December 2017 - tor-relays - lists.torproject.org

ansible-relayor, how to ?
by Petrusko 01 Apr '18

01 Apr '18

Hey! I'm planning to try the "ansible-relayor" to deploy some Tor relay instances. If I'm not wrong, it's a main goal ? 2 instances / IP... (soooory for being really noob about this!!!) But I'm lost... not found a tutorial, step by step, you know the tutorial so loved by all noobs! For now, on a fresh Debian8 install, there are : - tor 0.2.9.8 (fresh install from depo, client is ok when opening log file) - ansible - ansible-galaxy install nusenu.relayor - git clone https://github.com/nusenu/ansible-relayor (the folder is stored in my /home...) Will it configure (automatically) many torrc file per instance ? +every key files /relay ? (I'm not too much lost!) Do have I to do this install on every server built ? Or relayor can manage few servers on different locations ? Command lines list use this tool if available ? Many thx for help !!! (and hard work for this tool :) -- Petrusko C0BF 2184 4A77 4A18 90E9 F72C B3CA E665 EBE2 3AE5

6 9

Become a Fallback Directory Mirror
by teor 22 Jan '18

22 Jan '18

Dear Relay Operators, Do you want your relay to be a Tor fallback directory mirror? Will it have the same address and port for the next 2 years? Just reply to this email with your relay's fingerprint. If your relay is on the current list, you don't need to do anything. If you're asking: Q: What's a fallback directory mirror? Fallback directory mirrors help Tor clients connect to the network. For more details, see [1]. Q: Is my relay on the current list? Search [2] and [3] for your relay fingerprint or IP address and port. [2] is the current list of fallbacks in Tor. [3] is used to create the next list of fallbacks. Q: What do I need to do if my relay is on the list? Keep the same IP address, keys, and ports. Email tor-relays if the relay's details change. Q: Can my relay be on the list next time? We need fast relays that will be on the same IP address and port for 2 years. Reply to this email to get on the list, or to update the details of your relay. Once or twice a year, we run a script to choose about 150-200 relays from the potential list [3] for the list in Tor [2]. Q: Why didn't my relay get on the list last time? We check a relay's uptime, flags, and speed [4]. Sometimes, a relay might be down when we check. That's ok, we will check it again next time. It's good to have some new relays on the list every release. That helps tor clients, because blocking a changing list is harder. Q: What about the current relay DDoS? We don't think the DDoS will have much impact on the fallback list. If your relay is affected, please: * make sure it has enough available file descriptors, and * set MaxMemInQueues to the amount of RAM you have available per tor instance (or maybe a few hundred MB less). We're also working on some code changes. See [5] for more details. [1]: https://trac.torproject.org/projects/tor/wiki/doc/FallbackDirectoryMirrors [2]: https://gitweb.torproject.org/tor.git/tree/src/or/fallback_dirs.inc [3]: https://gitweb.torproject.org/tor.git/tree/scripts/maint/fallback.whitelist [4]: https://trac.torproject.org/projects/tor/attachment/ticket/21564/fallbacks_… [5]: https://lists.torproject.org/pipermail/tor-relays/2017-December/013881.html -- Tim / teor PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ricochet:ekmygaiu4rzgsk6n ------------------------------------------------------------------------

15 26

could Tor devs provide an update on DOS attacks?
by starlight.2017q4＠binnacle.cx 16 Jan '18

16 Jan '18

I realize we're in the middle of the Christmas / New Year dead week, but it would be great one of the developers could says something (anything) about the ongoing denial-of-service attacks. My node crashed a second time a fews days back, and while the second iteration of hardening appears have held, I see many others crack under the stress. If one opens a control channel and issues setevents extended orconn volumes of 650 ORCONN ... LAUNCHED ID=nnnn 650 ORCONN ... FAILED REASON=CONNECTREFUSED NCIRCS=x ID=nnnn messages appear. First I though these were operators with some new mitigation, but finally realized the relays are crashed and have not yet dropped off the consensus.

3 6

Tor Advocacy, Political & Artistic
by Kenneth Freeman 29 Dec '17

29 Dec '17

I've recently touted establishing a Tor exit node at the inaugural Boise organizing committee of the Democratic Socialists of America. The idea was considered esoteric, but such anonymity craft is useful for activists of all stripes. Too, performing artists (neo-burlesque, LGBTQ comics, etc.), punks and anarchists have also expressed interest in Tor. I have been told that Tor is conceptually difficult to wrap your head around, but these are useful mission fields.

