March 2021 - tor-commits - lists.torproject.org

[community/staging] Use TODO1 and TODO2 to highlight port difference.
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 4577ba8d28a5716e5866e309ff49d182e63bea10 Author: Philipp Winter <phw(a)nymity.ch> Date: Tue Sep 3 08:45:32 2019 -0700 Use TODO1 and TODO2 to highlight port difference. We don't want people to think that the OR port and obfs4 port are supposed to be the same. Thanks to Ken Kundert for pointing out this issue and for fixing it for CentOS/RHEL/OpenSuSE in commit a6a8c35. --- .../technical-setup/bridge/debian-ubuntu/contents.lr | 12 +++++++----- .../technical-setup/bridge/freebsd/contents.lr | 11 ++++++----- .../technical-setup/bridge/openbsd/contents.lr | 11 ++++++----- 3 files changed, 19 insertions(+), 15 deletions(-) diff --git a/content/relay-operations/technical-setup/bridge/debian-ubuntu/contents.lr b/content/relay-operations/technical-setup/bridge/debian-ubuntu/contents.lr index eed3be8..b97259c 100644 --- a/content/relay-operations/technical-setup/bridge/debian-ubuntu/contents.lr +++ b/content/relay-operations/technical-setup/bridge/debian-ubuntu/contents.lr @@ -25,16 +25,18 @@ If not, you can [build it from source](https://gitlab.com/yawning/obfs4#installa ``` BridgeRelay 1 -# Replace "TODO" with a Tor port of your choice. This port must be externally +# Replace "TODO1" with a Tor port of your choice. This port must be externally # reachable. Avoid port 9001 because it's commonly associated with Tor and # censors may be scanning the Internet for this port. -ORPort TODO +ORPort TODO1 ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy -# Replace "TODO" with an obfs4 port of your choice. This port must be externally reachable. -# Avoid port 9001 because it's commonly associated with Tor and censors may be scanning the Internet for this port. -ServerTransportListenAddr obfs4 0.0.0.0:TODO +# Replace "TODO2" with an obfs4 port of your choice. This port must be +# externally reachable and must be different from the one specified for ORPort. +# Avoid port 9001 because it's commonly associated with +# Tor and censors may be scanning the Internet for this port. +ServerTransportListenAddr obfs4 0.0.0.0:TODO2 # Local communication port between Tor and obfs4. Always set this to "auto". # "Ext" means "extended", not "external". Don't try to set a specific port number, nor listen on 0.0.0.0. diff --git a/content/relay-operations/technical-setup/bridge/freebsd/contents.lr b/content/relay-operations/technical-setup/bridge/freebsd/contents.lr index 862551a..951ef31 100644 --- a/content/relay-operations/technical-setup/bridge/freebsd/contents.lr +++ b/content/relay-operations/technical-setup/bridge/freebsd/contents.lr @@ -22,17 +22,18 @@ pkg install obfs4proxy-tor tor ca_root_nss RunAsDaemon 1 BridgeRelay 1 -# Replace "TODO" with a Tor port of your choice. This port must be externally +# Replace "TODO1" with a Tor port of your choice. This port must be externally # reachable. Avoid port 9001 because it's commonly associated with Tor and # censors may be scanning the Internet for this port. -ORPort TODO +ORPort TODO1 ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy -# Replace "TODO" with an obfs4 port of your choice. This port must be -# externally reachable. Avoid port 9001 because it's commonly associated with +# Replace "TODO2" with an obfs4 port of your choice. This port must be +# externally reachable and must be different from the one specified for ORPort. +# Avoid port 9001 because it's commonly associated with # Tor and censors may be scanning the Internet for this port. -ServerTransportListenAddr obfs4 0.0.0.0:TODO +ServerTransportListenAddr obfs4 0.0.0.0:TODO2 # Local communication port between Tor and obfs4. Always set this to "auto". # "Ext" means "extended", not "external". Don't try to set a specific port diff --git a/content/relay-operations/technical-setup/bridge/openbsd/contents.lr b/content/relay-operations/technical-setup/bridge/openbsd/contents.lr index 96ffc95..50d1a26 100644 --- a/content/relay-operations/technical-setup/bridge/openbsd/contents.lr +++ b/content/relay-operations/technical-setup/bridge/openbsd/contents.lr @@ -21,17 +21,18 @@ Usually located at `/etc/tor/torrc`, and replace its content with: RunAsDaemon 1 BridgeRelay 1 -# Replace "TODO" with a Tor port of your choice. This port must be externally +# Replace "TODO1" with a Tor port of your choice. This port must be externally # reachable. Avoid port 9001 because it's commonly associated with Tor and # censors may be scanning the Internet for this port. -ORPort TODO +ORPort TODO1 ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy -# Replace "TODO" with an obfs4 port of your choice. This port must be -# externally reachable. Avoid port 9001 because it's commonly associated with +# Replace "TODO2" with an obfs4 port of your choice. This port must be +# externally reachable and must be different from the one specified for ORPort. +# Avoid port 9001 because it's commonly associated with # Tor and censors may be scanning the Internet for this port. -ServerTransportListenAddr obfs4 0.0.0.0:TODO +ServerTransportListenAddr obfs4 0.0.0.0:TODO2 # Local communication port between Tor and obfs4. Always set this to "auto". # "Ext" means "extended", not "external". Don't try to set a specific port

