April 2015 - tor-relays - lists.torproject.org

Re: [tor-relays] Unreachable ORPort - Potential ISP block?
by CJ Barlow 05 Apr '15

05 Apr '15

My relay fingerprint is: TSLAGrin D0BA 2462 E224 2DE9 7F6F 7837 8F25 E63B AD51 88F8

1 0

moira1 bwauth reporting double?
by starlight.2015q2＠binnacle.cx 05 Apr '15

05 Apr '15

I find it a bit odd that moria1 is reporting exactly double the bandwidth for the relay here: Binnacle 4F0DB7E687FC7C0AE55C8F243DA8B0EB27FBF1F2 gabelmoo Bandwidth=7385 Measured=5810 tor26 Bandwidth=7385 Measured=6090 moria1 Bandwidth=7385 Measured=18700 GuardFraction=47 longclaw Bandwidth=7385 Measured=6140 Actual bandwidth is 75 MBits or 9375 KBytes, so the other auth's look good. Anyone have any idea? Switched to VZ FiOS about a month ago and I also note that the measured rate has gone up considerably and the bwauths have gone from providing disparate measurements to being mostly in sync (aside from moria1). I wonder at the cause of improvement and suspect it's one of 1) ongoing "Bandwidth Authority Renovation" https://trac.torproject.org/projects/tor/ticket/13630 2) Verizon improving their core network --I've seen some big routing and ping latency changes in PingPlotter 3) sliding window average applied by the bwauth's to prevent rapid ascension of new and potentially evil relays Also I see dizum has a terrible view of the relay, not even observing it as "fast" and Faravahar thinks it not "stable". Please could anyone who has some specific information comment. Thanks

