May 2016 - tor-relays - lists.torproject.org

Monitoring multiple relays
by Xza 01 Nov '17

01 Nov '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello, I have a couple relays / exits running. Now my question is : how do you manage them is there any dashboard or CLI tools to manage them ( statistics, ect.. ) I know the cli tool specially for Tor "arm" Thanks alot. - -- PGP : 29A4CE52 -----BEGIN PGP SIGNATURE----- iQI4BAEBCgAiGxxEbyA8eWFuZGVyZXNvbkByaXNldXAubmV0PgUCV0SJlwAKCRBI of/XNyszSvv/D/9VtjI+bmiqK53v//StUbmpYjgQjYheYvwktFld+2XDURh52dmU sbk3lab2RS1eQJxjV0BVXMF9O2JUAlp4NA2UMpj8ZJlCk0h1S6p2o4/sAlsrHr8Z nb67HiaRIyEvi9cQiXFtDtK/onAkEuKskolyvh3ysJRRUubHSX1z8WuNJIc4xyGH ZpSLPGUOO6qI7mM8ztS0muEy1khmkHgtlyHi2l4K/NsW3I90cV3w6Db2AEnV6v1c tsfehqLExsHUdEo0U3hHU7yY1p2fzD5Z+C0tgVKTnP5Zus/Vr9OH/zFwxneo0E7a 5FHdnCZnNIG9W32uQgjDdmBEv/YFEd0um/vMWFGUehFANSt+DIps7E+AjwiJwm2i ov97JJurQkrSMX7ZchTEsy720Ju272olp2eDiHaXXTK2TkxcEq+d1gZfj7CXycPW 6mCrj6L6URJAZ34GJQfFFjv8QbFmKkAvGhxl/O8KXRbXxedbLH7PY73jmFjJcmxO +KnSeyqMe1KbzazYyFydP+VmgI2k1IlO89l8Jq1Gq9f2KOPY9UKFZjGDKLS0xGZW EnqU/KUINcrGejYFT8nYNxA+OFTd/ZGIX5qP4Vo5NsZ/pDLZjdxIcvHx1jjZbER+ 5Ku2bihm2KTNAGoYDqB3LGCm+QdEFG/p573xQCcXPk92GyhMJDi9EMPDgA== =mTa0 -----END PGP SIGNATURE-----

8 8

Please enable IPv6 on your relay!
by Moritz Bartl 28 Jan '17

28 Jan '17

Hi! We still have a depressingly low number of relays that support IPv6 (currently only ~120 of ~1900 relays). If your host supports IPv6, please enable it, especially if you run an exit! This has to be done explicitly. https://trac.torproject.org/projects/tor/wiki/doc/IPv6RelayHowto In short, you add: ORPort [IPv6::address]:port IPv6Exit 1 ExitPolicy reject6 *:* (or a more open exit policy respectively) Thanks! -- Moritz Bartl https://www.torservers.net/

30 42

Netflix overblocking non-exit Tor relays
by Gero Kuehn 16 Dec '16

16 Dec '16

tl;dr: Even paying customers sharing IPs with non-exit Tor relays are now blocked from accessing Netflix Hello everyone ! After two very fruitless attempts to get the issue silently resolved through proper Netflix support channels, the time has come to make this public. As some of you have probably already read in the news, Netflix recently announced a crackdown on what they call "VPN Pirates" and what I call "paying customers using the same benefits of globalization that global companies like Netflix (ab)use for their taxes". They have now obviously changed their strategy regarding the Tor network. I am operating (among others) a middle-relay on a German residential fixed-ip VDSL-50 line (dc6jgk1/486740353B905AA4731F82C0B4CC25821A62C6E3) behind a NAT. Until 2 days ago, none of the devices sharing the same external IP address had any problem connecting to Netflix and there never was a Tor exit relay on that IP as far as I can tell. It is also obviously not possible for users of the Tor network to connect to Netflix through middle relays. As a consequence they should not be classifying such IP addresses as VPNs/Proxies and they should not be blocking them. This has been escalated and explained twice to "technical supervisors" in their callcenters. They did however not leave the impression that they a) care or b) intend to fix this at some point by parsing the Tor network information properly instead of using whatever cheap&wrong hack they use now. The official response from Netflix is that you now need to make a choice between operating that Tor relay (of any type) and the ability to watch Netflix. They also strictly refuse to refund any remaining credit in the customer account. My personal choice with regards to that blackmailing is as clear my next steps (conditional cancellation, 14 day deadline for refund and a legal challenge of their German AGB with regards to this issue). I am allergic to being blackmailed like that and being called a pirate by a service I legitimately paid for. For those of you who just would like to contribute to the Tor network without having trouble like that, please do not let this nonsense stop you. A more diversified Tor network is a more healthy network and I would really like to see more normal users operating tor relays operating in as many different locations as possible - including DSL lines "that are there anyways". If you do not want to be put into a position where you have to choose between your contribution to the network and some legal and paid-for entertainment, you might want to operate only a bridge until the issue has been resolved. If you already have the same problem, make it as expensive for Netflix as possible and spread the word about why this block (and geoblocking in general) is wrong. Thanks ! Kind regards, Gero / dc6jgk

