March 2015 - tor-relays - lists.torproject.org

Reminder: exit nodes probably shouldn't be using Google's DNS servers
by Nick Mathewson 25 Feb '16

25 Feb '16

Hi, all! While looking into a bug report, I noticed that an exit node was using one of Google's well-known public DNS servers for its own DNS server. No disrespect to the operators of Google's fine public DNS service, but my sense is that using it for a Tor exit node might not be the greatest idea for users' privacy, having one DNS provider that gets to see so many requests. It's probably a better idea to have your own local cacheing DNS server. Would anybody like to share a guide about how to set one of those up safely and migrate correctly? best wishes, -- Nick

23 38

Relay Consensus Weight
by Marco Morgia 24 Apr '15

24 Apr '15

Hello, on friday my realay's Consensus Weight felt down suddenly to 20 and the its bandwidth is not used anymore (https://atlas.torproject.org/#details/94212674A2C6AEBF77354D959D464E49BC878…) I don't understand why, as nothing is changed in its configuration. And, I don't know if it's related, but I noticed that the tor network has slow down in the last days and some times it's very difficult to use it. Thanks for your help, Marco ____________________________________________________________ Receive Notifications of Incoming Messages Easily monitor multiple email accounts & access them with a click. Visit http://www.inbox.com/notifier and check it out!

3 11

onionoo backend seems to be down.
by jason＠icetor.is 21 Apr '15

21 Apr '15

Hello All, Anyone else notice onionoo and the tools that rely on it (globe.torproject.org atlas.torproject.org) seem to be down? -Jason

5 4

Re: [tor-relays] Undiagnosable Crashes in Relays
by teor 21 Apr '15

21 Apr '15

> Date: Wed, 25 Mar 2015 17:21:50 +0800 > From: Vincent Yu <v(a)v-yu.com> > > On Wed, Mar 25, 2015 at 4:26 PM, skyhighatrist <skyhighatrist(a)tfwno.gf> > wrote: >> I am wondering if anyone has had their relay randomly crash in the >> past >> week or so. Three of mine (I run 6, nonexits) have fallen over. One of >> them ~5 days ago, one of them ~4 days ago, and one of them earlier >> today >> . > > This also happened to my two relays about three weeks ago. They are: > > https://globe.torproject.org/#/relay/C309A31AD772FFDD0805C9FECB6D4748A7CBF6… > https://globe.torproject.org/#/relay/18BE989663CF3351F73D33C672BB1C985E0EA5… > > They are both middle/guard relays (about 200 Mbps each) on the 0.2.6 > branch and are on the same dedicated server. They went down at > different times, and as far as I can remember, there was nothing > notable in the Tor and system logs. No issues prior to this over the > past 12 months. I haven't had time to investigate this. > This also happened to my EC2 relay a few weeks ago, but I never had time to investigate. It's quite possible it was a bad nightly tor version, or some sort of misconfiguration on my end, but the timing matches. I didn't manage to get it to come back up in the limited time I had to try and fix it. https://globe.torproject.org/#/relay/425E55A8FA145ACFC01FA58CD4E6F46DD7762A… (No record, it's been down for a while.) teor teor2345 at gmail dot com pgp 0xABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR C3C57B23 349825DE 929A1DEF C3531C25 A32287ED

