August 2015 - tor-relays - lists.torproject.org

Please enable IPv6 on your relay!
by Moritz Bartl 28 Jan '17

28 Jan '17

Hi! We still have a depressingly low number of relays that support IPv6 (currently only ~120 of ~1900 relays). If your host supports IPv6, please enable it, especially if you run an exit! This has to be done explicitly. https://trac.torproject.org/projects/tor/wiki/doc/IPv6RelayHowto In short, you add: ORPort [IPv6::address]:port IPv6Exit 1 ExitPolicy reject6 *:* (or a more open exit policy respectively) Thanks! -- Moritz Bartl https://www.torservers.net/

30 42

Reminder: exit nodes probably shouldn't be using Google's DNS servers
by Nick Mathewson 25 Feb '16

25 Feb '16

Hi, all! While looking into a bug report, I noticed that an exit node was using one of Google's well-known public DNS servers for its own DNS server. No disrespect to the operators of Google's fine public DNS service, but my sense is that using it for a Tor exit node might not be the greatest idea for users' privacy, having one DNS provider that gets to see so many requests. It's probably a better idea to have your own local cacheing DNS server. Would anybody like to share a guide about how to set one of those up safely and migrate correctly? best wishes, -- Nick

23 38

Relays with misconfigured MyFamily (declared vs. effective)
by nusenu 17 Feb '16

17 Feb '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, the following relays have misconfigured MyFamily settings. 'misconfigured' is defined by declared family does not match effective family (as computed by onionoo's new effectiv_family field [1] - thanks Karsten). Maybe we will see future versions of globe or atlas displaying a diff of the two family sets to make such misconfigurations more visible. Please let me know if you find any errors (I did not fact check the output). +------------------------------------------+----------+ | Contact (truncated) | Fingerpr | +------------------------------------------+----------+ | +1 303-265-9283, rdump@OFTC | 09683D5D | | 0x3AEE83BB539036CA <bb AT symvaro DOT co | 6FDF2D3B | | 0x6F6D60C1 Security Dept <hello@brasshor | 445F1C85 | | 0x6F6D60C1 Security Dept <hello@brasshor | 6BC82EBA | | 0x6F6D60C1 Security Dept <hello@brasshor | 254EB51B | | 0x6F6D60C1 Security Dept <hello@brasshor | B3515F16 | | 0xDE731050 Gareth Llewellyn <gareth@netw | 5CAECF26 | | 0xFD78BCE1 Fruity Oaty Tor Exit <torexit | 1ECD73B9 | | 1024D/1DFBA164 Bernhard M. Wiedemann <to | 172DC95F | | 1024D/39B9820C admin at perfect minus pr | B897826E | | 1024D/39B9820C admin at perfect minus pr | 5FCC8306 | | 1024D/39B9820C admin at perfect minus pr | 2421E10D | | 1024D/39B9820C admin at perfect minus pr | AC7AE98C | | 1024D/39B9820C admin at perfect minus pr | E8B7D19C | | 1024D/39B9820C admin at perfect minus pr | ED9F582E | | 1024D/39B9820C admin at perfect minus pr | B1843B40 | | 1MTUwHFknUyUgRYqpNDYiA2j7sXTYoCe2P | E799227D | | 4096R/8BA2371C Fabian Keil <fk@fabiankei | 34A5FBA4 | | 8192R/0xB431B67770E4AA38 Mikal Villa <me | FE305F8E | | <hneal AT imalazybastard dot com> | CF9E4605 | | <hneal AT imalazybastard dot com> | D12F66D6 | | <periplanetaamericanus AT gmail dot com> | 5B5213C4 | | <periplanetaamericanus AT gmail dot com> | 47D04EC4 | | <periplanetaamericnaus AT gmail dot com> | F19106D7 | | <support at gkware dot com> | E754AA99 | | <support at gkware dot com> | 868A253C | | <support AT gkware dot com> | 48674035 | | <tech AT dana dot io> - 1AgYtavutLAMxUYM | 752DA4A4 | | <tor .AT. jgjtech .DOT. com> BTC: 1QHXLy | 0DA71D95 | | <tor .AT. jgjtech .DOT. com> BTC: 1QHXLy | 31A40828 | | <tor AT 1d4 dot us> - 1N7sBLKvekRD4EUL2b | F1107CB0 | | Abuse Department <abuse AT hartvoorinter | 81B75D53 | | Abuse Department <abuse AT hartvoorinter | 89E3170B | | abuse<__aT>icetor{_DoT===}is - 1GDerBXAJ | 1D9D1C1D | | anders.io | 91361C96 | | anders.io | D56AA4A1 | | anders.io | 3A2192F5 | | Bauruine <torcontact aatt tuxli.ch> - 1C | 63C1904F | | Bauruine <torcontact aatt tuxli.ch> - 1C | 52F7C67B | | BFC62AD3 johannes <tor (@) kontrollappar | 750941D5 | | Big Jim Slade <sysop AT bigjimslade dot | 9AFA555B | | Big Jim Slade <sysop AT bigjimslade dot | ACDC9C49 | | DFRI <tor AT dfri dot se> | A10C4F66 | | DFRI <tor AT dfri dot se> | DD8BD730 | | DFRI <tor AT dfri dot se> | EC84E232 | | DFRI <tor AT dfri dot se> | A478E421 | | Fabian Keil <fk(a)fabiankeil.de> 8BA2371C | 5CE3AD8A | | General Zod <zod(a)kdf.mil> | 556D59FA | | General Zod <zod(a)kdf.mil> | CBABC09D | | GetReal <x50 AT riseup dot net> | 51529D02 | | http://www.onion.network/ <info at onion | F89A5238 | | http://www.privacyfoundation.ch/abuse/ | DC41244B | | http://www.privacyfoundation.ch/abuse/ | 0111BA9B | | http://www.privacyfoundation.ch/abuse/ | DE7DE889 | | http://www.privacyfoundation.ch/abuse/ | 487092BA | | http://www.privacyfoundation.ch/abuse/ | AD86CD1A | | http://www.privacyfoundation.ch/abuse/ | 95DA61AE | | http://www.privacyfoundation.ch/abuse/ | B060482C | | http://www.privacyfoundation.ch/abuse/ | 88487BDD | | https://www.torservers.net/donate.html < | 4E021F36 | | https://www.torservers.net/donate.html < | F657ACB3 | | https://www.torservers.net/donate.html < | 64D500C4 | | iggs <tor.20.iggs AT spamgourmet dot com | 2F557D48 | | jvictors at jessevictors com, PGP 0xC20B | C6DC982A | | jvictors at jessevictors com, PGP 0xC20B | 4B8C39A5 | | jvictors at jessevictors com, PGP 0xC20B | BFA0E9F3 | | jvictors at jessevictors com, PGP 0xC20B | 40DF7E2E | | Kevin <tor AT kberanek dot com> - 14BTbA | 92EA887F | | Kevin <tor AT kberanek dot com> - 14BTbA | A1E02458 | | kingbiskit(a)gmail.com - 18gEJokSQ3uwo3QTM | C921704A | | kingbiskit(a)gmail.com - 1CoXRRwDt6YVTZmJ3 | 3246AF7B | | M.K. Nitrox <mk DOT reg AT t-online DOT | BD912646 | | montanisemperliberi <a> safe-mail.net | E8B6E46B | | Nicholas Merrill <nick AT calyx dot com> | 51BFE90C | | Nicholas Merrill <nick AT calyx dot com> | 0B5E5E70 | | Nicholas Merrill <nick AT calyx dot com> | 84D361B7 | | Nicholas Merrill <nick AT calyx dot com> | E4D1F25D | | Pascal666 at Users dot SourceForge dot N | C9437269 | | Pascal666 at Users dot SourceForge dot N | 5B7AEB14 | | Peter Palfrader | 847B1F85 | | R P <edschlonz AT yahoo dot de> | FF06E7A0 | | Samuel Whited 0x54083AE104EA7AD3 <sam AT | CA54C9F2 | | Sebastian <tor(a)sebastianhahn.net> - 12Nb | EBE718E1 | | snIP3r <sniper(a)restricted-area.de> | 3EE8D536 | | tor TA fejk tod se | 2AFE9201 | | torelay [ANTISPAM at] ruggedinbox [ANTIS | 0559A3D3 | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | BAACCB29 | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 0B454C7E | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 5A551BF2 | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 4436A57F | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 6D3A3ED5 | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 75C4495F | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 6A29FD8C | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 0C77421C | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 8073670F | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | B35C5739 | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | E6E18151 | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 6A37488D | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | E11B6AE1 | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 70C55A11 | | Torservers.net <support .AT. torservers | 488239E0 | | Torservers.net <support .AT. torservers | 6B1E0019 | | Torservers.net <support .AT. torservers | C46524E5 | | Torservers.net <support .AT. torservers | 770BE0CD | | Torservers.net <support .AT. torservers | 5C84C359 | | Torservers.net <support .AT. torservers | 20B0038D | | Torservers.net <support .AT. torservers | 5714542D | | Torservers.net <support .AT. torservers | B4F883DB | | Torservers.net <support .AT. torservers | 78213EC8 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 4E918B21 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | A494237E | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 35FEEA5F | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 2576BFB0 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | A1025D32 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | C8D44E91 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | B7EC0C02 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | FFD6C2CE | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 4C6F66B1 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 43D0AB1B | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | A57B43E1 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 9030DCF4 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 3A5F08D0 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 5C1E076A | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 482A381B | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 2D671A4A | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 66CFF345 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 55F5CF9D | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | FEF59210 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | B4A553CB | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 92506510 | +------------------------------------------+----------+ ..based on onionoo.thecthulhu.com's data from 2015-07-15 18:00 [1] https://trac.torproject.org/projects/tor/ticket/16276 -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVprfXAAoJEFv7XvVCELh0/FcP/28/dhefuPNQaBNSY59NTZTs snwb9vRlAzhDDm0XmWEMIaawFlNjV8shJD8dWvzSvynWHYQySfrStmDdfkpe5CSC lu9ceE6qhhZe+RkyDPM3PdxLhz29XVK+KvQcDcCeWp6nIHzXIOJL+Xk7v7FoU75S Vx8GjhVQd/aiHJQg96zlpdzkAsU000jG2E3Z2EH+gd4Uypl94wgqd0482LSSehiQ LVbhPt6C8NlX32kZ4yAD3W5cHRoyhg30x076X8XHZ16H6F2l801hhON5X32VmXdv vd/kJ7R9JKo4Uig1Y9hq3qpsRsO8aJaN2JOXMsGw2A+6eNFA2OPFLg3/sNKLgiLV N/CPqDlMVsotMDcXX4iBYSHW0Y+J7vyc5ezxE/rKWzBCBZSnK9Sb5UzcrDnOfJRO ABFv+ZtGxSQYVPcnICVdMr+3Kuk0FnKMm7z2ufYriRxDK573LQgNJQnjZ3Tc3JG+ PIVZun0IN/+1gZmQif57xIjW1OFDbDYbhMtYFYbK9zRd7PidIr5NHcYCkEY4whfP 2vhN4jbtYQZZY/hDAMLZVBKDJ42tOYG/8EaWZeMJ8y/pd+F8EvT7ceWzXwuhYm77 WiK4VsgFU7PR7ETi/DJL+ajmFEjpRJ8QOy3J5E/dq/eumkkzL/eBTPL7ydnTmD/u 9271J4DjQYPfjzVtVqdl =ecVW -----END PGP SIGNATURE-----