14 21

British Airways website blocking non exit relays IPs?
by Pascal Terjan 11 Sep '16

11 Sep '16

I haven't been able to access BA website from home for the last few weeks. I have failed to get any other answer on the phone that to try using Internet Explorer or to wait for things to maybe get fixed. Twitter support was not more helpful. I am now wondering is this is because I run a (non exit) relay. Can anyone confirm if they also have the problem? http://ba.com/ Error is: The requested URL was rejected. Please contact our support team on Telephone: (+44) 0344 493 0787 option 3 (calls charged at local rate within the UK) Daily 06:00-20:00 UK time. Please quote support ID 13240401227540154825

10 16

Exit relay funding
by Michael McConville 04 Aug '16

04 Aug '16

Hi, everyone. I'm an experienced Tor relay operator and a mostly dormant community member. My main relay these days is on a dedicated server running OpenBSD and moving 3-4 MB/s. It costs me $35/month. https://atlas.torproject.org/#details/CDAB3AE06A8C9C6BF817B3B0F1877A4B91465… Sadly, I have to shut it down at least temporarily if no one can help me pay for it. Is anyone interested? You can search the mailing lists to see that I've been contributing for a few years, and I can give more verification if you'd like. Thanks for your time, Michael McConville

23 40

Don't use Google's DNS server
by Philipp Winter 29 Jul '16

29 Jul '16

I created a new diagram that illustrates the popularity of DNS resolvers used by exit relays. The diagram shows nine autonomous systems that hosted the most popular resolvers at some point over the last months. These autonomous systems are owned by Google, INIT7, LeaseWeb, Visual Online, OVH, OpenDNS, NForce Entertainment, Cyberdyne, and Level3. The x axis shows time and the y axis shows the fraction of DNS requests that the respective AS can observe: <https://nymity.ch/dns-traffic-correlation/img/exit-resolvers-2015-05.png> The two most popular setups are Google's 8.8.8.8 and local resolvers, i.e., exit relays doing their own resolution. Occasionally, Google got to see more than 40% of all DNS requests exiting the Tor network. That is concerning, particularly given Google's role in the PRISM program. No other autonomous system is getting even close. Please refrain from using 8.8.8.8. Instead, set up your own resolver, or at least use the one provided by your ISP. Here's Peter's quick guide on how to set up your own resolvers [1]: On Thu, Jan 08, 2015 at 04:11:09PM +0100, Peter Palfrader wrote: > o apt-get install unbound > o remove all nameserver entries in /etc/resolv.conf and add one for the > local recursor. Either manually or use (untested): > sed -i -e 's/^nameserver /#&/; $a nameserver 127.0.0.1' /etc/resolv.conf > o prevent anything else from modifying that file ever again: > chattr +i /etc/resolv.conf Note that running your own resolver is not universally safer because the exposure of DNS requests to network adversaries is greater. It's a tricky trade-off that we are currently trying to understand better [2], but increased exposure to network-level adversaries seems less bad than having Google see almost half of all DNS requests. If you are wondering how I created the above diagram, have a look at the measurement method [3]. [1] <https://lists.torproject.org/pipermail/tor-relays/2015-January/006147.html> [2] <https://nymity.ch/dns-traffic-correlation/> [3] <https://lists.torproject.org/pipermail/metrics-team/2016-February/000078.ht…> Cheers, Philipp

10 15

Exit node situation in Finland
by Nurmi, Juha 12 Jul '16

12 Jul '16

Greetings Tor Relay mailing list, I decided to write little bit about Finnish exit node situation. I am maintaining this exit node campaign in Finland: http://campaigns.ahmia.fi/finnish-tor-campaign/index_en.html In Finland: - Running an exit node is absolutely legal - ISP may cut your connection because it is listed as malware host - The National Cyber Security Center Finland (NCSC-FI) is able to "whitelist" your IP address so the ISP does not get those automated malware detections - Sebastian Mäki got police visit because his exit node - The National Bureau of Investigation is using exonerator.torproject.org so basically they are considering this information before they rush to your home - There has been warming up phase that maybe Finnish libraries start some Tor activity I am doing a lot of local advocacy work here :) Best, Juha