2 3

Tor and Freenode
by Markus Hitter 20 Apr '15

20 Apr '15

Hello all, after yesterday watching "State of the Onion", a speech held at 31C3 recently, I spontanuously decided to also run a Tor relay. After some back and forth it appears to be running fine on my OpenWRT based router. The only ORPort is 9001, which is also the only hole punched into the firewall, I hope I did this right. Today I wanted to continue at Freenode IRC, like I did for years, not even using an anonymous connection. But they wouldn't let me in: [12:02] * You are banned from this server- Your tor exit node must not allow connections to freenode (tor exit node (chat.freenode.net:8000)). Email tor-kline(a)freenode.net when corrected. (2015/1/24 09.41) I understand that my router and my PC share the same IP address to the remaining internet and IRC operators try to identify users by their IP address (which isn't possible). Reading up on the matter I found two texts: http://www.freenode.org/policy.shtml "The freenode network welcomes Tor users" http://www.freenode.org/irc_servers.shtml#tor "If you do want to be a Tor exit node and still use freenode, you will have to configure your exit policy to block all of the IRC ports we use, in addition to ports 80 and 443 as these are used for webchat." To me this sounds like "We welcome it, but please block all of its usage". They recommend to add a "reject *:*" rule, but that means the relay is no longer a relay, right? And blocking port 80 and 443 means Tor to become useless. As I can't find much on the matter by googling: is this actually a misalignment of Freenodes' statement to freedom as bad as it looks? If yes, what could I do about it? I'm a fairly experienced hobbyist hacker and admin, so I wouldn't fear writing some code. Cheers, Markus -- - - - - - - - - - - - - - - - - - - - Dipl. Ing. (FH) Markus Hitter http://www.jump-ing.de/

14 27

New relay not recognised by weathermap
by Sharif Olorin 30 Mar '15

30 Mar '15

Hi all, I configured a new relay[0] yesterday, and recently tried to sign up for the Weathermap[1], wherein I get a "could not locate a Tor node with that fingerprint" error message. The node's definitely been up for more than an hour, and Atlas can see it[2]. Is this expected behaviour, or might it indicate an issue with my configuration? I've checked everything on the "potential problems" list - the node does exist, the fingerprint is correct, it's been up for more than an hour, hasn't been down for over a year, and running a recent (0.2.5.11) version of Tor. Thanks, Sharif [0] dendrocyte.wiredlaboratories.com.au/03B5C7B81CA56DF3CCC31FDA8032A7763B8B50B4 [1] https://weather.torproject.org/subscribe/ [2] https://atlas.torproject.org/#details/03B5C7B81CA56DF3CCC31FDA8032A7763B8B5… -- PGP: 6FB7 ED25 BFCF 3E22 72AE 6E8C 47D4 CE7F 6B9F DF57

2 4

New relay not recognised gy weathermap
by Sebastian Urbach 30 Mar '15

30 Mar '15

Sharuf, I completely forgot to welcome you and thank you for running a relay ! So, welcome and i hope you stay for quite a while :-) -- Sincerely yours / Sincères salutations / M.f.G. Sebastian Urbach ----------------------------------------- Religion is fundamentally opposed to everything I hold in veneration - courage, clear thinking, honesty, fairness, and, above all, love of the truth. ----------------------------------------- Henry Louis Mencken (1880 - 1956), American journalist, essayist, magazine editor, satirist and critic.

