October 2016 - tor-relays - lists.torproject.org

Monitoring multiple relays
by Xza 01 Nov '17

01 Nov '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello, I have a couple relays / exits running. Now my question is : how do you manage them is there any dashboard or CLI tools to manage them ( statistics, ect.. ) I know the cli tool specially for Tor "arm" Thanks alot. - -- PGP : 29A4CE52 -----BEGIN PGP SIGNATURE----- iQI4BAEBCgAiGxxEbyA8eWFuZGVyZXNvbkByaXNldXAubmV0PgUCV0SJlwAKCRBI of/XNyszSvv/D/9VtjI+bmiqK53v//StUbmpYjgQjYheYvwktFld+2XDURh52dmU sbk3lab2RS1eQJxjV0BVXMF9O2JUAlp4NA2UMpj8ZJlCk0h1S6p2o4/sAlsrHr8Z nb67HiaRIyEvi9cQiXFtDtK/onAkEuKskolyvh3ysJRRUubHSX1z8WuNJIc4xyGH ZpSLPGUOO6qI7mM8ztS0muEy1khmkHgtlyHi2l4K/NsW3I90cV3w6Db2AEnV6v1c tsfehqLExsHUdEo0U3hHU7yY1p2fzD5Z+C0tgVKTnP5Zus/Vr9OH/zFwxneo0E7a 5FHdnCZnNIG9W32uQgjDdmBEv/YFEd0um/vMWFGUehFANSt+DIps7E+AjwiJwm2i ov97JJurQkrSMX7ZchTEsy720Ju272olp2eDiHaXXTK2TkxcEq+d1gZfj7CXycPW 6mCrj6L6URJAZ34GJQfFFjv8QbFmKkAvGhxl/O8KXRbXxedbLH7PY73jmFjJcmxO +KnSeyqMe1KbzazYyFydP+VmgI2k1IlO89l8Jq1Gq9f2KOPY9UKFZjGDKLS0xGZW EnqU/KUINcrGejYFT8nYNxA+OFTd/ZGIX5qP4Vo5NsZ/pDLZjdxIcvHx1jjZbER+ 5Ku2bihm2KTNAGoYDqB3LGCm+QdEFG/p573xQCcXPk92GyhMJDi9EMPDgA== =mTa0 -----END PGP SIGNATURE-----

8 8

Please enable IPv6 on your relay!
by Moritz Bartl 28 Jan '17

28 Jan '17

Hi! We still have a depressingly low number of relays that support IPv6 (currently only ~120 of ~1900 relays). If your host supports IPv6, please enable it, especially if you run an exit! This has to be done explicitly. https://trac.torproject.org/projects/tor/wiki/doc/IPv6RelayHowto In short, you add: ORPort [IPv6::address]:port IPv6Exit 1 ExitPolicy reject6 *:* (or a more open exit policy respectively) Thanks! -- Moritz Bartl https://www.torservers.net/

30 42

Netflix overblocking non-exit Tor relays
by Gero Kuehn 16 Dec '16

16 Dec '16

tl;dr: Even paying customers sharing IPs with non-exit Tor relays are now blocked from accessing Netflix Hello everyone ! After two very fruitless attempts to get the issue silently resolved through proper Netflix support channels, the time has come to make this public. As some of you have probably already read in the news, Netflix recently announced a crackdown on what they call "VPN Pirates" and what I call "paying customers using the same benefits of globalization that global companies like Netflix (ab)use for their taxes". They have now obviously changed their strategy regarding the Tor network. I am operating (among others) a middle-relay on a German residential fixed-ip VDSL-50 line (dc6jgk1/486740353B905AA4731F82C0B4CC25821A62C6E3) behind a NAT. Until 2 days ago, none of the devices sharing the same external IP address had any problem connecting to Netflix and there never was a Tor exit relay on that IP as far as I can tell. It is also obviously not possible for users of the Tor network to connect to Netflix through middle relays. As a consequence they should not be classifying such IP addresses as VPNs/Proxies and they should not be blocking them. This has been escalated and explained twice to "technical supervisors" in their callcenters. They did however not leave the impression that they a) care or b) intend to fix this at some point by parsing the Tor network information properly instead of using whatever cheap&wrong hack they use now. The official response from Netflix is that you now need to make a choice between operating that Tor relay (of any type) and the ability to watch Netflix. They also strictly refuse to refund any remaining credit in the customer account. My personal choice with regards to that blackmailing is as clear my next steps (conditional cancellation, 14 day deadline for refund and a legal challenge of their German AGB with regards to this issue). I am allergic to being blackmailed like that and being called a pirate by a service I legitimately paid for. For those of you who just would like to contribute to the Tor network without having trouble like that, please do not let this nonsense stop you. A more diversified Tor network is a more healthy network and I would really like to see more normal users operating tor relays operating in as many different locations as possible - including DSL lines "that are there anyways". If you do not want to be put into a position where you have to choose between your contribution to the network and some legal and paid-for entertainment, you might want to operate only a bridge until the issue has been resolved. If you already have the same problem, make it as expensive for Netflix as possible and spread the word about why this block (and geoblocking in general) is wrong. Thanks ! Kind regards, Gero / dc6jgk