9 14

Opt-In Trial: Fallback Directory Mirrors
by Nick Mathewson 22 Jun '16

22 Jun '16

TL;DR: Stable non-exit relays can help tor clients use the Tor network. Please opt-in! We want to run a trial of fallback directory mirrors (fallbacks) in Tor. Tor clients contact fallbacks to download the consensus during initial bootstrap, before they contact the directory authorities. Fallbacks allow Tor to bootstrap in networks that block the Tor directory authorities. This allows people to use Tor without manually configuring bridges or pluggable transports. For more information about fallbacks, see: https://trac.torproject.org/projects/tor/wiki/doc/FallbackDirectoryMirrors For this trial, we want to find around 100 stable non-exit relays, as exits currently experience high load. We want relays that expect to be stable for the next 2 years, with: good uptime, the same IP address(es) and port, the same relay identity key, good bandwidth and network connectivity. In December 2015, we created a list of ~400 candidate fallbacks. https://trac.torproject.org/projects/tor/attachment/ticket/15775/fallback_d… If your relay is on this list, and you expect it to be on the same IP address(es) and port for at least 2 years, please consider opting-in for this trial. (Relays that aren't on the list are welcome to opt-in. They will be considered in future releases, or if the selection criteria change.) For the initial fallback release, we will only add your relay if you opt in. Please reply on the tor-relays mailing list, if you are able. (Opt-ins, opt-outs, and fallbacks chosen for inclusion in tor, will be managed using lists in the publicly available tor git repository.) all best wishes, & thanks for running Tor!

19 29

Tor Weather has been discontinued
by Karsten Loesing 02 Jun '16

02 Jun '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear relay operators, as of April 4, 2016, Tor Weather has been discontinued. Tor Weather [0] provided an email notification service to any user who wanted to monitor the status of a Tor node. Upon subscribing, they could specify what types of alerts they would like to receive. The main purpose of Tor Weather was to notify node operators via email if their node was down for longer than a specified period, but other notification types were available, including one where operators would be informed when their node was around long enough to qualify for a t-shirt. The main reason for discontinuing Tor Weather is the fact that software requires maintenance, and Tor Weather is no exception. Tor Weather was promising t-shirts for relays that have not been around long enough or that provided too little bandwidth to be useful to the network, and it was almost impossible to deny a t-shirt after Tor Weather has promised it. Apart from that, Tor Weather was likely not offering t-shirts to people who have long earned it, thereby confusing them. An unreliable notification system is worse than not having a system at all. Relay operators shouldn't rely on Tor Weather to notify them when their relay fails. They should rather set up their own system instead. We have tried to find a new maintainer for Tor Weather for years, but without success. We started rewriting Tor Weather [1] using Onionoo [2] as data back-end in 2014, and even though that project didn't produce working code, somebody could pick up this efforts and finish the rewrite. The Roster developers said that they're planning to include an email notification function in Roster [3]. And we developed a simple Python script that provides information about a relay operator's eligibility for acquiring a t-shirt [4]. None of these alternatives is a full replacement of Weather, though. We encourage you, the community of Tor relay operators, to step up to start your own notification systems and to share designs and code. Tor Weather is still a good idea, it just needs somebody to implement it. Tor Weather is discontinued in two steps. For now, new subscriptions are disabled, new welcome messages are not sent out anymore, and existing subscriptions continue working until June 30, 2016. From July 1, 2016 on, Tor Weather will not be sending out any emails. Sorry for any inconvenience caused by this. All the best, Karsten [0] https://weather.torproject.org/ [1] https://trac.torproject.org/projects/tor/wiki/doc/weather-in-2014 [2] https://onionoo.torproject.org/ [3] http://www.tor-roster.org/ [4] https://gitweb.torproject.org/metrics-tasks.git/tree/task-9889/tshirt.py -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXAn7HAAoJEC3ESO/4X7XBmhEIAKxWEwex5pyp5RBHkE4+1IC2 WaKjcvIT0WiZJ8prZASNSxF7ART6r2trG50+Pd2GCdu0SOjIz3eeQNSkx251RaqF xF7dw2RVhExcYOar4FG5+KkXu6X3k0svMvNeMGzcRd51yaaVeW8OaAgV0NC+CHgE ZkA7bg26jCvG8EFrKCg4fuZ3JW3+O3mvcquea+aB4q6gbuQFjgoxzfH5+XkmpA5i gDZnsIRuBDYuUW8V1ior/7DG2wGlCjWZUotoTysfsFW2FSMUrTBZOlvhpHicMfER VpLxY8+b3ZGC6Olit50ISZql8l12yO3Hik32eKIcgK2fpx6vgKE+T83I8voIpOU= =LVj8 -----END PGP SIGNATURE-----

7 11

I'm Running A Tor Exit But Never Initiated It
by Percy Blakeney 01 Jun '16

01 Jun '16

According to files and folders I have on two separate computers in my house, I am running a Tor exit but I absolutely have nothing to do with it. I am only able to physically view certain files ie; var/log/tor, etc/tor/torrc, while other files like var/lib/tor/lock the content is invisible. I am MORE than willing to talk to anyone who may be able to help.

7 10