July 2016 - tor-relays - lists.torproject.org

Monitoring multiple relays
by Xza 01 Nov '17

01 Nov '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello, I have a couple relays / exits running. Now my question is : how do you manage them is there any dashboard or CLI tools to manage them ( statistics, ect.. ) I know the cli tool specially for Tor "arm" Thanks alot. - -- PGP : 29A4CE52 -----BEGIN PGP SIGNATURE----- iQI4BAEBCgAiGxxEbyA8eWFuZGVyZXNvbkByaXNldXAubmV0PgUCV0SJlwAKCRBI of/XNyszSvv/D/9VtjI+bmiqK53v//StUbmpYjgQjYheYvwktFld+2XDURh52dmU sbk3lab2RS1eQJxjV0BVXMF9O2JUAlp4NA2UMpj8ZJlCk0h1S6p2o4/sAlsrHr8Z nb67HiaRIyEvi9cQiXFtDtK/onAkEuKskolyvh3ysJRRUubHSX1z8WuNJIc4xyGH ZpSLPGUOO6qI7mM8ztS0muEy1khmkHgtlyHi2l4K/NsW3I90cV3w6Db2AEnV6v1c tsfehqLExsHUdEo0U3hHU7yY1p2fzD5Z+C0tgVKTnP5Zus/Vr9OH/zFwxneo0E7a 5FHdnCZnNIG9W32uQgjDdmBEv/YFEd0um/vMWFGUehFANSt+DIps7E+AjwiJwm2i ov97JJurQkrSMX7ZchTEsy720Ju272olp2eDiHaXXTK2TkxcEq+d1gZfj7CXycPW 6mCrj6L6URJAZ34GJQfFFjv8QbFmKkAvGhxl/O8KXRbXxedbLH7PY73jmFjJcmxO +KnSeyqMe1KbzazYyFydP+VmgI2k1IlO89l8Jq1Gq9f2KOPY9UKFZjGDKLS0xGZW EnqU/KUINcrGejYFT8nYNxA+OFTd/ZGIX5qP4Vo5NsZ/pDLZjdxIcvHx1jjZbER+ 5Ku2bihm2KTNAGoYDqB3LGCm+QdEFG/p573xQCcXPk92GyhMJDi9EMPDgA== =mTa0 -----END PGP SIGNATURE-----

8 8

Please enable IPv6 on your relay!
by Moritz Bartl 28 Jan '17

28 Jan '17

Hi! We still have a depressingly low number of relays that support IPv6 (currently only ~120 of ~1900 relays). If your host supports IPv6, please enable it, especially if you run an exit! This has to be done explicitly. https://trac.torproject.org/projects/tor/wiki/doc/IPv6RelayHowto In short, you add: ORPort [IPv6::address]:port IPv6Exit 1 ExitPolicy reject6 *:* (or a more open exit policy respectively) Thanks! -- Moritz Bartl https://www.torservers.net/