1 0

Re: [tor-relays] Installing obfs4 on Raspberry Pi bridge
by jchase 30 Mar '15

30 Mar '15

Thanks for your answer. Your instructions were good and explicit, but you hit on two of the problems I run into. I installed tor 0.2.5.11-1 from torproject.org and got two error messages that I couldn't solve. I would have to go back and re-install 0.2.5.11-1 to tell you what they were. In any case they weren't configuration problems. I had pretty much the same problem months ago when I installed a tor 0.2.5.x on Pi. Which leads me to want to use a raspbian repo. only I am unable to get /etc/apt/sources.list to recognize http://archive.raspbian.org/raspbian/pool/main/t/tor/ (or variations thereof) as a repository. And in my main raspian repo tor doesn't go any higher than 0.2.4.26 . So simply updating tor does not work. How do I add http://archive.raspbian.org/raspbian/pool/main/t/tor/ http://archive.raspbian.org/raspbian/pool/main/o/obfs4proxy/ http://archive.raspbian.org/raspbian/pool/main/libc/libcap2/ as one or more alternative repositories or force an install? Thanks, J. Chase tor-relays-request(a)lists.torproject.org: > Message: 4 > Date: Sun, 29 Mar 2015 00:19:14 +0200 > From: s7r <s7r(a)sky-ip.org> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Installing obfs4 on Raspberry Pi bridge > Message-ID: <551728E2.4030705(a)sky-ip.org> > Content-Type: text/plain; charset=windows-1252 > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA256 > > Hi, > > obfs4 will not run on 0.2.4.x , you need at least 0.2.5.x or 0.2.6.x > > First, upgrade your Tor. > > You can use torproject.org repositories. If you are running wheezy: > > 1. Add the repository: > # echo "deb http://deb.torproject.org/torproject.org wheezy main" >> > /etc/apt/sources.list > > 2. Add the signing key: > # gpg --keyserver keys.gnupg.net --recv 886DDD89; gpg --export > A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add ? > > 3. Install keyring: > # apt-get update && apt-get -y install deb.torproject.org-keyring > > Now upgrade your Tor, an apt-get -y install tor would upgrade to 0.2.5.1 > 1. > > You can install obfs4proxy from deb.torproject.org too: > > # echo "deb http://deb.torproject.org/torproject.org obfs4proxy main" >>> >> /etc/apt/sources.list > # apt-get update && apt-get -y install obfs4proxy > > Now, modify your torrc to enable the obfs4 transport. Make sure you > also add ExtORPort auto in torrc so it will report some useful > statistics. obfs4proxy also supports obfs3, and some users still use > that, so if you can be an obfs3 and obfs4 bridge at the same time > (requires just one more open port) it would be great. > > Sample torrc entry for enabling obfs4 and obfs3: > ExtORPort auto > ServerTransportPlugin obfs3,obfs4 exec /usr/bin/obfs4proxy > ServerTransportListenAddr obfs3 [::]:port > ServerTransportListenAddr obfs4 [::]:port > > To make the bridge even better, you can bind obfs3 and obfs4 to lower > ports (< 1024), if you have them free, such as obfs3 on 80 and obfs4 > on 443 (for example). This will help users behind really restrictive > firewalls who only allow connections on few ports. You can easily do > this with libcap2-bin package: > > # apt-get -y install libcap2-bin > # setcap 'cap_net_bind_service=+ep' /usr/bin/obfs4proxy > > To make this persistent after a reboot, edit the /etc/rc.local file > and add this line before 'exit 0': > setcap 'cap_net_bind_service=+ep' /usr/bin/obfs4proxy > > Hope this helps. If you don't want to use deb.torproject.org, > everything required is also included in raspbian main repo: > > http://archive.raspbian.org/raspbian/pool/main/t/tor/ > http://archive.raspbian.org/raspbian/pool/main/o/obfs4proxy/ > http://archive.raspbian.org/raspbian/pool/main/libc/libcap2/ > > If you want to use raspbian repo, simply ignore the lines where you > add deb.torproject.org to your sources.list file and just upgrade, > install the required packages and modify your torrc file. > > Thanks for running a bridge.

4 3

MY IP adress on blacklist and then in exit relay policy
by Cmar433 30 Mar '15

30 Mar '15

https://globe.torproject.org/#/relay/9DCF76179FCF47224D235ECD4A6165FED22ECE… So, i am running exit node. My provider send me an email .. "This IP is infected with, or is NATting for a machine infected with s_downloaderbot-mxb" Any idea what can i do with this problem ? Now i can see my IP in my server exit policy ... After my "delist action" is clean .. http://www.senderbase.org/lookup/ip/?search_string=37.157.192.208 I need just wait ? And all outgoing packet from my server still droped ? Thanks ..

5 7

Fwd: MY IP adress on blacklist and then in exit relay policy
by Zack Weinberg 30 Mar '15

30 Mar '15

On Mon, Mar 30, 2015 at 12:45 PM, Roger Dingledine <arma(a)mit.edu> wrote: > On Mon, Mar 30, 2015 at 12:23:21PM -0400, Zack Weinberg wrote: >> The only way your exit node's own IP address could be in the exit >> policy is if someone put it there. > > No, this is fine and normal. Tor relays automatically add themselves to > their exit policy by default. Thanks for the correction.

1 0