4 4

Debian Stretch (Raspbian): Tor daemon fails to complete launching procedure, endless cycling.
by Ralph Wetzel 28 Dec '17

28 Dec '17

2 2

Q about: The IPv4 ORPort address <IP> does not match the descriptor address
by Stijn Jonker 28 Dec '17

28 Dec '17

Hi All, As a follow-up to the thread, "Can it be done? - IPv6 only Relay" I linked the new OpenBSD Relay via an IPv4 over IPv6 tunnel to the other relay I operate. So there is: SJC01 / 328E54981C6DDD7D89B89E418724A4A7881E3192 and now SJC02 / 366BC592BC0154C0CD1D35C0E77D8F2C7F0B843E Both share the same public IP, as it's on atlas :-) I can see no issues sharing: SJC01 ORPort is on 80.127.117.180:443 / [2001:985:e77:10::4]:443 (DirPort 80) SJC02 ORPort is on 80.127.117.180:993 / [2001:985:e77:10::6]:993 (DirPort 8080) What I can't seem to get rid of is the warning: The IPv4 ORPort address 80.127.177.180 does not match the descriptor address 80.127.117.180. If you have a static public IPv4 address, use 'Address <IPv4>' and 'OutboundBindAddress <IPv4>'. If you are behind a NAT, use two ORPort lines: 'ORPort <PublicPort> NoListen' and 'ORPort <InternalPort> NoAdvertise'. I think I tried every combo of ORPort NoListen/NoAdvertise and Address/OutboundBindAddress, but I don't seem to be able to get rid of this. What I have now is: ORPort [2001:985:e77:10::6]:993 ORPort <<INTERNAL IP>>:993 NoAdvertise ORPort 80.127.177.180:993 NoListen Address 80.127.117.180 OutboundBindAddress <<INTERNAL IP>> OutboundBindAddress [2001:985:e77:10::6] Port 993 and 8080 are one-on-one pushed through to the new node with DNAT/Port forward from the 80.127.117.180. This on: [userhost ~]$ tor --version Tor version 0.3.1.9 (git-727d3f1b5e6eeda7). [userhost ~]$ uname -a OpenBSD host 6.2 GENERIC#306 amd64 The daemon reports "Self-testing indicates your ORPort is reachable from the outside. Excellent." / "Self-testing indicates your DirPort is reachable from the outside. Excellent. Publishing server descriptor." so that seems to be A-OK. Any suggestions (or should I "just" ignore this as mentioned on tor-dev @ Tue Jan 24 04:20:27 UTC 2017 in subject: "[tor-dev] log: ORPort/DirPort address does not match descriptor address")? Thx, Stijn

