May 2016 - tor-relays - lists.torproject.org

Re: [tor-relays] [Fwd: Re: I'm Running A Tor Exit But Never Initiated It]
by Greg Moss 01 Jun '16

01 Jun '16

Thanks Mr dingledine- was a good laugh but enough is enough On May 31, 2016 4:21 PM, "Roger Dingledine" <arma(a)mit.edu> wrote: On Tue, May 31, 2016 at 07:05:23PM -0400, Percy Blakeney wrote: > In addition I DO NOT have the full Xfinity package. Hi folks, I'm going to put an end to this thread now. Please be aware that 1700+ people are on the tor-relays list, so we really need to keep things concise and on-topic. Thanks! --Roger _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

[Fwd: Re: I'm Running A Tor Exit But Never Initiated It]
by Christian 01 Jun '16

01 Jun '16

-------- Weitergeleitete Nachricht -------- > Von: Christian Adam <hirnwurst(a)t-online.de> > An: tor-relays(a)lists.torproject.org > Betreff: Re: [tor-relays] I'm Running A Tor Exit But Never Initiated > It > Datum: Mon, 30 May 2016 22:14:51 +0200 > > Dear Percy, > > I read all of your messages very carefully and, please, believe me, I > don't mean to be rude, but just want to provide you a little bit of > relief. > > First of all, I have to share that I AM in fact a schizophrenic for 16 > years now, but fully therapied to the extent I do a job as a system > administrator and get certified for being a data security officer this > week. > This won't reveal any competence on my side, but gives a clue about my > functional level which is, after all, related to sanity. > > Why do I tell this? > Because you don't seem to know much about computers AND because 60% of > the population experience states during their lifetime resembling mine > while diagnosed, but nobody minds and it goes away and was just > triggered by external circumstances and internal attributions. > > I tell this, because my delusional system did not involve at all any > technical devices, but was completely interpersonal and cultural, which > is a little seldom in western countries. > > So, I learned that even if improbable, it helps keeping a harmless, > maybe also annoying, possibility in mind. > > Read Foster-Wallace, This Is Water? > > So, let's have a clue at the facts. > You moved to a new region. > So, you were not yet closely related to your new environment and the old > one you left might have been more and more distant, which makes people > sometimes do morally questionable things. > > You don't know anything about computers, so, someone must have installed > your linuxes. > > I also do that for people. My 73-year-old mom uses linux. And a former > friends mother. > I do remote administration via Teamviewer as I prefer users being > graphically informed I am on their box after their consent. > > Maybe the girl or guy who installed your linuxes has enabled SSH remote > access combined with a DynDNS name resolving to remotely administrate > (and spy) you (out). > > Maybe things got socially weird, not technically. > Maybe the computer shutdown at the library was just coincidence, as this > also happened to me at a university terminal which might have been > poorly maintained. > > In my educational company, the public PCs are the most poorly maintained > and I know that because I am in charge of that and not every library is > financially well off. > > The config you posted reveals two things: > 1. NOT an exit. > 2. You don't know that. > Let me explain. The hash symbol # comments out lines, i.e. these lines > don't contain config, but human readable remarks. > Of course, in a default config file, you can include commented out > options because the easily can be activated by removing the #. > Lines beginning with # are just nothing. > > The second thing is, that your "hard drive is partitioned". > Every hard drive is partitioned. > Operating systems don't use the raw physical devices, but the partitions > made up on them containing the file systems. > > On the most basic Windows installs, there's at least one partition which > you might know as device C:. > Personally, when I install linux, I separate system and user data which > results in two partitions at minimum, one containing /, the root > directory ("file system" in your file browser), and /home containing the > users' personal folders. > > Next thing is that /var/lib/tor contains among others sensitive > statistical data concerning the relays users and are therefore is only > accessible as root via a sudo command. > If you type "sudo -i" and "cd /var/lib/tor", you should be able to > access it as sudo provides you with administrator privileges which are > called root privileges on linux. > You cannot do "sudo cd /var/lib/tor". > > If this folder was normally accessible, someone could just use a > vulnerability in your firefox and learn from where your users originate > and if he knows your record of connections, he would know what the > people from region X do with your connection: accessing a relay or a > bridge, which sets users not only in other jurisdictions at risk of > uncontrolled data collection by whoever it is. > > I asked my mom whether she wants to run a bridge. > She didn't and so I did not install one. > I asked my CEO if he wants to run a bridge. > He didn't and so I did not install one. > I just got the job because I told everything an employer is not allowed > to ask here in Germany, because I told them that they first have to > decide whether to trust me as I will have highest privileges on the > entire network including their private PCs. > > What is true that remote administration is great for saving time and > miles to do people a quick favour. > But it can be used irresponsibly. > > Maybe the one providing you your installs decided you won't even notice > and you get that relay, period. > Not nice. Not responsible. Morally highly questionable. > But after all, quite probable, as every device has a partitioned hard > drive and real adversaries have a keen eye on you not noticing never > ever you have been compromised, except ransomware tricking you into > sending money via Western Union or Bitcoins. > > Criminals want to do criminal business, except ransomware tricking you > into sending money via Western Union or Bitcoins, and agencies want to > prosecute, but scaring you is not an aim of either if you're not an > agent yourself. > > In my house are 8 appartements. > Two of us are schizos. > We integrate well (public health system) and our neighbours like us, > but, of course, we use linux and of course, we have paranoid passwords > and of course... you understand, I guess. > > I have never ever been hacked. > But in my company, I can access every computer without prompting for > consent as everybody finds that comfortable cause they know about that. > I'm in the network at 3 a.m. and I can turn on half of the workstations > while laying in my bed. > > I know how that feels. > My diagnosis reads "paranoid-hallucinatoric schizophrenia" and I know > how it feels to have a perspective not even one of 7 billion people > share. > > Sensitivity is paranoia's beautiful sister. > I strongly suggest someone just wants to mock you. > > Given my experience with newbie users, paranoia and system > administration, what you wrote seemed quite normal and you didn't > provide (as far as I remember) any unusual technical details. > > Maybe what just happened was a lack of informed consent resulting in a > tasteless prank. > > I don't want to do injustice to you, but since Edward Snowden, we're all > used to question every system crash and honestly, our times seem to be > hysterical and violence-saturated. > > The rule is simple. When a user thinks he's infected, he's almost always > not. > If he's infected, he wouldn't notice. > > Hugs, I hope you find peace again soon. > > Please don't feel offended, I only told my story based on the facts you > gave. > > And kind regards, > > christian > > > Am Montag, den 30.05.2016, 13:25 +0200 schrieb Christian Pietsch: > > Hi GDR! > > > > On Mon, May 30, 2016 at 12:54:41PM +0200, GDR! wrote: > > > On Sun, 29 May 2016 15:23:24 +0000 "krutt(a)anche.no" <krutt(a)anche.no> wrote: > > > > > > > I can't image a single reason why Tor should be configured to run a > > > > relay without the system admins knowledge. > > > > > > Debian did this - I'm not sure if it does that any more. > > > > This bug is not present in current and recent versions of Debian. > > > > > `apt-get install tor` used to run an exit relay unless you uncomment > > > "ExitPolicy reject *:*" in torrc. I had the same problem a few years > > > ago, suddenly captchas started appearing everywhere after installing > > > tor. > > > > Do you mean this bug in Tor 0.1.0 which was fixed in 2005? > > > > -------------- begin quote from the Debian changelog -------------- > > > > tor (0.1.0.11-1) unstable; urgency=high > > > > * New upstream version (closes: #316753): > > - Fixes a serious bug: servers now honor their exit policies - > > In 0.1.0.x only clients enforced them so far. 0.0.9.x is > > not affected. > > * Build depend on libevent-dev >= 1.1. > > * Urgency high because 0.0.9.10-1 did not make it into testing after > > like 3 weeks because of an impending ftp-master move. So I might > > just as well upload this one. > > > > -- Peter Palfrader <weasel(a)debian.org> Mon, 4 Jul 2005 17:53:48 +0200 > > > > -------------- end quote from the Debian changelog -------------- > > > > > > Cheers, > > Christian > > > > _______________________________________________ > > tor-relays mailing list > > tor-relays(a)lists.torproject.org > > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > >

9 22

Re: [tor-relays] Question on warnings
by Tristan 31 May '16

31 May '16

Not sure where I found this, but I remember reading that Tor changed how it stored bandwidth information. Arm wasn't updated yet, so it throws an error. On May 30, 2016 4:32 PM, "Green Dream" <greendream848(a)gmail.com> wrote: Hi. Thanks for running a relay. These notice messages are from the monitoring tool Arm, and should not affect the Tor process. If you don't care about Arm and Tor seems to be working okay otherwise, you could safely ignore these messages. In case you want to look into them further, I'll share some thoughts below. It looks like you're running on a Unix or Linux system, I'll assume Debian or Ubuntu for the moment. > 20:42:57 [ARM_NOTICE] Unable to prepopulate bandwidth information > (unable to read the state file) This is normal in my experience. Arm is trying to read your node's bandwidth history to populate the graphs with data collected before you started Arm. I don't know why it fails, but you could squelch it by adding the following config line to ~/.arm/armrc: features.graph.bw.prepopulate false > 20:42:56 [ARM_WARN] Unable to read tor's log file: > /var/log/tor/log [1duplicate hidden] It looks like Arm doesn't have permission to read /var/log/tor/log. I normally start Arm with something like this, so it has the same permissions as the Tor daemon: sudo -u debian-tor arm > 20:42:56 [ARM_NOTICE] Tor is preventing system utilities like netstat > and lsof from working. This means that arm can't provide you with > connection information. You can change this by adding > 'DisableDebuggerAttachment 0' to your torrc and restarting tor. For > more information see... https://trac.torproject.org/3313 You need to add the following to /etc/tor/torrc if you want to utilize all the features of Arm: DisableDebuggerAttachment 0 It's disabled by default for security (with a value of '1'), so think carefully before doing this. It "reduces security by enabling debugger attachment to the Tor process. This can be used by an adversary to extract keys." (Quoting from https://trac.torproject.org/projects/tor/ticket/13880) If you do enable the deubgger attachment for Arm, make sure your control port is locked down (not reachable from the Internet or from other hosts you don't control, etc.) _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

