May 2015 - tor-relays - lists.torproject.org

Please enable IPv6 on your relay!
by Moritz Bartl 28 Jan '17

28 Jan '17

Hi! We still have a depressingly low number of relays that support IPv6 (currently only ~120 of ~1900 relays). If your host supports IPv6, please enable it, especially if you run an exit! This has to be done explicitly. https://trac.torproject.org/projects/tor/wiki/doc/IPv6RelayHowto In short, you add: ORPort [IPv6::address]:port IPv6Exit 1 ExitPolicy reject6 *:* (or a more open exit policy respectively) Thanks! -- Moritz Bartl https://www.torservers.net/

30 42

Reminder: exit nodes probably shouldn't be using Google's DNS servers
by Nick Mathewson 25 Feb '16

25 Feb '16

Hi, all! While looking into a bug report, I noticed that an exit node was using one of Google's well-known public DNS servers for its own DNS server. No disrespect to the operators of Google's fine public DNS service, but my sense is that using it for a Tor exit node might not be the greatest idea for users' privacy, having one DNS provider that gets to see so many requests. It's probably a better idea to have your own local cacheing DNS server. Would anybody like to share a guide about how to set one of those up safely and migrate correctly? best wishes, -- Nick

23 38

How to use our own TOR relay as entry node for local network hosts
by Tor User 04 Jun '15

04 Jun '15

Hello, We have been operating a moderately successful public tor relay for a while now. Having read about how TOR works back a couple of years ago, I was more or less sold on the idea that if traffic originating on your local network uses your own TOR relay as the first hop (entry node), then by the time your traffic has left your tor relay, people in the middle can't tell the difference between traffic originating from your network and other (relayed) traffic passing through your TOR relay. I also understand that this still doesn't protect you from an exit node being able to see your traffic (and why you should use HTTPS with a high-quality cipher if it's really important), and that there are other ways your traffic can be analyzed -- but all in all, I would rather our TOR traffic enter the TOR network through a relay I *KNOW* I can trust (mine!) than leave it to chance. We have polipo running on our public TOR relay, configured to accept traffic from our local subnets. We've basically followed the info in this TOR doco: https://trac.torproject.org/projects/tor/wiki/doc/CentralizedTorServer The TOR browser bundle appears to function correctly, ie, it is able to start up, open circuits, etc. and we get the expected Congratulations! page opening a new browser window. But when clicking the green onion to show the circuit of relays handling the browser's connection, our relay is never the first hop. I'm using TBB 5.01a on one particular system, and for an example, it shows this for the circuit: - This browser - Austria (aa.bb.cc.dd) - Germany (ee.ff.gg.hh) - Guatemala (ii.jj.kk.ll) - Internet I have tried defining an EntryNodes statement with the $fingerprint of our TOR relay and setting StrictNodes 1 in the TBB's torrc file, but it can't ever establish a circuit when I try this. We get messages like this logged on the browser's tor: 05/20/2015 04:21:20.700 [WARN] Failed to find node for hop 0 of our path. Discarding this circuit. 05/20/2015 04:21:20.700 [WARN] Failed to find node for hop 0 of our path. Discarding this circuit. 05/20/2015 04:21:20.900 [NOTICE] Closing no-longer-configured Socks listener on 127.0.0.1:9150 05/20/2015 04:21:20.900 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 05/20/2015 04:21:20.900 [NOTICE] Closing old Socks listener on 127.0.0.1:9150 05/20/2015 04:21:21.700 [NOTICE] Delaying directory fetches: DisableNetwork is set. Is it possible to define your desired entry node via IP address and port, or some other way that does not require a successful directory connection/circuit first? (so it can find the relay by its fingerprint)? It seems like a chicken vs. egg problem... Or what about defining a directory for the client to use by its IP/port? We are operating a public directory as well. I can't find any info about this or other approaches anywhere. So I always end up removing the EntryNodes and StrictNodes statement from TBB's torrc file, leaving only the HTTPSProxy aa.bb.cc.dd:<polipo-listen-port> statement in there with the DataDirectory, GeoIPFile, and GeoIPv6File statements. It gets the TBB's on our network to the local polipo proxy, which in turn forwards the traffic to our public TOR relay. TBB works fine, but I don't think our TOR relay is the one getting to see our traffic with the original source address with this setup. It is definitely possible, likely even, that I am misunderstanding parts of how this is supposed to work or how a central TOR relay/proxy is supposed to be configured. But it doesn't seem to me that proxying our local network's TBB clients' traffic through the polipo instance on our public TOR relay means that our TOR traffic is being "anonymized" as to where it originated from before it gets to the first node in the circuit - or we would be seeing our TOR relay as the first hop when we look at the circuit in "the green onion button". If I'm wrong about this, that's great - I'd love to see some documentation to explain it better if you have any links handy. But if I'm right, how can I configure our TBB clients to actually MAKE them use our TOR proxy as their entry node? Thanks, Tor User