1 0

Manual Relay Guide for OS X
by Zachary Alberico 04 Apr '15

04 Apr '15

Hi Tor-Relays, I wrote the following documentation after figuring out how to get my Tor relay working with a manual install. The goal is to give easy to follow and concise instructions that explain just enough to understand what you're doing. I'm trying to find out the best way to make this available - would it be possible to add it to the externally facing documentation? I'd also really appreciate it if someone looks it over and sees if I made any typos/forgot something. I can help with whatever needs to be done. Thanks, Zach ### Manually configuring a Tor Relay on OS X (Yosemite, Tor 0.2.5.11) This guide walks you through the process of configuring your very own tor relay explaining each step along the way. First install homebrew which will allow us to install the most recent version of Tor (http://brew.sh) The following command pasted into a terminal will download and install homebrew. {code} ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)" {code} Once that completes we'll use homebrew to install tor with the following command. {code} brew install tor {code} At this point tor should be installed and the homebrew command should have printed the following: {quote} You will find a sample `torrc` file in /usr/local/etc/tor. It is advisable to edit the sample `torrc` to suit your own security needs: https://www.torproject.org/docs/faq#torrc After editing the `torrc` you need to restart tor. To have launchd start tor at login: ln -svn /usr/local/opt/tor/*.plist ~/Library/LaunchAgents Then to load tor now: launchctl load ~/Library/LaunchAgents/homebrew.mxcl.tor.plist {quote} Notice that it mentions the location of the torrc file (we're going to edit that next). It also explains how to have tor run at startup and how to start it now. Before we go ahead and run those commands let's create the location logging is supposed to go since for some reason it doesn't already exist. These commands are creating directories. {code} mkdir /usr/local/Cellar/tor/0.2.5.11/var mkdir /usr/local/Cellar/tor/0.2.5.11/var/log mkdir /usr/local/Cellar/tor/0.2.5.11/var/log/tor {code} Similarly create the following for the DataDirectory if it doesn't already exist. {code} mkdir /usr/local/Cellar/tor/0.2.5.11/var/lib mkdir /usr/local/Cellar/tor/0.2.5.11/var/lib/tor {code} Next let's edit the torrc.sample file and save it as torrc. To open its location in a finder window use the following command: {code} open /usr/local/etc/tor {code} Then open the torrc.sample file in your chosen editor (text edit works fine). Read through the file and try to understand what each of the options are, at a minimum we're going to want to uncomment and use the following options. {code} #Sets the logging location Log notice file /usr/local/Cellar/tor/0.2.5.11/var/log/tor/notices.log #Sets the DataDirectory DataDirectory /usr/local/Cellar/tor/0.2.5.11/var/lib/tor #If you're only configuring this as a relay SocksPort 0 #Your main ORPort ORPort 9001 #Name of your relay Nickname supercoolrelay #Bandwidth limits RelayBandwidthRate 5000 KB RelayBandwidthBurst 10000 KB #Way for the tor project to conact you ContactInfo Random Person <a special email you should make just for this>@gmail.com #What port to advertise for directory connections DirPort 9030 #If you don't want to run an exit (if you're able to run an exit please use the file default!) ExitPolicy reject *:* # no exits allowed {code} Once you've uncommented/edited those lines save the file as torrc and exit. Now it's time for an oversimplified and possibly inaccurate lesson about Networking. You are probably sitting at a home network at a computer connected wirelessly or wired to a router which is connected to a modem which is connecting you to the outside Internet. Your entire network connection has one IPv4 address facing the outside world. Your router then uses NAT which stands for Network Address Translation to remap traffic to the unique IP addresses you have per device on your local intranet. When we configure 'port forwarding' we're telling your router to take the ports we need on your computer's local IP behind the router and forward them to the ports exposed to the real internet as part of this NAT process. In this case this allows the tor relay we've configured to receive incoming connections on the port we've specified. Unfortunately this process is different for every router, but in order to provide an example I'll show what the changes look like for an Apple Airport Extreme and hopefully you'll be able to translate them to your own router's settings. First though we need to know your computer's local IP. Open System Preferences Click Network Click Advanced Click TCP/IP In this window you should see "IPv4 Address: XX.X.X.X" That's the address we need. Next open Airport Utilty (this is to configure port forwarding on an Apple Airport Extreme router) Click on the Airport Extreme Click Edit on the tooltip that pops up Click Network Notice the Port Settings Box, Click + Add the following settings: Description: Tor Ports Public UDP Ports: 9001, 9030 Public TCP Ports: 9001, 9030 Private IP Address: XX.X.X.X (this is the IP we found in Network) Priave UDP Ports: 9001, 9030 Public TCP Ports: 9001, 9030 Click Save Click Update (note the router will reboot) Note: This example shows the default ports we configured in our torrc, if you need to or decide to use different ports you'd have to configure the forwarding differently. I think only the TCP settings matter here, but I ended up setting both while trying to get this to work. Now we can set tor to launch on startup as well as start it right now with these two commands. {code} ln -svn /usr/local/opt/tor/*.plist ~/Library/LaunchAgents launchctl load ~/Library/LaunchAgents/homebrew.mxcl.tor.plist {code} Note: If you make changes to torrc in the future you need to restart tor. You can restart tor with the following command. {code} pkill -sighup tor {code} Now let's check out the logs and verify things are working. This command will show the end of the log and any new lines as they appear. {code} tail -f /usr/local/Cellar/tor/0.2.5.11/var/log/tor/notices.log {code} In a few mintues you should see the following lines if things are working: 19:29:38 [NOTICE] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor. 19:29:36 [NOTICE] Self-testing indicates your DirPort is reachable from the outside. Excellent. If you see something like the following it's irrelevant: Apr 02 22:33:02.000 [notice] Have tried resolving or connecting to address '[scrubbed]' at 3 different places. Giving up. And if you see this it's not working (the X's here represent your public internet facing IPv4): Apr 03 17:10:41.000 [warn] Your server (XX.XXX.XXX.XXX:9001) has not managed to confirm that its ORPort is reachable. Please check your firewalls, ports, address, /etc/hosts file, etc. Apr 03 17:10:41.000 [warn] Your server (XX.XXX.XXX.XXX:9030) has not managed to confirm that its DirPort is reachable. Please check your firewalls, ports, address, /etc/hosts file, etc. If you're still having trouble try hopping on IRC. ###

