives, the best * The ISP is not at fault and not liable for your actions. This is normally the case, but the poor abuse person dealing with the issues just wants to hear it isn't the ISPs problem. They will move on after they are comfortable. * Discuss options. Options Phobos has been offered: * The ISP/Complaintant may very well demand to see logfiles. Fortunately, by default, nothing sensitive disclosed. You may want a new ISP if they demand access to log files ad hoc. - * The ISP/Complaintant suggests you convert to middleman. In this case, you may want to counter with a reduced exit policy, such as the one suggested in [https://blog.torproject.org/running-exit-node item #6 of the above blog post]. + * The ISP/Complaintant suggests you convert to middleman. In this case, you may want to counter with a reduced exit policy, such as the one suggested in [item #6 of the above blog post](https://blog.torproject.org/running-exit-node). * The ISP/Complaintant demands you disable Tor. You may want a new ISP as a result. * The ISP/Complaintant states they will firewall off the traffic on the default ports. You may want a new ISP as a result. - * Update the config to disallow traffic to a certain IP range from your exit node. You may want to suggest the complaintant use the [Tor DNS RBL](https://www.torproject.org/projects/tordnsel.html.en ) instead. + * Update the config to disallow traffic to a certain IP range from your exit node. You may want to suggest the complaintant use the [Tor DNS RBL](https://2019.www.torproject.org/projects/tordnsel.html.en) instead. * After all has been discussed, offer a follow up conversation within a week. Make sure your agreed upon changes are implemented. Neither the ISP nor Complaintant may want to do this, but the fact that you offered is in your credit. This may help them feel "comfortable" with you. ## Other Template Sets - * [DMCA Response template for Tor node maintainer to ISP](FIXME) as written by the [EFF](http://www.eff.org EFF). + * [DMCA Response template for Tor node maintainer to ISP](FIXME) as written by the [EFF](http://www.eff.org). * Moritz Bartl, the operator of some of our fastest Tor exit nodes, has begun compiling a [set of abuse response template emails](https://www.torservers.net/wiki/abuse/templates) as well. --- html: two-columns-page.html diff --git a/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr b/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr new file mode 100644 index 0000000..37e98d1 --- /dev/null +++ b/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr @@ -0,0 +1,117 @@ +_model: page +--- +title: Tor Exit Guidelines +--- +body: + +These guidelines are meant to give you a quick introduction into the business of running your own exit relay. + +NOTE: This FAQ is for informational purposes only and does not constitute legal advice. Our aim is to provide a general description of the legal issues surrounding Tor exit relaying. Different factual situations and different legal jurisdictions will result in different answers to a number of questions. Therefore, please do not act on this information alone; if you have any specific legal problems, issues, or questions, seek a complete review of your situation with a lawyer licensed to practice in your jurisdiction. + +## Hosting + +### Tor at Universities: Find allies. + +Find some professors (or deans!) who like the idea of supporting and/or researching anonymity on the Internet. If possible, use an extra IP range whose abuse contact doesn't go through the main university abuse team. Ideally, use addresses that are not trusted by the IP-based authentication many library-related services use -- if the university's entire IP address space is "trusted" to access these library resources, the university is forced to maintain an iron grip on all its addresses. Also read [How do I make my University / ISP / etc happy with my exit node?](FIXME) + +### Find Tor-friendly ISPs. + +A good ISP is one that offers cheap bandwidth and is not being used by other members of the Tor community. Before you continue, you may ask the Tor community if your choice is a good one. We very much need diversity, and it does not help if we pool too many exits at one friendly ISP. + +In any case, add the ISP to the [GoodBadISPs](FIXME) wiki page. + +To find an ISP, go through forums and sites where ISPs posts their latest deals, and contact them about Tor hosting. Once you identified your ISP, you can follow the two-step advice of TorServers.net. + +1. Ask if the ISP is okay with a Tor exit + +2. If they come back positively, ask them if they are OK with an IP range reassignment. If not, you can still explain that you are a non-profit superb large organization filled with security professionals, and that all will be good, and why IP reassignment helps reduce their workload. + +The two-step process usually helps in elevating your request to higher levels of support staff without scaring them off too early, even if you don't end up with your own IP range. Here is template you can use: [Inquiry](https://www.torservers.net/wiki/hoster/inquiry) + + +## Legal + +* Make sure you know the relevant legal paragraphs for common-carrier like communication services in your country (and the country of your hosting provider!). + +At least most western countries should have regulations that exclude communication service providers from liability. Please add your country's regulations to this list. + +* USA: [DMCA 512](https://www.law.cornell.edu/uscode/text/17/512); see [EFF's Legal FAQ for Tor Operators](https://2019.www.torproject.org/eff/tor-legal-faq) (a very good and relevant read for other countries as well) + * Germany: [TMG 8](http://www.gesetze-im-internet.de/tmg/__8.html) and [15](http://www.gesetze-im-internet.de/tmg/__15.html). + * Netherlands: [Artikel 6:196c BW](http://wetten.overheid.nl/BWBR0005289/Boek6/Titel3/Afdeling4A/Artikel196c/) + * Austria: [ECG 13](http://www.ris.bka.gv.at/Dokument.wxe?Abfrage=Bundesnormen&Dokumentnummer=NOR40025809) +* France: FIXME + * Sweden: [16-19 2002:562](https://lagen.nu/2002:562#P16S1) + +If you country is missing here and you know a lawyer who can provide a legal opinion, please get in contact with Tor Project. + +* If you're part of an organization that will be running the exit relay (ISP, university etc), consider teaching your legal people about Tor. + +It's way better for them to hear about Tor from you, in a relaxed environment, than to hear about it from a stranger over the phone. Make them aware of [EFF's Legal FAQ for Tor Operators](https://2019.www.torproject.org/eff/tor-legal-faq). EFF has also offered to talk to other lawyers to explain the legal aspects of Tor; contact us at support(a)torservers.net and we'll make the connections for you. + +* If you're not part of an organization, think about starting one! + +Depending on the chosen form, setting up a legal body might help with liability, and in general it helps to appear bigger than you are (and less likely to get raided). The guys from Torservers.net in Germany found a lawyer who would agree to "host" them inside his office. They are now are a non-profit association ("eingetragener Verein, gemeinnutzig") registered inside a lawyer's office. The setup process was easy and cheap. Similar setups probably exist for your country. Another benefit of an association-like structure is that it might still work even when you leave, if you manage to find successors. + +* Consider preemptively teaching your local law enforcement about Tor. + +"Cybercrime" people actually love it when you offer to [teach them about Tor and the Internet](https://blog.torproject.org/blog/talking-german-police-stuttgart) -- they're