April 2015 - tor-relays - lists.torproject.org

Reminder: exit nodes probably shouldn't be using Google's DNS servers
by Nick Mathewson 25 Feb '16

25 Feb '16

Hi, all! While looking into a bug report, I noticed that an exit node was using one of Google's well-known public DNS servers for its own DNS server. No disrespect to the operators of Google's fine public DNS service, but my sense is that using it for a Tor exit node might not be the greatest idea for users' privacy, having one DNS provider that gets to see so many requests. It's probably a better idea to have your own local cacheing DNS server. Would anybody like to share a guide about how to set one of those up safely and migrate correctly? best wishes, -- Nick

23 38

Effectively donating bandwidth
by Curtis Gagliardi 29 Apr '15

29 Apr '15

I'm running a relay with the extra bandwidth on my VPS, but I'm unsure if it's optimally configured. I have 2.5TB of bandwidth I want to use every month. Given that, how do I configure my relay in the most helpful way? The docs mention dividing my bandwidth by 30 and setting an accounting max of 1 day. It also suggests "You might also consider rate limiting to spread your usefulness over more of the day". What not use an accouting period of a month and spread it out over the full month? Spreading it out feels like the right thing to do, but is it actually the most helpful? Maybe burning my bandwidth is faster bursts is more helpful. If spreading it over the month using a low bandwidth rate and a monthly accounting period is ideal, is there a better way to configure it than busting out a calculator and coverting TB/month to KB/s? How should I determine my BandwidthBurstRate? I understand what it is, but should it be defined in relation to my bandwidth rate? Thanks in advance, Curtis Gagliardi

2 2

Re: [tor-relays] running multiple bridges on one machine?
by teor 29 Apr '15

29 Apr '15

> On 29 Apr 2015, at 22:00 , tor-relays-request(a)lists.torproject.org wrote: > > Date: Tue, 28 Apr 2015 17:45:44 +0200 > From: yl <tor(a)yl.ms> > > Am 28.04.2015 um 03:30 schrieb syndikal: >> let's begin: is it possible to run 5 bridges on one low-end VPS? each >> bridge would be hosted on a different IP address from five different /24 >> IP blocks, so that's not an issue. would i have to use multiple Tor >> processes, and would 5 processes be too much for a 2-core VPS with >> 256mb memory? >> >> also, how much bandwidth does a bridge normally burn through per month? >> on said VPS, the economical choice is to provide 200gb bandwidth per >> month. if that is not sufficient, the offer isn't financially feasible. > > I run a tor relay on some Atom processor, the bottleneck is the missing > AES-NI I think, however on 100MBit/s it only makes 35MBit/s with one CPU > core being loaded 100% and the other 3 at ~10%. My relay makes a few > TB/month like that, so I guess it is still good to keep it running. yl, have you tried running a second tor instance on another pair of ports? (onion / directory) The second instance would be able to use another of the processors on your multiprocessor machine. (Unfortunately, tor multithreading only offloads some of the work.) There is currently a limit of two instances per IP address, but if you have 2 IP addresses, you could potentially run 4 instances, one instance per processor. teor teor2345 at gmail dot com pgp 0xABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR D5BE4EC2 255D7585 F3874930 DB130265 7C9EBBC7

