October 2013 - tor-relays - lists.torproject.org

Re: [tor-relays] NSA v TOR Guardian article
by tor＠t-3.net 05 Oct '13

05 Oct '13

The tech articles had fascinating info which I know the Tor devs will be eating right up like a cupcake :) Does anyone have any insights into the articles which would be specific to tor relay operators, and would allow us to be better node hosts? Didn't like that the NSA has in essence verified that they run some nodes. Could have guessed it was the case, but still. Would love to know which nodes belong to them. They would have a big budget for donated bandwidth if they so chose, since they get to dip the soup ladle deep into the US/UK taxpayer cauldron. On Saturday 05/10/2013 at 1:26 am, Roger Dingledine wrote: > On Fri, Oct 04, 2013 at 09:12:07PM -0800, I wrote: >> >> http://www.theguardian.com/world/2013/oct/04/nsa-gchq-attack-tor-network-en… > > Hi! > > This is best discussed on the big thread on tor-talk. > > But see also > https://blog.torproject.org/blog/yes-we-know-about-guardian-article > > Thanks, > --Roger > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

NSA v TOR Guardian article
by I 05 Oct '13

05 Oct '13

2 2

Running more nets than Tor?
by grarpamp 05 Oct '13

05 Oct '13

Anyone also offering up vpngate, i2p, mail mixes, other p2p/networks, etc to the public on their relay platform?

5 5

BBG and Tor funding
by mick 05 Oct '13

05 Oct '13

See http://www.theguardian.com/world/2013/oct/04/nsa-gchq-attack-tor-network-en… Note the new addition at the end of this article, presumably added at the request of BBG "• This article was amended on 4 October after the Broadcasting Board of Governors pointed out that its support of Tor ended in October 2012." So. How does this square with BBG's alleged support for financing new fast exit relays? https://lists.torproject.org/pipermail/tor-relays/2013-September/002824.html Best Mick --------------------------------------------------------------------- Mick Morgan gpg fingerprint: FC23 3338 F664 5E66 876B 72C0 0A1F E60B 5BAD D312 http://baldric.net ---------------------------------------------------------------------

1 0

Admin panel compromised
by Yoriz 04 Oct '13

04 Oct '13

For your info: I am the operator of the "privshield" exit. I just got notice from my hoster (5gbps.com) that their backoffice admin panel was compromised. Indeed my firstname and password to the admin panel have been changed. Fortunately, I have SSH on my VPS configured to only accept public key-based logins, and see no signs of entry of the VPS. As the backoffice panel provides direct console access, there is a slight chance they logged in directly by a safe-mode boot, but my uptime is a month, and I see no dip in the tor bandwidth: https://atlas.torproject.org/#details/DA3F7BD5428F88C79C9C7006B791982DA0115… However, as a precaution I have shut down my tor exit. I will request a clean Ubuntu image and reinstall my tor exit this weekend. I will generate new server keys just to be sure. My mail is hosted on the same system, I won't have access to this email address for a few days. // Yoriz

3 2

need help with running tor in combination with shorewall
by Jan Hendrik den Besten 04 Oct '13

04 Oct '13

Hi, I installed tor a few days ago. It only runs fine if I stop my shorewall firewall. I found here some online help: https://trac.torproject.org/projects/tor/wiki/doc/TorFAQ However, the shorewall-rules example given there doesn't work. It's mentioned the example is for shorewall v2.2.3 whereas the current version is v4.5.16.1. Does anyone have a latest exmple of the /etc/shorewall/rules file? thanks, Jan Hendrik --

2 2

relays "in the cloud"
by Jonathan D. Proulx 04 Oct '13

04 Oct '13

Hi All, There must be discussion of this I'm not finding so references to that are welcomed. As I understand it there are three risk layers in each Tor node: 1) The node operator (who has r00t) 2) The data center (who has net) 3) The legal jurisdiction I've recently started running a couple of relays on public IaaS providers. To my thinking this doesn't present significant security issues beyond a hosted physical server, largely because they are not running hidden services or using Tor to anonymize their own traffic. Presumably memory inspection on the underlying hypervisor could easily reveal that. Most of what could be discovered from hypervisor monitoring seems liek it could also be discovered by traffic analysis available to any datacenter provider should they choose or be compeled to. The one novel thing this may make easier is stealing the hosts private keys, which would make traffic analysis easier (but I don't thing significantly better) and allow impersonation of the node which would not otherwise be possible (well it maybe possible to steal from memory on a running system given physical access and sufficient equipment, time and expertise but nearly impossible if not actually so). What is the consensus level of paranoia on this? Are there threats to virtualized systems I'm not considering? Thanks, -Jon

4 5

hardware accelerated crypto
by Sarah Vigote 03 Oct '13

03 Oct '13

hi, I would like to run a 100Mb/s tor exit node, but I have issues wrt power consumption. reading http://ortizaudio.blogspot.fr/2011/10/using-dreamplugs-crypto-chip.html it seems dreamplugs has *fast* aes-128-ecb. Does anyone have any experience running a node based on cheap crypto chip (dreamplug, marvell 88F6282, sheeva-core, padlock, ...) ? What performance can I expect out of these ? regards, sv

9 12

Warnings in log
by Konrad Neitzel 02 Oct '13

02 Oct '13

Hi all, I am running a tor node (idkneitzel) on a linux server (using opensuse 12.3). Today I saw: Oct 01 14:20:34.000 [warn] Failing because we have 8163 connections already. Please raise your ulimit -n. So I modified the /etc/security/limits.conf and added: * soft nofile 65000 * soft nofile 65535 and rebooted the system but now I got that warning again. Did I missunderstood the warning and should I add other entries, too? And now I also got the following warning: Oct 01 18:25:19.000 [warn] Cannot get strong entropy: no entropy source found. Now I am unsure, what I should do regarding this point. (After a restart, this message seems to no longer occur but I am still curious what is going on here). Thank you in advance for your help. With kind regards, Konrad

4 5

Directory traffic
by Jobiwan Kenobi 02 Oct '13

02 Oct '13

As of between 18:00 and 19:00 yesterday (9/30/13) directory traffic on my relay has gone up dramatically, from mere background noise to more than half my advertised bandwidth, and hasn't really come down since. I pasted the numbers from /opt/var/lib/tor/state into a spreadsheet and made a graph. The green line is the interesting one. I don't know whether I can send attachments to the list, so I put it here: http://jb4m.homeip.net/T/graph1-dirw.png Right now, I advertise 1 Mbit but don't actually limit bandwidth, and I was quite happy with the profile until this started. If it keeps doing this, I may have to put a cap on again. I'm a non-exit, non-guard. Is this normal? Is there anything I should look into? Thanks, -Job

1 0