14 21

LLC vis-à-vis Nonprofit
by Kenneth Freeman 04 Dec '16

04 Dec '16

An Idaho nonprofit has expressed guarded interest in Tor. Ideally I'd like them to run an exit node without fuss or bother, but the Tor Project's Tips on Running an Exit Node only covers limited liability corporations (LLCs) regarding the legal/corporate set-up. Is there anything to add, or is that sufficient? Thanks in advance.

3 5

Interrogated by Finnish police for alleged idendity crimes, fraud and attempts of fraud
by Juuso Lapinlampi 08 Nov '16

08 Nov '16

Putting the word out: I was interrogated by the Finnish police today for multiple alleged counts (15+) of identity crimes, fraud and attempts of fraud. The invitation letter to be interrogated was sent out on 2016-10-21 and received by me on 2016-10-25. Today is 2016-10-31. The police suspects me because of an "IP-address assigned to my name", which I can't confirm or deny to have a relation to me. As a suspect, I was not told what this aclaimed IP-address was on a specific date to my knowledge. It is only speculation if these allegations wrongly against me have something to do with my relation with the Tor community or activism about digital rights online. Pending ongoing investigation, I am not allowed by law to share more specific details about to the investigation. I'd be glad to reveal more details about the case once the investigation is over and share/hear how I became a suspect, once I know about it. (Note that my story is at least slightly opinionated.) I had a witness with me and I feel like my rights were being violated during the interrogation. The officer (not to be named publicly in respect for privacy) didn't want to allow me to write down their badge number by taking the badge away from me while trying to write down the numbers. The officer looked slightly anxious. After refusing to comment on few questions (to which I have a legal right as a suspect), soon after me and my belongings with me were searched for aclaimed "security reasons" and "making sure I'm not recording this interrogation (with a phone)". I'll let you decide on the implications on unwarranted searches and individual legal protection. (See supreme court decision KKO:1990:36.) I audibly and multiple times in calm manner protested to not consent to searches, but alas it happened against my will without being suspected of wrongdoing at the police station in front of my witness. I didn't physically resist but also didn't voluntarily help the officer. The officer asked me inappropriate questions which were not related to the investigation. I was asked about my previous involvement with the police, how much I knew about the law and unsolicited advice about how "it will be easier for me if I talked". I demanded the officer to write down every question since the beginning of interrogation to the interrogation minutes, including the inappropriate ones, but the officer refused, trying to make up a fake reason how they were "irrelevant". The officer raised their voice once or twice during the 45 minutes of interrogation, apparently angry that I would not "make a confession" or "help out and tell more" to prove innocence. Confronting the officer again with a simple question "am I a suspect or a witness" to confirm my position, I was confirmed again that I was a suspect in the case. Subtly reminding that "I have my rights" that should be respected, the officer replied among the lines of "I have my rights too" with disrespect. After the interrogation minutes did not rightfully represent what was actually questioned, the only sensible thing to me was to not sign the minutes. The officer after the officer made threatening claims about how I "would be going to court" over this, but didn't spend too much effort on trying to get my signature. Once the interrogation was concluded, the officer made an unsolicited comment of "gladly not seeing people like [me] often". I told that I would be in contact with my lawyers. I am glad that I was not detained in a cell or arrested, which in my opinion I can likely attribute to having a witness with me. Looking back at what just happened at the police station, I should have demanded a lawyer immediately to the interrogation after having my rights violated, but I'm relying on my witness for now to make a testimony if necessary. I repeat that I absolutely deny being guilty of any suspected crimes. Be safe out there, tor-relays@ and all. (I have legal support behind me and have never been particularly worried about the investigation or outcome of this case.) Proof of invitation letter: https://wubthecaptain.eu/files/legal/2016-10-21-alleged-fraud-identity-crim…

