November 2015 - tor-relays - lists.torproject.org

Please enable IPv6 on your relay!
by Moritz Bartl 28 Jan '17

28 Jan '17

Hi! We still have a depressingly low number of relays that support IPv6 (currently only ~120 of ~1900 relays). If your host supports IPv6, please enable it, especially if you run an exit! This has to be done explicitly. https://trac.torproject.org/projects/tor/wiki/doc/IPv6RelayHowto In short, you add: ORPort [IPv6::address]:port IPv6Exit 1 ExitPolicy reject6 *:* (or a more open exit policy respectively) Thanks! -- Moritz Bartl https://www.torservers.net/

30 42

Reminder: exit nodes probably shouldn't be using Google's DNS servers
by Nick Mathewson 25 Feb '16

25 Feb '16

Hi, all! While looking into a bug report, I noticed that an exit node was using one of Google's well-known public DNS servers for its own DNS server. No disrespect to the operators of Google's fine public DNS service, but my sense is that using it for a Tor exit node might not be the greatest idea for users' privacy, having one DNS provider that gets to see so many requests. It's probably a better idea to have your own local cacheing DNS server. Would anybody like to share a guide about how to set one of those up safely and migrate correctly? best wishes, -- Nick

23 38

Relays with misconfigured MyFamily (declared vs. effective)
by nusenu 16 Feb '16

16 Feb '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, the following relays have misconfigured MyFamily settings. 'misconfigured' is defined by declared family does not match effective family (as computed by onionoo's new effectiv_family field [1] - thanks Karsten). Maybe we will see future versions of globe or atlas displaying a diff of the two family sets to make such misconfigurations more visible. Please let me know if you find any errors (I did not fact check the output). +------------------------------------------+----------+ | Contact (truncated) | Fingerpr | +------------------------------------------+----------+ | +1 303-265-9283, rdump@OFTC | 09683D5D | | 0x3AEE83BB539036CA <bb AT symvaro DOT co | 6FDF2D3B | | 0x6F6D60C1 Security Dept <hello@brasshor | 445F1C85 | | 0x6F6D60C1 Security Dept <hello@brasshor | 6BC82EBA | | 0x6F6D60C1 Security Dept <hello@brasshor | 254EB51B | | 0x6F6D60C1 Security Dept <hello@brasshor | B3515F16 | | 0xDE731050 Gareth Llewellyn <gareth@netw | 5CAECF26 | | 0xFD78BCE1 Fruity Oaty Tor Exit <torexit | 1ECD73B9 | | 1024D/1DFBA164 Bernhard M. Wiedemann <to | 172DC95F | | 1024D/39B9820C admin at perfect minus pr | B897826E | | 1024D/39B9820C admin at perfect minus pr | 5FCC8306 | | 1024D/39B9820C admin at perfect minus pr | 2421E10D | | 1024D/39B9820C admin at perfect minus pr | AC7AE98C | | 1024D/39B9820C admin at perfect minus pr | E8B7D19C | | 1024D/39B9820C admin at perfect minus pr | ED9F582E | | 1024D/39B9820C admin at perfect minus pr | B1843B40 | | 1MTUwHFknUyUgRYqpNDYiA2j7sXTYoCe2P | E799227D | | 4096R/8BA2371C Fabian Keil <fk@fabiankei | 34A5FBA4 | | 8192R/0xB431B67770E4AA38 Mikal Villa <me | FE305F8E | | <hneal AT imalazybastard dot com> | CF9E4605 | | <hneal AT imalazybastard dot com> | D12F66D6 | | <periplanetaamericanus AT gmail dot com> | 5B5213C4 | | <periplanetaamericanus AT gmail dot com> | 47D04EC4 | | <periplanetaamericnaus AT gmail dot com> | F19106D7 | | <support at gkware dot com> | E754AA99 | | <support at gkware dot com> | 868A253C | | <support AT gkware dot com> | 48674035 | | <tech AT dana dot io> - 1AgYtavutLAMxUYM | 752DA4A4 | | <tor .AT. jgjtech .DOT. com> BTC: 1QHXLy | 0DA71D95 | | <tor .AT. jgjtech .DOT. com> BTC: 1QHXLy | 31A40828 | | <tor AT 1d4 dot us> - 1N7sBLKvekRD4EUL2b | F1107CB0 | | Abuse Department <abuse AT hartvoorinter | 81B75D53 | | Abuse Department <abuse AT hartvoorinter | 89E3170B | | abuse<__aT>icetor{_DoT===}is - 1GDerBXAJ | 1D9D1C1D | | anders.io | 91361C96 | | anders.io | D56AA4A1 | | anders.io | 3A2192F5 | | Bauruine <torcontact aatt tuxli.ch> - 1C | 63C1904F | | Bauruine <torcontact aatt tuxli.ch> - 1C | 52F7C67B | | BFC62AD3 johannes <tor (@) kontrollappar | 750941D5 | | Big Jim Slade <sysop AT bigjimslade dot | 9AFA555B | | Big Jim Slade <sysop AT bigjimslade dot | ACDC9C49 | | DFRI <tor AT dfri dot se> | A10C4F66 | | DFRI <tor AT dfri dot se> | DD8BD730 | | DFRI <tor AT dfri dot se> | EC84E232 | | DFRI <tor AT dfri dot se> | A478E421 | | Fabian Keil <fk(a)fabiankeil.de> 8BA2371C | 5CE3AD8A | | General Zod <zod(a)kdf.mil> | 556D59FA | | General Zod <zod(a)kdf.mil> | CBABC09D | | GetReal <x50 AT riseup dot net> | 51529D02 | | http://www.onion.network/ <info at onion | F89A5238 | | http://www.privacyfoundation.ch/abuse/ | DC41244B | | http://www.privacyfoundation.ch/abuse/ | 0111BA9B | | http://www.privacyfoundation.ch/abuse/ | DE7DE889 | | http://www.privacyfoundation.ch/abuse/ | 487092BA | | http://www.privacyfoundation.ch/abuse/ | AD86CD1A | | http://www.privacyfoundation.ch/abuse/ | 95DA61AE | | http://www.privacyfoundation.ch/abuse/ | B060482C | | http://www.privacyfoundation.ch/abuse/ | 88487BDD | | https://www.torservers.net/donate.html < | 4E021F36 | | https://www.torservers.net/donate.html < | F657ACB3 | | https://www.torservers.net/donate.html < | 64D500C4 | | iggs <tor.20.iggs AT spamgourmet dot com | 2F557D48 | | jvictors at jessevictors com, PGP 0xC20B | C6DC982A | | jvictors at jessevictors com, PGP 0xC20B | 4B8C39A5 | | jvictors at jessevictors com, PGP 0xC20B | BFA0E9F3 | | jvictors at jessevictors com, PGP 0xC20B | 40DF7E2E | | Kevin <tor AT kberanek dot com> - 14BTbA | 92EA887F | | Kevin <tor AT kberanek dot com> - 14BTbA | A1E02458 | | kingbiskit(a)gmail.com - 18gEJokSQ3uwo3QTM | C921704A | | kingbiskit(a)gmail.com - 1CoXRRwDt6YVTZmJ3 | 3246AF7B | | M.K. Nitrox <mk DOT reg AT t-online DOT | BD912646 | | montanisemperliberi <a> safe-mail.net | E8B6E46B | | Nicholas Merrill <nick AT calyx dot com> | 51BFE90C | | Nicholas Merrill <nick AT calyx dot com> | 0B5E5E70 | | Nicholas Merrill <nick AT calyx dot com> | 84D361B7 | | Nicholas Merrill <nick AT calyx dot com> | E4D1F25D | | Pascal666 at Users dot SourceForge dot N | C9437269 | | Pascal666 at Users dot SourceForge dot N | 5B7AEB14 | | Peter Palfrader | 847B1F85 | | R P <edschlonz AT yahoo dot de> | FF06E7A0 | | Samuel Whited 0x54083AE104EA7AD3 <sam AT | CA54C9F2 | | Sebastian <tor(a)sebastianhahn.net> - 12Nb | EBE718E1 | | snIP3r <sniper(a)restricted-area.de> | 3EE8D536 | | tor TA fejk tod se | 2AFE9201 | | torelay [ANTISPAM at] ruggedinbox [ANTIS | 0559A3D3 | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | BAACCB29 | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 0B454C7E | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 5A551BF2 | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 4436A57F | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 6D3A3ED5 | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 75C4495F | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 6A29FD8C | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 0C77421C | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 8073670F | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | B35C5739 | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | E6E18151 | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 6A37488D | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | E11B6AE1 | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 70C55A11 | | Torservers.net <support .AT. torservers | 488239E0 | | Torservers.net <support .AT. torservers | 6B1E0019 | | Torservers.net <support .AT. torservers | C46524E5 | | Torservers.net <support .AT. torservers | 770BE0CD | | Torservers.net <support .AT. torservers | 5C84C359 | | Torservers.net <support .AT. torservers | 20B0038D | | Torservers.net <support .AT. torservers | 5714542D | | Torservers.net <support .AT. torservers | B4F883DB | | Torservers.net <support .AT. torservers | 78213EC8 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 4E918B21 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | A494237E | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 35FEEA5F | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 2576BFB0 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | A1025D32 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | C8D44E91 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | B7EC0C02 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | FFD6C2CE | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 4C6F66B1 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 43D0AB1B | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | A57B43E1 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 9030DCF4 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 3A5F08D0 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 5C1E076A | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 482A381B | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 2D671A4A | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 66CFF345 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 55F5CF9D | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | FEF59210 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | B4A553CB | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 92506510 | +------------------------------------------+----------+ ..based on onionoo.thecthulhu.com's data from 2015-07-15 18:00 [1] https://trac.torproject.org/projects/tor/ticket/16276 -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVprfXAAoJEFv7XvVCELh0/FcP/28/dhefuPNQaBNSY59NTZTs snwb9vRlAzhDDm0XmWEMIaawFlNjV8shJD8dWvzSvynWHYQySfrStmDdfkpe5CSC lu9ceE6qhhZe+RkyDPM3PdxLhz29XVK+KvQcDcCeWp6nIHzXIOJL+Xk7v7FoU75S Vx8GjhVQd/aiHJQg96zlpdzkAsU000jG2E3Z2EH+gd4Uypl94wgqd0482LSSehiQ LVbhPt6C8NlX32kZ4yAD3W5cHRoyhg30x076X8XHZ16H6F2l801hhON5X32VmXdv vd/kJ7R9JKo4Uig1Y9hq3qpsRsO8aJaN2JOXMsGw2A+6eNFA2OPFLg3/sNKLgiLV N/CPqDlMVsotMDcXX4iBYSHW0Y+J7vyc5ezxE/rKWzBCBZSnK9Sb5UzcrDnOfJRO ABFv+ZtGxSQYVPcnICVdMr+3Kuk0FnKMm7z2ufYriRxDK573LQgNJQnjZ3Tc3JG+ PIVZun0IN/+1gZmQif57xIjW1OFDbDYbhMtYFYbK9zRd7PidIr5NHcYCkEY4whfP 2vhN4jbtYQZZY/hDAMLZVBKDJ42tOYG/8EaWZeMJ8y/pd+F8EvT7ceWzXwuhYm77 WiK4VsgFU7PR7ETi/DJL+ajmFEjpRJ8QOy3J5E/dq/eumkkzL/eBTPL7ydnTmD/u 9271J4DjQYPfjzVtVqdl =ecVW -----END PGP SIGNATURE-----

