October 2015 - tor-relays - lists.torproject.org

Re: [tor-relays] Exit policy reject fails
by spiros_spiros＠freemail.gr 20 Oct '15

20 Oct '15

Hi Josef, I think you must put any reject entries above the accept because the rules read from top to bottom. Also, I don't know if this make any difference at all, but I also put port in my torrc like this : ExitPolicy reject 195.113.0.0/16:* #comment here S On 19 Oct 2015, at 22:03, Josef Stautner <hello(a)veloc1ty.de> wrote: Hello @all, I have a probleme with an reject rule which seems to fail. Due to an message from WebIron against my exit relay I wanted to block a subnet. My exit policy looks like this: ExitPolicy accept *:53 # DNS ExitPolicy accept *:80 # HTTP ExitPolicy accept *:8080 # HTTP 2 ExitPolicy accept *:443 # HTTPS ExitPolicy reject 5.133.182.0/24 # WebIron report ExitPolicy reject *:* After I added the reject rule I reloaded tor and thought the case is done. But WebIron keeps sending me messages because of "ongoing attacks" against a host in that subnet. Of course I trusted the reject rule and ignored them. After the 6th mail I got suspicious and added an iptables ACCEPT rule in my OUTPUT chain to have a look if there is really a traffic flow. I just received another mail and checked the packet counter: Chain OUTPUT (policy ACCEPT 116M packets, 159G bytes) num pkts bytes target prot opt in out source destination 2 142 8304 ACCEPT all -- * * 31.220.45.6/32 5.133.182.0/24 /* WebIron Block check */ There is traffic flowing from my relay IP 31.220.45.6 to the subnet. Can somebody please hint me what I'm doing wrong? Link to the relay in case you need more information: https://atlas.torproject.org/#details/29E3D95332812F81F67FF31B3B1B842683D1C… Thanks in advance, ~Josef _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

3 2

Optimizing TOR-Relay
by Volker Mink 20 Oct '15

20 Oct '15

1 0

Exit policy reject fails
by Josef Stautner 19 Oct '15

19 Oct '15

Hello @all, I have a probleme with an reject rule which seems to fail. Due to an message from WebIron against my exit relay I wanted to block a subnet. My exit policy looks like this: ExitPolicy accept *:53 # DNS ExitPolicy accept *:80 # HTTP ExitPolicy accept *:8080 # HTTP 2 ExitPolicy accept *:443 # HTTPS ExitPolicy reject 5.133.182.0/24 # WebIron report ExitPolicy reject *:* After I added the reject rule I reloaded tor and thought the case is done. But WebIron keeps sending me messages because of "ongoing attacks" against a host in that subnet. Of course I trusted the reject rule and ignored them. After the 6th mail I got suspicious and added an iptables ACCEPT rule in my OUTPUT chain to have a look if there is really a traffic flow. I just received another mail and checked the packet counter: Chain OUTPUT (policy ACCEPT 116M packets, 159G bytes) num pkts bytes target prot opt in out source destination 2 142 8304 ACCEPT all -- * * 31.220.45.6/32 5.133.182.0/24 /* WebIron Block check */ There is traffic flowing from my relay IP 31.220.45.6 to the subnet. Can somebody please hint me what I'm doing wrong? Link to the relay in case you need more information: https://atlas.torproject.org/#details/29E3D95332812F81F67FF31B3B1B842683D1C… Thanks in advance, ~Josef

2 2

TCP: too many orphaned sockets
by fatal 19 Oct '15

19 Oct '15

Hello, I had to move my exit relay to another VPS due to the provider getting annoyed by the abuse mails. The new VPS has exactly the same software setup but only 512 instead of 1024 Mb RAM. Traffic was/is around 45 Mbit/s on both. On the new VPS I get the following message (from time to time lots of them): "kernel: [XXXXXX.XXXXXX] TCP: too many orphaned sockets" which I've never seen on the old VPS. Memory consumption is as follows: total used free shared buffers cached Mem: 492560 465600 26960 348 9852 74476 -/+ buffers/cache: 381272 111288 Swap: 1998844 40956 1957888 I'm unsure if I should limit the maxbandwidth in torrc or try to tune the kernel settings (like /proc/sys/net/ipv4/tcp_max_orphans /proc/sys/net/ipv4/tcp_mem) and which of them? Ordering 1024 Gb of RAM would double the cost and could be an option after I got more experience with the new provider and abuse mails. Thanks for any advice!