1 0

running multiple bridges on one machine?
by syndikal 28 Apr '15

28 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 hello relay operators! i've asked this question on IRC once or twice, but it seems the right people aren't online/active when i am. i think i might be able to get a better audience to answer my questions here on the mailing lists. let's begin: is it possible to run 5 bridges on one low-end VPS? each bridge would be hosted on a different IP address from five different /24 IP blocks, so that's not an issue. would i have to use multiple Tor processes, and would 5 processes be too much for a 2-core VPS with 256mb memory? also, how much bandwidth does a bridge normally burn through per month? on said VPS, the economical choice is to provide 200gb bandwidth per month. if that is not sufficient, the offer isn't financially feasible. thanks for all you do! - -- @syndikal A9FF 2FE3 A171 FE53 AEC3 A0F9 72B5 44E0 4417 11B2 twitter.com/syndikal -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVPuKmAAoJEHK1ROBEFxGyfUQP/irH1HzKPCe+t9TFSMignsRq oX5tK6YfInQ7vmfdhpPyHodM6DneeC1uBVdY6+qyJ6g3Ef5JXblSua+2zqJe8mlI rlwL9ll+i4tYSquqpaht3dWU1xY/UoqnlwCSO8+xaCz0zYBmOafib1MHI8nCDblp Y1PXMVWs3nhaXP/ev8JS3y8HuVeVy03lRF8pAaxKJmFI5YZJpNqHO/gVXTwU0O6M OrlqPT/YPmN/cD00TrnT5k+dVEHIPzEt7vK20NlUfCTS7vLOZync+jwRBYPzS6es fFq7C/gTP3oxyx6RIGLXpHEtKmvUwQeC89GKrgrDfb0EynX7bZ+jcvzXBCq5TPFz rgz19ogAbDZ167FshkVhMc+twfhkaq1FN2ADIHF7iIFLd6z93Img3IVMk+i2nijy lb4CtfHFqhJKSxuAfUYVFHx5GnC2u37gOCKdF+ZOCtpOAyP7ozrSwVYLY+OjsPf2 7F9dq22x8QxOdSccyK4lrmyl0SZpliMDCIoJk4IvJT2elqStntwH/Ecur2I48mWv UvPcwUEbsUhZg/u3xDkuvhB5zcVYB01gqbFSr8N7nYgMgx9Ww7lVVMmj+2ADQS9e ttOHmck50ewjz/EVN/xbWcemdGyiNl1M0aPyoysWgn/8TZ12TLhAL1jgJxOJFE99 7K8kTak9an5FOf+RbpY6 =eeGb -----END PGP SIGNATURE-----

4 3

Re: [tor-relays] Tor Cloud/AWS relay set up but no Tor installed
by aredocilla＠gmail.com 27 Apr '15

