May 2013 - tor-relays - lists.torproject.org

Circuit creation "storms" overwhelming Raspberry Pi?
by torsion＠ftml.net 07 Jul '13

07 Jul '13

Hi there, I just joined the mailing list and apologized if this has been discussed before. I did find discussion of a similar issue in January 2013's archive: https://lists.torproject.org/pipermail/tor-relays/2013-January/001809.html It's important to note that I believe I've seen (but didn't save logs) a couple "circuit creation burst" events on my established relay (about 5Mbps, stable, guard, non-exit) which was mostly able to handle it without crashing as it has plenty of RAM and the above-mentioned messages - "Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a m ore restricted exit policy." - appear only with the relay is under load for other reasons AND a large number of circuits are being suddenly created. I wondered if this was some kind of DOS attempt but didn't think much of it because my fast relay continued working fine. However, I've just set up a Raspberry Pi, the 512MB model, as a relay on a slower connection. Here are the relevant settings on this relay: RelayBandwidthRate 130 KB RelayBandwidthBurst 340 KB The Pi has a fairly slow CPU, so I'd occasionally get messages about log deduplication being too slow or something, but didn't think much of it. I finally got the relay up and left it up for over 24 hours. When I woke up this morning it had crashed. Here are the relevant log messages - note the huge jump in number of circuits between 22:35 and 04:35 (maybe I got the Stable flag), then the storm of circuit open requests starting at 05:49. Eventually I believe the Pi ran out of memory and killed the tor process. What's very interesting here is that my fast VPS relay with a RelayBandwidthRate over 5x faster is almost never handling much more than 1000 circuits, so why all of a sudden the demand on the Pi that's advertising a lower bandwidth rate? Mar 17 22:35:00.000 [notice] Heartbeat: Tor's uptime is 1 day 0:00 hours, with 26 circuits open. I've sent 974.13 MB and received 969.92 MB. Mar 18 04:35:00.000 [notice] Heartbeat: Tor's uptime is 1 day 6:00 hours, with 972 circuits open. I've sent 1.61 GB and received 1.59 GB. Mar 18 05:49:44.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. Mar 18 05:49:44.000 [warn] Failed to hand off onionskin. Closing. Mar 18 05:50:44.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [5817 similar message(s) suppressed in last 60 seconds] Mar 18 05:52:30.000 [warn] Your system clock just jumped 101 seconds forward; assuming established circuits no longer work. Mar 18 05:53:51.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [1055 similar message(s) suppressed in last 60 seconds] Mar 18 05:55:14.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [329 similar message(s) suppressed in last 60 seconds] I'd like to figure out just how much the Raspberry Pi is capable of, because it could be a cheap way to build out the relay network by people who want to donate bandwidth - but of course it needs to be stable, and something about my setup is not. Also: Mar 16 20:55:33.000 [notice] No AES engine found; using AES_* functions. I have no idea if the Broadcom BCM2835 SoC (ARM1176JZF-S CPU) in the Pi has any AES capability, but it'd be great to find out.

3 4

Multiple Bridges on same AWS Account
by torrelay＠mail.md 10 Jun '13

10 Jun '13

Greetings! I currently have 1 bridge relay running on my AWS account. Is it possible to add another 2 bridge relays to run as separate instances from the same AWS account? I'm wondering if there might be issues with IP address allocation? For example, would I need to make any ammendment to the tor configuration file a la 'tor family' to differentiate between the different nodes running on the same amazon account? Any advise appreciated. Best regards, Johnnie

5 10

Re: [tor-relays] [tor-talk] Skype banned tor-nodes?
by Mike Perry 29 May '13

29 May '13

Cross-posting to tor-relays to give everyone the heads up - I just added 33033 to the ReducedExitPolicy page for Skype: https://trac.torproject.org/projects/tor/wiki/doc/ReducedExitPolicy Non-relay related discussion should remove tor-relays from the Cc. James Brown: > Hello, people! > > Because many my contacts continue to use Skype and don't want to use any > nice soft (such as jabber, torchat and etc.) I need to use it too. > For protecting of my location and etc. I use it only through Tor (on VM > working under transparently-torifed user). > Some days ago I would be very, very difficalt to connect to skype > through the Tor-net (earlier it was very easy). > As can I see in my Vidalia, my skype application can make resolving > through tor and can connect to hosts through port 443, but conncetions > with port 33033 cannot establish (I can the the trying to open it and > after it it closed immediatly). > As can I see the skype doesn't work without that connections which now > establishes very rarely. > I have 2 versions: > a) the Skype team ban the Tor-connections to skype (but I can still > connect to skype to ports 443 and I can to browse their web-site and > even log in to it through the Tor without any problems) > or > b) many Tor-exits don't let the above-mentioned port (33033) in their > ExitPolicy. > It is not good from the Skype team if they do the first. > If the second hypothesis is right I ask owners of Exit-nodes, if it > possible, to let that port in their ExitPolicies. Not sure if that's actually the problem, but if the only way you can get to Skype is to use a Bittorrent-supporting exit, it certainly seems like a possibility. Thanks for the heads up James! -- Mike Perry