typically overwhelmed by their jobs and don't have enough background to know where to start. Contacting them gives you a chance to teach them why Tor is useful to the world (and why it's [not particularly helpful to criminals](https://2019.www.torproject.org/docs/faq-abuse#WhatAboutCriminal…. Also, if they do get a report about your relay, they'll think of you as a helpful expert rather than a potential criminal. + +## Handling abuse complaints + +### Answering complaints + +If you receive an abuse complaint, don't freak out! Here is some advice for you: + +* Answer to abuse complaints in a professional manner within a reasonable time span. + +TorServers.net is a fairly large Tor exit operator and we receive only a very small number of complaints, especially compared to the amount of traffic we push. Roughly 80% are automated reports, and the rest is usually satisfied with [our default reply](https://www.torservers.net/wiki/abuse/templates). We have not needed the input of a lawyer in many years of operation following the advice on this page. + +In addition to the [templates at Torservers.net](https://www.torservers.net/wiki/abuse/templates), you can find many more templates for various scenarios on the [Tor Abuse Templates](FIXME) . It is exceptionally rare to encounter a scenario where none of these templates apply. + +* If you receive a threatening letter from a lawyer about abusive use or a DMCA complaint, also don't freak out. + +We are not aware of any case that made it near a court, and we will do everything in our power to support you if it does. You can look up if an IP address was listed as an exit relay at a given time at [ExoneraTor](https://exonerator.torproject.org/). Point to that page in your reply to the complaint. If you feel it might be helpful, we can write you a signed letter confirming this information: Contact us at tor-assistants(a)torproject.org if you need one. + +In your reply, state clearly that you are not liable for forwarded content passing through your machine, and include the relevant legal references for your country. + +## Things you can do preemptively + +* Make the WHOIS info point as close to you as possible. + +One of the biggest reasons exit relays disappear is because the people answering the abuse address get nervous and ask you to stop. If you can get your own IP block, great. Even if not, many providers will still reassign subblocks to you if you ask. ARIN uses [SWIP](https://www.arin.net/resources/request/reassignments.html), and RIPE uses something similar. You can also add comments to your range, hinting at your usage as anonymization service ([Example](https://apps.db.ripe.net/search/query.html?searchtext=ZWIEBELFREUN…) If you have questions about the process, please write an email to support(a)torservers.net and we will try to explain the process to you. + +* Register a phone number and a fax number as abuse contact. + +At least law enforcement in Germany regularly uses the fax and phone numbers present in IP records. Torservers.net uses a free German fax-to-email service, call-manager.de, and a VoIP number from Sipgate.de. + +* Consider using the Reduced Exit Policy. + +The [Reduced Exit Policy](FIXME) is an alternative to the default exit policy. It allows many Internet services while still blocking the majority of TCP ports. This drastically reduces the odds that a Bittorrent user will select your node and thus reduces or even eliminates the number of [DMCA complaints](https://2019.www.torproject.org/eff/tor-dmca-response) you will receive. + +If you have your own experience of abuse handling, just share it on our public mailing list or write us an email to tor-assistants(a)torproject.org. + +## Technical + +Please read all the technical details before getting started. If you have any questions or need help, please contact us at [tor-relays](https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relay…. + +* [TorRelayGuide](https://community.torproject.org/relay) + +* Set up an informative website on the exit IP(s) on port 80. + +A disclaimer helps giving people the right idea about what is behind traffic coming from these IPs. A simple notice can be published without a separate webserver using Tor's "DirPortFrontPage " directive. + +* Try to use dedicated IPs, and when possible dedicated hardware. + +* Disk encryption might be useful to protect your node keys, but on the other hand unencrypted machines are easier to "audit" if required. We feel it's best to be able to easily show that you do Tor exiting, and nothing else (on that IP or server). + +* Set reverse DNS to something that signals its use, e.g. 'anonymous-relay', 'proxy', 'tor-proxy'. so when other people see the address in their web logs, they will more quickly understand what's going on. If you do, and if SMTP is allowed in your exit policy, consider configuring [SPF](https://en.wikipedia.org/wiki/Sender_Policy_Framework) on your domain: this will protect you from users using your exit node to forge e-mails which look like they come from you. +--- +html: two-columns-page.html +--- +key: 5 +--- +section: Community Resources +--- +section_id: community-resources +--- +subtitle: Quick introduction into running your Exit relay diff --git a/content/relay-operations/community-resources/tor-relay-universities/contents.lr b/content/relay-operations/community-resources/tor-relay-universities/contents.lr new file mode 100644 index 0000000..0fb65a2 --- /dev/null +++ b/content/relay-operations/community-resources/tor-relay-universities/contents.lr @@ -0,0 +1,49 @@ +_model: page +--- +title: Tor Relay Universities +--- +body: + +To keep your exit node running long-term, you're going to need the support of the people around you. In this sense, Tor provides a lever to help you change your organization's policies. If the administration considers an Internet community that helps other people to be a foreign concept, or if they're used to treating new situations as security risks and telling everybody to quit it, a Tor relay may give you a way to focus the discussion and find allies who want to help change policy. In short, running a Tor exit node may well require you to become an advocate for anonymity and privacy in the world. + +The best strategy depends on your situation, but here are some tips to get you started. (We focus on the university scenario, but hopefully you can adapt it to your own situation.) + + * First, learn about your university's AUP -- acceptable use policy. Most likely it is ambiguously worded, to let them allow or deny things based on the situation. But it might be extremely restrictive ("no services of any kind"), in which case you're going to have a tough road ahead of you. + + * Second, learn about your local laws with respect to liability of traffic that exits from your Tor relay. In the US, these appear to be mainly the [DMCA](https://2019.www.torproject.org/eff/tor-legal-faq.html#DMCA) and [CDA](https://2019.www.torproject.org/eff/tor-legal-faq.html#Lawsuits), and the good news is that many lawyers believe that Tor exit node operators are in the same boat as the ISPs themselves. Become familiar with +[the EFF's template letter regarding DMCA notices for Tor](https://2019.www.torproject.org/eff/tor-dmca-response.html), which is quite clear about not putting liability on service providers. The CDA is less clear, because it was written before the modern Internet emerged, but EFF and ACLU are optimistic. Of course, you need to understand that without actual clear precedent (and even then), it's still possible that a given judge will not interpret things the way the lawyers expect. In any case, the key