27 Apr '15

Hi there, After a long month of not having time for this, I've got it working thanks to Sina's help. I've attached patches to the ec2-prep.sh script that should make it work again (nothing extensive, basically just what Sina pointed out plus something about ExtORPort I saw it complaining about in the log. Bridge is now up. :) Best wishes, allicoder On Sun, Mar 22, 2015 at 10:51:42AM +0000, tor-relays-request(a)lists.torproject.org wrote: > Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > > > Today's Topics: > > 1. Re: IPv6 HiddenServicePort (teor) > 2. Tor Cloud/AWS relay set up but no Tor installed > (aredocilla(a)gmail.com) > 3. Re: Tor Cloud/AWS relay set up but no Tor installed (SiNA Rabbani) > 4. Tor-Tshirts (Nchinda Nchinda) > 5. Re: Tor-Tshirts (Roger Dingledine) > > Message: 2 > Date: Sun, 22 Mar 2015 03:10:53 +0000 > From: aredocilla(a)gmail.com > To: tor-relays(a)lists.torproject.org > Subject: [tor-relays] Tor Cloud/AWS relay set up but no Tor installed > Message-ID: <20150322031053.GB5948@MadHatter> > Content-Type: text/plain; charset=us-ascii > > Hello, > > I've been trying to set up a tor relay on AWS using the free tier using the > instructions in various places (e.g. https://cloud.torproject.org/, > https://www.fak3r.com/2012/08/11/howto-run-a-tor-node-in-the-cloud-for-free/) > But sshing in from my PC shows clearly that not only is tor not running, it's > not even installed! > > ubuntu@ip-172-31-28-207:~$ aptitude show tor > Package: tor > State: not installed > Version: 0.2.5.11-1~precise+1 > Priority: optional > Section: net > ... > > ubuntu@ip-172-31-28-207:~$ ps -ely | grep tor > ubuntu@ip-172-31-28-207:~$ ls /var/log > alternatives.log auth.log btmp dist-upgrade dmesg.0 dmesg.2.gz fsck landscape mail.err news udev unattended-upgrades wtmp > apt boot.log cloud-init.log dmesg dmesg.1.gz dpkg.log kern.log lastlog mail.log syslog ufw.log upstart > > Has something changed, and the images no longer include tor on start-up (I made > sure I followed the gist of the cloud.torproject.org steps, given that the > interface has changed significantly; even went to the previous page from the > linked one to check that the AMI thing mentioned tor)? I've noticed various > people have posted online saying it's not safe to run Tor on cloud services - > has the image been deleted because of this? I wanted to try it anyway because > the main torproject website still says in several places that running a relay > on AWS is A Good Thing. > > Or did I just do something wrong? > > Best wishes, > allicoder. > > -- > PGP key available on request > > > ------------------------------ > > Message: 3 > Date: Sun, 22 Mar 2015 04:52:34 +0000 (UTC) > From: SiNA Rabbani <sina(a)redteam.net> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Tor Cloud/AWS relay set up but no Tor > installed > Message-ID: > <1101716784.98280.1426999954497.JavaMail.zimbra(a)redteam.net> > Content-Type: text/plain; charset=utf-8 > > Hi allicoder, > > The images on Tor Cloud website have not been updated for a while. The project is lacking someone > that can keep it up to date. I tried to take on the responsibility but so far I have failed to dedicate > the necessary time. Sorry for the bad experience. > > As far as the specific problem with the Cloud image itself, there is a script that is supposed to install the relay > on first boot. See /etc/rc.local. > > You can also find that script here: https://gitweb.torproject.org/tor-cloud.git/plain/ec2-prep.sh > > There are a couple of issues with the script itself that I noticed immediately: > 1) the harcoded pgp key is expired > 2) the debian experimental repository is returning a 404 > W: Failed to fetch http://deb.torproject.org/torproject.org/dists/experimental-precise/main/bi… 404 Not Found [IP: 38.229.72.16 80] > > If you wish to do some trouble-shooting, try to get these commands to run without any errors: > sudo apt-get -y update > sudo apt-get -y upgrade > sudo bash /etc/ec2-prep.sh bridge > > Finally, now that you have a running image and ssh access, you can just follow the Tor relay installations here: > https://www.torproject.org/docs/debian.html.en > > I apologize for the inconvenience and thank you for running a relay. > > All the best, > Sina > > > > > "Be the change that you wish to see in the world." - Mahatma Gandhi > > ----- On Mar 21, 2015, at 11:10 PM, aredocilla(a)gmail.com wrote: > > > Hello, > > > > I've been trying to set up a tor relay on AWS using the free tier using the > > instructions in various places (e.g. https://cloud.torproject.org/, > > https://www.fak3r.com/2012/08/11/howto-run-a-tor-node-in-the-cloud-for-free/) > > But sshing in from my PC shows clearly that not only is tor not running, it's > > not even installed! > > > > ubuntu@ip-172-31-28-207:~$ aptitude show tor > > Package: tor > > State: not installed > > Version: 0.2.5.11-1~precise+1 > > Priority: optional > > Section: net > > ... > > > > ubuntu@ip-172-31-28-207:~$ ps -ely | grep tor > > ubuntu@ip-172-31-28-207:~$ ls /var/log > > alternatives.log auth.log btmp dist-upgrade dmesg.0 dmesg.2.gz > > fsck landscape mail.err news udev unattended-upgrades wtmp > > apt boot.log cloud-init.log dmesg dmesg.1.gz dpkg.log > > kern.log lastlog mail.log syslog ufw.log upstart > > > > Has something changed, and the images no longer include tor on start-up (I made > > sure I followed the gist of the cloud.torproject.org steps, given that the > > interface has changed significantly; even went to the previous page from the > > linked one to check that the AMI thing mentioned tor)? I've noticed various > > people have posted online saying it's not safe to run Tor on cloud services - > > has the image been deleted because of this? I wanted to try it anyway because > > the main torproject website still says in several places that running a relay > > on AWS is A Good Thing. > > > > Or did I just do something wrong? > > > > Best wishes, > > allicoder. > > > > -- > > PGP key available on request > > _______________________________________________ > > tor-relays mailing list > > tor-relays(a)lists.torproject.org > > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > ------------------------------ > > End of tor-relays Digest, Vol 50, Issue 31 > ****************************************** -- PGP key available on request

