September 2019 - tor-commits - lists.torproject.org

[community/develop] Add full url path to EFF Legal FAQ
by hiro＠torproject.org 18 Sep '19

18 Sep '19

commit 8796b97d5bcf40b8596d25e3cad7e1b38d2c8e91 Author: gus <gus(a)torproject.org> Date: Tue Sep 3 12:00:52 2019 -0400 Add full url path to EFF Legal FAQ --- .../community-resources/tor-abuse-templates/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/relay-operations/community-resources/tor-abuse-templates/contents.lr b/content/relay-operations/community-resources/tor-abuse-templates/contents.lr index 2af9f6b..0e37f24 100644 --- a/content/relay-operations/community-resources/tor-abuse-templates/contents.lr +++ b/content/relay-operations/community-resources/tor-abuse-templates/contents.lr @@ -212,7 +212,7 @@ If a serious abuse complaint not covered by this template set arrives, the best ## Other Template Sets - * [DMCA Response template for Tor node maintainer to ISP](community-resources/eff-tor-legal-faq/) as written by the [EFF](http://www.eff.org). + * [DMCA Response template for Tor node maintainer to ISP](/relay/community-resources/eff-tor-legal-faq/) as written by the [EFF](http://www.eff.org). * Torservers [response template emails](https://www.torservers.net/wiki/abuse/templates). --- html: two-columns-page.html

1 0

[community/develop] Link to trac ReducedEXitPolicy wiki page
by hiro＠torproject.org 18 Sep '19

18 Sep '19

commit c066579182da5621749d2ea016343bb9e038483b Author: gus <gus(a)torproject.org> Date: Tue Sep 3 11:56:52 2019 -0400 Link to trac ReducedEXitPolicy wiki page --- .../community-resources/tor-exit-guidelines/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr b/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr index 3165b23..ddbddef 100644 --- a/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr +++ b/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr @@ -100,7 +100,7 @@ At least law enforcement in Germany regularly uses the fax and phone numbers pre ### Consider using the Reduced Exit Policy. -The [Reduced Exit Policy](FIXME) is an alternative to the default exit policy. It allows many Internet services while still blocking the majority of TCP ports. +The [Reduced Exit Policy](https://trac.torproject.org/projects/tor/wiki/doc/ReducedExitPolicy) is an alternative to the default exit policy. It allows many Internet services while still blocking the majority of TCP ports. This drastically reduces the odds that a Bittorrent user will select your node and thus reduces or even eliminates the number of [DMCA complaints](https://2019.www.torproject.org/eff/tor-dmca-response) you will receive. If you have your own experience of abuse handling, just share it on our public mailing list or write us an email to tor-assistants(a)torproject.org.

1 0

[community/develop] Following our Relay Guide, the ideal monthly Outbound Traffic is 2 TB and not 20 TB
by hiro＠torproject.org 18 Sep '19

18 Sep '19

commit b0c0a52858a737cfaccca1e2ff5b6c575db5ed16 Author: gus <gus(a)torproject.org> Date: Tue Sep 3 11:21:41 2019 -0400 Following our Relay Guide, the ideal monthly Outbound Traffic is 2 TB and not 20 TB --- content/relay-operations/relays-requirements/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/relay-operations/relays-requirements/contents.lr b/content/relay-operations/relays-requirements/contents.lr index ccee8c3..6ae3581 100644 --- a/content/relay-operations/relays-requirements/contents.lr +++ b/content/relay-operations/relays-requirements/contents.lr @@ -35,7 +35,7 @@ If you do not know your bandwidth you can use http://beta.speedtest.net to measu It is required that a Tor relay be allowed to use a minimum of 100 GByte of outbound traffic (and the same amount of incoming traffic) per month. Note: That is only about 1 day worth of traffic on a 10 Mbit/s (Mbps) connection. More (>2 TB/month) is better and recommended. -**Ideally a relay runs on an unmetered plan** or includes 20 TB/month or more. +**Ideally a relay runs on an unmetered plan** or includes 2 TB/month or more. If you have a metered plan you might want to configure tor to only use a given amount of [bandwidth or monthly traffic](FIXME). # Public IPv4 Address