2 1

Question on warnings
by Santiago Roland 31 May '16

31 May '16

Hi, i have installed a non-exit relay in my home server and for many days i have had this warnings: 20:42:57 [ARM_NOTICE] Unable to prepopulate bandwidth information (unable to read the state file) 20:42:56 [ARM_WARN] Unable to read tor's log file: /var/log/tor/log [1 duplicate hidden] 20:42:56 [ARM_NOTICE] Tor is preventing system utilities like netstat and lsof from working. This means that arm can't provide you with connection information. You can change this by adding 'DisableDebuggerAttachment 0' to your torrc and restarting tor. For more information see... https://trac.torproject.org/3313 20:42:52 [ARM_NOTICE] No armrc loaded, using defaults. You can customize arm by placing a configuration file at '/home/santiago/.arm/armrc' (see the armrc.sample for its options). I just wanted to know if there are safe warnings or should i modify something in my config Best regards, -- Santiago Roland.- --------------------------------- Jabber: santiago(a)undernet.uy GNU Social: http://bit.ly/gnusr openPGP ID: 5ADF0F53 openPGP key: http://bit.ly/pgpun CX1DR - Grid Locator: GF25bf ---------------------------------

2 1

I'm Running A Tor Exit Node And NEVER Initiated It
by Percy Blakeney 30 May '16

30 May '16

Like I stated a few minutes ago, I am and have been running Tor from my location yet I have nothing to do with it. I have been sitting on this for a while. Before anyone comes down on me for it, you have to understand what I've been going through with my network. Tor is only the tip of the iceberg. This is as of today: usr/share/tor/tor-service-defaults-torrc DataDirectory /var/lib/tor PIDFile /var/run/tor/tor.pid RunasDaemon 1 user debian-tor control socket /var/run/tor/control control socket group writable 1 cookie authentication 1 cookie auth file group readable 1 cookie auth file /var/run/tor/control-authcookie log notice file /var/log/tor/log etc/tor/torrc contact info 0xFFFFFFFF Random Person <nobody AT example dot com> #Dirport 80 No Listen #Dirport 127.0.0.1:9091 No Advertise #Dirport front page /etc/tor/tor-exit-notice.html #Exit Policy Accept *:6660-6667, reject *:* #allow irc ports but no more #accept *:119 # accept nntp as well as default exit policy var/lib/tor lock-Mon 16 May 2016 09:48:32 PM EDT (File content is not visible to me) cached-certs-Mon 16 May 2016 09:48:32 PM EDT (File content is not visible to me) cached-microdescs-Mon 16 May 2016 10:18:34 PM EDT (File content is not visible to me) cached-microdescs.new-Mon 16 May 2016 10:18:34 PM EDT (File content is not visible to me) state-Wed 25 May 2016 04:36:02 AM EDT (This one IS visible) cached-microdesc-consensus-Sun 29 May 2016 09:17:15 AM EDT (File content is not visible to me) tor.pid-32156 /var/lib/tor/state #Tor state file last generated on 2016-05-25 04:36:02 local time #Other times below are in UTC #You *do not* need to edit this file. EntryGuard Jans 50586E25BE067FD1F739998550EDDCB1A14CA5B2 DirCache EntryGuardAddedBy 50586E25BE067FD1F739998550EDDCB1A14CA5B2 0.2.4.27 2016-04-28 16:16:20 THERE'S WAY more to the above file but I'm not sure what I should and shouldn't share on here. As a matter of fact, I'm not sure what half of this stuff means so I've spent the last few months trying to educate myself on as much of this as possible. Like I said, I am MORE than willing to talk to anyone out there who may be able to help.