2 3

How to prevent netscan usage?
by Roland 'ValiDOM' Jungnickel 07 Feb '16

07 Feb '16

hi, I'm operating a tor exit with a relatively high bandwith rate for more than 3 years. My ISP receives more and more abuse tickets about my server regarding netscans. These netscans are executed with dest. port 80 so I'm not able to block them easily. Any idea how to prevent netscans using my exit node? Below you find an extract of such an abuse mail. Thanks a lot! ValiDOM Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 41518 => 46.20.92.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 41545 => 46.20.92.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 41575 => 46.20.92.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 45219 => 59.192.63.xx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 45218 => 59.192.63.xx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 45217 => 59.192.63.xx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 42460 => 59.203.179.x 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 42517 => 59.203.179.x 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 42569 => 59.203.179.x 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 57564 => 59.211.15.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 57596 => 59.211.15.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 57631 => 59.211.15.xxx 80 Wed Nov 18 12:55:27 2015 TCP 88.198.14xxx 58022 => 59.228.86.xxx 80 Wed Nov 18 12:55:27 2015 TCP 88.198.14xxx 58046 => 59.228.86.xxx 80 Wed Nov 18 12:55:27 2015 TCP 88.198.14xxx 58081 => 59.228.86.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 37123 => 64.238.74.xx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 37178 => 64.238.74.xx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 41003 => 65.20.53.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 45785 => 65.186.130.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 45850 => 65.186.130.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 45907 => 65.186.130.xxx 80 Wed Nov 18 12:55:12 2015 TCP 88.198.14xxx 60607 => 66.87.185.xxx 80 Wed Nov 18 12:55:12 2015 TCP 88.198.14xxx 60611 => 66.87.185.xxx 80 Wed Nov 18 12:55:12 2015 TCP 88.198.14xxx 60613 => 66.87.185.xxx 80 Wed Nov 18 12:55:14 2015 TCP 88.198.14xxx 52693 => 69.191.200.xxx 80 Wed Nov 18 12:55:14 2015 TCP 88.198.14xxx 52740 => 69.191.200.xxx 80 Wed Nov 18 12:55:14 2015 TCP 88.198.14xxx 52783 => 69.191.200.xxx 80 Wed Nov 18 12:55:27 2015 TCP 88.198.14xxx 35453 => 71.54.215.xx 80 Wed Nov 18 12:55:27 2015 TCP 88.198.14xxx 35464 => 71.54.215.xx 80 Wed Nov 18 12:55:12 2015 TCP 88.198.14xxx 39263 => 101.249.145.xxx 80

6 9

PASSWORD
by John favino 29 Nov '15

29 Nov '15

I NEVER RECEIVED A PASSWORD.

3 2

Re: [tor-relays] webiron requesting to block several /24 subnet
by Dhalgren Tor 28 Nov '15

28 Nov '15

>. . .I have to understand how my ISP reacts to this kind of things. >For the moment I will keep a low profile and I will block the >mentioned IP range for a month. Webiron's system sends notifications to both the abusix.org contact for the IP and to abuse(a)base-domain.tld for the reverse-DNS name of the relay IP. So if you can configure abuse@ for the relay domain to forward to you, you will see their notices at the same time as the ISP abuse desk. Might be helpful to know about it before they contact you and/or to see if they become familiar enough with the notices to ignore them. Automated abuse complaints from other sources do not always go to the domain-based address. http://multirbl.valli.org/ is a handy resource that shows the abuseix.org and abuse.net information, as well as how many DNSBLs the relay has racked up. You can change the abuse.net contact but Webiron appears to ignore this source and simply construct the abuse@ from the rDNS domain name.

7 8

Any experience with Pulse Servers?
by Jesse V 28 Nov '15

28 Nov '15

Hi everyone, I've been looking around for a new host for my Tor infrastructure, which includes exits, relays, and a bridge. I've been reviewing https://trac.torproject.org/projects/tor/wiki/doc/GoodBadISPs and ran across Pulse Servers, which seems Tor friendly. They have VPSs in Canada and the UK and have really low prices on VPSs, which I'm trying to understand. I've been trying to learn more but I think they have a pretty small setup (apparently the owner does tech support) and documentation is limited. Does anyone have any experience or opinions on them? -- Jesse V