3 3

Re: [tor-relays] Tools for managing multiple relays
by starlight.2015q3＠binnacle.cx 19 Oct '15

19 Oct '15

>None of the above :) > >I run these three relays[1][2][3]. > >ccrelaycc [1] has acquired the guard flag in the >last few days (don't know when, last time I >checked it did not have it). This relay is rated near the boundary of minimum Guard rating and goes in and out of the state. >A thing that is bothering me is that ccrelaycc and >inara ([1] and [2] respectively) are both on >DigitalOcean, they are in two different regions >(AMS and SIN) *but*, notwithstanding that they >have an identical configuration, ccrelaycc has >been experiencing 2 TB traffic per month in the >last 3 or 4 months while inara has barely reached >100 GB per month over same period (I use vnstat >and arm for these stats), that is a 20x >difference. I would like to understand this >difference. With a VPS a tremendous number of variables are at work. How heavily loaded is the physical server with other VPS clients? What kind of NICs are present? What type of server, etc? Is not surprising at all that the QOS varies wildly. >It should be noted that both are the smallest VPS >available on DigitalOCean and that comes with 1 TB >of traffic per month but it seems that >DigitalOcean is liberal about using more bandwidth >(I have read a similar comment on this list about >DO). > >jaine is much more recent and it is on Aruba.it in >Italy. I expect that they are much less liberal >about using more bandwidth than what is allotted >so I set lower limits for the RelayBandwidhtRate >parameter. > >For ccrelaycc and inara I have set: >--- >RelayBandwidthRate 1600 KB >RelayBandwidthBurst 3200 KB >--- >and for jaine: >--- >RelayBandwidthRate 800 KB >RelayBandwidthBurst 1600 KB If you have the ability to use 'tc' instead of BandwidthRate (per posts earlier this month) you should do that. RelayBandwidth* are not intended for limiting bandwidth in dedicated relays. Replace them with BandwidthRate and BandwidthBurst if you can't use 'tc'. >--- >What I see in the end are three quite different >behaviors. Given that jaine is at the beginning of >its lifecycle I would give it some more time >before drawing any conclusions, but I would really >like to understand why ccrelaycc and inara are >behaving so differently. I would appreciate any >input on this. Per above, huge number of variables easily explain it. On top of the variability of the VPS, the networks could have dramatically different quality, reachability, loading and congestion. You can look at the individual BWauth ratings for a more complete picture. Found https://collector.torproject.org/recent/relay-descriptors/votes/ where # gabelmoo ED03BB6... Erlangen, Bavaria-DE # maatuska 49015F7... Belgium # Faravahar EFCBE72... ? # longclaw 23D15D9... Seattle, WA-US # moria1 D586D18... Cambridge, MA-US here's Blutmagie (actual bandwidth) _gfs_ ccrelaycc NL 942 98 4.27 L 95.85.8.226 443 80 95.85.8.226 __fs_ jaine IT 216 13 4.27 L 5.249.145.164 443 80 ... .aruba.it __fs_ inara SG 38 98 4.27 L 128.199.148.243 443 80 128.199.148.243 and rueckgr.at (max self-measure / advertised) _gfsh ccrelaycc NL 1987 __fsh jaine IT 999 __fsh inara GB 823 Suggest installing and running 0.2.6.10 in instead of 0.2.4.27. The Aruba dedicated Atom server discussed earlier could make a nice relay, or perhaps the next-up one for 20 euros. Perhaps try running the existing Aruba node as an exit for a month first to see how they respond. With the "reduced" exit policy the worst-case is a pile of automated complaints about WordPress brute-force login attacks. Very minor but how they respond will be telling. The exit policy can be turned off if they freak. LeaseWeb has 49 euro 100TB servers available in the Netherlands--killer exit boxes that will rate high and pull 15000 per Blutmagie. OVH has good offerings as well, including the Kimsufi subsidiary. Despite 'tor-relays' claims to the contrary, Kimsufi apparently will tolerate (at least one) exit nodes: e_fs_ Kiss208 FR 703 10 6.10 L 5.135.152.208 443 444 ks3296627.kimsufi.com e_fsh Kiss208 FR 1503 The above has been an exit for 14 months. Here's the fastest Kimsufi though this is probably a Pentium or Xeon: _gfs_ Unnamed FR 9865 61 6.10 L 91.121.82.25 443 80 ks26969.kimsufi.com _gfsh Unnamed FR 10947 ===== But an Aruba exit is perhaps a more diverse addition.