3 5

amount of unmeasured relays continuously rising since 2 weeks
by nusenu 02 Jun '15

02 Jun '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Dear Tor BW Authories, we'd like to bring the following issue to your attention. Since the last two weeks the amount of unmeasured relays is steadily rising [1]. unmeasured relays on 2015-05-01: 387 unmeasured relays today: 1087 (and growing) Graph showing the last 5 months: https://trac.torproject.org/projects/tor/attachment/ticket/13450/unmeasured… Data: https://trac.torproject.org/projects/tor/attachment/ticket/13450/2015-01-01… Would be great if you had some time to look into this: https://trac.torproject.org/projects/tor/ticket/13450 (follow ups should probably go to trac) ..so bw doesn't go wasted. A contributed but unused relay doesn't make relay ops happy. thanks! [1] https://lists.torproject.org/pipermail/tor-relays/2015-May/006946.html -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVVP8PAAoJEFv7XvVCELh03bwP/1NQi99IweePw+o/Mj4nWieE yRLDmTt2J8IeJXp8tMQPcqJIZSEzSOW7u7J9o7McNR+n2lm2Mx9x9IMKQPCX6CFh /v5JJ2/aZyfu7JnkTLr7sNKw6DqkAODnKHbyALuc20zsc1oQmu56VZpY6orwC3RG n4qhbXxyD7+TXCv5iZF5CZsnlrVojHevK6tKkivOem/qMVSwshFHCUSnYVi/YK+R CcLIGllT5fx8msYEWDnnTdIBi9PoIl2gO7SE4Y3TKEpkFhGeU8FEsGmIV9LQi8O1 XcaIeU2BVup4PJMDBSgtB9BlSuKGQAq1ICiVx3OnVUVPleTYsFATFUQxW83irfu9 o8Q3ns3srj3tmtLHE0LA9c2gCuE4NiWA++t72sCc+tiqCy9+X4f5BKsqsem7bT5o 89PfZijjuR4ZI3531e+PCjZDokNY9Gx7lCjIlnrGDeGKSIPqPz9N53bYYIXB+d4r uKDeRaRjv3iz/yKjXFYSra3p70HcQmx+CM4aws035LSCTLg/zFyARXb+hf8/NeKn JzXaVoURRiRX3gzeyiznQ7EVNXTyQmr1ppGJVZAXhtfAuiCrqS5JsPJ8BTzxcylI hZBkcwyQzkV3cCeBFMABQFy3AtQ2SZSOuLzS1vyH1oAHPPWd5K1bgHcSMvOqIEPh LspnH0QSv8ICnU1uhbTZ =rNB9 -----END PGP SIGNATURE-----

14 33

[warn] Problem bootstrapping. Stuck at 10%: Finishing handshake with directory server.
by Martin Ekendahl 29 May '15