2 3

Failure from drain-fd
by Brian Walker 27 Oct '15

27 Oct '15

Anybody know what this means? My logs are littered with it. Tor v2.6.9 with Libevent 2.0.21-stable, OpenSSL 1.0.1o and Zlib 1.2.8 on Windows Server 2012 R2. Aug 06 13:26:35.000 [warn] Failure from drain_fd [3892 similar message(s) suppressed in last 7200 seconds] Aug 06 15:26:37.000 [warn] Failure from drain_fd [3526 similar message(s) suppressed in last 7200 seconds] Thanks

3 6

OT: starlight vs. email threading
by nusenu 15 Oct '15

15 Oct '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 hi starlight, is there any chance we can talk you into setting the usual email headers for proper email threading? (decent MUAs take care of this by default) At times it is hard to follow the flow of a discussion if every email starts a new thread (what message was the reply to which email). thanks, nusenu -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVxfCpAAoJEFv7XvVCELh0wZwQAIZ+jOaNTwjYYwQLfl8gIK9j pE+GHGi4mV0R/FSsFAjfkJQzWp1AakaOMR7AeqxWjQmz4HWUyjm09TP+R+x6tfUw /9ilSiZn++p9F/+J++ukUa8ozoi1ogN4XTo/OnJo12udgAAZ/+p5NW4suMO9scId wuDA3JtvLeG7u80j6LEdb28vkS8+cx1OZ1ZExemOUzb/T6i/K+EZx5//lWqzpukJ MwAS/P5n54cyvlD1xn10EUcwazJ3o7cA1d4QthXekgKzl9+EsyZ70n8uJ+1r2tab YDpf84qKjjdOkLVppukZmLXeyznKrAAP1rcpVesSWdlQp9AVgd+XYYm+wBqrUhrL CuQs9qv6CmQKFpc5GlYX7L3fLKrXE1daKBNqIA0o0BJNMrq/PLti2ixwfXZU3GOj a4jDFnXtMFWzDD4Ut2fSR2+aRAjuhtUmWNexN2rF+8KecenfV5Bb09c3I11FygTf 2IWfCPoqSHtTPCq+sLt91T2Hh/zfSV0+ckjHIfaJPFig3KyivBI4B6fY2X2txSxT zRffuHqXknIwUMgFaCjNSl1qlqozTbpN2rVhx14V4KNK7GCFK2/gtZlFb1f64Dyy bTZ6IxWjLFX11hYVI0jPlTp3Usc5j0PkxprXD2IgvrEXzH89zm994jK36n8MK6w+ uctpM8RxpEsoBfQBnlib =RE3I -----END PGP SIGNATURE-----

3 3

Bots, love 'em or hate 'em?
by starlight.2015q3＠binnacle.cx 08 Sep '15

08 Sep '15

My relay says it receives about 50k v1/v2/v3 connections each day to the 60k v4 connections that come in. "Entry-ips" says it has about 35k guard- clients. Blutmagie says there are no pre-0.2.4 relays talking anything other than v4. So I'm left thinking that 95% or more of the bandwidth consumption and client count is from crusty old botnet bots running ancient versions of the Tor daemon. But all that bot traffic creates a lot of statistical "background noise," and so may be providing a service in making it more difficult for advanced adversaries to perform traffic correlation analysis. Thoughts anyone?

