March 2011 - tor-relays - lists.torproject.org

Re: [tor-relays] Network Scan through Tor Exit Node (Port 80)
by Scott Bennett 02 Apr '11

02 Apr '11

On Thu, 10 Mar 2011 10:27:50 -0800 Chris Palmer <chris(a)eff.org> wrote: >On 03/10/2011 09:10 AM, mick wrote: > >> Using Tor to scan the internet is a good way to see how the internet >> looks from different perspectives at once, which can be quite valuable." >> >> Which says to me that you are using Tor to do this research. > >No, it says to you that using Tor to scan the internet is a good way to >see how the internet looks from different perspectives at once, which >can be quite valuable. > >> So which is it? > >The Observatory work was not done through Tor. Good. > >However, using Tor to scan the internet is a good way to see how the >internet looks from different perspectives at once, which can be quite >valuable, so I vociferously defend the idea of doing so. > Ah. "The ends justify the means." How enlightened. :-( Scott Bennett, Comm. ASMELG, CFIAG ********************************************************************** * Internet: bennett at cs.niu.edu * *--------------------------------------------------------------------* * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * * -- Gov. John Hancock, New York Journal, 28 January 1790 * **********************************************************************

2 1

Tor not releasing port on shutdown?
by Geoff Down 02 Apr '11

02 Apr '11

Hi, the most recent times I have tried to restart Tor after a 'killall -INT' I have been presented with the following error: "[warn] Could not bind to 0.0.0.0:9001: Address already in use. Is Tor already running?" I'm not sure if this has started since I changed version, I'm on Tor 0.2.2.22-alpha (git-e5e38e55b33b2cc0) OSX 10.3.9 . Anyone else see this? How do I release that port? Command 'lsof -i' returns no results, so I don't see Tor is really using it still - no sign of Tor in command 'ps -aux' output. Update: after running those commands, Tor was able to start. Why the delay? Is this normal? TIA GD -- http://www.fastmail.fm - The professional email service

5 5

Re: [tor-relays] Network Scan through Tor Exit Node (Port 80)
by Scott Bennett 29 Mar '11

29 Mar '11

On Wed, 9 Mar 2011 19:18:34 -0500 cmeclax-sazri <cmeclax-sazri(a)ixazon.dynip.com> wrote: >On Wednesday 09 March 2011 17:20:17 Chris Palmer wrote: >> On 03/09/2011 01:48 PM, Arjan wrote: >> >> We are saying hello on port 443, and then saying goodbye. Once. Using >> >> normal TCP and TLS handshaking, no tricks. For the good of the internet. >> > >> > That would be enough to get me in trouble with my ISP for performing >> > portscans (if I were running an exit node). >> >> And how would you, or anyone else, differentiate that from normal web >> browsing? > >If a lot of those connection attempts are going to IP addresses with no host >present, or hosts not running a webserver, it looks like portscanning. If >almost all of the connection attempts are to webservers that have port 443 >open, it looks like normal https web browsing. Are you kidding? Closing a connection upon receipt of the ACK response to the SYN you sent looks like normal HTTPS web browsing? On what planet? Normal web browsing, whether HTTP or HTTPS, involves data transmission occurring in both directions between receipt of that ACK and the closing of the connection by the web browser. Closing the connection upon receipt of the ACK response to the SYN without any intervening data transmission is, OTOH, a characteristic behavior of port scanners. So you had it backwards. Here's a tidbit for you to consider. pf offers an option on filtering rules for inbound SSL connections called "synproxy", which relieves server software of the effort of dealing with bogus connection attempts by handling the SSL exchanges itself before passing the connection on to the server. It also means that a connection from something that doesn't know how to perform the SSL handshaking will sit until the timeout occurs, so the attacker is stuck with an outstanding connection tying up resources until that happens. That delay of a couple of minutes can be a long and wasteful nuisance to an attacker. OTOH, a legitimate application, e.g., a tor client or relay trying to connect to the ORPort of another relay, completes the handshake and begins communicating with its peer with no delay, and the software accepting the connection only deals with the legitimate connections. It works just great! :-) I highly recommend it to anyone running a tor relay on a system that supports pf. > >I have only one external address and only a few ports forwarded, so I can't >detect portscans. I have noticed that an attempt to guess passwords on SSH is >often, but not always, preceded by a connect and disconnect from the same IP >address, which is probably part of a portscan. I don't block addresses that >scan ports, but I do block addresses that try to guess passwords (not on the >Tor box, just on the other one). The block expires in a day. > To each his/her own. Legitimate port scanning operations are typically run by system/network administrators against the machines on their *own networks*. I treat any others as attackers or at least attacker-wannabes, and I keep track of such miscreants indefinitely against the possibility that I might someday provide services other than tor relaying. The miscreants will have no access to such services on general principles and will only have access to the tor node if and when they are currently running a public (i.e., not a bridge) tor node on the system with the IP address from which their tor attempts to connect to mine. Scott Bennett, Comm. ASMELG, CFIAG ********************************************************************** * Internet: bennett at cs.niu.edu * *--------------------------------------------------------------------* * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * * -- Gov. John Hancock, New York Journal, 28 January 1790 * **********************************************************************