1 0

[community/develop] Link to EFF DMCA response template
by hiro＠torproject.org 18 Sep '19

18 Sep '19

commit 3c9a60cba429f3d2e595eaa5ff3f40e052ca954c Author: gus <gus(a)torproject.org> Date: Tue Sep 3 11:58:12 2019 -0400 Link to EFF DMCA response template --- .../community-resources/tor-exit-guidelines/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr b/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr index ddbddef..3d31bf1 100644 --- a/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr +++ b/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr @@ -101,7 +101,7 @@ At least law enforcement in Germany regularly uses the fax and phone numbers pre ### Consider using the Reduced Exit Policy. The [Reduced Exit Policy](https://trac.torproject.org/projects/tor/wiki/doc/ReducedExitPolicy) is an alternative to the default exit policy. It allows many Internet services while still blocking the majority of TCP ports. -This drastically reduces the odds that a Bittorrent user will select your node and thus reduces or even eliminates the number of [DMCA complaints](https://2019.www.torproject.org/eff/tor-dmca-response) you will receive. +This drastically reduces the odds that a Bittorrent user will select your node and thus reduces or even eliminates the number of [DMCA complaints](/relay/community-resources/eff-tor-legal-faq/tor-dmca-response/) you will receive. If you have your own experience of abuse handling, just share it on our public mailing list or write us an email to tor-assistants(a)torproject.org.

1 0

[community/develop] Remove Fedora Instructions
by hiro＠torproject.org 18 Sep '19

18 Sep '19

commit 232dcaf5b3bc22d8f6957c3da675d36e8f8cfa1b Author: Christopher King <bunnyapocalypse(a)protonmail.com> Date: Tue Sep 3 16:15:35 2019 +0000 Remove Fedora Instructions Fair enough, that all makes sense. I removed all of the Fedora stuff but kept the parts relevant to RHEL / CentOS. --- .../bridge/centos-rhel-opensuse/contents.lr | 46 +--------------------- 1 file changed, 1 insertion(+), 45 deletions(-) diff --git a/content/relay-operations/technical-setup/bridge/centos-rhel-opensuse/contents.lr b/content/relay-operations/technical-setup/bridge/centos-rhel-opensuse/contents.lr index c0f82d4..0f11215 100644 --- a/content/relay-operations/technical-setup/bridge/centos-rhel-opensuse/contents.lr +++ b/content/relay-operations/technical-setup/bridge/centos-rhel-opensuse/contents.lr @@ -21,12 +21,6 @@ yum install git golang tor policycoreutils-python-utils zypper install tor go git ``` -* Fedora: - -``` -dnf install git golang tor policycoreutils-python-utils -``` - ### 2. Build obfs4proxy and move it into place. Heavily outdated versions of git can make `go get` fail, so try upgrading to a more recent git version if you're running into this problem. @@ -48,14 +42,6 @@ go get gitlab.com/yawning/obfs4.git/obfs4proxy sudo cp $GOPATH/bin/obfs4proxy /usr/local/bin/ ``` -* Fedora: - -``` -export GOPATH=`mktemp -d` -go get gitlab.com/yawning/obfs4.git/obfs4proxy -sudo cp $GOPATH/bin/obfs4proxy /usr/bin/ -``` - ### 3. Edit your Tor config file, usually located at `/etc/tor/torrc` and replace its content with: * CentOS / RHEL / OpenSUSE: @@ -89,36 +75,6 @@ ContactInfo <address(a)email.com> # Pick a nickname that you like for your bridge. This is optional. Nickname PickANickname ``` -* Fedora: - -``` -RunAsDaemon 1 -BridgeRelay 1 - -# Replace "TODO" with a Tor port of your choice. This port must be externally -# reachable. Avoid port 9001 because it's commonly associated with Tor and -# censors may be scanning the Internet for this port. -ORPort TODO - -ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy - -# Replace "TODO" with an obfs4 port of your choice. This port must be -# externally reachable. Avoid port 9001 because it's commonly associated with -# Tor and censors may be scanning the Internet for this port. -ServerTransportListenAddr obfs4 0.0.0.0:TODO - -# Local communication port between Tor and obfs4. Always set this to "auto". -# "Ext" means "extended", not "external". Don't try to set a specific port -# number, nor listen on 0.0.0.0. -ExtORPort auto - -# Replace "<address(a)email.com>" with your email address so we can contact you if -# there are problems with your bridge. This is optional but encouraged. -ContactInfo <address(a)email.com> - -# Pick a nickname that you like for your bridge. This is optional. -Nickname PickANickname -``` Don't forget to change the `ORPort`, `ServerTransportListenAddr`, `ContactInfo`, and `Nickname` options. @@ -130,7 +86,7 @@ Nickname PickANickname `systemctl restart tor` -* Fedora / RHEL / CentOS: +* RHEL / CentOS: ``` sudo semanage port -a -t tor_port_t -p tcp [desired ORPort number set earlier]