1 1

send me somerelays and bridges for vidalia
by Sh.F.M 04 Apr '15

04 Apr '15

1 0

Re: [tor-relays] multi-instance Tor support for *BSD packages
by Nusenu 03 Apr '15

03 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi Pascal, thanks for your feedback. Pascal Stumpf: >> Multi-instance support isn't something that's provided by >> OpenBSD's rc.d(8) subsystem, and I doubt it ever will be. Too >> much complexity for something that's more of a crutch to work >> around few applications' limitations than something universally >> needed and useful. Ok, my take away here is that I won't be able to get any multi-instance support into OpenBSD's tor rc.d script. So I guess the next best option for ansible-relayor will indeed be to configure multiple services and copy the rc.d script of your package once per tor instance tor0,tor1,... plus one line per tor instance in /etc/rc.conf.local as described previously here: https://lists.torproject.org/pipermail/tor-relays/2015-March/006526.html >> Btw, aren't there locking problems with the files in >> DataDirectory? Or does every single tor instance need its own? >> And the ControlPort? One for each instance? How do you >> distinguish tor instances when doing syslog logging? ansible-relayor takes care of this and generates torrc files accordingly (separate datadir, separate logfiles, ...). regards, Nusenu -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVHuGbAAoJEFv7XvVCELh0nz0P/i0KffWajNLbBv0cHF5BB5V2 BgQAIDyy/UpSGXNkiUShOBvQIW1GhjvpX9UJeAVzBy2nJuAN8v+AEKp+9A7w4fLt qBxsgul0iaWSalrzlzGFu85QRrc31MV4MKUMW6HmBoINKwMZ71cbWqcmWwykzhOr VPjxrEzCcIw2FF42G2rd65ivWJVWueJLUlbN4KvhzP0clYbOMlgAZ4smstdIksbp pd13/AdA1aJGdCs+i4pXgd19Jq+7WG6Eqj7+YSEpk3LOxqiaVBAi0MhHH5J8be57 GKyI/9QI4yfgAYhtDyEZOVaslafgSAaMzniYYfmGDAPzZobKBbhwmXxtmnok7A30 4TMpUPiqYpVvhBu+NHqlhngYDvKJj/KoZb3lySyN5wMpi5gTtUIt1QxxQ6ofP0eW LuCQSJhinTuLehWx2Ib/gx+J2g+BqJeHkBZRt2BjL63RxHMiRJ3qy7Xd0mJlsh5t DPPPzovk6yaNRUNv7GDTTaq4vRSwJzfUikm9upUi+J37CJ1L3wo/xYqcqLHKWz/w 3NtoMi9mkJfjJ0Bx5ORDzeWJ6LtTKPmhQuWP+5PiK0CxEiu/ZVuReElKyz0Pnypa qrIji5vpu+w/ITw4E/IpMZYS/p/SZV+HYG/ffLUZNgJ6i6vHNqc7om6c+0Qp9qut Eax3QbcU8mCR+F8d2WmL =YcuY -----END PGP SIGNATURE-----

