March 2014 - tor-mirrors - lists.torproject.org

New Tor Mirror and Introduction
by Max Jakob Maass 09 Apr '14

09 Apr '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi everyone, I'm a CS Student and part-time polically interested activist from Germany, specializing in privacy and security. I am running a server together with a friend, and we are already running a Tor Relay [0] that has been active for almost two years with minimal interruptions (for example, when our providers network infrastructure went offline about a month ago. sigh). Seeing the situation in turkey, I finally decided to also mirror the tor website. So, feel free to add the following to your list: HTTP dist/: http://mirror.velcommuta.de/tor/dist/ HTTP website: http://mirror.velcommuta.de/tor/ HTTPS dist/: https://mirror.velcommuta.de/tor/dist/ HTTPS website: https://mirror.velcommuta.de/tor/ The SSL CA is StartCom / StartSSL. Certificate Fingerprints: SHA1: E1:29:6D:B5:0F:C8:8E:BA:57:41:DA:0B:FA:71:C2:E7:88:68:28:9E SHA256: 63:29:C9:E5:AA:AB:74:78:D4:FB:87:5E:40:C1:25:5A:3D:62:7B:C7: 12:89:45:B6:E4:D8:F9:C6:97:AB:C8:F3 SHA512: A5:1B:AB:E8:B3:37:78:97:1A:77:07:D5:E8:32:C6:8A:CD:88:25:66: 96:8D:AC:4B:D4:49:30:B4:D1:4F:77:6C:AF:C0:5E:76:02:BC:F5:D5: 99:70:B8:E5:2F:3C:0D:EB:9D:AB:29:0D:FF:59:97:59:A4:DE:3F:04: 7A:C1:EA:8E (in case anyone wants to check, the up-to-date cert fingerprints can always be found at [1], signed by my PGP key [2]) The mirror is reachable using IPv4 and IPv6. Two questions: 1. Is it desirable to force SSL connections using a .htaccess file, or should I avoid that, as some countries will terminate / track SSL connections? 2. Would it make sense to also make the mirror available as a hidden service, so people already using Tor can get new versions by downloading them from a hidden service? As that would entail almost zero extra work, I would be perfectly willing to add the few lines to my torrc to make that possible. Sincerely, Max Maass P.S.: If I have missed any pitfalls when configuring the mirror, please let me know. [0] http://torstatus.blutmagie.de/router_detail.php?FP=f606c4dc0fc5ca80cd6f22ba… [1] https://verify.velcommuta.de/ssl/ssl.txt [2] FP: 84C4 8097 A3AF 7D55 189A 77AC 169F 9624 3408 825E -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQJ8BAEBCgBmBQJTNHT7XxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQ4NEM0ODA5N0EzQUY3RDU1MTg5QTc3QUMx NjlGOTYyNDM0MDg4MjVFAAoJEBafliQ0CIJe15kP/jrEktFIuhlAa5fjyTDzFAyj gS5zFNH/e65MyxdsDH0sgThHr0hyrXcp4FuFGwEMWz2ZGR9sKkD9CgvZi3a7Z5hR WAKLdfkdU2blr+vlRHrtJ/JFtATzokAPtb/YwVaUQksBnncV0Abo4s7WJ9uDqxmd wasLRY3FVX/61k4m2T200tnkTMNGph7UcTGeKhYduiMZHfndrU3w6HcNa2llAX0g 5R0tWOVeNSKT2US482z03cDo6aYud4BRF7Cx0U+7rjxXaPvPBcVlmO4JxD8OiFhW +LyRuf2jhANNOzpl1q+pKSngjRN15P2QdfYf9p7o9A4Sgv3+McKYuMqlfSr3NUj/ vFHm1mZTUIi1TNQoWZvoyWlPCY4QQksumrs4SOaYA6U7w4EGNQ1K/G1V/YmPg7OO 1xWrCTaTgzUDGe59RjE9qTx3JhWDBvWOvTTGoBb+UYBLX2eYPZAbMI+m6V6ne7Ae +h6FpjspdgbJUoxIWtERQD7W/deTtFWlfPUP18Z+9YsmU70Fb9dWsoYKMme77k6K 1FAXW/EGUvZT8xobFkraKcR28FpiMaoXUADfZQ33ONrKD+t2tmh/xLtZlrcMphPf +Pk/IRmbaBszhcP9KgOacL2q5jaF9xYFMU0WKjxsv5zd9NgM/+BC1Mlwf3qetJY5 Xy409GfP+yTUZUcuKYZ+ =CFoJ -----END PGP SIGNATURE-----

2 2

Mirror in the DNS?
by Taylor Hornby 31 Mar '14

31 Mar '14

Hi, I wrote this little tool for implementing a "filesystem" in the DNS: https://github.com/defuse/dnsfs I'm sure this has been done before, but I couldn't find anything exactly like it, and it works surprisingly well. Currently you can download the Tor source code from my DNS server like this (note, this is only temporary, I may remove it in the future): for i in `seq 15394`; do host -t TXT f2p$i.dnsfs.defuse.ca | \ cut -d '"' -f 2|base64 --decode; done > /tmp/tor-0.2.4.21.tar.gz Or, if you want to try it but don't want to make *15,394* DNS requests (please respect your ISP's DNS server, the responses will be cached), here's a smaller demo that downloads and displays a text file: for i in `seq 21`; do host -t TXT f1p$i.dnsfs.defuse.ca | \ cut -d '"' -f 2|base64 --decode; done|less I wrote it just for fun, but I realized it might actually be useful for getting Tor and other things to people in censored areas like Turkey. So, my question is: Is this useful at all? Should I keep making Tor available this way? Thanks, -- Taylor Hornby