1 0

[community/develop] Added Fedora Guide
by hiro＠torproject.org 18 Sep '19

18 Sep '19

commit 5eefe0bafc796df20691c516bcec8941e0c79003 Author: Chris King <bunnyapocalypse(a)protonmail.com> Date: Tue Sep 3 11:26:27 2019 -0500 Added Fedora Guide --- .../technical-setup/bridge/fedora/contents.lr | 102 +++++++++++++++++++++ 1 file changed, 102 insertions(+) diff --git a/content/relay-operations/technical-setup/bridge/fedora/contents.lr b/content/relay-operations/technical-setup/bridge/fedora/contents.lr new file mode 100644 index 0000000..a1584b0 --- /dev/null +++ b/content/relay-operations/technical-setup/bridge/fedora/contents.lr @@ -0,0 +1,102 @@ +_model: page +--- +color: primary +--- +title: Fedora +--- +body: + +### 1. Install tor and dependencies + +``` +dnf install git golang tor policycoreutils-python-utils +``` + +### 2. Build obfs4proxy and move it into place. + +``` +export GOPATH=`mktemp -d` +go get gitlab.com/yawning/obfs4.git/obfs4proxy +sudo cp $GOPATH/bin/obfs4proxy /usr/bin/ +``` + +### 3. Edit your Tor config file, usually located at `/etc/tor/torrc` and replace its content with: + +``` +RunAsDaemon 1 +BridgeRelay 1 + +# Replace "TODO" with a Tor port of your choice. This port must be externally +# reachable. Avoid port 9001 because it's commonly associated with Tor and +# censors may be scanning the Internet for this port. +ORPort TODO + +ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy + +# Replace "TODO" with an obfs4 port of your choice. This port must be +# externally reachable. Avoid port 9001 because it's commonly associated with +# Tor and censors may be scanning the Internet for this port. +ServerTransportListenAddr obfs4 0.0.0.0:TODO + +# Local communication port between Tor and obfs4. Always set this to "auto". +# "Ext" means "extended", not "external". Don't try to set a specific port +# number, nor listen on 0.0.0.0. +ExtORPort auto + +# Replace "<address(a)email.com>" with your email address so we can contact you if +# there are problems with your bridge. This is optional but encouraged. +ContactInfo <address(a)email.com> + +# Pick a nickname that you like for your bridge. This is optional. +Nickname PickANickname +``` + + Don't forget to change the `ORPort`, `ServerTransportListenAddr`, `ContactInfo`, and `Nickname` options. + +* Note that both Tor's OR port and its obfs4 port must be reachable. If your bridge is behind a firewall or NAT, make sure to open both ports. You can use [our reachability test](https://bridges.torproject.org/scan/) to see if your obfs4 port is reachable from the Internet. + +### 4. Restart tor + +``` +sudo semanage port -a -t tor_port_t -p tcp [desired ORPort number set earlier] +sudo semanage port -a -t tor_port_t -p tcp [desired ServerTransportListenAddr port number set earlier] +systemctl restart tor +``` + +### 5. Monitor your logs (usually in your syslog) + +To confirm your bridge is running with no issues, you should see something like this: + +``` +[notice] Your Tor server's identity key fingerprint is '<NICKNAME> <FINGERPRINT>' +[notice] Your Tor bridge's hashed identity key fingerprint is '<NICKNAME> <HASHED FINGERPRINT>' +[notice] Registered server transport 'obfs4' at '[::]:46396' +[notice] Tor has successfully opened a circuit. Looks like client functionality is working. +[notice] Bootstrapped 100%: Done +[notice] Now checking whether ORPort <redacted>:3818 is reachable... (this may take up to 20 minutes -- look for log messages indicating success) +[notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor. +``` + +### 6. Final notes + +If you are having troubles setting up your bridge, have a look at [our help +section](https://community.torproject.org/relay/setup/bridge/getting-help/). If +your bridge is now running, check out the [post-install +notes](https://community.torproject.org/relay/setup/bridge/post-install/). + +--- +html: two-columns-page.html +--- +key: + +2 +--- +color: primary +--- +subtitle: How to deploy an obfs4 bridge on CentOS / RHEL / OpenSUSE +--- +_template: layout.html +--- +section: bridge +--- +section_id: bridge