here is to become familiar with the laws and their implications and uncertainties. + + * Third, learn about Tor's design. Read the [design overview](https://2019.www.torproject.org/overview.html), the [design paper](https://www.torproject.org/svn/trunk/doc/design-paper/tor-design.htm…, and the FAQ. Hang out on IRC (irc.oftc.net - #tor-relays) for a while and learn more. If possible, attend a talk by one of the Tor developers. Learn about the types of people and organizations who need secure communications on the Internet. Practice explaining Tor and its benefits and consequences to friends and neighbors -- the [abuse FAQ](https://2019.www.torproject.org/faq-abuse) may provide some helpful starting points. + + * Fourth, learn a bit about authentication on the Internet. Many library-related services use source IP address to decide whether a subscriber is allowed to see their content. If the university's entire IP address space is "trusted" to access these library resources, the university is forced to maintain an iron grip on all its addresses. Universities like Harvard do the smart thing: their students and faculty have actual methods to authenticate -- say, certificates, or usernames and passwords -- to a central Harvard server and access the library resources from there. So Harvard doesn't need to be as worried about what other services are running on their network, and it also takes care of off-campus students and faculty. On the other hand, universities like Berkeley simply add a "no proxies" line to their network policies, and are stuck in a battle to patrol every address on their network. We should encourage all these networks to move to an end-to-end authentication model rather th an conflating network location with who's on the other end. + + * Fifth, start finding allies. Find some professors (or deans!) who like the idea of supporting and/or researching anonymity on the Internet. If your school has a botnet research group or studies Internet attacks (like at Georgia Tech and UCSD), meet them and learn more about all the scary things already out there on the Internet. If you have a law school nearby, meet the professors that teach the Internet law classes, and chat with them about Tor and its implications. Ask for advice from everybody you meet who likes the idea, and try to work your way up the chain to get as many good allies as you can in as many areas as you can. + + * Sixth, teach your university's lawyers about Tor. This may seem like a risky move, but it's way better for them to hear about Tor from you, in a relaxed environment, than to hear about it from a stranger over the phone. Remember that lawyers don't like being told how to interpret laws by a non-lawyer, but they are often pleased to hear that other lawyers have done a lot of the research and leg-work (this is where [the EFF's legal FAQ](https://2019.www.torproject.org/eff/tor-legal-faq) comes in, along with your law school contacts if you found any). Make sure to keep these discussions informal and small -- invite one of the general counsel out to coffee to discuss "something neat that may come up later on." Feel free to bring along one of the allies you found above, if it makes you more comfortable. Avoid having actual meetings or long email discussions, and make it clear that you don't need their official legal opinion yet. Remember that lawyers are paid to say no unless they hav e a reason to say yes, so when the time finally comes to ask their opinion on running a Tor exit node, make sure the question is not "are there any liability issues?", but rather "we'd like to do this, can you help us avoid the biggest issues?" Try to predict what they will say, and try to gain allies among the lawyers who like your cause and want to help. If they have concerns, or raise questions that you don't know how to answer, work with them to figure out the answers and make them happy. Becoming friends with the lawyers early in the process will avoid situations where they need to learn about everything and make a decision in one day. + + * Seventh, teach your network security people about Tor. You aren't going to keep your Tor exit node a secret from them for long anyway, and like with the lawyers, hearing it from you is way better than hearing it from a stranger on the phone. Avoid putting them on the spot or formally asking permission: most network security people will like the idea of Tor in theory, but they won't be in a position to "authorize" your Tor relay. Take them out to coffee to explain Tor and let them know that you are planning to run a Tor server. Make it clear that you're willing to work with them to make sure it isn't too much hassle on their part; for example, they can pass complaints directly on to you if they like. These people are already overworked, and anything you can do to keep work off their plate will make everybody happier. You might let them know that there are ways you can dial down the potential for abuse complaints, for example by rate limiting or partially restricting your exit poli cy -- but don't be too eager to offer or take these steps, since once you give up ground here it's very hard to get it back. + +You'll also want to learn if there are bandwidth limitations at your organization. (Tor can handle a variety of rate limiting approaches, so this isn't the end of the world). + +In some cases, you should talk to the network security people before you talk to the lawyers; in some cases, there will be yet other groups that will be critical to educate and bring into the discussion. You'll have to make it up as you go. + +If the authorities contact your university for logs, be pleasant and helpful. Tor's default log level doesn't provide much that's useful, so if they want copies of your logs, that's fine. Be helpful and take the opportunity to explain to them about Tor and why it's useful to the world. (If they contact you directly for logs, you should send them to +your university's lawyers -- acting on it yourself is [almost always a poor idea](https://2019.www.torproject.org/eff/tor-legal-faq.html#RequestForLogs). + +If there are too many complaints coming in, there are several approaches you can take to reduce them. First, you should follow the tips in the [Tor relay documentation](https://community.torproject.org/relay), such +as picking a descriptive hostname or getting your own IP address. If that doesn't work, you can scale back the advertised speed of your relay, by using the Max``Advertised``Bandwidth to attract less traffic from the Tor network. Lastly, you can scale back your exit policy. + +Some people have found that their university only tolerates their Tor relay if they're involved in a research project around anonymity. So if you're interested, you might want to get that started early in the process -- see our [Research Portal](https://research.torproject.org/). This approach has the added benefit that you can draw in other faculty and students in the process. The downside is that your Tor relay's existence is more fragile, since the terms of its demise are already negotiated. Note that in many cases you don't even need to be researching the exit node itself -- doing research on the Tor network requires that there be a Tor network, after all, and keeping it going is a community effort. + +--- +cta: Subscribe to Tor at universities, colleges, and other education institutions: https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays-universiti… +--- +html: two-columns-page.html +--- +key: 2 +--- +section: Community Resources +--- +section_id: community-resources +--- +subtitle: How do I make my University / ISP / etc happy with my exit node?