1 0

Installing obfs4 on Raspberry Pi bridge
by jchase 25 Apr '15

25 Apr '15

Hello, Thanks, everyone, for all the help. Obfs4proxy is up and running on a Pi2. Although the information on the subject is scattered across several issues on this list, I hope others can use it to build some bridges! http://www.zipplet.co.uk/index.php/content/raspberrypi_golang was a useful page on getting go 1.2 or higher installed on a Pi2. Thanks again, J Chase > Message: 1 > Date: Thu, 23 Apr 2015 20:42:42 +0000 > From: Yawning Angel <yawning(a)schwanenlied.me> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Installing obfs4 on Raspberry Pi bridge > Message-ID: <20150423204242.65bed2f9(a)schwanenlied.me> > Content-Type: text/plain; charset="us-ascii" > > On Thu, 23 Apr 2015 19:53:55 +0000 > jchase <jchase(a)riseup.net> wrote: >> Hello, >> When I run >> >> $ go get git.torproject.org/pluggable-transports/obfs4.git/obfs4proxy >> $ sudo cp $GOPATH/bin/obfs4proxy /usr/local/bin >> >> on a laptop running linuxmint/ubuntu it produces a nice binary >> executable. Unfortunately it doesn't work to copy it to the Pi2, >> because it's not an ARM binary. >> When I run the same script on the Pi2 I get the following error >> messages: >> >> go get git.torproject.org/pluggable-transports/obfs4.git/obfs4proxy >> # git.torproject.org/pluggable-transports/obfs4.git/common/ntor >> /usr/lib/go/src/pkg/git.torproject.org/pluggable-transports/obfs4.git/common/ntor/ntor.go:272: >> undefined: sha256.Sum256 >> >> [snip] >> >> Any idea how I can get it cleanly on a Pi2? > > This is covered in the README.md: >> * Go 1.2.0 or later. Prior versions of Go (Eg: 1.0.2) are missing >> certain important parts of the runtime library like a SHA256 >> implementation. > > Go 1.2 was released on December 1, 2013, so I'm not particularly > inclined to support older versions, especially since it means > re-implementing parts of the standard runtime library. > > Regards, >

1 0

Subpoena received
by Tyler Durden 24 Apr '15

24 Apr '15

Hi I just wanted to let you know that Washington sent us a subpoena regarding one of our exit nodes in Romania. They want to know the real IP behind the Tor Network. I mailed them what Tor is and why I can't help them in identifying this person. Nevertheless I will give you the link to the full subpoena. Maybe you guys find it interesting. I will forward the subpoena to our lawyer as well. https://mega.co.nz/#!ilIjlZSb!-deirKharWaDtp_UMxhev58E14zeouyoWUbzxeWPvEQ Greetings -- Sam Grüneisen - President Frënn vun der Ënn A.S.B.L. enn.lu

16 28

Relay Consensus Weight
by Marco Morgia 24 Apr '15

24 Apr '15

Hello, on friday my realay's Consensus Weight felt down suddenly to 20 and the its bandwidth is not used anymore (https://atlas.torproject.org/#details/94212674A2C6AEBF77354D959D464E49BC878…) I don't understand why, as nothing is changed in its configuration. And, I don't know if it's related, but I noticed that the tor network has slow down in the last days and some times it's very difficult to use it. Thanks for your help, Marco ____________________________________________________________ Receive Notifications of Incoming Messages Easily monitor multiple email accounts & access them with a click. Visit http://www.inbox.com/notifier and check it out!