1 0

obfsproxy on freebsd
by Peter Kasper 28 May '13

28 May '13

hi, i'm trying to run obfsproxy on freebsd 9.1, i have installed packages obfsproxy-0.1.4,1 and tor-devel-0.2.4.12.a log file: May 24 16:36:29.000 [notice] Your OpenSSL version seems to be 0.9.8y. We recommend 1.0.0 or later. May 24 16:36:52.000 [notice] To correct this, use a more recent OpenSSL, built without disabling any secure ciphers or features. May 24 16:36:53.000 [warn] The communication stream of managed proxy '/usr/local/bin/obfsproxy' is 'closed'. Most probably the managed proxy stopped running. This might be a bug of the managed proxy, a bug of Tor, or a misconfiguration. Please enable logging on your managed proxy and check the logs for errors. May 24 16:36:53.000 [notice] Failed to terminate process with PID '12021' ('No such process'). when i start obfsproxy directly, there is only obfs2 protocol 2013-05-25 21:09:51 [notice] Starting (obfsproxy version: 0.1.4 (git-94ebc4c3edf1e3e5)). Usage: obfsproxy [obfsproxy_args] protocol_name [protocol_args] protocol_options protocol_name ... * Available protocols: [dummy] [obfs2] any idea? peter ---------- ZPS 14 za 16,90 EUR - vypredaj internetoveho skladu pokracuje! SUPER AKCIA! Registracia nove .EU domeny len za 1,99 EUR! Najdite si strateny alebo ukradnuty telefon programom Zoner AntiVirus Free pre Android Domeny .SK len za 12.29 EUR Ponuka z vydavatelstva Zoner Press Mam rad Android - klikni tu

2 2

Increasing nofiles when running Tor-Relay in a chroot environment
by Sven Reissmann 28 May '13

28 May '13

Hi, I'm running Tor inside a chroot that I built long ago, using this guide: https://trac.torproject.org/projects/tor/wiki/doc/TorInChroot For some weeks my traffic limitations are gone, so I' d like to increase the allowed traffic on my relay. Problem is, that I also need to increase the maximum number of open file descriptors, tor may use. I did this in the limits.conf configuration file, but it has no effect in the chroot environment. Is anyone running a similar setup or has a hint how it could be solved? Regards, Sven. -- PGP Schluessel : https://0x80.io/files/key.asc Anonyme Antwort: https://privacybox.de/srm.msg

1 0

Several IP address on the same box
by Torry Torah 24 May '13

24 May '13

Hi, I have two network interfaces on my server and thus 2 IP addresses. Since tor uses only a very small fraction of my resources (I'm running a bridge), I was wondering if I could put up two bridges, one on each interface. I didn't find anything in the docs about that. Many thanks, -- Torry

2 1

Is TOR using more than just OrPort and DirPort?
by Daniel Wu 13 May '13

13 May '13

I just started a relay (non-exit node, not running a client myself), on Windows, using the latest Vidalia Relay Bundle. Looks like from the configuration, given that I'm running in relay mode, there should be only two ports used by Tor (OrPort and DirPort), right? However, when I run "netstat -ano", I see that the Tor process is using up a lot more ports. There are these connections, from 127.0.0.1 back to itself. Some sort of internal process used by Tor? Not as concerned about these, since these are internal. But still curious. TCP 127.0.0.1:63417 127.0.0.1:63418 ESTABLISHED TCP 127.0.0.1:63418 127.0.0.1:63417 ESTABLISHED TCP 127.0.0.1:63419 127.0.0.1:63420 ESTABLISHED But then I see connections like these: TCP 192.168.1.202:55049 174.136.105.86:9001 ESTABLISHED TCP 192.168.1.202:56804 37.128.208.46:9002 ESTABLISHED TCP 192.168.1.202:56896 171.25.193.9:80 ESTABLISHED TCP 192.168.1.202:57113 109.232.224.74:9001 ESTABLISHED TCP 192.168.1.202:57206 91.227.249.44:9001 ESTABLISHED TCP 192.168.1.202:57221 67.164.46.197:9001 ESTABLISHED TCP 192.168.1.202:57253 128.31.0.34:9101 ESTABLISHED TCP 192.168.1.202:57259 204.124.83.132:587 ESTABLISHED TCP 192.168.1.202:57260 128.232.18.57:9001 ESTABLISHED TCP 192.168.1.202:57309 204.124.83.131:443 ESTABLISHED TCP 192.168.1.202:57331 81.24.98.236:9001 ESTABLISHED These appear to be the actual Tor relay traffic (192.168.1.202 is my computer). Why are these using ports in the 55000+ range, when I specified my OrPort to be a singular value (in my case, 9031)? I would like to know the port ranges used by Tor for relay traffic, so I can use my dd-wrt to set the QoS by specifying these Tor port ranges. Thanks, DW