1 0

[community/develop] Update contents.lr
by hiro＠torproject.org 18 Sep '19

18 Sep '19

commit 96416609b4f4eb35c6caa3154a43219569cf77c4 Author: Christopher King <bunnyapocalypse(a)protonmail.com> Date: Tue Sep 3 16:46:44 2019 +0000 Update contents.lr --- .../relay-operations/technical-setup/bridge/fedora/contents.lr | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/content/relay-operations/technical-setup/bridge/fedora/contents.lr b/content/relay-operations/technical-setup/bridge/fedora/contents.lr index a1584b0..40ad6a9 100644 --- a/content/relay-operations/technical-setup/bridge/fedora/contents.lr +++ b/content/relay-operations/technical-setup/bridge/fedora/contents.lr @@ -17,7 +17,11 @@ dnf install git golang tor policycoreutils-python-utils ``` export GOPATH=`mktemp -d` go get gitlab.com/yawning/obfs4.git/obfs4proxy -sudo cp $GOPATH/bin/obfs4proxy /usr/bin/ +sudo cp $GOPATH/bin/obfs4proxy /usr/local/bin/ +``` +And tell selinux to allow Tor to use obfs4proxy: +``` +/sbin/restorecon -v /usr/local/bin/obfs4proxy ``` ### 3. Edit your Tor config file, usually located at `/etc/tor/torrc` and replace its content with: @@ -31,7 +35,7 @@ BridgeRelay 1 # censors may be scanning the Internet for this port. ORPort TODO -ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy +ServerTransportPlugin obfs4 exec /usr/local/bin/obfs4proxy # Replace "TODO" with an obfs4 port of your choice. This port must be # externally reachable. Avoid port 9001 because it's commonly associated with

1 0

[community/develop] Update xml stream
by hiro＠torproject.org 18 Sep '19

18 Sep '19

commit 075fab63ded10d4e44321a0befc093787812fb78 Author: hiro <hiro(a)torproject.org> Date: Wed Sep 4 14:46:36 2019 +0200 Update xml stream --- templates/outreach.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/outreach.html b/templates/outreach.html index e35f896..a640059 100644 --- a/templates/outreach.html +++ b/templates/outreach.html @@ -35,7 +35,7 @@ <div class="row py-5 text-center mx-auto"> <h2 class="display-4 text-primary text-center mx-auto">{{ _('Upcoming Tor Events') }}</h2> <div class="col-12"> - {{ render_stream()|safe }} + {{ render_stream("https://blog.torproject.org/events.xml")|safe }} </div> </div> </div>

1 0

[community/develop] Fix broken installation path.
by hiro＠torproject.org 18 Sep '19