1 0

[community/staging] Include technical considerations like AS and OS diversity from Tor relay guide to lektor
by hiro＠torproject.org 05 Jul '19

05 Jul '19

commit 04faaec85c3052b0e5e91e3e7786aba4af56e640 Author: gus <gus(a)torproject.org> Date: Thu Jul 4 18:31:23 2019 -0400 Include technical considerations like AS and OS diversity from Tor relay guide to lektor --- content/relay-operations/technical-considerations/contents.lr | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/relay-operations/technical-considerations/contents.lr b/content/relay-operations/technical-considerations/contents.lr index 9951d45..df9ce12 100644 --- a/content/relay-operations/technical-considerations/contents.lr +++ b/content/relay-operations/technical-considerations/contents.lr @@ -90,6 +90,6 @@ section: relay operations --- section_id: relay-operations --- -key: 2 +key: 3 --- -subtitle: How to choose a good hosting provider, what's AS and Operating System diversity. +subtitle: How to choose a good hosting provider, what's an AS and Operating System diversity.

1 0

[community/staging] Import obfs4 bridge deployment guide to lektor
by hiro＠torproject.org 05 Jul '19

05 Jul '19

commit 084ee9038ce3272e1d5355e1396b780b2eb46d6a Author: gus <gus(a)torproject.org> Date: Thu Jul 4 18:34:58 2019 -0400 Import obfs4 bridge deployment guide to lektor --- .../centos-rhel-opensuse/contents.lr | 2 +- .../bridge-deployment-guide/contents.lr | 8 ++- .../debian-ubuntu/contents.lr | 2 +- .../bridge-deployment-guide/freebsd/contents.lr | 2 +- .../bridge-deployment-guide/openbsd/contents.lr | 67 ++++++++++++++++++++++ 5 files changed, 76 insertions(+), 5 deletions(-) diff --git a/content/relay-operations/technical-setup/bridge-deployment-guide/centos-rhel-opensuse/contents.lr b/content/relay-operations/technical-setup/bridge-deployment-guide/centos-rhel-opensuse/contents.lr index 22d0f46..5849e5a 100644 --- a/content/relay-operations/technical-setup/bridge-deployment-guide/centos-rhel-opensuse/contents.lr +++ b/content/relay-operations/technical-setup/bridge-deployment-guide/centos-rhel-opensuse/contents.lr @@ -96,6 +96,6 @@ key: --- color: primary --- -subtitle: How to deploy obfs4proxy on CentOS / RHEL +subtitle: How to deploy obfs4proxy Bridge on CentOS / RHEL / OpenSUSE --- _template: layout.html diff --git a/content/relay-operations/technical-setup/bridge-deployment-guide/contents.lr b/content/relay-operations/technical-setup/bridge-deployment-guide/contents.lr index b542590..c83b3e6 100644 --- a/content/relay-operations/technical-setup/bridge-deployment-guide/contents.lr +++ b/content/relay-operations/technical-setup/bridge-deployment-guide/contents.lr @@ -2,18 +2,22 @@ _model: page --- title: - Bridge deployment + Bridge --- body: This guide will help you run an obfs4 bridge to help censored users connect to the Tor network. The requirements are 1) 24/7 Internet connectivity and 2) the ability to expose TCP ports to the Internet (make sure that NAT doesn't get in the way). + +Note: If you're running platforms that are not listed on this page, you should probably [compile obfs4 from source](https://gitlab.com/yawning/obfs4#installation). --- html: two-columns-page.html --- -key: 1 +key: 2 --- section: Bridge operations --- section_id: bridge-operations --- subtitle: Run an obfs4 bridge to help censored users connect to the Tor network +--- +_slug: {{bridge}} diff --git a/content/relay-operations/technical-setup/bridge-deployment-guide/debian-ubuntu/contents.lr b/content/relay-operations/technical-setup/bridge-deployment-guide/debian-ubuntu/contents.lr index 6bb7b79..8900995 100644 --- a/content/relay-operations/technical-setup/bridge-deployment-guide/debian-ubuntu/contents.lr +++ b/content/relay-operations/technical-setup/bridge-deployment-guide/debian-ubuntu/contents.lr @@ -77,4 +77,4 @@ key: 1 --- html: two-columns-page.html --- -subtitle: Follow the steps below to deploy obfs4proxy on Debian / Ubuntu +subtitle: How to deploy an obfs4proxy Bridge on Debian / Ubuntu diff --git a/content/relay-operations/technical-setup/bridge-deployment-guide/freebsd/contents.lr b/content/relay-operations/technical-setup/bridge-deployment-guide/freebsd/contents.lr index e14737e..01adcd2 100644 --- a/content/relay-operations/technical-setup/bridge-deployment-guide/freebsd/contents.lr +++ b/content/relay-operations/technical-setup/bridge-deployment-guide/freebsd/contents.lr @@ -95,4 +95,4 @@ FreeBSDlatest: { ``` --- -subtitle: Follow the steps below to deploy obfs4proxy on FreeBSD +subtitle: How to deploy obfs4proxy Bridge on FreeBSD diff --git a/content/relay-operations/technical-setup/bridge-deployment-guide/openbsd/contents.lr b/content/relay-operations/technical-setup/bridge-deployment-guide/openbsd/contents.lr index 24f1601..ae682d9 100644 --- a/content/relay-operations/technical-setup/bridge-deployment-guide/openbsd/contents.lr +++ b/content/relay-operations/technical-setup/bridge-deployment-guide/openbsd/contents.lr @@ -5,3 +5,70 @@ title: OpenBSD html: two-columns-page.html --- key: 4 +--- +body: + +# 1. Install packages +``` +pkg_add tor obfs4proxy +``` + +# 2. Edit your Tor config file + +Usually located at `/etc/tor/torrc`, add the following lines: + +``` +#Bridge config +RunAsDaemon 1 +ORPort auto +BridgeRelay 1 +ServerTransportPlugin obfs4 exec /usr/local/bin/obfs4proxy +# For a fixed obfs4 port (e.g. 34176), uncomment the following line. +#ServerTransportListenAddr obfs4 0.0.0.0:34176 +# Local communication port between Tor and obfs4. Always set this to "auto". "Ext" means +# "extended", not "external". Don't try to set a specific port number, nor listen on 0.0.0.0. +ExtORPort auto + +# Contact information that allows us to get in touch with you in case of +# critical updates or problems with your bridge. This is optional, so you +# don't have to provide an email address if you don't want to. +ContactInfo <address(a)email.com> +# Pick a nickname that you like for your bridge. +Nickname PickANickname + +Log notice file /var/log/tor/notices.log + +User _tor +``` + +Don't forget to change the ContactInfo and Nickname options. + +Note that both Tor's OR port and its obfs4 port must be reachable. If your bridge is behind a firewall or NAT, make sure to open both ports. + +# 3. Start the tor daemon and make sure it starts at boot: + +``` +rcctl enable tor +rcctl start tor +``` +# 4. Monitor your logs + +To confirm your bridge is running with no issues, you should see something like this (`/var/log/tor/notices.log`): + +``` +[notice] Your Tor server's identity key fingerprint is '<NICKNAME> <FINGERPRINT>' +[notice] Your Tor bridge's hashed identity key fingerprint is '<NICKNAME> <HASHED FINGERPRINT>' +[notice] Registered server transport 'obfs4' at '[::]:46396' +[notice] Tor has successfully opened a circuit. Looks like client functionality is working. +[notice] Bootstrapped 100%: Done +[notice] Now checking whether ORPort <redacted>:9001 is reachable... (this may take up to 20 minutes -- look for log messages indicating success) +[notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor. +``` + +Remember to open the random port associated with your bridge. You can find it in your tor log; in the above example it is 46396. To use a fixed port, uncomment the [ServerTransportListenAddr](https://www.torproject.org/docs/tor-manual.html.… option in your torrc. You can use [our reachability test](https://bridges.torproject.org/scan/) to see if your obfs4 port is reachable from the Internet. +--- +subtitle: How to deploy obfs4proxy Bridge on OpenBSD +--- +section: Bridge +--- +section_id: bridge