4 6

"Localized" TOR exit notices?
by Conrad Hoffmann 06 May '13

06 May '13

Hi all, I recently decided I should run a TOR exit node. I am new to the list and still in the process of setting things up. One thing I noticed is that the TOR exit notice [1] contains a US-specific section (it even says so in the comments). Is there a resource anywhere as to how this paragraph might look in other countries? I am located in Germany for example, and I suppose a short mention of the TMG [2], specifically § 8 and § 15 would be suitable replacement for the above mentioned paragraph. I guess that even if not in the git repo, at least a collection in the wiki might be a neat idea? Or did I just not find it? Cheers and thanks for any hints, Conrad [1] https://gitweb.torproject.org/tor.git/blob/HEAD:/contrib/tor-exit-notice.ht… [2] http://www.gesetze-im-internet.de/tmg/index.html (in german)

2 1

A call to arms for obfuscated bridges
by George Kadianakis 06 May '13

06 May '13

Greetings, A year ago we asked you to run obfuscated bridges to help people in Iran [0]. Many people answered our call and we ended up having a big pool of obfuscated bridges to give to our users. Unfortunately, today, most of those bridges are down, and fresh ones are needed more than ever, since obfuscated bridges are the only way for people to access Tor in some areas of the world (like China, Iran and Syria). On the bright side, Tor's anti-censorship infrastructure has improved, and now you don't have to send the bridge addresses to us; if you run an obfuscated bridge with Tor 0.2.4.x, Tor will send its own address to BridgeDB [1] like normal bridges do. Also, obfsproxy was rewritten in Python and it now supports a new pluggable transport called 'obfs3' which works even in China [2]. We have dropped support for the C-version of Obfsproxy, and the new Pluggable Transport Bundles contain the Python version [3]. Finally, future pluggable transports will be developed for the Python version. Looking into BridgeDB, we have 200 obfs2 bridges, but only 40 obfs3 bridges: this means that we need more people running the new Python obfsproxy! Upgrading obfsproxy should be easy now, since we prepared new instructions and Debian/Ubuntu packages. If you run Debian or Ubuntu check out these instructiosn: https://www.torproject.org/projects/obfsproxy-debian-instructions.html.en otherwise use these: https://www.torproject.org/projects/obfsproxy-instructions.html.en (and make sure your pip is upgraded so that it uses HTTPS [4]) Furthermore, Tor's support assistants need some _unpublished_ bridges to give to censored users who ask for help via email. To configure an unpublished bridge you add "PublishServerDescriptor 0" to its torrc. After you do so, fire up Tor, and check its logs to find the ports that 'obfs2' and 'obfs3' are using. Send your IP and ports to tor-assistants(a)torproject.org. Finally, if in the future we need you to do something extra (for example to upgrade obfsproxy to support a new pluggable transport) we will send another mail to tor-relays. Thanks for the help! [0]: https://lists.torproject.org/pipermail/tor-talk/2012-February/023070.html [1]: https://bridges.torproject.org [2]: In China obfs2 is blocked using active probes: https://trac.torproject.org/projects/tor/ticket/8591 [3]: https://blog.torproject.org/blog/new-name-obfsproxy-tor-browser-bundles [4]: https://groups.google.com/forum/#!msg/python-virtualenv/foXxh-NpdGg/uT0NPc9…

14 26

Support for Relay Operators (signed)
by Moritz Bartl 04 May '13

04 May '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 The last mail was not signed, because the Mail Merge addon does not work together with Enigmail. Sorry. - ---- cut ---- Hi, I just noticed that I never announced that we offer support for relay operators at support [at] torservers [dot] net. You can encrypt your mails using PGP -- https://www.torservers.net/torservers_pub.asc fingerprint B099 CF5D 5B97 DC65 2406 B458 C8F4 2EB2 E033 4E90 Currently, four founding members of Torservers.net read that address. If you are a "Torservers partner", please think about joining the support team. We can use your help! - -- Moritz Bartl https://www.torservers.net/ -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJRg7atAAoJEOGPxWJITcUAHc4H/2mv6Wlpg5bLA5aHTx7lFn19 Dfgr2NTslfwRSA5CO3HeGRytoEoZUJ1xiZMh3SNZzLB6241WxBhdp5mExXFgTe0e E4WFP9rcDVSY2wuzi9QkjergQy3oeaadL17eiRs//GK+eb9wcBfpZ8OHyCTrauln dTUWVCAdtglptTed4Kx2ZUEPjHVoA9pWr9DQ9mxJjXLbREiu4ru0acC7QYswBj/r zt44LfkqPwEOzCrnvqEKOLT/MPP1lPk27tq7dfsTTozdII7VsrVj+nxdoWsfbFOp MyWe7240q4+0QOxHddWXMAAOgnnHOT+QfMeK1BYc1/FBosm9TAVVQmSQvbsb0HU= =BuJ9 -----END PGP SIGNATURE-----

3 3