5 4

Re: [tor-relays] Tools for managing multiple relays
by starlight.2015q3＠binnacle.cx 15 Oct '15

15 Oct '15

On Thu, Oct 15, 2015 at 20:20:13 -0000, nusenu <nusenu(a)openmailbox.org> wrote: >>> LeaseWeb has 49 euro 100TB servers available >>> in the Netherlands--killer exit boxes that will >>> rate high and pull 15000 per Blutmagie. OVH has >>> good offerings as well >> >>Please consider diversity when adding relays. >> >>OVH (AS) and NL (CC) are among the worst places >>to add relays from a (simplified) diversity >>point of view. Problem is costs in Asia are like ten times costs in Europe. US is double or triple. Other locales still cost more. So is it better to run a 100TB server for $60/month in Germany or the Netherlands where privacy is a major priority, or a 1TB VPS in Singapore for $25/month? Both are presumed easily collectable by five-eyes agencies. The former provides substantial incremental usability while the cost/benefit of the latter is far less compelling. Russia, Ukraine, etc might be better in theory except they surveille too, are less constrained by law and harbor obviously dubious actors (not saying don't consider it). That many independent operators contribute is terrific for diversity in itself --perhaps the most important factor. Choices are not simple.

2 1

Re: [tor-relays] Tools for managing multiple relays
by starlight.2015q3＠binnacle.cx 15 Oct '15

15 Oct '15

_gfs_ ccrelaycc NL 942 98 4.27 L 95.85.8.226 443 80 95.85.8.226 __fs_ jaine IT 216 13 4.27 L 5.249.145.164 443 80 ... .aruba.it __fs_ inara SG 38 98 4.27 L 128.199.148.243 443 80 128.199.148.243 One likely contributor to the relatively high rating of 'ccrelaycc' is residence in the Netherlands. Central Europe Internet is the best in the world for affordable high-quality high-capacity bandwidth. This is why so many fast relays are found in the region. ----- Pulled the BWauth ratings for you. The median value is selected for the consensus weight. Results look sane. ccrelaycc 2015-10-15 17:00:00 gablemoo--w Bandwidth=1638 Measured=2930 Faravahar-w Bandwidth=1638 Measured=3010 longclaw--w Bandwidth=1638 Measured=3410 median moria1----w Bandwidth=1638 Measured=3490 maatuska--w Bandwidth=1638 Measured=3580 jaine 2015-10-15 17:00:00 maatuska--w Bandwidth=819 Measured=505 Faravahar-w Bandwidth=819 Measured=543 gablemoo--w Bandwidth=819 Measured=544 median longclaw--w Bandwidth=819 Measured=740 moria1----w Bandwidth=819 Measured=767 inara 2015-10-15 17:00:00 gablemoo--w Bandwidth=843 Measured=235 longclaw--w Bandwidth=843 Measured=330 maatuska--w Bandwidth=843 Measured=336 median moria1----w Bandwidth=843 Measured=336 Faravahar-w Bandwidth=843 Measured=1580