3 11

Re: [tor-relays] Installing obfs4 on Raspberry Pi bridge
by jchase 23 Apr '15

23 Apr '15

Hello, When I run $ go get git.torproject.org/pluggable-transports/obfs4.git/obfs4proxy $ sudo cp $GOPATH/bin/obfs4proxy /usr/local/bin on a laptop running linuxmint/ubuntu it produces a nice binary executable. Unfortunately it doesn't work to copy it to the Pi2, because it's not an ARM binary. When I run the same script on the Pi2 I get the following error messages: go get git.torproject.org/pluggable-transports/obfs4.git/obfs4proxy # git.torproject.org/pluggable-transports/obfs4.git/common/ntor /usr/lib/go/src/pkg/git.torproject.org/pluggable-transports/obfs4.git/common/ntor/ntor.go:272: undefined: sha256.Sum256 /usr/lib/go/src/pkg/git.torproject.org/pluggable-transports/obfs4.git/common/ntor/ntor.go:369: undefined: hmac.Equal # git.torproject.org/pluggable-transports/obfs4.git/common/log /usr/lib/go/src/pkg/git.torproject.org/pluggable-transports/obfs4.git/common/log/log.go:131: function ends without a return statement # git.torproject.org/pluggable-transports/obfs4.git/transports/obfs3 /usr/lib/go/src/pkg/git.torproject.org/pluggable-transports/obfs4.git/transports/obfs3/obfs3.go:278: function ends without a return statement # git.torproject.org/pluggable-transports/obfs4.git/transports/scramblesuit /usr/lib/go/src/pkg/git.torproject.org/pluggable-transports/obfs4.git/transports/scramblesuit/conn.go:322: undefined: hmac.Equal /usr/lib/go/src/pkg/git.torproject.org/pluggable-transports/obfs4.git/transports/scramblesuit/handshake_uniformdh.go:143: undefined: hmac.Equal /usr/lib/go/src/pkg/git.torproject.org/pluggable-transports/obfs4.git/transports/scramblesuit/handshake_uniformdh.go:152: undefined: sha256.Sum256 and the script exits Any idea how I can get it cleanly on a Pi2? Thanks, J. Chase tor-relays-request(a)lists.torproject.org: > Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > > > Today's Topics: > > 1. Re: Installing obfs4 on Raspberry Pi bridge (jchase) > 2. Re: Installing obfs4 on Raspberry Pi bridge (Yawning Angel) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 12 Apr 2015 17:43:55 +0000 > From: jchase <jchase(a)riseup.net> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Installing obfs4 on Raspberry Pi bridge > Message-ID: <552AAEDB.4020007(a)riseup.net> > Content-Type: text/plain; charset=windows-1252 > > Hello, > Thanks to you I have tor 0.2.5.11 running on a Raspberry Pi2 and obfs4 > installed from git. I have good news and bad news. > The largest problem is that I get the warning "could not launch managed > proxy executable at '/path/obfs4proxy'('Permission denied')" In the past > this used to be a problem with apparmor, but apparmor isn't installed. > Any idea where I can start looking for a solution? > Here are a couple of details and small problems: > I didn't install obfs4 directly (due to problems), but installed it to > another laptop and copied it to the Pi2 using scp. > I have ORPort somewhere above 9000. When I set it to auto, I got a late > warning that the port chosen by tor was presenting problems, had I > arranged port forwarding, etc.? ExtORPort is "auto" and I get no > complaints (probably because obfs4 isn't working). > And I have ServerTransportListenAddr obfs3 0.0.0.0:90xx because a lower > port, like 80, with port forwarding, received a warning (and didn't work). > One thing at a time... Like I asked, where can I look for answers to the > obfs4proxy permission denied problem? If I get that fixed, I assume I > can play around with the rest until I can use lower ports. > Thanks, > J Chase > > > ------------------------------ > > Message: 2 > Date: Sun, 12 Apr 2015 20:14:33 +0000 > From: Yawning Angel <yawning(a)schwanenlied.me> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Installing obfs4 on Raspberry Pi bridge > Message-ID: <20150412201433.6c42f28d(a)schwanenlied.me> > Content-Type: text/plain; charset="us-ascii" > > On Sun, 12 Apr 2015 17:43:55 +0000 > jchase <jchase(a)riseup.net> wrote: >> Hello, >> Thanks to you I have tor 0.2.5.11 running on a Raspberry Pi2 and obfs4 >> installed from git. I have good news and bad news. >> The largest problem is that I get the warning "could not launch >> managed proxy executable at '/path/obfs4proxy'('Permission denied')" >> In the past this used to be a problem with apparmor, but apparmor >> isn't installed. Any idea where I can start looking for a solution? >> Here are a couple of details and small problems: >> I didn't install obfs4 directly (due to problems), but installed it to >> another laptop and copied it to the Pi2 using scp. > > Oh dear. What happens when you run the obfs4proxy executable in a > shell directly (on the pi2)? > > It should look something like: > $ ./obfs4proxy > 2015/04/12 20:13:02 [ERROR]: obfs4proxy - must be run as a managed > transport > > If not, what does 'file /path/obfs4proxy' say? > > Regards, >

2 1

Any t-shirts being sent?
by I 23 Apr '15

23 Apr '15

2 1