March 2012 - tor-relays - lists.torproject.org

hardware accel option in tor alpha
by Sebastian Urbach 01 Apr '12

01 Apr '12

Hi, I want to use the "hardware accel" feature with the actual tor alpha version 0.2.3.12-alpha1. My CPUs support the Intel AES NI function and the kernel module is enabled and running well. Im running OpenSSL 1.0.1, the debian dev told me that there is no dynamic loadable aes ni shipped though its supporting th function. Im pretty confused about the options int the torrc right now. I have enabled "hardware accel" but did not define any dynamic loadable engine anymore because there is no one according to the debian dev and also the output from "openssl engine". The debug log does not show any enabled aes / evp functions what so ever. Im stuck right now, does anybody have some advice, woudl be awesome ;-) ? Thanks -- Mit freundlichen Grüßen / Yours sincerely Sebastian Urbach -------------------------------------------------------- Religion is something left over from the infancy of our intelligence, it will fade away as we adopt reason and science as our guidelines. -------------------------------------------------------- Bertrand Arthur William Russell (1872-1970), British philosopher, logician, mathematician, historian, and social critic.

2 3

How does Tor use nameservers?
by Steve Snyder 31 Mar '12

31 Mar '12

I am attempting to load-balance DNS resolution requests. Suppose, in Linux, you have a /etc/resolv.conf with this contents: nameserver aaa.bbb.ccc.ddd nameserver eee.fff.000.111 nameserver 222.333.444.555 How does a Tor exit node use these 3 nameservers? Are they used in a round-robin fashion with the next name resolution request being handled by the next nameserver in rotation? Is the first nameserver ("aaa.bbb.ccc.ddd" above) always used first, with the second being used if the first exceeds some time-out threshold, and the third used only if the first 2 fail? Does a middle node use name resolution at all, or is the relaying based purely on IP addresses? Thanks.

2 1

Questions about exit enclaves
by Jef Heri 31 Mar '12

31 Mar '12

Hello list, I hope this is the correct list to send these questions, if not I apologize and please tell me where I should send this message. I want to setup a Tor node to run as a exit enclave for a web site (WordPress) and message board (vBulletin). However, I have found little documentation on how to accomplish this on a remote server, e.g. https://trac.torproject.org/projects/tor/wiki/doc/ExitEnclave . Is there a more throughout document/manual for exit enclaves? Is it correct that a exit enclave will act as a 'normal' exit node, as well as the exit enclave for its IP address (https://trac.torproject.org/projects/tor/ticket/800)? If so, is it possible to block exit to any IP other than the node's own IP via torrc file? If not, maybe I could only allow exists to white-list IPs, such as Tor Project web site IP, EFF IP, and etc? I believe someone who sends messages to tor-talk maintains a hardened (OS(?) and) Tor, meant to be run as a node only, from remote server space. Does anyone have a link for that software? I looked at the Tor web site but I didn't find information. I am thinking about using that software as the exit enclave. Lastly, is it possible (and smart - re anonymity and resources) to use the exit enclave to offer hidden service address? Thanks!

5 8

Re: [tor-relays] Questions about exit enclaves
by Jef Heri 31 Mar '12

31 Mar '12

Hello Tom and Konstantinos, >>>>> On Mar 30, 2012 14:18:35, "Jef Heri" <jefheri1 at yahoo.com> wrote: >>>>> >>>>> Hello list, >>>>> >>>>> [snip] >>>>> >>>>> Is it correct that a exit enclave will act as a >>>>> 'normal' exit node, as well as the exit enclave for its IP >>>>> address (https://trac.torproject.org/projects/tor/ticket/800)? >>>>> If so, is it possible to block exit to any IP other than the >>>>> node's own IP via torrc file? If not, maybe I could only >>>>> allow exists to white-list IPs, such as Tor Project web site >>>>> IP, EFF IP, and etc? >>>>> >>>>> [snip] >>>>> >>>>> Thanks! >>>> On Mar 30, 2012 14:43:09, "Tom Ritter" <tom at ritter.vg> wrote: >>>> >>>> It's my understanding that if you put the following Exit Policy in your torrc: >>>> >>>> ExitPolicyRejectPrivate 0 >>>> ExitPolicy accept 97.107.139.108 >>>> ExitPolicy reject *:* >>>> >>>> Where 97.107.139.108 is your IP address (that one's mine), you will >>>> Exit Enclave to your site, not allow any other exit traffic, you will >>>> be a normal tor relay (meaning you should check your bandwidth >>>> limits/accounting), and you will become the preferred path for Tor >>>> traffic to your site. >>>> [snip] >>> On 30 March 2012 14:50:49, Konstantinos Asimakis <inshame at gmail.com> wrote: >>> >>> Wouldn't it be safer to accept connections only on port 80? Else he >>> would be exposing the whole machine. >> On 30 March 2012 14:43:09, "Tom Ritter" <tom at ritter.vg> wrote: >> >> Hm. I don't know. If you have a local firewall that blocks access to >> say, samba, from external addresses, but allows it locally - would tor >> allow you to access the port, because it appears that the connection >> from coming locally? >> >> If you're already exposing port 22 on the internet, I would argue >> allowing it through tor exit enclaving isn't increasing your risk any. >> But if tor lets you bypass the firewall - then there's a concern. >> >> -tom > On Mar 30, 2012 15:02:04, Konstantinos Asimakis <inshame at gmail.com> wrote: > > I bet it will bypass the firewall but until someone else answers play it > safe and allow only the ports you need. ;-) Thank you both for the interesting back and fourth. I think I tend to side with Konstantinos, and since my site will only offer SSL (not http), I guess I should setup to only accept connections from 443, correct? Thank you both.