3 2

OT: starlight vs. email threading
by nusenu 15 Oct '15

15 Oct '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 hi starlight, is there any chance we can talk you into setting the usual email headers for proper email threading? (decent MUAs take care of this by default) At times it is hard to follow the flow of a discussion if every email starts a new thread (what message was the reply to which email). thanks, nusenu -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVxfCpAAoJEFv7XvVCELh0wZwQAIZ+jOaNTwjYYwQLfl8gIK9j pE+GHGi4mV0R/FSsFAjfkJQzWp1AakaOMR7AeqxWjQmz4HWUyjm09TP+R+x6tfUw /9ilSiZn++p9F/+J++ukUa8ozoi1ogN4XTo/OnJo12udgAAZ/+p5NW4suMO9scId wuDA3JtvLeG7u80j6LEdb28vkS8+cx1OZ1ZExemOUzb/T6i/K+EZx5//lWqzpukJ MwAS/P5n54cyvlD1xn10EUcwazJ3o7cA1d4QthXekgKzl9+EsyZ70n8uJ+1r2tab YDpf84qKjjdOkLVppukZmLXeyznKrAAP1rcpVesSWdlQp9AVgd+XYYm+wBqrUhrL CuQs9qv6CmQKFpc5GlYX7L3fLKrXE1daKBNqIA0o0BJNMrq/PLti2ixwfXZU3GOj a4jDFnXtMFWzDD4Ut2fSR2+aRAjuhtUmWNexN2rF+8KecenfV5Bb09c3I11FygTf 2IWfCPoqSHtTPCq+sLt91T2Hh/zfSV0+ckjHIfaJPFig3KyivBI4B6fY2X2txSxT zRffuHqXknIwUMgFaCjNSl1qlqozTbpN2rVhx14V4KNK7GCFK2/gtZlFb1f64Dyy bTZ6IxWjLFX11hYVI0jPlTp3Usc5j0PkxprXD2IgvrEXzH89zm994jK36n8MK6w+ uctpM8RxpEsoBfQBnlib =RE3I -----END PGP SIGNATURE-----

3 3

Tools for managing multiple relays
by Cristian Consonni 15 Oct '15

15 Oct '15

Hi, I am currently running three small relays on two different services/ISPs. I have two somewhat unrelated questions: * given costant resource (i.e. euro/month) I can afford to run relays is it in general better to run one bigger relay or, say, two smaller ones. * are there any tools to manage multiple tor node? For example, if I want to check if there are security updates I have to login separately in each system and launch them manually. Is this the way I should do this or there are ways to monitor the status of all my nodes and maintaing them as a whole. Thanks in advance. Cristian

5 7

Re: [tor-relays] Tools for managing multiple relays
by starlight.2015q3＠binnacle.cx 15 Oct '15

15 Oct '15

>* given costant resource (i.e. euro/month) I can >afford to run relays is it in general better to >run one bigger relay or, say, two smaller ones. Based on a past thread, guessing you run __fs_ BV2 IT 344 71 6.10 L 5.249.159.209 9001 None ... .aruba.it __fs_ BV3 IT 344 73 6.10 L 5.249.159.198 9001 None ... .aruba.it __fs_ BV4 IT 312 73 6.10 L 5.249.149.153 9001 None ... .aruba.it __fs_ BV5 IT 224 71 6.10 L 89.46.70.98 9001 None ... .aruba.it which are too slow to be assigned the guard flag. If that's the case, probably the cost the VPSs could cover a small dedicated/bare-metal server which would be assigned a more than 10x higher weight than any one of the above and service many more users. Much more effective and efficient.

2 1