1 0

[community/staging] Import Exit guide section to lektor
by hiro＠torproject.org 05 Jul '19

05 Jul '19

commit 41282d4b48c35cd710f2cd80c22017c49e98c0fa Author: gus <gus(a)torproject.org> Date: Thu Jul 4 18:30:41 2019 -0400 Import Exit guide section to lektor --- content/relay-operations/technical-setup/exit-relay/contents.lr | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/content/relay-operations/technical-setup/exit-relay/contents.lr b/content/relay-operations/technical-setup/exit-relay/contents.lr index 708c12d..7c57eeb 100644 --- a/content/relay-operations/technical-setup/exit-relay/contents.lr +++ b/content/relay-operations/technical-setup/exit-relay/contents.lr @@ -1,6 +1,6 @@ _model: page --- -title: Exit Relay Configuration +title: Exit --- html: two-columns-page.html --- @@ -8,7 +8,7 @@ section: relay operations --- section_id: relay-operations --- -key: 5 +key: 3 --- body: @@ -175,3 +175,7 @@ To avoid that the configuration gets changed (for example by the DHCP client): chflags schg /etc/resolv.conf ``` +--- +subtitle: How to deploy an Exit node +--- +_slug: {{exit}}

1 0

[community/staging] Move middle relay instructions to a new section
by hiro＠torproject.org 05 Jul '19

05 Jul '19

commit 8b4aaa6897f815d7ebb37352b7733db8255afca8 Author: gus <gus(a)torproject.org> Date: Thu Jul 4 18:33:31 2019 -0400 Move middle relay instructions to a new section --- .../middleguard-relay/centosrhel/contents.lr | 56 +++++++++++++++++ .../technical-setup/middleguard-relay/contents.lr | 15 +++++ .../middleguard-relay/debianubuntu/contents.lr | 46 ++++++++++++++ .../middleguard-relay/fedora/contents.lr | 37 +++++++++++ .../middleguard-relay/freebsd/contents.lr | 73 ++++++++++++++++++++++ 5 files changed, 227 insertions(+) diff --git a/content/relay-operations/technical-setup/middleguard-relay/centosrhel/contents.lr b/content/relay-operations/technical-setup/middleguard-relay/centosrhel/contents.lr new file mode 100644 index 0000000..27b6031 --- /dev/null +++ b/content/relay-operations/technical-setup/middleguard-relay/centosrhel/contents.lr @@ -0,0 +1,56 @@ +_model: page +--- +title: CentOS/RHEL +--- +body: + +# 1. Enable the EPEL repository + +To install `tor` package on CentOS/RHEL, you need to install the [EPEL](https://fedoraproject.org/wiki/EPEL) repository first: + +`yum install epel-release` + +# 2. Install the tor package and verify the EPEL signing key + +`yum install tor` + +When you install the first package from the EPEL repository you will be asked about verifying the EPEL GPG signing key. Please ensure the key matches with the one available on the [Fedora Project website](https://getfedora.org/keys/). + +# 3. Put the tor configuration file `/etc/tor/torrc` in place + +``` +#change the nickname "myNiceRelay" to a name that you like +Nickname myNiceRelay +ORPort 9001 +SocksPort 0 +ExitRelay 0 +# Change the email address bellow and be aware that it will be published +ContactInfo tor-operator@your-emailaddress-domain +``` + +# 4. Enable and start your Tor relay + +CentOS 7 / RHEL 7: + +``` +systemctl enable tor +systemctl start tor +``` + +CentOS 6 / RHEL 6: + +``` +service tor enable +service tor start +``` + +--- +html: two-columns-page.html +--- +key: 5 +--- +section: relay operations +--- +section_id: relay-operations +--- +subtitle: How to deploy a middle/Guard node on CentOS/RHEL diff --git a/content/relay-operations/technical-setup/middleguard-relay/contents.lr b/content/relay-operations/technical-setup/middleguard-relay/contents.lr new file mode 100644 index 0000000..7cfa3dd --- /dev/null +++ b/content/relay-operations/technical-setup/middleguard-relay/contents.lr @@ -0,0 +1,15 @@ +_model: page +--- +title: Middle/Guard relay +--- +body: In this guide we describe how to setup a new Middle/Guard relay. Please choose your platform below. +--- +html: two-columns-page.html +--- +key: 1 +--- +section: relay operations +--- +section_id: relay-operations +--- +subtitle: Run a Middle/Guard relay diff --git a/content/relay-operations/technical-setup/middleguard-relay/debianubuntu/contents.lr b/content/relay-operations/technical-setup/middleguard-relay/debianubuntu/contents.lr new file mode 100644 index 0000000..f7992dd --- /dev/null +++ b/content/relay-operations/technical-setup/middleguard-relay/debianubuntu/contents.lr @@ -0,0 +1,46 @@ +_model: page +--- +title: Debian/Ubuntu +--- +body: + +# 1. Configure Tor Package Repository + +Enable the Torproject package repository by following the instructions **[here](https://2019.www.torproject.org/docs/debian.html.en#ubuntu)**. + +# 2. Package Installation + +Install the `tor` package: + +`apt update && apt install tor` + +# 3. Configuration File + +Put the configuration file `/etc/tor/torrc` in place: + +``` +#change the nickname "myNiceRelay" to a name that you like +Nickname myNiceRelay +ORPort 443 +ExitRelay 0 +SocksPort 0 +ControlSocket 0 +# Change the email address bellow and be aware that it will be published +ContactInfo tor-operator@your-emailaddress-domain +``` + +# 4. Restart the Service + +Restart the tor daemon so your configuration changes take effect: + +`systemctl restart tor@default` +--- +html: two-columns-page.html +--- +key: 1 +--- +section: relay operations +--- +section_id: relay-operations +--- +subtitle: How to deploy a middle/Guard node on Debian/Ubuntu diff --git a/content/relay-operations/technical-setup/middleguard-relay/fedora/contents.lr b/content/relay-operations/technical-setup/middleguard-relay/fedora/contents.lr new file mode 100644 index 0000000..cc984cc --- /dev/null +++ b/content/relay-operations/technical-setup/middleguard-relay/fedora/contents.lr @@ -0,0 +1,37 @@ +_model: page +--- +title: Fedora +--- +body: + +# 1. Install the tor package: + +`dnf install tor` + +# 2. Put the tor configuration file `/etc/tor/torrc` in place: + +``` +#change the nickname "myNiceRelay" to a name that you like +Nickname myNiceRelay +ORPort 9001 +ExitRelay 0 +# Change the email address bellow and be aware that it will be published +ContactInfo tor-operator@your-emailaddress-domain +``` + +# 3. Start the tor daemon and make sure it starts at boot: + +``` +systemctl enable tor +systemctl start tor +``` +--- +html: two-columns-page.html +--- +key: 3 +--- +section: relay operations +--- +section_id: relay-operations +--- +subtitle: How to deploy a middle/Guard node on Fedora diff --git a/content/relay-operations/technical-setup/middleguard-relay/freebsd/contents.lr b/content/relay-operations/technical-setup/middleguard-relay/freebsd/contents.lr new file mode 100644 index 0000000..a47dfc8 --- /dev/null +++ b/content/relay-operations/technical-setup/middleguard-relay/freebsd/contents.lr @@ -0,0 +1,73 @@ +_model: page +--- +title: FreeBSD +--- +body: + +## 1. Install the tor package + +`pkg install tor ca_root_nss` + +or for alpha releases: + +`pkg install tor-devel ca_root_nss` + +## 2. Put the configuration file `/usr/local/etc/tor/torrc` in place + +``` +#change the nickname "myNiceRelay" to a name that you like +Nickname myNiceRelay +ORPort 9001 +ExitRelay 0 +SocksPort 0 +# Change the email address bellow and be aware that it will be published +ContactInfo tor-operator@your-emailaddress-domain +Log notice syslog +``` + +## 3. Ensure that the `random_id` sysctl setting is enabled: + +``` +echo "net.inet.ip.random_id=1" >> /etc/sysctl.conf +sysctl net.inet.ip.random_id=1 +``` + +## 4. Start the tor daemon and make sure it starts at boot: + +``` +sysrc tor_enable=YES +service tor start +``` + +### Optional but recommended + +To get package updates faster after they have been build it is best to switch from the "quarterly" with "latest" repository. + +Create the following folder: + +`mkdir -p /usr/local/etc/pkg/repos` + +and create the file `/usr/local/etc/pkg/repos/FreeBSD.conf` with the following content: + +``` +FreeBSD: { enabled: no } + +FreeBSDlatest: { + url: "pkg+https://pkg.FreeBSD.org/${ABI}/latest", + mirror_type: "srv", + signature_type: "fingerprints", + fingerprints: "/usr/share/keys/pkg", + enabled: yes +} +``` + +--- +html: two-columns-page.html +--- +key: 2 +--- +section: relay operations +--- +section_id: relay-operations +--- +subtitle: How to deploy a middle/Guard node on FreeBSD