29 May '15

This morning I rebooted my relay after some patching. I was running 2.6.7 on Ubuntu 14.04.2 LTS from. The server is always a bit slow rebooting but when it came back up always check the Tor relay and now I see an excessive amount of these errors: May 29 12:20:36.000 [warn] Problem bootstrapping. Stuck at 10%: Finishing handshake with directory server. (DONE; DONE; count 906; recommendation warn; host CC23B32FA040945FF49D94AC3D4334429CB4E2CD at 62.75.241.71:1110) May 29 12:20:36.000 [warn] 905 connections have failed: May 29 12:20:36.000 [warn] 849 connections died in state connect()ing with SSL state (No SSL object) May 29 12:20:36.000 [warn] 42 connections died in state handshaking (TLS) with SSL state unknown state in HANDSHAKE May 29 12:20:36.000 [warn] 8 connections died in state handshaking (Tor, v3 handshake) with SSL state SSL negotiation finished successfully in OPEN May 29 12:20:36.000 [warn] 2 connections died in state handshaking (TLS) with SSL state SSL negotiation finished successfully in OPEN May 29 12:20:36.000 [warn] 2 connections died in state handshaking (TLS) with SSL state SSLv3 read server hello B in HANDSHAKE May 29 12:20:36.000 [warn] 1 connections died in state handshaking (TLS) with SSL state SSLv3 read finished A in HANDSHAKE May 29 12:20:36.000 [warn] 1 connections died in state handshaking (Tor, v3 handshake) with SSL state SSL negotiation finished successfully in CLOSED I still see about 7000 inbound connections and 3000 outbound, I'm not sure what my connection average is, but the current bandwidth being used is below average (from the reboot). There have been a couple DDOS alerts from my ISP the past couple days, something I never used to get. I can confirm via my dashboard nothing has been mitigated so I assume no filtering is going on, and traffic is still coming and going, but for some reason there are a lot of connections not being made it appears from the logs, and these only started appearing after I restarted my server/relay. Any ideas what would be causing all these issues?

1 0

Get bridge
by Victor Victoe 28 May '15

28 May '15

2 1

Re: [tor-relays] Leaseweb exit relay notice
by tor＠t-3.net 25 May '15

25 May '15

On 05/25/2015 08:17 PM, Rejo Zenger wrote: > ++ 25/05/15 12:48 -0400 - tor(a)t-3.net: >> >> A lot of trouble would be prevented for exit node operators if, when they >> brought their relays up for the first time, they ensured that the exit policy >> rejected port 25. Even if they desire to run as unrestricted a relay as >> possible, in my experience, that one really should be rejected. It is the > > Some (or most or even all) of the Leaseweb nodes didn't forward port 25. > So, alltough you advice is a good one, it's not applicable to some (or > most or even all) of the nodes that are discussed in this thread. > I'd be curious to know what this checker says about the IP address that ultimately got this ISPs attention: http://mxtoolbox.com/blacklists.aspx I run 2 fast exits with only ports 25 and 465 rejected. I find that the IPs are in some expected lists that target Tor, plus barracuda and spamhaus-zen. But not a gigantic pile of RBLs like was being described. No sorbs, no spamcop, no uceprotect. Nothing like a real spamming box. Doing nothing on email ports but still ending up on a meaningful number of RBLs doesn't sound right. Maybe all it took to piss the ISP off was for one of them to do it.