5 8

Calling for more Exit Relays
by s7r 04 Sep '15

04 Sep '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hello, In the last 48 hours we went under the 'psychological' threshold of 1000 Exit Relays in the consensus. Right now, Thu Aug 20 23:57:02 UTC 2015, we have: 6234 Running relays 954 Exit relays I think we can improve this balance. Let's do it! This is a call for everyone: Please run Exit relays, or if you are running a middle relay turn it into an Exit relay! I have been running high capacity Exit relays for a very long time, and I tell you it's not a headache and it will not attract any problems if you just take care of the abuse complaints. During this very long time, 98% of the abuse complaints were automated messages which can safely be ignored (fail2ban notifications, portscans, web CMS plugins sending reports about http fetches, etc.) and the rest were from very nice people who didn't know what Tor is and how it works, but after explaining to them they actually liked the idea - gives you a really nice feeling. Only 2 times I have received email from law enforcement agents (which are just normal people like us, doing a hard job) - a complete and clear explanation was all that it took for them to fully understand and eliminate any doubt that the server in question is somehow interesting to them. Tor is _legal_ in all sane countries! We as a community are here and I give you my word that me and others will personally assist, in the measure and ways we can, whoever runs into troubles because of running an exit, which is highly unlikely. It is recommended to reject in your policy port 25 (it's not needed and it will blacklist you for spam messages if you leave it open). Allow all other ports, or use the reduced exit policy from torproject.org if you want to allow only what is highly necessary. Don't think any longer about it ;) - - Email me directly any time if you need technical support in setting things up, hardening the server or need a customized setup adapted to certain conditions. - - Email me directly any time if you have the funds needed to run a Tor exit relay but don't know how to set it up, where to get it from or don't want to rent and run it under your real name. - - Email me directly any time if you need instructions about how to deal with abuse complaints and short templates for replies. For live chat come on IRC, OFTC network, #tor channel. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) iQEcBAEBCAAGBQJV1m+CAAoJEIN/pSyBJlsRhD8H/3NpZniYVIELenCvxKNKIEeR J6hvSIwsAJUzlk+Hm5v74f7uzeXoLwA8z/FtzKCBVACOvUoCo1b4/2hF3wBMDfcw CsSZC0AkkIdF+4ePSIsjAU8giOr2uXkCS9CSoRyDnIebmyx5RkSnFDXgTg6/QLJT YJBuTrAA2anxqCHmqL9xHEDM40JhTMP6N6CR3aR4CCPkVOeELyyLTSgb637rZzUs EuRkliktZifirhENxOHzvMVv4D4X60lXeSo1i347gdPwTGuNpiL5fPu+ET0E1sTh Ol8Prvi6XP9yBojW7Up0q1y6083JkguLTbxQDomnqEYT7LCCqAFVBwdc1xWUdg0= =kFIY -----END PGP SIGNATURE-----

16 27

clarification on what Utah State University exit relays store ("360 gigs of log files")
by nusenu 03 Sep '15

03 Sep '15

Hi Jesse, I found your email address in exit relay descriptors run at USU [1]. There has been an interesting comment on a recent boingboing post [2] that implies that USU exit relays store significant amount of logs without going into much detail: > dweller_below August 5, 2015 > > A very similar thing happened to USU. We received a summons from > Homeland/ICE to produce 3 months of records (plus identifying > info) for an IP that was one of our TOR exit nodes. > > I eventually managed to contact the Special Agent in charge of the > investigation. He turned out to be a reasonable person. I > explained that the requested info was an extremely active TOR exit > node. I said that we had extracted and filtered the requested data, > it was 90 4 gig files (for a total of 360 gigs of log files) or > about 3.2 billion log entries. [...] If you can confirm that the comment is authentic I'd be interested what kind of tor related data you are logging at your exit relays and why. thanks, nusenu [1] https://atlas.torproject.org/#search/contact:C20BEC80 [2] http://boingboing.net/2015/08/04/what-happened-when-the-fbi-sub.html

12 30

Re: [tor-relays] bwauth graph for August 2015
by starlight.2015q3＠binnacle.cx 31 Aug '15

31 Aug '15

In addition to reducing Unmeasured=1 relays from ~350 to ~150, the combination of the new Torflow release and addition of the Faravahar BWauth have dramatically improved the reliability and stability of bandwidth measurements of relays, for both the individual BWauth values and consensus values. This shows up most clearly in the 3-month and 1-year Atlas graphs of consensus weights.

1 0

bwauth graph for August 2015
by nusenu 30 Aug '15

30 Aug '15

Hi, I generated graphs for bwauth votes. The graph [1] shows that adding Faravahar (yellow) as 5th bwauth significantly reduced the amount of unmeasured relays (difference between red and blue), at least as long as it did provide measurements. [1] https://raw.githubusercontent.com/nusenu/tor-network-observations/master/pn…

1 0