1 0

[community/staging] Update image container
by hiro＠torproject.org 05 Jul '19

05 Jul '19

commit febe98dd88aac4593d211afe1d0799518b182825 Author: Pili Guerra <pili(a)piliguerra.com> Date: Wed Jun 12 11:39:47 2019 +0200 Update image container --- templates/onion-services.html | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/templates/onion-services.html b/templates/onion-services.html index 31f2197..c334d9d 100644 --- a/templates/onion-services.html +++ b/templates/onion-services.html @@ -1,12 +1,10 @@ <div class="container py-5"> <div class="row py-5"> - <div class="col-8"> + <div class="col-lg-7"> {{ this.body }} </div> - <div class="col-4 bg-light"> - <div class="illo-container"> - <img src="/static/images/home/png/{{ this.section_id }}.png" class="img-fluid" alt="{{ this.section }}" /> - </div> + <div class="col-lg-5"> + <img src="/static/images/home/png/{{ this.section_id }}.png" class="img-fluid" alt="{{ _(this.section) }}" /> </div> </div> <a href="{{ this.path|url }}overview/"><h2 class="text-primary"><u>{{ _('Learn more about onion services here') }}

1 0

[community/staging] rollback lektor file that shouldn't have been committed
by hiro＠torproject.org 05 Jul '19

05 Jul '19

commit f0a6a864168149cdcb3314881e095344c8ae927f Author: Pili Guerra <pili(a)piliguerra.com> Date: Wed Jun 12 18:38:42 2019 +0200 rollback lektor file that shouldn't have been committed --- .../i18n/__pycache__/lektor_i18n.cpython-37.pyc | Bin 15397 -> 15379 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/packages/i18n/__pycache__/lektor_i18n.cpython-37.pyc b/packages/i18n/__pycache__/lektor_i18n.cpython-37.pyc index 488bd31..52322b7 100644 Binary files a/packages/i18n/__pycache__/lektor_i18n.cpython-37.pyc and b/packages/i18n/__pycache__/lektor_i18n.cpython-37.pyc differ

1 0

[community/staging] delete file committed by mistake
by hiro＠torproject.org 05 Jul '19

05 Jul '19

commit 72520ae33f4aef4e4da8851e73150ae3da5c5e41 Author: emma peel <emma.peel(a)riseup.net> Date: Thu Jun 13 07:23:02 2019 +0200 delete file committed by mistake --- packages/i18n/__pycache__/lektor_i18n.cpython-37.pyc | Bin 15379 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/packages/i18n/__pycache__/lektor_i18n.cpython-37.pyc b/packages/i18n/__pycache__/lektor_i18n.cpython-37.pyc deleted file mode 100644 index 52322b7..0000000 Binary files a/packages/i18n/__pycache__/lektor_i18n.cpython-37.pyc and /dev/null differ