8 11

most (>57% cwfr) of the tor network still vulnerable to CVE-2016-8860 - update your relay!
by nusenu 02 Nov '16

02 Nov '16

just a reminder since most of the tor network (including some of the biggest operators) still runs vulnerable relays https://blog.torproject.org/blog/tor-0289-released-important-fixes Since 2/3 directory authorities removed most vulnerable versions from their 'recommended versions' you should see a log entry if you run outdated versions (except if you run 0.2.5.12). It is not possible to reliable determine the exact CW fraction affected[1] due to the fact that patches were released that didn't increase tor's version number. Therefore it is also possible that you get log entries even if you run a patched version (IMHO this hasn't been handled in the most professional way). Update instructions Debian/Ubuntu ============== make sure you use the Torproject repository: https://www.torproject.org/docs/debian.html.en (you can also use the debian repository but the Torproject's repo will provide you with the latest releases) aptitude update && aptitude install tor CentOS/RHEL/Fedora =================== yum install --enablerepo=epel-testing tor FreeBSD ============ pkg update pkg upgrade OpenBSD =========== pkg_add -u tor Windows ======== No updated binaries available for this platform yet. [1] as of 2016-10-25 18:00 (onionoo data) conservative estimate ---------------------- (counts only 0.2.8.9 and 0.2.9.4-alpha as patched) 31% CW fraction patched optimistic estimate ------------------- (additionally assumes every non-Windows running 0.2.4.27, 0.2.5.12, 0.2.6.10, 0.2.7.6 that restarted since 2016-10-17 is patched): 43% CW fraction patched

9 16

assign_to_cpuworker failed. Ignoring.
by Felix 01 Nov '16

01 Nov '16

Hi everybody May be someone can help with this warning: The security update (Tor v0.2.8.9 running on FreeBSD with Libevent 2.0.22-stable, OpenSSL LibreSSL 2.4.3 and Zlib 1.2.8.) shows the following log entry each hour: Oct 19 02:51:07.000 [warn] Your system clock just jumped 136 seconds forward; assuming established circuits no longer work. Oct 19 02:51:07.000 [warn] assign_to_cpuworker failed. Ignoring. ... Oct 19 02:51:07.000 [warn] assign_to_cpuworker failed. Ignoring. Oct 19 02:51:15.000 [notice] Tor has successfully opened a circuit. Looks like client functionality is working. ... Oct 19 03:51:10.000 [warn] Your system clock just jumped 138 seconds forward; assuming established circuits no longer work. Oct 19 03:51:11.000 [warn] assign_to_cpuworker failed. Ignoring. ... Oct 19 04:50:37.000 [warn] Your system clock just jumped 105 seconds forward; assuming established circuits no longer work. Oct 19 04:50:37.000 [warn] assign_to_cpuworker failed. Ignoring. ... Oct 19 05:51:14.000 [warn] Your system clock just jumped 142 seconds forward; assuming established circuits no longer work. Oct 19 05:51:15.000 [warn] assign_to_cpuworker failed. Ignoring. ... The warning first appeared on 2.8.7 after update on September 13th (Tor v0.2.8.7 running on FreeBSD with Libevent 2.0.22-stable, OpenSSL LibreSSL 2.4.2 and Zlib 1.2.8.). That time I switched back (Tor v0.2.7.6 running on FreeBSD with Libevent 2.0.22-stable, OpenSSL LibreSSL 2.4.2 and Zlib 1.2.8.) and the warning disappeared. What can I do? The warning is reproted in tor-talk: https:// lists.torproject.org/pipermail/tor-talk/2016-October/042425.html -- Best regards, Felix

3 7

Blocking Domains
by Tristan 01 Nov '16

01 Nov '16

Is it possible to block domain names in Tor's ExitPolicy? I've been getting abuses on *.panelboxmanager.com, and I'd like to be proactive about this if possible.