1 0

multi-instance Tor support for *BSD packages
by Nusenu 02 Apr '15

02 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Dear Tor package maintainers for FreeBSD and OpenBSD, I wrote/I'm writing an ansible [1] role for tor relay operators [2]. Besides supporting Linux I'm also aiming to supporting OpenBSD and FreeBSD. Tor does not scale well across multiple CPU cores, to work around this issue relay operators frequently choose to run multiple tor instances on a single host. To better support tor relay operators with this common task tor's official RPM packages recently got multi-instance support [5] and a ticket for the official debian package has been filed [6]. To better know how to proceed with my ansible role - where multi-instance support is a core feature - I'd like to know how you think about adding easy multi-instance support to your packages as well? One way to configure a BSD system to run multiple tor instances would be to defined multiple services tor0, tor1, ... [3], but that doesn't strike me as a particular clean solution [4]. What do you think about supporting multiple tor instances with a single rc.d script that starts one tor process per available *.torrc file in (/usr/local)/etc/tor/enabled/ ? looking forward to your comments, Nusenu [1] http://docs.ansible.com/ [2] https://github.com/nusenu/ansible-relayor [3] https://lists.torproject.org/pipermail/tor-relays/2015-March/006526.html [4] https://lists.torproject.org/pipermail/tor-relays/2015-March/006527.html [5] https://trac.torproject.org/projects/tor/ticket/14996 [6] https://trac.torproject.org/projects/tor/ticket/14995 -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVHZZ6AAoJEFv7XvVCELh04/IQAKZfuYvXUM4xkc3cS3GJciGg NsbkyL483NLM7un/gd0HNkUTzOVLMwI6gkzUERg5uYiwWD1ZHEnudrOk47N19FHR 7WjDTQQuKDfDBpMCBiAywFXsJKKnRk0Cg01+zmMlCmPZ5kEk1hyaE64sZNmjBLyQ 7ydLMV9/xy7h/qm7OfOjU9djoPQTbnd5Ky8+V15ZyTwr65IkWI6vX5KlIfhdTvHh sl3PlRppCE1aYPF5jbwSwpICOSd4diLWToFfOSDFRfvpc4FdMiJfIdAXj37FktMA RdI4MTJXRanLj7WVwKua8Gf2Za8my2t2mCTD3loFR1tRPE30uA1xul9eii+zp27n NBvSsSIhdVKcn1qK7lUfHIxa0v2ArzIjgBczHh6KzlS0U5Fd6LYqx+Y7sRSkjBlr nULJ2Bs+EqcjBF3OTjQFNG+dg/96QgIK+f7nVp/pvoGPKCDxiIdnuT7wlueguI9r Ys/7wCTOSTyrk7+q6IxYrliPReahTlK80HkMtba5m4JpBlGlikMtZcgVYeEuyeac fVfe/TcLjOkqFIomVpkhbtRDHJafu9Q5cMm/6eydXAH4y9GhM/Q6N+zEp4nXuSP3 /LzNFhwuFSabTwlnDx/5VpSXVYP+cmMoK9tWQjORNM//1zRONOea43eXeyhuwipo mTv/uEMpR9eDdPAJseod =ft3h -----END PGP SIGNATURE-----

1 0

Re: [tor-relays] Keep smiling only - i dont expect any answer
by Teófilo Couto 01 Apr '15

01 Apr '15

Same old, same old story, again and again... "They" operate badly developed, badly implemented "sites", full of well known vulns, but the issue, the "bad guy on set," is a tor relay... Typical... -------- Original Message -------- Subject: [tor-relays] Keep smiling only - i dont expect any answer Time (GMT): Apr 01 2015 14:02:00 From: cmar433(a)yandex.com To: tor-relays(a)lists.torproject.org nice abuse :) From: isac(a)kftc.or.kr To: abuse(a)wedos.com Date: 01.04.2015 08:42:07 Subject: [KF/ISAC] Warning! Unauthorized Access Trial! Dear Network Manager : I am a network security manager of Korea Financial Telecommunications and Clearings Institute(KFTC). My job is to protect Korean financial organizations from illegal intrusion attacks. We have received a report of unauthorized access trial originating from your site as shown below. -------------------------------------------------------------------------------- Date/Time(GMT+9): 2015-04-01 12:47:46 ~ 2015-04-01 12:47:46 Source IP : 37.157.192.208 Destination IP : 59.11.68.197 Attack Type : FCKeditor_Vul -------------------------------------------------------------------------------- We are seriously considering notifying these illegal attempts to the related authorities of both your and our countries and requesting proper legal actions. So, please take appropriate measures to identify and stop the attacker. And, please inform us of the results. (isac(a)kftc.or.kr) Thank you for your cooperation. p.s. : If you are not the correct person to deal with this incident, please forward this to the proper person and inform us for future convenience.

2 1

(no subject)
by Franck Marcel 01 Apr '15

01 Apr '15

Re

3 2