9 15

Re: [tor-relays] I'm Running A Tor Exit But Never Initiated It
by david.carlson.417＠gmail.com 30 May '16

30 May '16

Two thoughts: I did not see mentioned whether your Wi-fi is secured.If your running a guest machine in a vm you will not know about the host.Have you tried booting into a rescue DVD? David C Sent from my LG G Pad 7.0 LTE, an AT&T 4G LTE tablet ------ Original message------From: ng0Date: Sun, May 29, 2016 12:36 PMTo: tor-relays@lists.torproject.org;Subject:Re: [tor-relays] I'm Running A Tor Exit But Never Initiated It On 2016-05-29(04:32:12+0000), krutt(a)anche.no wrote:> Hey there,>> This situation sounds really weird. Could you try running> sudo cat /var/lib/tor/fingerprint> on one of your Tor-machines? Then we can determine whether you are> really running an exit relay.>> As Arjen stated before, you can probably remove the Tor package with> sudo apt-get install torCorrection: apt-get remove tor> Best regards,> KRutt>> Percy Blakeney:> > There is NO ONE else in this house that uses my computers other than my 13> > year old daughter who plays Minecraft on hers. I have one Dell desktop> > that runs Linux Mint Rosa, however, sometimes when I turn it on a black> > screen appears with a message stating "VirtualBox restarting." Neither my> > child nor myself installed VirtualBox on the desktop. I also have an Acer> > laptop that runs Linux Mint Mate and a Lenovo that runs Windows 10. When I> > try to install the Tor browser on my Acer it tells me I already have it and> > it's running, however when I try to open it I'm told I don't have it. Yet> > my folders and files tell me otherwise. I have so much to get out that> > once again I'll apologize for my ADD responses.> >> > On Sun, May 29, 2016 at 11:23 AM, krutt(a)anche.no wrote:> >> >> Hey percy,> >>> >> I can't image a single reason why Tor should be configured to run a> >> relay without the system admins knowledge. Are there any other useres> >> with root access at those machines?> >> You could issue "(sudo) ls -al" on that folder to find out when the Tor> >> configs were created. Are there any other settings set in your torrc?> >>> >> I'm not quite sure but this could be a "good" crypto locker too.> >>> >> Best regards,> >> KRutt> >>> >> Percy Blakeney:> >>> According to files and folders I have on two separate computers in my> >>> house, I am running a Tor exit but I absolutely have nothing to do with> >>> it. I am only able to physically view certain files ie; var/log/tor,> >>> etc/tor/torrc, while other files like var /lib/tor/lock the content is> >>> invisible. I am MORE than willing to talk to anyone who may be able to> >>> help.--♥Ⓐ ng0 | http://www.n0.is/u/n4096R/13212A27975AF07677A29F7002A296150C201823_________… mailing listtor-relays@lists.torproject.orghttps://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

2 1

Fwd: Enable relay as trusted directory & entry guard
by Tim Wilson-Brown - teor 26 May '16

26 May '16

> Begin forwarded message: > > From: Austin Holiday <aholiday(a)yahoo.com> > Subject: Enable relay as trusted directory & entry guard > Date: 25 May 2016 at 23:24:42 GMT-3 > > Hi, > > I have the extra capacity/bandwidth would like to upgrade my relay to an entry node and directory server: > https://atlas.torproject.org/#details/1523C502A9754B6B42CCA5EB402A833CFF0E4… > > Is there anything I need to do? Hi, This question is best answered on the tor-relays list, I've cc'd the reply there. Your relay may be recommended as a "Guard" (entry node) by the directory authorities if it has enough stability and bandwidth over time. For more information, please read: https://blog.torproject.org/blog/lifecycle-of-a-new-relay Your relay is already a directory mirror, because you have configured a DirPort. Tim Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP 968F094B ricochet:ekmygaiu4rzgsk6n

1 0

Re: [tor-relays] VPS for Exits
by Neel Chauhan 26 May '16

26 May '16

> An exit node could be expensive ... Well, I'm still sticking with CoolHousing/Virtual Server Lite because I hardly ever get abuse complaints. For ITL, I may leave after my term expires. But a few other companies I found were: https://hostmaze.com/ https://www.lcsnet.eu/index.php https://serverastra.com/ https://blazingfast.io/ Thanks, Neel Chauhan https://www.neelc.org/

4 3

TOR router install without access to root
by Markus Koch 26 May '16

26 May '16

possible or do I have to ask my hosting company for the install on a shared server? Markus

9 17

Re: [tor-relays] VPS for Exits
by Neel Chauhan 23 May '16

23 May '16

>Do you know of a VPS for an exit? I have two exits on VPS servers. One is on ITL (https://itldc.com/) and the other one is on CoolHousing using their Virtual Server Lite brand (http://virtualniserverlite.cz/en/) My experience with both hosts has been very good. For the latter, you WILL need a Reduced Exit Policy, and have to remove IRC ports. I also previously had a VPS with Verelox (https://verelox.com/) when they had unlimited bandwidth, and they allow Tor exit nodes as well. I don't know about other providers, but a good place to ask for a Tor friendly VPS is vpsBoard (https://vpsboard.com/) -Neel Chauhan https://www.neelc.org/

4 3