2 2

Re: [tor-relays] Please Confirm Changed Fallback Details
by teor 28 Dec '17

28 Dec '17

Thank you to everyone who has replied to the fallback threads. We're tracking the fallback changes here: https://trac.torproject.org/projects/tor/ticket/22321 Once we've reviewed some list format changes, we'll generate the new list. This will probably happen in the next two weeks. Please email us about new fallbacks at any time. T > On 28 Dec 2017, at 10:34, Casper <fantom(a)fedoraproject.org> wrote: > > Hi teor, > > Yes I had to change the ORport and DirPort for POP3 standard ports, > specially because Let's Encrypt works only with HTTPS ports. And this > time it won't change again, who is using POP3 these days... ^^ > > Merry christmas teor :) > > teor a écrit : >> Hi, >> >> Are you the operator of the following relays? >> >> mkultra - 16102E458460349EE45C0901DAA6C30094A9BBEA >> ParkBenchInd001 - F10BDE279AE71515DDCCCC61DC19AC8765F8A3CC >> Underworld - DC163DDEF4B6F0C6BC226F9F6656A5A30C5C5686 >> Casper03 - 7350AB9ED7568F22745198359373C04AC783C37C >> sputnik - AD19490C7DBB26D3A68EFC824F67E69B0A96E601 >> zwiubel - B0553175AADB0501E5A61FC61CEA3970BE130FF2 >> >> Your relay is on the fallback directory whitelist, and it looks like >> its details have changed. (Or, maybe I wrote them down wrong.) >> >> I tried to contact you a few days ago using the ContactInfo on your >> relay, but I haven't received a response. >> >> Will your relay be around for the next two years? >> Will its IP, ports, and fingerprint stay the same? >> >> Please reply to this email and let us know! >> (If you don't reply, we will assume the change is permanent.) >> >> Thanks >> >> Tim >> >> >> Here is the full list: >> >> Changed fingerprint: >> >> Has OR 163.172.138.22:443 / [2001:bc8:4400:2100::1:3]:443 changed fingerprint from 8664DC892540F3C789DB37008236C096C871734D to 16102E458460349EE45C0901DAA6C30094A9BBEA? >> 163.172.138.22:80 orport=443 id=16102E458460349EE45C0901DAA6C30094A9BBEA ipv6=[2001:bc8:4400:2100::1:3]:443 # mkultra >> >> Changed IPv4: >> >> Has F10BDE279AE71515DDCCCC61DC19AC8765F8A3CC changed IPv4 from 192.99.212.139 to 193.70.112.165? >> 193.70.112.165:80 orport=443 id=F10BDE279AE71515DDCCCC61DC19AC8765F8A3CC # ParkBenchInd001 >> >> Has DC163DDEF4B6F0C6BC226F9F6656A5A30C5C5686 changed IPv4 from 176.158.132.12 to 176.158.236.102? >> 176.158.236.102:9030 orport=9001 id=DC163DDEF4B6F0C6BC226F9F6656A5A30C5C5686 # Underworld >> >> Changed DirPort: >> >> Has 7350AB9ED7568F22745198359373C04AC783C37C changed DirPort from 176.31.191.26:80 to 176.31.191.26:110? >> 176.31.191.26:110 orport=995 id=7350AB9ED7568F22745198359373C04AC783C37C # Casper03 >> >> Gained IPv6 address: >> >> Has AD19490C7DBB26D3A68EFC824F67E69B0A96E601 gained an IPv6 address [2a01:4f8:221:1ac1:dead:beef:7005:9001]:9001? >> 188.40.128.246:9030 orport=9001 id=AD19490C7DBB26D3A68EFC824F67E69B0A96E601 ipv6=[2a01:4f8:221:1ac1:dead:beef:7005:9001]:9001 # sputnik >> >> Has B0553175AADB0501E5A61FC61CEA3970BE130FF2 gained an IPv6 address [2a01:4f8:190:30e1::2]:9001? >> 5.9.147.226:9030 orport=9001 id=B0553175AADB0501E5A61FC61CEA3970BE130FF2 ipv6=[2a01:4f8:190:30e1::2]:9001 # zwiubel >> >> T >> >> -- >> Tim Wilson-Brown (teor) >> >> teor2345 at gmail dot com >> PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B >> ricochet:ekmygaiu4rzgsk6n >> xmpp: teor at torproject dot org >> ------------------------------------------------------------------------ >> > > > > -- > GPG Key ID: 83288189 @ hkp://keys.fedoraproject.org > Empreinte: CC26 692F 5205 AC8F 7912 7783 D7A7 F4C5 8328 8189 > > x509 C.A.: https://dl.casperlefantom.net/pub/root.pem > Empreinte: 0975 864A 2036 0F94 A139 114A D32E 8EBE 30F2 2429 T -- Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ricochet:ekmygaiu4rzgsk6n xmpp: teor at torproject dot org ------------------------------------------------------------------------

1 0

Recent wave of abuse on Tor guards
by fcornu＠wardsback.org 27 Dec '17

27 Dec '17

Hi I'm the happy maintainer of wardsback : B143D439B72D239A419F8DCE07B8A8EB1B486FA7 As many of us have noticed, many guard nodes are beeing abused by extremely high numbers of connection attempts. Thanks to some of you guys, I manged to put some mitigation in place [0] and I assume many of us did as well. I now sit back with questions and concerns arising : 1) Why didn't we see this abuse wave coming ? We kept replying to reporters of the dreaded "Failing because we have XXX connections already. Please read doc/TUNING for guidance" about how they could amend their config to accept more connections. Although the 'global scale' of those events should have been detected, without most of use assuming it was due to nodes' bad config. 2) We can see on Metrics [1] that guards count is dropping rapidly for a couple weeks now. Presumably because many guard maintainers gave up on restarting their crushed node. (I never will. Even though my Metrics graph shows I've also been in trouble) 3) What could we do to better detect those 'attacks' and spread the word to fellow maintainers about how to mitigate / correct the situation ? I must admit I don't have a valuable clue about how things can technically be improved, but I humbly wanted to share a few thought here. Peace [0] : https://lists.torproject.org/pipermail/tor-relays/2017-December/013846.html [1] : https://metrics.torproject.org/relayflags.html?start=2017-09-21&end=2017-12… -- Frédéric CORNU