4 3

Arm thinks Tor is not running as a Daemon?
by Jannis Wiese 27 Nov '15

27 Nov '15

Hi, I’m a bit confused right now. I’ve upgraded my relay to Debian Jessie yesterday and since then, arm keeps telling me > [ARM_WARN] The torrc differs from what tor's using. You can issue a > sighup to reload the torrc values by pressing x. > - configuration value is missing from the torrc: RunAsDaemon I’m running the same configuration as before (running Debian Wheezy), where it worked without any warning. RunAsDaemon is set to 1 in tor-service-defaults-torrc, still arm is showing me on the Tor configuration page “RunAsDaemon False”. Putting RunAsDaemon into torrc as well triggers this: > [ARM_WARN] The torrc differs from what tor's using. You can issue a > sighup to reload the torrc values by pressing x. > - torrc value differs on line: 17 The problem here: There is no line 17 in my torrc… I’ve already read tickets like #16459[1] and #2501[2] but it didn’t help much. Damian says in Ticket #16459 > […] This message is meant to help people who edit their torrc, forget to restart tor, and are then confused why the settings didn't take effect. [...] I did restart tor (a couple times) and apparently it is running as a Daemon (service --status-all). So I hope this is “just” an issue with arm… Maybe someone of you has an idea? I’m running arm 1.4.5.0 and tor 0.2.7.5 (from deb.torproject.org <http://deb.torproject.org/>) Cheers, Jannis [1] https://trac.torproject.org/projects/tor/ticket/16459 [2] https://trac.torproject.org/projects/tor/ticket/2501

2 2

Re: [tor-relays] Faravahar messing with my IP address
by SiNA Rabbani 26 Nov '15

26 Nov '15

Dear Relay Operator, I am the operator of Faravahar, It has been having some network issues, specifically very long latency. But this is the first time I hear of an issue like this. 154.35.32.5 is Faravahr's older IP addresses which was replaced with and 154.35.175.225 is the new IP (current). There are iptable rules forwarding the traffic from OLD IP to the new one for the clients that have not updated yet. Are you running the latest version of tor software? I'll be sure to keep an eye on this email and open a ticket as needed. Thank you for reporting the issue and running a relay. All the best, Sina "Be the change that you wish to see in the world." - Mahatma Gandhi ----- On Oct 22, 2015, at 11:22 AM, Logforme m7527(a)abc.se wrote: > I run the relay Logforme (855BC2DABE24C861CD887DB9B2E950424B49FC34) > > Saw this in yesterday's log file: > Oct 22 03:17:55.000 [notice] Our IP Address has changed from > 84.219.173.60 to 154.35.32.5; rebuilding descriptor (source: > 154.35.175.225). > Oct 22 03:17:55.000 [notice] Self-testing indicates your ORPort is > reachable from the outside. Excellent. Publishing server descriptor. > Oct 22 03:17:56.000 [notice] Performing bandwidth self-test...done. > Oct 22 03:26:55.000 [notice] Our IP Address has changed from 154.35.32.5 > to 84.219.173.60; rebuilding descriptor (source: 194.109.206.212). > > 84.219.173.60: <- My real IP address > 154.35.32.5: faravahar.rabbani.jp <- No idea > 154.35.175.225: faravahar.redteam.net <- Authority server > 194.109.206.212: tor.dizum.com <- Better authority server > > So if I read it right my relay asked the authority server Faravahar what > my IP address is and got the wrong answer. 9 minutes later my relay > asked another authority server and got the right answer. My relay show > an uptime starting from this time and if the relay did a full restart it > meant all the circuits got dropped? Inconvenient for users. > > My relay have "restarted" like this a few times the last weeks (only Tor > daemon "restarting", not the machine). Don't know if Faravahar is behind > the other "restarts". This time I just caught it in the log file before > it got archived. > > Is this a know issue with Faravahar? If so, should it be fixed? > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

7 12

Nagios/Icinga plugin check_tor_bandwidth for gathering bandwidth data
by Josef Stautner 26 Nov '15

26 Nov '15

Hello @all, (I'm not sure if you guys are interested in a topic like this) I wrote a perl script to gather bandwidth data from my Tor exit relay. The script connects to the Tor control socket, fetches the running config to extract the bandwidth limits and the reject rule count. Afterwards the last 60 bw-cache entries are fetched and average values are built for bandwidth in and out. All this performance data is then forwarded to Nagios/Icinga where you can do anything with that values. Every 30 minutes a cronjob renders the graph showing the datapoints of the last 6 houres and uploads the resulting image to my website. You can find the image here (Hint: The values for in and out are stacked): https://blog.veloc1ty.de/bandwidth-large.png The source of the script can be found here on GitHub: https://github.com/vlcty/check_tor_bandwidth It's released under the GPLv3 Maybe somebody will find it usefull :-) ~Josef

4 4