1 0

Tor Mirror Security
by Taylor Hornby 28 Mar '14

28 Mar '14

Hi, I just set up an experimental Tor mirror here: https://defuse.ca/tor-mirror/ (Please don't include it in any mirror lists yet.) I'm a little worried about security, though. The 'Configuring a Mirror' page [1] has me cloning the Tor website via rsync, which isn't a secure protocol. There are two specific risks here: 1. To the user of the mirror: A network attacker between my server and Tor could have replaced the Tor binaries with a malicious copy. 2. To the host of the mirror: A network attacker, or an evil sysadmin at Tor, could insert PHP scripts (or other things that Apache will execute) into my system, then execute by making a web request. I worked around (2) by adding "php_flag engine off" to the Directory entry in my Apache configuration, but I'm not certain that's good enough. Can the .htaccess in the Tor mirror override it? Are there other things that Apache will execute that I'm not aware of? To solve (1), how about letting users submit an SSH public key so they can rsync over SSH, or just have an account with a stupid password like "tormirror", then publish the SSH fingerprint on torproject.org? A Git repository with signed tags could be another solution. [1] https://www.torproject.org/docs/running-a-mirror.html.en Thanks, -- Taylor Hornby

2 2

ADD mirror tor-mirror-ssl.nicecon.org
by Darren Meyer 27 Mar '14

27 Mar '14

Rsynced every 4 hours, should be HTTPS-only (HTTP redirects to HTTPS): https://tor-mirror-ssl.nicecon.org Intend to keep it available for as long as Tor is blocked in Turkey (or until Turkey blocks that site as well)

1 0

Hello - new mirror
by berkay＠kslt.tk 25 Mar '14

25 Mar '14

Hello. I've opened a new mirror in Turkey, address is http://tor.kslt.tk/. If there's anything broken, please let me know. Thanks, Berkay

3 3

New Torproject Mirror
by info＠xn--externenprfung-nichtschler-7zcn.de 23 Mar '14

23 Mar '14

Hello everybody I'd like to introduce myself: My name's André Schulz and i'm currently hosting a mirror of the Tor website at http://tor.xn--externenprfung-nichtschler-7zcn.de/ and the dist is located at http://tor.xn--externenprfung-nichtschler-7zcn.de/dist/ ------------------------------------------------------------------------------ Via the .htaccess-file I activated Directory Indexing so the dist directory can be seen in public. I didn't buy an SSL-Certificate yet, so i'm only hosting in http - not https. Further information and mirror details: | Country | Organisation | Status | ftp | http dist/ | http website | https dist/ | https website | rsync dist/ | rsync website | | DE | Externenprüfung Nichtschüler | Up to date | - | http [http://tor.xn--externenprfung-nichtschler-7zcn.de/dist/] | http [http://tor.xn--externenprfung-nichtschler-7zcn.de/] | - | - | - | - | To specify the "up do date": I let a cronjob execute an .sh-script every 4 hours so my mirror is synchronized with your primary server every 4 hours ^^ Greetings, André Schulz

2 1

New Tor Mirror
by tailsgnulinux＠gmail.com 05 Mar '14

05 Mar '14

Hello, I have set up a new Tor mirror. It is located in the United States. The url is http://tor.mirrors.tailsgnulinux.org/. Timothy Anderson

4 3

New Tor Mirror, please check
by MacLemon 04 Mar '14

04 Mar '14

Hello! I've set up a new Website Mirror following the instructions from https://www.torproject.org/docs/running-a-mirror.html.en at https://tor-anonymizer.maclemon.at/ Updates are done automatically every 6h via rsync as recommended. Is there anything else I should check, double check, do before submitting it to the official list of mirror servers? Best regards MacLemon

2 1

Re: [tor-mirrors] [Tails-dev] New Tor Mirror
by tailsgnulinux＠gmail.com 02 Mar '14

02 Mar '14

I have added the warning to the top of http://www.tailsgnulinux.org/ as requested. Timothy Anderson From: intrigeri Sent: ‎Wednesday‎, ‎February‎ ‎26‎, ‎2014 ‎8‎:‎47‎ ‎AM To: tailsgnulinux(a)gmail.com Cc: tails-dev(a)boum.org Hi, Lunar wrote (26 Feb 2014 11:13:28 GMT) : > tailsgnulinux(a)gmail.com: >> I have set up a new Tor mirror. It is located in the United States. >> The url is http://tor.mirrors.tailsgnulinux.org/. > Sorry but to the best of my knowledge, the canonical URL for Tails is > <https://tails.boum.org/>. I am quite opposed to adding mirrors with > misleading domain names to the pool of Tor Project's mirrors. I'm afraid people who are looking for Tails might mistakenly believe that tailsgnulinux.org is the real thing. Could you please add a visible warning on this website, that points users to our website? Cheers, -- intrigeri | GnuPG key @ https://gaffer.ptitcanardnoir.org/intrigeri/intrigeri.asc | OTR fingerprint @ https://gaffer.ptitcanardnoir.org/intrigeri/otr.asc

1 0