1 0

[community/staging] Training section
by hiro＠torproject.org 05 Jul '19

05 Jul '19

commit 6b6a515a2146371e7ccf79ea72a39a38e062def8 Author: Pili Guerra <pili(a)piliguerra.com> Date: Wed Jun 12 17:56:11 2019 +0200 Training section --- content/training/best-practices/contents.lr | 58 +++++++++++++++++++++ content/training/resources/contents.lr | 19 +++++++ content/training/resources/tor-network-2019.odp | Bin 0 -> 244102 bytes content/training/resources/tor-network-2019.odp.lr | 13 +++++ content/training/resources/tor-network-2019.pdf | Bin 0 -> 524047 bytes content/training/resources/tor-network-2019.pdf.lr | 13 +++++ .../resources/tor-slides-full-deck-2019.odp | Bin 0 -> 3569187 bytes .../resources/tor-slides-full-deck-2019.odp.lr | 13 +++++ .../resources/tor-slides-full-deck-2019.pdf | Bin 0 -> 2344713 bytes .../resources/tor-slides-full-deck-2019.pdf.lr | 13 +++++ models/resource.ini | 32 ++++++++++++ models/resources.ini | 34 ++++++++++++ .../i18n/__pycache__/lektor_i18n.cpython-37.pyc | Bin 15379 -> 15397 bytes templates/macros/resources.html | 8 +++ templates/resource.html | 1 + templates/resources.html | 29 +++++++++++ templates/training.html | 17 ++++-- 17 files changed, 247 insertions(+), 3 deletions(-) diff --git a/content/training/best-practices/contents.lr b/content/training/best-practices/contents.lr new file mode 100644 index 0000000..741685b --- /dev/null +++ b/content/training/best-practices/contents.lr @@ -0,0 +1,58 @@ +section: training +--- +section_id: training +--- +color: primary +--- +_template: layout.html +--- +title: Training Best Practices +--- +subtitle: Good preparation is essential to an effective and safe training, so we've curated some resources to help you make the most of your training event. +--- +cta: Best Practices for Trainers +--- +key: 1 +--- +html: two-columns-page.html +--- +body: + +Running security trainings is a fun and rewarding way to help your community conduct human rights work safely. Good preparation is essential to an effective and safe training, so we've curated some resources to help you make the most of your training event. + +## Before the training + +_Am I the right person to give this training?_ + +Security trainings can help people communicate and use the internet safely, but there are additional considerations to be made before training some at-risk groups. That's why we recommend this resource from EFF's Security Education Companion, ["Am I the right person to give this training?"](https://sec.eff.org/articles/right-person-to-train). This resource can help you be sure that you're doing the best by the community of people you wish to train. + +Other questions to ask yourself before deciding to do a training: + +- How will you assess the needs of your group? What needs can you meet? +- How will you assess the skill level of your group? What skill levels can you teach to? + +Once you've answered those questions, you're ready to plan your training! + +1. Find a location that is accessible, affordable, has an internet connection and other materials like a white board, projector, and screen. Make sure that the location is safe for your attendees to visit. +2. Promote your event in your community's spaces, taking safety into consideration. Under many circumstances, social media is great for promotion, but for higher risk groups, you may want to use a smaller word-of-mouth network or require community members to share information individually to other trusted people. +3. Create localized handouts for some of the more difficult concepts that you'll be teaching. +4. Make sure you have plenty of stickers to hand out to participants! +5. Create a link list of all the resources you'll be talking about. This includes downloads and PDFs of handouts. You'll share this link list on a whiteboard or project it at the training. +6. Determine how you'll do hands-on assistance at your training. Will you be able to handle this alone? Or will you require partners? If you need more help, make sure the partners you're bringing in are aware of the safety needs of the community, and communicate with your contacts in the community to make sure they're okay with you bringing in additional trainers. +7. Make sure your presentation is up-to-date (both information and screenshots) and save your presentation in two file formats -- for example, odp and pdf -- and on at least one additional device -- for example, on your computer and on a USB stick. +8. Decide how you will facilitate a safer space. We recommend using the Tor Code of Conduct. You can also start the training by asking participants to come up with their own community agreements for the space. + +## At the training + +1. Create an agenda and share it on a projection or on a whiteboard so that your participants can be prepared for the day. +2. Communicate about how much time the training will take, and when breaks will happen. Make sure you take breaks! +3. Communicate about when you'll take questions, either during the training, at the end, or both. +4. Communicate about how you'll offer hands-on help (if at all). +5. Communicate about how participants can contact you securely after the training. +6. Show the participants the resources at community.torproject.org and support.torproject.org. +7. Show the participants other resources like sec.eff.org. + +## After the training + +1. Think about how you will evaluate your success at the training. You may want to create a follow up survey, or at least contact participants and ask them to share their feedback with you. + diff --git a/content/training/resources/contents.lr b/content/training/resources/contents.lr new file mode 100644 index 0000000..58a6907 --- /dev/null +++ b/content/training/resources/contents.lr @@ -0,0 +1,19 @@ +section: training +--- +section_id: training +--- +color: primary +--- +_template: layout.html +--- +title: Training Resources +--- +subtitle: Do you teach your community about using Tor? These resources are for you. +--- +key: 2 +--- +html: resources.html +--- +body: + +Do you teach your community about using Tor? These training resources are for you. \ No newline at end of file diff --git a/content/training/resources/tor-network-2019.odp b/content/training/resources/tor-network-2019.odp new file mode 100644 index 0000000..2d24160 Binary files /dev/null and b/content/training/resources/tor-network-2019.odp differ diff --git a/content/training/resources/tor-network-2019.odp.lr