1 0

Re: [tor-relays] Questions about exit enclaves
by Jef Heri 31 Mar '12

31 Mar '12

Hello Tom, --- On Mar 30, 2012 5:43 PM, "Tom Ritter" <tom at ritter.vg> wrote: > > On 03/30/2012 04:18 PM, Jef Heri wrote: > > > > Hello list, > > > > [snip] > > > > Is it correct that a exit enclave will act as a > > 'normal' exit node, as well as the exit enclave for its IP > > address (https://trac.torproject.org/projects/tor/ticket/800)? > > If so, is it possible to block exit to any IP other than the > > node's own IP via torrc file? If not, maybe I could only > > allow exists to white-list IPs, such as Tor Project web site > > IP, EFF IP, and etc? > > > > [snip] > > > > Thanks! > It's my understanding that if you put the following Exit Policy in your > torrc: > > ExitPolicyRejectPrivate 0 > ExitPolicy accept 97.107.139.108 > ExitPolicy reject *:* > > Where 97.107.139.108 is your IP address (that one's mine), you will > Exit Enclave to your site, not allow any other exit traffic, you will > be a normal tor relay (meaning you should check your bandwidth > limits/accounting), and you will become the preferred path for Tor > traffic to your site. Thank you. That was very helpful.

1 0

Bad Exit
by Matthias Bethke 30 Mar '12

30 Mar '12

I was wondering whether anyone could explain me how a node gets the "Bad Exit" flag? The thing is this, my router: http://torstatus.blutmagie.de/router_detail.php?FP=6c7c819f808ac125c69e1d98… As you can see, it has the "Bad Exit" flag even though it's not an exit and hasn't been for months. So I suppose that's something manually assigned? To do with POP/IMAP sniffing honeypots maybe? Seeing that quite a lot of people use unencrypted mail protocols over TOR, I wrote script about a year ago to try and warn them about it: - run ulogd and dsniff to capture logins - try and do a login to the account to see if it succeeded, to see whether it's just an unsuccessful hacking attempt (dsniff doesn't tell me and I was too lazy to write something myself to check the response) - if so, guess the full address. Either it's in the login or if not the server probably serves only one domain anyway and I use the reverse lookup - Send them a mail saying, hey, either you've been doing this yourself and it's a bad idea, or someone stole your credentials and is anonymously snooping around in your mail; in any case, change your password. I suppose someone is doing the reverse and has some fake accounts that they access via TOR and then see if there are any logins that are not theirs to flag the respective exit as a bad guy. Still sounds like a good idea to me but obviously it doesn't work when flagged as bad. Maybe someone can convince me otherwise or has an ide on how to coordinate the two things? Or am I completely off the track here and the reason for the flag is something different? cheers, Matthias

2 1

Exit node and VPN relakks.com
by Jonathan 21 Mar '12

21 Mar '12

Hey all, I have a server in a server farm on a 100mbit symmetrical line... I was looking at relakks.com as a VPN service. Anyone has any experience with these guys? Someone I know use it but only gets up to 2mbit on this line... Anyone has different experiences? I run a relay at home, but wanted to contribute with an exit node on the server as it has a big connection which does not get all fully used at the moment... Thanks, Jon

3 4

Re: [tor-relays] [tor] Re: Hosting relays in the Netherlands
by grarpamp 12 Mar '12

12 Mar '12

[sorry, same note, right tor-relays address this time :-] >> I got to a point where I want to make an active contribution to the >> Tor cause starting with running some nodes of my own, but I'm having >> difficulties on finding hosting companies (vps/dedicated) that allow >> running Tor services. >> >> I know that you've been resuming your servers in the Netherlands >> Would like to hear what's your experience with that. > > There is not much advice I can give you. I do not want to recommend any > of our ISPs, not because we're not happy with them (to the contrary), > but because it makes no sense to put more and more Tor exits into few > places. My strategy always is to find appropriate offers (cheap high > bandwidth) and then contact the ISP. This has evolved into a pretty > standardized two-step approach: First, I ask if they were okay "with > Tor" and reassigning IP space, and telling them that we're security > researchers and that we have worked with many ISPs successfully in the > past. Because the reassignment is somewhat of a special case, this > usually helps in reaching someone higher up in the support chain who can > make such decisions. Once they get back to me, I explain Tor a little > more and only then tell them about the caveats, but reassure them that > we have a volunteer team handling abuse around the clock etc. > > Depending on what you're able and willing to spend, a good approach > would be to look for data centers, and ask there for potential partners. > I wrote a small script that puts the GeoIP location of Tor nodes on a > map, which is somewhat helpful in finding "empty spots". A good idea > would be a script that extracts ASNs, sums up "their" Tor bandwidth, and > then not go with those that already have a high bandwidth exit, but > maybe some other AS in the same datacenters? Yes! Far better to look for new diverse holes and fill them than to essentially duplicate existing nodes. Bringing in tor-relays on this, as this topic comes up there once in a while too. I'll add that AS path info is available from route views looking glasses. Think of it like traceroute, but for BGP. It's quite handy. A node map showing current GEO, AS, and provider would be a cool idea. Lots of cities have datacenters and moms/pops of some sort. People could then find a gap near them, then poke around the phonebook, webhostingtalk, datacentertalk, [NA]NOG's, etc to find a diverse fill.

2 1

Reg : Torperf measurements
by Sambuddho Chakravarty 10 Mar '12

10 Mar '12

Hi all The section on Performance data in the Tor metrics page https://metrics.torproject.org/data.html , says that you are recording data by running Torperf on 'moria', 'torperf' and 'siv'. I know 'moria' is a exit node. But what are 'torperf' and 'siv' ? Tor directory listing doesn't list them.

2 2