March 2015 - tor-relays - lists.torproject.org

Meeting notes of the relay operators meeting in Valencia
by Jens Kubieziel 17 Mar '15

17 Mar '15

Hi, below you find my notes for the relay operators meeting we had in Valencia. Those just some short notes. If you have any questions or remarks, please don't hesitate. * Introduction Several Tor relay operators met at Tor Developer meeting in Valencia, Spain. At our meeting we had operators from the following countries: - Germany - Netherlands - France - Spain - India - Costa Rica This document gives a short overview what we discussed. If you have any questions or comments don't hesitate. * DDoS attacks: One questions which was raised is what to do against DDoS attacks. Several ISPs complained about DDoS attacks against Tor relays. There were also shutdowns of servers. It was suggested to employ DDoS mitigation tools. Other operators suggested to don't do anything. It is better to educate the ISP about Tor. Do you have any experiences with this topic? * Abuse TorServers has templates for different cases of abuse. See [[https://www.torservers.net/wiki/abuse/templates]] The Tor Project offers also some advice in their wiki. See [[https://trac.torproject.org/projects/tor/wiki/doc/TorAbuseTemplates]] Furthermore several organisations developed their own templates. Someone at the meeting offered to review others templates. As a general advice one should start with thanking the person and acknowledge what they do. TODO: We should rephrase some of the templates and generate some hice, good example documents. * Bridges The current alpha release of Tor Browser Bundle 4.5 comes with support for obfs4. Currently there are only few bridges which use obfs4 and everyone is asked to enable the new protocol. Obfs3 doesn't really work in China and obfs4 is the current best bet. If you have any questions about obfs4 you should have a look at the documentation or write an email to Yawning (<yawning(a)torproject.org>). Some links: - How to run an obfs4 bridge: https://tor.stackexchange.com/q/6370/88 - Debian package: https://packages.debian.org/search?keywords=obfs4proxy - Post at tor-relays: https://lists.torproject.org/pipermail/tor-relays/2014-September/005372.html * Tor relays in Japan It is legal to run relays in Japan, but practically it depends on ISP. So if you know a person in Japan, encourage them to run a Tor relay. It was said that relays from SE asia went online for some time and slowed down the overall network. Jens talked to Mike Perry who couldn't remember such incident and also couldn't believe that this is true. * Relays in India There are some relays in India, some of them probably in universities and some very slow. A home connection is 60/60MB/s and capped at 8GB/80GB per month. I couldn't really understand what the correct numbers were. * How to make nodes faster Someone had a 10Gig which link was not used. It was recommended to use multiple processes; one process per core. So also hints at https://blog.torproject.org/blog/lifecycle-of-a-new-relay * Tor wheather Several peopel work on Tor weather. The status is not clear. However there is some need for a working version. * ARM devices We found out that several organisation have utilised some ARM device. Juris from Torservers runs a Bananapi at a data center and gets 30-40MB/s. DFRI has a router which they give away to interested persons. Jacob Appelbaum made a combination of Relay and Router. Merlijn suggested that Hardkernel has some faster ones which fit for exit relays. We want to work more closely together to create some neat device. * Stats on exits Someone asked if it is OK to run statistics on exit relays. As long as the tools only monitor the amount of traffic this is OK. Looking into exit traffic or even messing with the traffic would instantly qualify you as a bad exit. * Legal issues + Germany has no data retention law in place + data retention in the Netherlands: court case said illegal, try to make a law + France: https://netzpolitik.org/2015/franzoesischer-patriot-act-ueberwachungsmassna… (yes, data retention since 2011) + article 12 of ecommerce directive + Costa Rica has no data retention law * World Hosting Days + Who is interested to go there? * TODO - Work on templates - How many DMCA notices do you get? Can you give Jens some monthly numbers together with the exit probability of your relays? An EFF person wanted to collect some numbers. Jens will relay those numbers. - run obfs4 bridges -- Jens Kubieziel http://www.kubieziel.de

2 2

Tor-node/relay: System installation vs. TorBrowser
by Lars Edman ＠ LinuxSuSE 17 Mar '15

17 Mar '15

Hi! I was referred to you from help(a)rt.torproject.org. when asking them if they discouraged from using tor as a client or node/relay with tor in a system installation. By "system installation" I mean installation of tor, libevent, libgeoip (and ev vidalia) together with openssl. I found they today absolutely discouraged from the use of such a "system installation" when using tor as a client. When it came to using tor as a node/relay or running a server they referred the question to you. My reason for asking is that I have been running a "system installed" tor node in my Slackware server for 3 years now. subsequently updating/grading them. It has served well and I monitor the log continously for warnings or errors correcting the when they very rarely occur (usually by updating/_grading). My reason for using a system installation for node/server use is that I've found it easier to configure the way I wanted than the BrowserBundle. Do you consider this kind of installation insecure? Best regards Larse