18 Sep '19

commit 8c38cb65a092f0b09480b463c5479345eed5eea6 Author: Philipp Winter <phw(a)nymity.ch> Date: Wed Sep 4 09:04:56 2019 -0700 Fix broken installation path. Thanks to Wolfgang for pointing out this issue and to egypcio for confirming that it was indeed an issue. --- content/relay-operations/technical-setup/bridge/freebsd/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/relay-operations/technical-setup/bridge/freebsd/contents.lr b/content/relay-operations/technical-setup/bridge/freebsd/contents.lr index 951ef31..93f7aec 100644 --- a/content/relay-operations/technical-setup/bridge/freebsd/contents.lr +++ b/content/relay-operations/technical-setup/bridge/freebsd/contents.lr @@ -27,7 +27,7 @@ BridgeRelay 1 # censors may be scanning the Internet for this port. ORPort TODO1 -ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy +ServerTransportPlugin obfs4 exec /usr/local/bin/obfs4proxy # Replace "TODO2" with an obfs4 port of your choice. This port must be # externally reachable and must be different from the one specified for ORPort.

1 0

[community/develop] Harmonise instructions with other guides.
by hiro＠torproject.org 18 Sep '19

18 Sep '19

commit 3ece2fbb2c9f1b28cca37603e0f1278ee2b5a1ab Author: Philipp Winter <phw(a)nymity.ch> Date: Wed Sep 4 09:44:59 2019 -0700 Harmonise instructions with other guides. In particular: * Use "TODO1" and "TODO2" to make it clear that the OR and the obfs4 port are separate ports. * Slightly rephrase comments for selinux commands. * Fix link to help section. * Fix subtitle. --- .../technical-setup/bridge/fedora/contents.lr | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/content/relay-operations/technical-setup/bridge/fedora/contents.lr b/content/relay-operations/technical-setup/bridge/fedora/contents.lr index 40ad6a9..d4c2734 100644 --- a/content/relay-operations/technical-setup/bridge/fedora/contents.lr +++ b/content/relay-operations/technical-setup/bridge/fedora/contents.lr @@ -30,17 +30,18 @@ And tell selinux to allow Tor to use obfs4proxy: RunAsDaemon 1 BridgeRelay 1 -# Replace "TODO" with a Tor port of your choice. This port must be externally +# Replace "TODO1" with a Tor port of your choice. This port must be externally # reachable. Avoid port 9001 because it's commonly associated with Tor and # censors may be scanning the Internet for this port. -ORPort TODO +ORPort TODO1 ServerTransportPlugin obfs4 exec /usr/local/bin/obfs4proxy -# Replace "TODO" with an obfs4 port of your choice. This port must be -# externally reachable. Avoid port 9001 because it's commonly associated with +# Replace "TODO2" with an obfs4 port of your choice. This port must be +# externally reachable and must be different from the one specified for ORPort. +# Avoid port 9001 because it's commonly associated with # Tor and censors may be scanning the Internet for this port. -ServerTransportListenAddr obfs4 0.0.0.0:TODO +ServerTransportListenAddr obfs4 0.0.0.0:TODO2 # Local communication port between Tor and obfs4. Always set this to "auto". # "Ext" means "extended", not "external". Don't try to set a specific port @@ -62,8 +63,8 @@ Nickname PickANickname ### 4. Restart tor ``` -sudo semanage port -a -t tor_port_t -p tcp [desired ORPort number set earlier] -sudo semanage port -a -t tor_port_t -p tcp [desired ServerTransportListenAddr port number set earlier] +sudo semanage port -a -t tor_port_t -p tcp [OR port set earlier, in TODO1] +sudo semanage port -a -t tor_port_t -p tcp [obfs4 port set earlier, in TODO2] systemctl restart tor ``` @@ -84,7 +85,7 @@ To confirm your bridge is running with no issues, you should see something like ### 6. Final notes If you are having troubles setting up your bridge, have a look at [our help -section](https://community.torproject.org/relay/setup/bridge/getting-help/). If +section](https://community.torproject.org/relay/getting-help/). If your bridge is now running, check out the [post-install notes](https://community.torproject.org/relay/setup/bridge/post-install/). @@ -97,7 +98,7 @@ key: --- color: primary --- -subtitle: How to deploy an obfs4 bridge on CentOS / RHEL / OpenSUSE +subtitle: How to deploy an obfs4 bridge on Fedora --- _template: layout.html ---

1 0