1 0

[community/staging] Contact us in frontdesk instead of tor-assistants
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 94a79592cae6b0094e989a26d1a1832572719ae0 Author: gus <gus(a)torproject.org> Date: Tue Sep 3 11:58:52 2019 -0400 Contact us in frontdesk instead of tor-assistants --- .../community-resources/tor-exit-guidelines/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr b/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr index 3d31bf1..7529051 100644 --- a/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr +++ b/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr @@ -103,7 +103,7 @@ At least law enforcement in Germany regularly uses the fax and phone numbers pre The [Reduced Exit Policy](https://trac.torproject.org/projects/tor/wiki/doc/ReducedExitPolicy) is an alternative to the default exit policy. It allows many Internet services while still blocking the majority of TCP ports. This drastically reduces the odds that a Bittorrent user will select your node and thus reduces or even eliminates the number of [DMCA complaints](/relay/community-resources/eff-tor-legal-faq/tor-dmca-response/) you will receive. -If you have your own experience of abuse handling, just share it on our public mailing list or write us an email to tor-assistants(a)torproject.org. +If you have your own experience of abuse handling, just share it on our public mailing list or write us an email to frontdesk(a)torproject.org. ## Technical

1 0

[community/staging] Link to trac ReducedEXitPolicy wiki page
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 6cff11d4c7580431b34c408311c6e410e6e993d7 Author: gus <gus(a)torproject.org> Date: Tue Sep 3 11:56:52 2019 -0400 Link to trac ReducedEXitPolicy wiki page --- .../community-resources/tor-exit-guidelines/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr b/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr index 3165b23..ddbddef 100644 --- a/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr +++ b/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr @@ -100,7 +100,7 @@ At least law enforcement in Germany regularly uses the fax and phone numbers pre ### Consider using the Reduced Exit Policy. -The [Reduced Exit Policy](FIXME) is an alternative to the default exit policy. It allows many Internet services while still blocking the majority of TCP ports. +The [Reduced Exit Policy](https://trac.torproject.org/projects/tor/wiki/doc/ReducedExitPolicy) is an alternative to the default exit policy. It allows many Internet services while still blocking the majority of TCP ports. This drastically reduces the odds that a Bittorrent user will select your node and thus reduces or even eliminates the number of [DMCA complaints](https://2019.www.torproject.org/eff/tor-dmca-response) you will receive. If you have your own experience of abuse handling, just share it on our public mailing list or write us an email to tor-assistants(a)torproject.org.