4 4

Bridges on OpenWrt
by Mitar 29 Mar '11

29 Mar '11

Hi! Is there some package for running Tor bridges on OpenWrt supported devices? But as I understand Tor bridges consumes same amount of CPU power and RAM as Tor itself so they are not really possible for low power devices as WiFi routers where OpenWrt normally runes (with typically around 16 MB RAM and 200 MHz CPU power). But on the other hand, as we have in operation a lot of WiFi routers around the country, many of them having their own public IP from very diverse IP ranges, this would be quite useful for bridges. So my question is if somebody has tried to do something like that? Have some experience with it? And also if maybe bridges support would be possible to extend so that we could make (low overhead) tunnels from this WiFi routers to the central server where there would be running a Tor node connected to the Tor network, having enough CPU power and RAM to run everything. So it would be great if the Tor clients would be able to connect to those VPNed end points, but encryption itself would be done on the server. Mitar

3 5

multiple tor nodes on one router? was first using bridge then become bridge
by Lorenz Kirchner 27 Mar '11

27 Mar '11

Hi everyone, so I received no hint as to how or whether to pursue this thought... i shall find other sources of information I just started reading the manual, would you believe it.. I have a new question now, I currently have set up number of tor relays on my router which are loadbalanced using squid... in the hope to increase throughput and perhaps achieve increased anonymity by sending requests for one site through different tor routes... Is that advisable or even effective? My feeling is that the connection is somewhat more reliable than with just one tor relay.. and following on with this could one of these relays be set up to connect to tor via a bridge and then pass directory info on to the other relays running on the same machine? Kind regards, Loz On Thu, Mar 10, 2011 at 11:16 PM, Lorenz Kirchner <znerol2(a)gmail.com> wrote: > On 3/9/11 11:29 PM, mick wrote: > >> >> This this: >>> https://sites.google.com/a/infosecurity.ch/testst/ >>> >>> It's the google spreadsheet that load the bridge information embedded >>> into a google site. >>> >> I need a google account for that. What if I don't want one? >> >> So, any new ideas anybody? I still feel it would be best if 1. there was > a special function within tor to change from using a bridge to becoming a > bridge whithin the censored network, and 2. spreading this bridge-status > info locally... perhaps like dht in torrent.. only revealing a small > selection of available bridges nearby.. i obviously only have a very dim > idea of what i'm talking about.. sorry about that > > anyways, if these two problems could be addressed tor could be a biggie > with a lot of people here.. ;) -- think: cheap openwrt low maintenance > appliance.. > > Loz >

2 2

what updates do I need to install?
by Kathryn Cramer 25 Mar '11

25 Mar '11

I gather from Jacob's Twitter feed that I should download and install the new Tor Browser Bundle because of security updates. Will this affect the relay I am running? Do I also need to update Vidalia? Kathryn

2 1

IRQ affinity
by Mitar 24 Mar '11

24 Mar '11

Hi! I do not know if you have solved this but reading here: http://www.alexonlinux.com/smp-affinity-and-proper-interrupt-handling-in-li… It is written that: "So if on your system CPU0 handles all interrupts by default, this probably means that APIC configured ambiguously." So maybe it is nothing wrong with e1000e drivers/cards but with APIC configuration? Mitar

1 1

frequency of checking an IP change
by tagnaq 23 Mar '11

23 Mar '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, I'm wondering how often Tor tries to detect an IP change of itself and if a relay operator can modify that frequency? Observing the detection point in time and the actual IP change I guess it takes several minutes: - From the logfile: 00:33:30 Tor: Our IP Address has changed from ... to ... The new IP address was actually assigned several minutes before: 00:27:53 (check occurs every 10seconds) It would be valueable to modify the frequency because the relay in question gets a new IP address every few hours (<10h). Looking at the man page I couldn't find anything regarding that frequency. kind regards, tagnaq -----BEGIN PGP SIGNATURE----- iF4EAREKAAYFAk2J3ZIACgkQyM26BSNOM7b4NwD/QmH0RWDsp0muCy0PFtkE0Gw4 TDNZx4eDYcOLKfvRX5UA/1PdG8w7DYtfvktWGkzBj82d6/gFo68oVJ+QAM8yqvWU =wnE6 -----END PGP SIGNATURE-----

1 0

abuse reports from shadowserver.org
by Alexander Bernauer 21 Mar '11

21 Mar '11

Hi everybody, my ISP keeps on receiving abuse reports from shadowserver.org. They claim that an IRC bot operates from the IP that belongs to my tor exit. The strange thing is that my exit policy only allows web and mail ports. Furthermore, the IPs of the shadowserver honeypots have a ptr entry for *.sinkhole.shadowserver.org. So, I could block their servers either by means of the exit policy or with iptables. Which one would you prefer? I additionally wanted to ask here if there is any experience with shadowserver in this regard? Explaining the issue to my ISP failed. They keep on getting nervous. Talking to shadowserver also failed, because subscription to their public mailing list is moderated and my direct mails have been ignored for several months now. Any advice? regards Alex

6 6

weighting algorithm
by Olaf Selke 16 Mar '11

16 Mar '11

Hi, between Saturday evening and Tuesday afternoon (UTC+1) my relay's bandwidth dropped to about 2/3 of its normal value. Did some changes in directory's weighting algorithm occur during this time period? regards Olaf

5 6