30 42

Netflix overblocking non-exit Tor relays
by Gero Kuehn 16 Dec '16

16 Dec '16

tl;dr: Even paying customers sharing IPs with non-exit Tor relays are now blocked from accessing Netflix Hello everyone ! After two very fruitless attempts to get the issue silently resolved through proper Netflix support channels, the time has come to make this public. As some of you have probably already read in the news, Netflix recently announced a crackdown on what they call "VPN Pirates" and what I call "paying customers using the same benefits of globalization that global companies like Netflix (ab)use for their taxes". They have now obviously changed their strategy regarding the Tor network. I am operating (among others) a middle-relay on a German residential fixed-ip VDSL-50 line (dc6jgk1/486740353B905AA4731F82C0B4CC25821A62C6E3) behind a NAT. Until 2 days ago, none of the devices sharing the same external IP address had any problem connecting to Netflix and there never was a Tor exit relay on that IP as far as I can tell. It is also obviously not possible for users of the Tor network to connect to Netflix through middle relays. As a consequence they should not be classifying such IP addresses as VPNs/Proxies and they should not be blocking them. This has been escalated and explained twice to "technical supervisors" in their callcenters. They did however not leave the impression that they a) care or b) intend to fix this at some point by parsing the Tor network information properly instead of using whatever cheap&wrong hack they use now. The official response from Netflix is that you now need to make a choice between operating that Tor relay (of any type) and the ability to watch Netflix. They also strictly refuse to refund any remaining credit in the customer account. My personal choice with regards to that blackmailing is as clear my next steps (conditional cancellation, 14 day deadline for refund and a legal challenge of their German AGB with regards to this issue). I am allergic to being blackmailed like that and being called a pirate by a service I legitimately paid for. For those of you who just would like to contribute to the Tor network without having trouble like that, please do not let this nonsense stop you. A more diversified Tor network is a more healthy network and I would really like to see more normal users operating tor relays operating in as many different locations as possible - including DSL lines "that are there anyways". If you do not want to be put into a position where you have to choose between your contribution to the network and some legal and paid-for entertainment, you might want to operate only a bridge until the issue has been resolved. If you already have the same problem, make it as expensive for Netflix as possible and spread the word about why this block (and geoblocking in general) is wrong. Thanks ! Kind regards, Gero / dc6jgk

14 21

British Airways website blocking non exit relays IPs?
by Pascal Terjan 11 Sep '16

11 Sep '16

I haven't been able to access BA website from home for the last few weeks. I have failed to get any other answer on the phone that to try using Internet Explorer or to wait for things to maybe get fixed. Twitter support was not more helpful. I am now wondering is this is because I run a (non exit) relay. Can anyone confirm if they also have the problem? http://ba.com/ Error is: The requested URL was rejected. Please contact our support team on Telephone: (+44) 0344 493 0787 option 3 (calls charged at local rate within the UK) Daily 06:00-20:00 UK time. Please quote support ID 13240401227540154825

10 16

obfs4 - git how to ?
by Petrusko 15 Aug '16

15 Aug '16

Trying to use obfs4 from git on a test bridge : With "root" user: cd /home/TEST git clone https://git.torproject.org/pluggable-transports/obfs4.git ln -s /home/TEST/obfs4/obfs4proxy /usr/bin/obfs4proxy torrc file : [...] ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy managed ServerTransportListenAddr obfs4 0.0.0.0:48001 In the log when starting Tor : [...] [warn] Could not launch managed proxy executable at '/usr/bin/obfs4proxy' ('Permission denied'). [...] Tor is still working and is connected to the network... Humm, I think I've not understand how to use this source, and how to manage it ?! Thx for you help :) -- Petrusko PubKey EBE23AE5 C0BF 2184 4A77 4A18 90E9 F72C B3CA E665 EBE2 3AE5

4 4

Got a visit from the police this morning..
by Stig Atle Steffensen 05 Aug '16

05 Aug '16

I never thought I would be one of those operators who had to deal with the police or anything like that. I've done all I can to set things up so that it's easy to see that I run a exit node. I have a disclaimer on my website : https://stigatle.no/index.php/tor-exit-node/ and if you go to the ip of the node, you'll see the same info: https://185.97.32.18/ I run this node - which is no secret: https://atlas.torproject.org/#details/04250C3835019B26AA6764E85D836088BE441… So, back to earlier this morning. Suddenly got a hard knock on my door, I was surprised because we never get visitors. I saw it was the police (2 officers), and they asked if we could talk in private, because they heard my kids (2 and 4) and my wife upstairs, I said yes, no problem, let them in. They would not let me know what it was about at first, they asked a lot about what I did yesterday, easy for me to answer since I was out climbing mountains all day long. Then asked a lot about who has access to my connection at home, It's just me, my wife, no one else. Then I start to ask a bit, and I thought about the exit node I run, I quickly confirmed that it was the exit node (which is in sweden and not in Norway where I live) that was the reason why they where at my house. All though - 2 second check would confirm to them that the server is not at my house, and the impression they gave me until I showed the Exit node was that they thought it was sent from my house. I have blocked the email ports on the exit node, but the issue was that a email had been sent through hotmail (web), threatening Angela Merkel, that's why they where at my house this morning. I got the chance to explain everything as best I could, explained how it all worked, and why I run a exit node, and I feel they got all the answers they needed. They then left - and for now that was that. I would be put on some kind of list, but that list would also explain that I operate a tor exit node. I'm happy with that, and hopefully this will be all that there's to it. I might have to do some more explaining if I travel to sweden\germany, but that's fine with me. Anyone else here that has this happen to you recently as well?..