8 13

OpenWrt
by Nima Fatemi 31 Oct '16

31 Oct '16

Hi relay operators, I'm curious to see if there are any openwrt users here and if by any chance any of you is running a relay or a bridge on it. Here's why: The current Tor package on openwrt is left without an active maintainer. I just send a patch to update it to 0.2.8.9 and I'm wondering whether it's worth to put the time and maintain the package. Best, -- Nima 0X58C4B928A3E218F6 | @mrphs "I disapprove of what you say, but I will defend to the death your right to say it" --Evelyn Beatrice Hall

2 1

ExitPolicy reject 184.107.0.0/16* funio.com
by Markus Koch 28 Oct '16

28 Oct '16

Getting abuse mass mails on nearly all exist in the last hours: The following intrusion attempts were detected: ./pilipia/pilipiak.com:188.166.63.113 - - [27/Oct/2016:18:06:35 -0400] "GET / HTTP/1.1" 200 5734 "-" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1" ./pilipia/pilipiak.com:188.166.63.113 - - [27/Oct/2016:18:06:36 -0400] "GET /?subscribe-email=dlcw87%40hotmail.com&subscribe-submit=Informez-moi& HTTP/1.1" 200 5734 "http://pilipiak.com/" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1" ./autoparcs.promoafrik.com:188.166.63.113 - - [27/Oct/2016:00:30:30 -0400] "GET / HTTP/1.1" 200 26737 "-" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1" ./autoparcs.promoafrik.com:188.166.63.113 - - [27/Oct/2016:00:30:31 -0400] "GET /search-listing.php?list_search_box=&subscribe=Search& HTTP/1.1" 200 9280 "http://autoparcs.com/" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1" ./pilipiak.com:188.166.63.113 - - [27/Oct/2016:18:06:35 -0400] "GET / HTTP/1.1" 200 5734 "-" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1" ./pilipiak.com:188.166.63.113 - - [27/Oct/2016:18:06:36 -0400] "GET /?subscribe-email=dlcw87%40hotmail.com&subscribe-submit=Informez-moi& HTTP/1.1" 200 5734 "http://pilipiak.com/" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1" ./promoaf/autoparcs.promoafrik.com:188.166.63.113 - - [27/Oct/2016:00:30:30 -0400] "GET / HTTP/1.1" 200 26737 "-" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1" ./promoaf/autoparcs.promoafrik.com:188.166.63.113 - - [27/Oct/2016:00:30:31 -0400] "GET /search-listing.php?list_search_box=&subscribe=Search& HTTP/1.1" 200 9280 "http://autoparcs.com/" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [26/Oct/2016:23:41:12 -0400] "GET /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [26/Oct/2016:23:41:16 -0400] "POST /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 116 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:00:02:49 -0400] "GET /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:00:02:51 -0400] "POST /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 116 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:10:32:33 -0400] "GET /index.php?option=com_user&task=activate&activation=e36afd6ab6a066e3485fcd4aedbc74ac HTTP/1.1" 200 11230 "-" "" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:10:32:34 -0400] "GET /index.php?option=com_user&view=login HTTP/1.1" 200 12349 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:10:32:36 -0400] "POST /index.php?option=com_user&view=login HTTP/1.1" 200 116 "http://hq-hospitality.com/index.php?option=com_user&view=login" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:10:32:38 -0400] "GET /index.php?option=com_user&view=user&task=edit HTTP/1.1" 200 25720 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:12:55:40 -0400] "GET /index.php?option=com_user&task=activate&activation=72ca806c4be186be71e7a5e0316e8681 HTTP/1.1" 200 11230 "-" "" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:19:28:56 -0400] "GET /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [26/Oct/2016:23:41:12 -0400] "GET /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [26/Oct/2016:23:41:16 -0400] "POST /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 116 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:00:02:49 -0400] "GET /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:00:02:51 -0400] "POST /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 116 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:10:32:33 -0400] "GET /index.php?option=com_user&task=activate&activation=e36afd6ab6a066e3485fcd4aedbc74ac HTTP/1.1" 200 11230 "-" "" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:10:32:34 -0400] "GET /index.php?option=com_user&view=login HTTP/1.1" 200 12349 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:10:32:36 -0400] "POST /index.php?option=com_user&view=login HTTP/1.1" 200 116 "http://hq-hospitality.com/index.php?option=com_user&view=login" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:10:32:38 -0400] "GET /index.php?option=com_user&view=user&task=edit HTTP/1.1" 200 25720 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:12:55:40 -0400] "GET /index.php?option=com_user&task=activate&activation=72ca806c4be186be71e7a5e0316e8681 HTTP/1.1" 200 11230 "-" "" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:19:28:56 -0400] "GET /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0" Abuse Department Funio to stop the mass flood of abuse bot mails I tried to reject the IP space of funio but Tor is telling me its not allowed. Why? Markus

5 6