1 0

[community/staging] Added Fedora Guide
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 00e385fc1fbf6469a240ab6e2c84eff12487ee81 Author: Chris King <bunnyapocalypse(a)protonmail.com> Date: Tue Sep 3 11:26:27 2019 -0500 Added Fedora Guide --- .../technical-setup/bridge/fedora/contents.lr | 102 +++++++++++++++++++++ 1 file changed, 102 insertions(+) diff --git a/content/relay-operations/technical-setup/bridge/fedora/contents.lr b/content/relay-operations/technical-setup/bridge/fedora/contents.lr new file mode 100644 index 0000000..a1584b0 --- /dev/null +++ b/content/relay-operations/technical-setup/bridge/fedora/contents.lr @@ -0,0 +1,102 @@ +_model: page +--- +color: primary +--- +title: Fedora +--- +body: + +### 1. Install tor and dependencies + +``` +dnf install git golang tor policycoreutils-python-utils +``` + +### 2. Build obfs4proxy and move it into place. + +``` +export GOPATH=`mktemp -d` +go get gitlab.com/yawning/obfs4.git/obfs4proxy +sudo cp $GOPATH/bin/obfs4proxy /usr/bin/ +``` + +### 3. Edit your Tor config file, usually located at `/etc/tor/torrc` and replace its content with: + +``` +RunAsDaemon 1 +BridgeRelay 1 + +# Replace "TODO" with a Tor port of your choice. This port must be externally +# reachable. Avoid port 9001 because it's commonly associated with Tor and +# censors may be scanning the Internet for this port. +ORPort TODO + +ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy + +# Replace "TODO" with an obfs4 port of your choice. This port must be +# externally reachable. Avoid port 9001 because it's commonly associated with +# Tor and censors may be scanning the Internet for this port. +ServerTransportListenAddr obfs4 0.0.0.0:TODO + +# Local communication port between Tor and obfs4. Always set this to "auto". +# "Ext" means "extended", not "external". Don't try to set a specific port +# number, nor listen on 0.0.0.0. +ExtORPort auto + +# Replace "<address(a)email.com>" with your email address so we can contact you if +# there are problems with your bridge. This is optional but encouraged. +ContactInfo <address(a)email.com> + +# Pick a nickname that you like for your bridge. This is optional. +Nickname PickANickname +``` + + Don't forget to change the `ORPort`, `ServerTransportListenAddr`, `ContactInfo`, and `Nickname` options. + +* Note that both Tor's OR port and its obfs4 port must be reachable. If your bridge is behind a firewall or NAT, make sure to open both ports. You can use [our reachability test](https://bridges.torproject.org/scan/) to see if your obfs4 port is reachable from the Internet. + +### 4. Restart tor + +``` +sudo semanage port -a -t tor_port_t -p tcp [desired ORPort number set earlier] +sudo semanage port -a -t tor_port_t -p tcp [desired ServerTransportListenAddr port number set earlier] +systemctl restart tor +``` + +### 5. Monitor your logs (usually in your syslog) + +To confirm your bridge is running with no issues, you should see something like this: + +``` +[notice] Your Tor server's identity key fingerprint is '<NICKNAME> <FINGERPRINT>' +[notice] Your Tor bridge's hashed identity key fingerprint is '<NICKNAME> <HASHED FINGERPRINT>' +[notice] Registered server transport 'obfs4' at '[::]:46396' +[notice] Tor has successfully opened a circuit. Looks like client functionality is working. +[notice] Bootstrapped 100%: Done +[notice] Now checking whether ORPort <redacted>:3818 is reachable... (this may take up to 20 minutes -- look for log messages indicating success) +[notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor. +``` + +### 6. Final notes + +If you are having troubles setting up your bridge, have a look at [our help +section](https://community.torproject.org/relay/setup/bridge/getting-help/). If +your bridge is now running, check out the [post-install +notes](https://community.torproject.org/relay/setup/bridge/post-install/). + +--- +html: two-columns-page.html +--- +key: + +2 +--- +color: primary +--- +subtitle: How to deploy an obfs4 bridge on CentOS / RHEL / OpenSUSE +--- +_template: layout.html +--- +section: bridge +--- +section_id: bridge