11 13

Two bridge relay questions
by Tor-Node.net 05 Aug '16

05 Aug '16

Hi! I run an obfs4 bridge. 1) Why is the advertised bandwidth 56.72 KB/s when the relay is on a (shared) gigabit connection? According to my experiments it should be several MB/s. 2) Where can I submit my bridges to help people in Iran, China etc, besides the Tor BridgeDB? Kind regards Tor-node.net

3 2

Exit relay funding
by Michael McConville 04 Aug '16

04 Aug '16

Hi, everyone. I'm an experienced Tor relay operator and a mostly dormant community member. My main relay these days is on a dedicated server running OpenBSD and moving 3-4 MB/s. It costs me $35/month. https://atlas.torproject.org/#details/CDAB3AE06A8C9C6BF817B3B0F1877A4B91465… Sadly, I have to shut it down at least temporarily if no one can help me pay for it. Is anyone interested? You can search the mailing lists to see that I've been contributing for a few years, and I can give more verification if you'd like. Thanks for your time, Michael McConville

23 40

Don't use Google's DNS server
by Philipp Winter 29 Jul '16

29 Jul '16

I created a new diagram that illustrates the popularity of DNS resolvers used by exit relays. The diagram shows nine autonomous systems that hosted the most popular resolvers at some point over the last months. These autonomous systems are owned by Google, INIT7, LeaseWeb, Visual Online, OVH, OpenDNS, NForce Entertainment, Cyberdyne, and Level3. The x axis shows time and the y axis shows the fraction of DNS requests that the respective AS can observe: <https://nymity.ch/dns-traffic-correlation/img/exit-resolvers-2015-05.png> The two most popular setups are Google's 8.8.8.8 and local resolvers, i.e., exit relays doing their own resolution. Occasionally, Google got to see more than 40% of all DNS requests exiting the Tor network. That is concerning, particularly given Google's role in the PRISM program. No other autonomous system is getting even close. Please refrain from using 8.8.8.8. Instead, set up your own resolver, or at least use the one provided by your ISP. Here's Peter's quick guide on how to set up your own resolvers [1]: On Thu, Jan 08, 2015 at 04:11:09PM +0100, Peter Palfrader wrote: > o apt-get install unbound > o remove all nameserver entries in /etc/resolv.conf and add one for the > local recursor. Either manually or use (untested): > sed -i -e 's/^nameserver /#&/; $a nameserver 127.0.0.1' /etc/resolv.conf > o prevent anything else from modifying that file ever again: > chattr +i /etc/resolv.conf Note that running your own resolver is not universally safer because the exposure of DNS requests to network adversaries is greater. It's a tricky trade-off that we are currently trying to understand better [2], but increased exposure to network-level adversaries seems less bad than having Google see almost half of all DNS requests. If you are wondering how I created the above diagram, have a look at the measurement method [3]. [1] <https://lists.torproject.org/pipermail/tor-relays/2015-January/006147.html> [2] <https://nymity.ch/dns-traffic-correlation/> [3] <https://lists.torproject.org/pipermail/metrics-team/2016-February/000078.ht…> Cheers, Philipp

10 15

Re: [tor-relays] cheap unmetered non-exit VPS offers
by Tor-Node.net 28 Jul '16

28 Jul '16

Markus Koch <niftybunny(a)googlemail.com> wrote: > exit allowed? I can vouch for www.stayon.no VPS with dedicated, unmetered 1 Gbps connection. 1 GB RAM / 1 CPU @ 2.6 GHz Price: 149 NOK/month (~ 16 EUR / 17 USD). Tor exit friendly. Their abuse departement will ask you to block destination IPs if it's something serious. Kind regards Tor-node.net

2 1