12 19

Please Confirm Changed Fallback Details
by teor 27 Dec '17

27 Dec '17

Hi, Are you the operator of the following relays? mkultra - 16102E458460349EE45C0901DAA6C30094A9BBEA ParkBenchInd001 - F10BDE279AE71515DDCCCC61DC19AC8765F8A3CC Underworld - DC163DDEF4B6F0C6BC226F9F6656A5A30C5C5686 Casper03 - 7350AB9ED7568F22745198359373C04AC783C37C sputnik - AD19490C7DBB26D3A68EFC824F67E69B0A96E601 zwiubel - B0553175AADB0501E5A61FC61CEA3970BE130FF2 Your relay is on the fallback directory whitelist, and it looks like its details have changed. (Or, maybe I wrote them down wrong.) I tried to contact you a few days ago using the ContactInfo on your relay, but I haven't received a response. Will your relay be around for the next two years? Will its IP, ports, and fingerprint stay the same? Please reply to this email and let us know! (If you don't reply, we will assume the change is permanent.) Thanks Tim Here is the full list: Changed fingerprint: Has OR 163.172.138.22:443 / [2001:bc8:4400:2100::1:3]:443 changed fingerprint from 8664DC892540F3C789DB37008236C096C871734D to 16102E458460349EE45C0901DAA6C30094A9BBEA? 163.172.138.22:80 orport=443 id=16102E458460349EE45C0901DAA6C30094A9BBEA ipv6=[2001:bc8:4400:2100::1:3]:443 # mkultra Changed IPv4: Has F10BDE279AE71515DDCCCC61DC19AC8765F8A3CC changed IPv4 from 192.99.212.139 to 193.70.112.165? 193.70.112.165:80 orport=443 id=F10BDE279AE71515DDCCCC61DC19AC8765F8A3CC # ParkBenchInd001 Has DC163DDEF4B6F0C6BC226F9F6656A5A30C5C5686 changed IPv4 from 176.158.132.12 to 176.158.236.102? 176.158.236.102:9030 orport=9001 id=DC163DDEF4B6F0C6BC226F9F6656A5A30C5C5686 # Underworld Changed DirPort: Has 7350AB9ED7568F22745198359373C04AC783C37C changed DirPort from 176.31.191.26:80 to 176.31.191.26:110? 176.31.191.26:110 orport=995 id=7350AB9ED7568F22745198359373C04AC783C37C # Casper03 Gained IPv6 address: Has AD19490C7DBB26D3A68EFC824F67E69B0A96E601 gained an IPv6 address [2a01:4f8:221:1ac1:dead:beef:7005:9001]:9001? 188.40.128.246:9030 orport=9001 id=AD19490C7DBB26D3A68EFC824F67E69B0A96E601 ipv6=[2a01:4f8:221:1ac1:dead:beef:7005:9001]:9001 # sputnik Has B0553175AADB0501E5A61FC61CEA3970BE130FF2 gained an IPv6 address [2a01:4f8:190:30e1::2]:9001? 5.9.147.226:9030 orport=9001 id=B0553175AADB0501E5A61FC61CEA3970BE130FF2 ipv6=[2a01:4f8:190:30e1::2]:9001 # zwiubel T -- Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ricochet:ekmygaiu4rzgsk6n xmpp: teor at torproject dot org ------------------------------------------------------------------------

1 0

Relays operators meetup
by Nicolas Braud-Santoni 26 Dec '17

26 Dec '17

Hi ! (Sorry for the late announcement, I somehow forgot to fire off the email...) The Tor relays operators meetup, at 34C4, will be TOMORROW (day 1), from 18.30 to 20.10, in lecture room 11 (in CCL, 2nd floor) : https://events.ccc.de/congress/2017/wiki/index.php/Session:Tor_relays_opera… Best, nicoo

1 1