1 0

[community/staging] Make instructions non-redundant
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 4ebd0280503d5dc64cbe86df5ab9732cc0ebaa9a Author: Christopher King <bunnyapocalypse(a)protonmail.com> Date: Wed Sep 4 18:06:17 2019 +0000 Make instructions non-redundant --- .../technical-setup/bridge/centos-rhel-opensuse/contents.lr | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/content/relay-operations/technical-setup/bridge/centos-rhel-opensuse/contents.lr b/content/relay-operations/technical-setup/bridge/centos-rhel-opensuse/contents.lr index 521ed71..914ca90 100644 --- a/content/relay-operations/technical-setup/bridge/centos-rhel-opensuse/contents.lr +++ b/content/relay-operations/technical-setup/bridge/centos-rhel-opensuse/contents.lr @@ -81,18 +81,17 @@ Nickname PickANickname ### 4. Restart tor -* CentOS / RHEL / OpenSUSE: - -`systemctl restart tor` - * RHEL / CentOS: ``` sudo semanage port -a -t tor_port_t -p tcp [desired ORPort number set earlier] sudo semanage port -a -t tor_port_t -p tcp [desired ServerTransportListenAddr port number set earlier] -systemctl restart tor ``` +* CentOS / RHEL / OpenSUSE: + +`systemctl restart tor` + ### 5. Monitor your logs (usually in your syslog) To confirm your bridge is running with no issues, you should see something like this:

1 0

[community/staging] Harmonise instructions with other guides.
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit e2b8aa6cbebe15f24e38b58ca3f27403b1746f36 Author: Philipp Winter <phw(a)nymity.ch> Date: Wed Sep 4 09:44:59 2019 -0700 Harmonise instructions with other guides. In particular: * Use "TODO1" and "TODO2" to make it clear that the OR and the obfs4 port are separate ports. * Slightly rephrase comments for selinux commands. * Fix link to help section. * Fix subtitle. --- .../technical-setup/bridge/fedora/contents.lr | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/content/relay-operations/technical-setup/bridge/fedora/contents.lr b/content/relay-operations/technical-setup/bridge/fedora/contents.lr index 40ad6a9..d4c2734 100644 --- a/content/relay-operations/technical-setup/bridge/fedora/contents.lr +++ b/content/relay-operations/technical-setup/bridge/fedora/contents.lr @@ -30,17 +30,18 @@ And tell selinux to allow Tor to use obfs4proxy: RunAsDaemon 1 BridgeRelay 1 -# Replace "TODO" with a Tor port of your choice. This port must be externally +# Replace "TODO1" with a Tor port of your choice. This port must be externally # reachable. Avoid port 9001 because it's commonly associated with Tor and # censors may be scanning the Internet for this port. -ORPort TODO +ORPort TODO1 ServerTransportPlugin obfs4 exec /usr/local/bin/obfs4proxy -# Replace "TODO" with an obfs4 port of your choice. This port must be -# externally reachable. Avoid port 9001 because it's commonly associated with +# Replace "TODO2" with an obfs4 port of your choice. This port must be +# externally reachable and must be different from the one specified for ORPort. +# Avoid port 9001 because it's commonly associated with # Tor and censors may be scanning the Internet for this port. -ServerTransportListenAddr obfs4 0.0.0.0:TODO +ServerTransportListenAddr obfs4 0.0.0.0:TODO2 # Local communication port between Tor and obfs4. Always set this to "auto". # "Ext" means "extended", not "external". Don't try to set a specific port @@ -62,8 +63,8 @@ Nickname PickANickname ### 4. Restart tor ``` -sudo semanage port -a -t tor_port_t -p tcp [desired ORPort number set earlier] -sudo semanage port -a -t tor_port_t -p tcp [desired ServerTransportListenAddr port number set earlier] +sudo semanage port -a -t tor_port_t -p tcp [OR port set earlier, in TODO1] +sudo semanage port -a -t tor_port_t -p tcp [obfs4 port set earlier, in TODO2] systemctl restart tor ``` @@ -84,7 +85,7 @@ To confirm your bridge is running with no issues, you should see something like ### 6. Final notes If you are having troubles setting up your bridge, have a look at [our help -section](https://community.torproject.org/relay/setup/bridge/getting-help/). If +section](https://community.torproject.org/relay/getting-help/). If your bridge is now running, check out the [post-install notes](https://community.torproject.org/relay/setup/bridge/post-install/). @@ -97,7 +98,7 @@ key: --- color: primary --- -subtitle: How to deploy an obfs4 bridge on CentOS / RHEL / OpenSUSE +subtitle: How to deploy an obfs4 bridge on Fedora --- _template: layout.html ---