6 5

List of longest lived Exits and Relays
by grarpamp 17 Mar '15

17 Mar '15

Is there a list somewhere (preferably on metrics) of exits and relays sorted by longest period of service (years) on the same IP? Preferably this would subset by exit policy... whether open, or using some published, named, and adopted "standard" exit policy. Such as "reduced" (whatever that means, each version should be reflected in the name "reduced-N").

2 1

connection problems
by Malte Ketelsen 17 Mar '15

17 Mar '15

Hey, I have connection problems with my relay. Can someone tell whats this mean: Mar 16 23:59:12.000 [debug] TLS error: unexpected close while reading (SSL negotiation finished successfully) Mar 16 23:59:12.000 [debug] channel_close_for_error(): Closing channel 0x7fe72b1a41c0 due to lower-layer error Mar 16 23:59:12.000 [debug] channel_change_state(): Changing state of channel 0x7fe72b1a41c0 (global ID 79) from "closing" to "channel error" I get a lot of these news.

1 0

Tor server received reload signal
by cmar433＠yandex.com 17 Mar '15

17 Mar '15

Hi all, its normal situation ? every day on 2:49:02 AM my server received HUP signal. I checked all possible logs but i have no idea why. https://globe.torproject.org/#/relay/9DCF76179FCF47224D235ECD4A6165FED22ECE… Thank in advance for proposal :-) Cmar

2 2

Many inbound and outbound connections but no circuits
by mattia 16 Mar '15

16 Mar '15

Hello, I've been running a relay for some weeks. It has now earned the stable flag. Despite this I always have more than 500 inbound and outbound connections but no circuits at all. Is this normal?

2 3

keeping tor relays operational
by Larry Brandt 15 Mar '15

15 Mar '15

Sorry if this question has been answered dozens of times before. I have a middle relay that has been operational since last summer. I wish to make some alterations to my torrc file and make these changes operationally active without stopping and restarting tor. Is this possible? I experience a bit of down time whenever I up bandwidth, change contact info, etc. I'm also disapointed when ubuntu sends updates that require a server restart. What is the best method to handle this on a stand-alone server? LB

5 5

IP Address change detected wrongly (Our IP Address has changed)
by Sasikantha babu 14 Mar '15

14 Mar '15

Hi all, Today on my relay I observed the below messages 2 hours back. Tor reported address change from IP_IN_INDIA to IP_IN_FRANCE from SRC_1. The next second SRC_2 reported address change from IP_IN_FRANCE to IP_IN_INDIA . How could it be possible?. Is this a normal behavior?. Mar 10 08:06:52 NoNameForHost Tor[27279]: Our IP Address has changed from <MY_IP_INDIA> to <IP_IN_FRANCE>; rebuilding descriptor (source: SOURCE_IP_1__). Mar 10 08:06:53 NoNameForHost Tor[27279]: Our IP Address has changed from <IP_IN_FRANCE> to <MY_IP_INDIA>; rebuilding descriptor (source: SOURCE_IP_2__). PS: I'm not posting IP addresses but If you somebody wants the IP address too I will post them. Thanks

3 4

Using /dev/hwrng
by Imse Vimse 14 Mar '15

14 Mar '15

Hello. Would enabling the hardware random number generator on a relay node be usefull in terms of increased performance? If so, is it enough to activate /dev/hwrnd or is some configuration and/or recompilation required? Regards

2 2

PGP-Key for Debian Repo
by Sven Reissmann 12 Mar '15

12 Mar '15

Hi, I'm not able to fetch the pgp key for the debian repo, as described here: https://www.torproject.org/docs/debian.html.en $ gpg --keyserver keys.gnupg.net --recv 886DDD89 gpg: requesting key 886DDD89 from hkp server keys.gnupg.net ?: keys.gnupg.net: Host not found gpgkeys: HTTP fetch error 7: couldn't connect: Success gpg: no valid OpenPGP data found. gpg: Total number processed: 0 Is there a problem on my side? Could anyone check this and give me feedback please? Regards, Sven. -- PGP Key: https://0x80.io/pub/files/key.asc PGP Key Fingerprint: 2DF2 79CD 48DD 4D38 F0B6 7557 2E68 D557 49AA 1D99 Note: I'll be transitioning away from this key in the near future.

4 5