b/content/training/resources/tor-network-2019.odp.lr new file mode 100644 index 0000000..d1abc51 --- /dev/null +++ b/content/training/resources/tor-network-2019.odp.lr @@ -0,0 +1,13 @@ +_model: resource +--- +title: Tor Network +--- +description: ODP file +--- +type: odp +--- +date: 2019 +--- +file: tor-network-2019.odp +--- +key: 1 \ No newline at end of file diff --git a/content/training/resources/tor-network-2019.pdf b/content/training/resources/tor-network-2019.pdf new file mode 100644 index 0000000..a5187ea Binary files /dev/null and b/content/training/resources/tor-network-2019.pdf differ diff --git a/content/training/resources/tor-network-2019.pdf.lr b/content/training/resources/tor-network-2019.pdf.lr new file mode 100644 index 0000000..5a84664 --- /dev/null +++ b/content/training/resources/tor-network-2019.pdf.lr @@ -0,0 +1,13 @@ +_model: resource +--- +title: Tor Network +--- +description: PDF file +--- +type: pdf +--- +date: 2019 +--- +file: tor-network-2019.pdf +--- +key: 0 \ No newline at end of file diff --git a/content/training/resources/tor-slides-full-deck-2019.odp b/content/training/resources/tor-slides-full-deck-2019.odp new file mode 100644 index 0000000..66d3d70 Binary files /dev/null and b/content/training/resources/tor-slides-full-deck-2019.odp differ diff --git a/content/training/resources/tor-slides-full-deck-2019.odp.lr b/content/training/resources/tor-slides-full-deck-2019.odp.lr new file mode 100644 index 0000000..97ef6dc --- /dev/null +++ b/content/training/resources/tor-slides-full-deck-2019.odp.lr @@ -0,0 +1,13 @@ +_model: resource +--- +title: Tor Network +--- +description: ODP file +--- +type: odp +--- +date: 2019 +--- +file: tor-slides-full-deck-2019.odp +--- +key: 3 \ No newline at end of file diff --git a/content/training/resources/tor-slides-full-deck-2019.pdf b/content/training/resources/tor-slides-full-deck-2019.pdf new file mode 100644 index 0000000..6933dcf Binary files /dev/null and b/content/training/resources/tor-slides-full-deck-2019.pdf differ diff --git a/content/training/resources/tor-slides-full-deck-2019.pdf.lr b/content/training/resources/tor-slides-full-deck-2019.pdf.lr new file mode 100644 index 0000000..86b9049 --- /dev/null +++ b/content/training/resources/tor-slides-full-deck-2019.pdf.lr @@ -0,0 +1,13 @@ +_model: resource +--- +title: Tor Network +--- +description: PDF file +--- +type: pdf +--- +date: 2019 +--- +file: tor-slides-full-deck-2019.pdf +--- +key: 3 \ No newline at end of file diff --git a/models/resource.ini b/models/resource.ini new file mode 100644 index 0000000..2198873 --- /dev/null +++ b/models/resource.ini @@ -0,0 +1,32 @@ +[model] +name = Resource +label = {{ this.title }} + +[fields.name] +label = Name +type = string +translate = True + +[fields.link] +label = Link +type = string + +[fields.description] +label = Description +type = string + +[fields.type] +label = Type +type = string + +[fields.date] +label = date +type = string + +[fields.file] +label = File +type = string + +[fields.key] +label = Key +type = string \ No newline at end of file diff --git a/models/resources.ini b/models/resources.ini new file mode 100644 index 0000000..1df9906 --- /dev/null +++ b/models/resources.ini @@ -0,0 +1,34 @@ +[model] +name = Resources +label = {{ this.title }} +hidden = yes + +[fields.title] +label = Title +type = string + +[fields.section] +label = Section +type = string +translate = True + +[fields.section_id] +label = Section_id +type = string +translate = False + +[fields.body] +label = Body +type = markdown + +[fields.color] +label = Color +type = string + +[fields.html] +label = Html +type = string + +[children] +model = resource +order_by = key \ No newline at end of file diff --git a/packages/i18n/__pycache__/lektor_i18n.cpython-37.pyc b/packages/i18n/__pycache__/lektor_i18n.cpython-37.pyc index 52322b7..488bd31 100644 Binary files a/packages/i18n/__pycache__/lektor_i18n.cpython-37.pyc and b/packages/i18n/__pycache__/lektor_i18n.cpython-37.pyc differ diff --git a/templates/macros/resources.html b/templates/macros/resources.html new file mode 100644 index 0000000..e632faf --- /dev/null +++ b/templates/macros/resources.html @@ -0,0 +1,8 @@ +{% macro render_resource(item) %} +<tr> + <td><a href="{{ item|url }}">{{ item.file }}</a></td> + <td>{{ item.description }}</td> + <td>{{ item.type}}</td> + <td>{{ item.date }}</td> +</tr> +{% endmacro %} diff --git a/templates/resource.html b/templates/resource.html new file mode 100644 index 0000000..0b1bdf2 --- /dev/null +++ b/templates/resource.html @@ -0,0 +1 @@ +{{ this.name }} \ No newline at end of file diff --git a/templates/resources.html b/templates/resources.html new file mode 100644 index 0000000..d40c313 --- /dev/null +++ b/templates/resources.html @@ -0,0 +1,29 @@ +<div class="row pt-5"> + {% include 'sidenav.html' %} + <div class="col-sm-12 col-xs-12 ml-sm-auto col-md-9 col-lg-9 {{ bag('alternatives', this.alt, 'order') }}"> + {{ this.body }} + <div class="container py-3"> + <div class="row"> + <table class="table"> + <thead> + <tr> + <th scope="col">Title</th> + <th scope="col">Description</th> + <th scope="col">Formats</th> + <th scope="col">Last Updated</th> + </tr> + </thead> + <tbody> + {% from "macros/resources.html" import render_resource %} + {% for item in this.attachments %} + {{ render_resource(item) }} + {% endfor %} + </tbody> + </table> + </div> + </div> + </div> +</div> + + + diff --git a/templates/training.html b/templates/training.html index a7fcbb6..65c7187 100644 --- a/templates/training.html +++ b/templates/training.html @@ -7,10 +7,21 @@ <img src="/static/images/home/png/{{ this.section_id }}.png" class="img-fluid" alt="{{ _(this.section) }}" /> </div> </div> - <div class="row py-5"> - <h2 class="text-primary text-center mx-auto"><u>{{ _('Resources') }}</u> - </h2> + {% for child in this.children|sort(attribute='key') %} + {% if child.key != '0' %} + <div class="col-sm-6 col-md-6 col-sm-12 col-xl-6 py-4"> + <div class="card h-100 border-0"> + <div class="card-body"> + <h2 class="text-primary display-2"><i class="fas fa-{{ child.image }}"></i></h2> + <h4 class="card-title text-primary">{{ child.title }}</h4> + <p class="card-text">{{ child.subtitle }}</p> + <a href="{{ child.path|url }}">{{ child.cta }} <i class="fas fa-arrow-right"></i></a> + </div> + </div> + </div> + {% endif %} + {% endfor %} </div> <div class="row py-5 text-center mx-auto"> <h2 class="display-4 text-primary text-center mx-auto">{{ _('Join the Community') }}</h2>

1 0