1 0

[community/staging] Merge remote-tracking branch 'ggus/community-resources'
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 742479de17aa723e0792911cb80745c8cd03915d Merge: 7557129 02bc5b6 Author: emma peel <emma.peel(a)riseup.net> Date: Tue Sep 3 18:19:34 2019 +0200 Merge remote-tracking branch 'ggus/community-resources' .../community-resources/contents.lr | 2 +- .../eff-tor-legal-faq/contents.lr | 2 +- .../tor-dmca-response/contents.lr | 4 ++-- .../community-resources/good-bad-isps/contents.lr | 16 ++++++-------- .../{swags => swag}/contents.lr | 6 +++--- .../tor-abuse-templates/contents.lr | 2 +- .../tor-exit-guidelines/contents.lr | 12 +++++------ .../tor-relay-universities/contents.lr | 25 +++++++++------------- .../relays-requirements/contents.lr | 6 +++--- .../technical-considerations/contents.lr | 2 +- .../relay-operations/types-of-relays/contents.lr | 2 +- 11 files changed, 35 insertions(+), 44 deletions(-)

1 0

[community/staging] Update contents.lr
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 58c72a4ea76a22481b46f7bc5f98a1b20909fdbb Author: Christopher King <bunnyapocalypse(a)protonmail.com> Date: Tue Sep 3 16:46:44 2019 +0000 Update contents.lr --- .../relay-operations/technical-setup/bridge/fedora/contents.lr | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/content/relay-operations/technical-setup/bridge/fedora/contents.lr b/content/relay-operations/technical-setup/bridge/fedora/contents.lr index a1584b0..40ad6a9 100644 --- a/content/relay-operations/technical-setup/bridge/fedora/contents.lr +++ b/content/relay-operations/technical-setup/bridge/fedora/contents.lr @@ -17,7 +17,11 @@ dnf install git golang tor policycoreutils-python-utils ``` export GOPATH=`mktemp -d` go get gitlab.com/yawning/obfs4.git/obfs4proxy -sudo cp $GOPATH/bin/obfs4proxy /usr/bin/ +sudo cp $GOPATH/bin/obfs4proxy /usr/local/bin/ +``` +And tell selinux to allow Tor to use obfs4proxy: +``` +/sbin/restorecon -v /usr/local/bin/obfs4proxy ``` ### 3. Edit your Tor config file, usually located at `/etc/tor/torrc` and replace its content with: @@ -31,7 +35,7 @@ BridgeRelay 1 # censors may be scanning the Internet for this port. ORPort TODO -ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy +ServerTransportPlugin obfs4 exec /usr/local/bin/obfs4proxy # Replace "TODO" with an obfs4 port of your choice. This port must be # externally reachable. Avoid port 9001 because it's commonly associated with

1 0

[community/staging] Merge branch 'patch-1' of github.com:BunnyApocalypse/community into patch-1
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit beb4f69cf7af71e6f2d74760725ae44681e87c5b Merge: e2b8aa6 4ebd028 Author: Philipp Winter <phw(a)nymity.ch> Date: Wed Sep 4 12:01:44 2019 -0700 Merge branch 'patch-1' of github.com:BunnyApocalypse/community into patch-1 .../technical-setup/bridge/centos-rhel-opensuse/contents.lr | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)

1 0

[community/staging] Fix broken installation path.
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 31fda162a25a06f979c49b85c788ee268664cb19 Author: Philipp Winter <phw(a)nymity.ch> Date: Wed Sep 4 09:04:56 2019 -0700 Fix broken installation path. Thanks to Wolfgang for pointing out this issue and to egypcio for confirming that it was indeed an issue. --- content/relay-operations/technical-setup/bridge/freebsd/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/relay-operations/technical-setup/bridge/freebsd/contents.lr b/content/relay-operations/technical-setup/bridge/freebsd/contents.lr index 951ef31..93f7aec 100644 --- a/content/relay-operations/technical-setup/bridge/freebsd/contents.lr +++ b/content/relay-operations/technical-setup/bridge/freebsd/contents.lr @@ -27,7 +27,7 @@ BridgeRelay 1 # censors may be scanning the Internet for this port. ORPort TODO1 -ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy +ServerTransportPlugin obfs4 exec /usr/local/bin/obfs4proxy # Replace "TODO2" with an obfs4 port of your choice. This port must be # externally reachable and must be different from the one specified for ORPort.

1 0