2 1

Re: [tor-relays] Leaseweb exit relay notice
by tor＠t-3.net 25 May '15

25 May '15

On 05/22/2015 12:19 AM, Speak Freely wrote: > The problem is compounded by the fact each BL company is racing it's way > to the bottom, adding each others finds to their own lists. SpamHaus has > OVER 1 *BILLION* addresses listed. > > I lost several relays (11) from OVH because DanTor recorded my relays, > then CBL recorded DanTor, then SpamHaus Zen recorded CBL, which allowed > OVH to claim "100% of your IPs are blacklisted on multiple lists" when > in reality it was from a guy in the UK who publishes all Tor relays - > guard, middle, exit - that caused this whole problem for me. Not one > single complaint from anyone against any of my relays. > > > Matt > Speak Freely > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays A lot of trouble would be prevented for exit node operators if, when they brought their relays up for the first time, they ensured that the exit policy rejected port 25. Even if they desire to run as unrestricted a relay as possible, in my experience, that one really should be rejected. It is the port which email servers tend to use to deliver mail to one another, and some bad/old clients might try to use it as well. In theory, open-relay port 25 is just about sending email. It can send email on behalf of anyone in the world. Big deal, right? But in practice, open-relay port 25 is all about spam. Has been for years and years. It's always been abused by awful spammers wherever it may be found. It's never been used as some great tool for anonymity or email freedom. As far as Tor exits go specifically, there is someone out there who is apparently watching Tor for when exits appear that are willing to send on port 25. They very quickly begin dumping spam out of any such relays, should they appear. I know this because I briefly turned on relay for port 25, and the spammers found it fast. They immediately transformed it into a spam-vomiting heap of crap. Traffic graphs on it skyrocketed (although within the configured maximums). The new mail in the admin mailbox for the netblock clearly reflected what the box was doing. I closed that port off fast, and problem solved. In addition to port 25, relay operators who want to be extra careful of their relationship with their ISP may also wish to reject ports 465 and 587. Doing that would more-completely lock the Tor exit away from the tricks spammers use. By blocking off the email portion of the relay (especially port 25), the machine doesn't spew spam, and therefore doesn't get noticed by those who are trying to stop spam. This is good for the relay because the 'net is more accepting of it (IP reputation lists, RBLs, etc), and good for the exit relay operator's working relationship with the hosting ISP. Reputable ISPs tend to dislike spam, and if a billion spam complaints flood in for your relay, it's not going to help your cause. People who are trying to do anonymous email have means to do so which do not include dumping anything directly to port 25. And if a direct push from Tor to 465 or 587 is wanted, it can always go to the relays which don't perceive any ISP-related risk from it.

2 1

[Fwd: Re: a line "enable IPv6 on your relay"]
by tor-server-creator＠use.startmail.com 25 May '15

25 May '15

sorry, i confused something. "relay should show in the consensus as an "a" line." does not mean a "a" is required in torrc. i got confued cause of the headline "1.1 Ordinary relays" stupid me, pardon -------------------------- Original-Nachricht -------------------------- Betreff: Re: [tor-relays] a line "enable IPv6 on your relay" Von: yl <tor(a)yl.ms> Datum: Sonntag, 24. Mai 2015 19:54 An: tor-relays(a)lists.torproject.org Am 24.05.2015 um 19:25 schrieb tor-server-creator(a)use.startmail.com: > shouldnt there be a "a" in the first line? how important ist the > letter > a? i guess some operators just added the lines without "a" like > above. > additional: how many ipv6 relays are up NOW? and are there plans to > include a button into torbrowser to enable/disable ipv6? Not sure where the a should be put, so maybe someone can just past a sample config with the IPv6 enabled, I think from that we can substitute easily. One question also, is this for relay servers or ONLY for exit enabled servers? yl _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 1

a line "enable IPv6 on your relay"
by tor-server-creator＠use.startmail.com 24 May '15

24 May '15

hi, about that following lines in the mail from Moritz Bartl. [tor-relays] Please enable IPv6 on your relay! > In short, you add: > ORPort [IPv6::address]:port > IPv6Exit 1 > ExitPolicy reject6 *:* shouldnt there be a "a" in the first line? how important ist the letter a? i guess some operators just added the lines without "a" like above. additional: how many ipv6 relays are up NOW? and are there plans to include a button into torbrowser to enable/disable ipv6? thanks

2 1