August 2017 - tor-relays - lists.torproject.org

ansible-relayor, how to ?
by Petrusko 01 Apr '18

01 Apr '18

Hey! I'm planning to try the "ansible-relayor" to deploy some Tor relay instances. If I'm not wrong, it's a main goal ? 2 instances / IP... (soooory for being really noob about this!!!) But I'm lost... not found a tutorial, step by step, you know the tutorial so loved by all noobs! For now, on a fresh Debian8 install, there are : - tor 0.2.9.8 (fresh install from depo, client is ok when opening log file) - ansible - ansible-galaxy install nusenu.relayor - git clone https://github.com/nusenu/ansible-relayor (the folder is stored in my /home...) Will it configure (automatically) many torrc file per instance ? +every key files /relay ? (I'm not too much lost!) Do have I to do this install on every server built ? Or relayor can manage few servers on different locations ? Command lines list use this tool if available ? Many thx for help !!! (and hard work for this tool :) -- Petrusko C0BF 2184 4A77 4A18 90E9 F72C B3CA E665 EBE2 3AE5

6 9

Monitoring multiple relays
by Xza 01 Nov '17

01 Nov '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello, I have a couple relays / exits running. Now my question is : how do you manage them is there any dashboard or CLI tools to manage them ( statistics, ect.. ) I know the cli tool specially for Tor "arm" Thanks alot. - -- PGP : 29A4CE52 -----BEGIN PGP SIGNATURE----- iQI4BAEBCgAiGxxEbyA8eWFuZGVyZXNvbkByaXNldXAubmV0PgUCV0SJlwAKCRBI of/XNyszSvv/D/9VtjI+bmiqK53v//StUbmpYjgQjYheYvwktFld+2XDURh52dmU sbk3lab2RS1eQJxjV0BVXMF9O2JUAlp4NA2UMpj8ZJlCk0h1S6p2o4/sAlsrHr8Z nb67HiaRIyEvi9cQiXFtDtK/onAkEuKskolyvh3ysJRRUubHSX1z8WuNJIc4xyGH ZpSLPGUOO6qI7mM8ztS0muEy1khmkHgtlyHi2l4K/NsW3I90cV3w6Db2AEnV6v1c tsfehqLExsHUdEo0U3hHU7yY1p2fzD5Z+C0tgVKTnP5Zus/Vr9OH/zFwxneo0E7a 5FHdnCZnNIG9W32uQgjDdmBEv/YFEd0um/vMWFGUehFANSt+DIps7E+AjwiJwm2i ov97JJurQkrSMX7ZchTEsy720Ju272olp2eDiHaXXTK2TkxcEq+d1gZfj7CXycPW 6mCrj6L6URJAZ34GJQfFFjv8QbFmKkAvGhxl/O8KXRbXxedbLH7PY73jmFjJcmxO +KnSeyqMe1KbzazYyFydP+VmgI2k1IlO89l8Jq1Gq9f2KOPY9UKFZjGDKLS0xGZW EnqU/KUINcrGejYFT8nYNxA+OFTd/ZGIX5qP4Vo5NsZ/pDLZjdxIcvHx1jjZbER+ 5Ku2bihm2KTNAGoYDqB3LGCm+QdEFG/p573xQCcXPk92GyhMJDi9EMPDgA== =mTa0 -----END PGP SIGNATURE-----

8 8

Re: [tor-relays] Tor exit nodes attacking SSH?
by me＠eugenemolotov.ru 08 Oct '17

08 Oct '17

On 08/08/2017 01:48 PM, Steven Chamberlain wrote: > Further investigation shows that this happens for any destination IP > address, even where there's no SSH service running: Make a "trap" ssh server (for example on virtualbox machine without any sensitive data) and log in into it through tsocks. After that check from which ip it was logged in. This probably would be ip of the exit node.

5 4

Relay uptime versus outdated Tor version
by K. Besig 02 Oct '17

02 Oct '17

One of my relays has over 416 days of uptime, which I'm very proud of, however it's running an outdated version of Tor. I should probably already know the answer, but it seems to me I would have to stop the tor service to update the relay. Would I in fact lose my uptime or would it be seamless? Thanks for the response

14 21

Force OpenSSL AES-NI usage on a VPS without the AES CPU flag passthrough
by Roman Mamedov 07 Sep '17

07 Sep '17

Hello, Today I found that it is possible to force OpenSSL enable the use of CPU AES acceleration even if it doesn't detect the "aes" CPU flag. Many VPS hosts configure their hypervisors in a way that does not have the flag passed through into VPSes, even though all their host nodes surely have CPUs with support for AES-NI. In my experience hosts have not been forthcoming in reconfiguring their systems to include that flag passthrough. But it turns out we can force OpenSSL to believe AES is supported, even if the CPU does not report it. This can be done with the "OPENSSL_ia32cap" environment variable. Searching around, all I found was scenarios to use it for disabling AES-NI (for testing), e.g.: https://mjanja.ch/2013/11/disabling-aes-ni-on-linux-openssl/ I believe the syntax used there applies "xor" over the real flag values, e.g. OPENSSL_ia32cap="~0x200000200000000" to disable AES. But what if you need to force-enable it. Turns out the syntax working for that is simply: OPENSSL_ia32cap="+0x200000200000000" Let's take one VPS box with the aforementioned problem. # cat /proc/cpuinfo processor : 0 vendor_id : GenuineIntel cpu family : 6 model : 13 model name : QEMU Virtual CPU version 1.5.3 stepping : 3 microcode : 0x1 cpu MHz : 1695.729 cache size : 4096 KB physical id : 0 siblings : 1 core id : 0 cpu cores : 1 apicid : 0 initial apicid : 0 fpu : yes fpu_exception : yes cpuid level : 4 wp : yes flags : fpu de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pse36 clflush mmx fxsr sse sse2 syscall nx lm rep_good nopl eagerfpu pni cx16 hypervisor lahf_lm bugs : bogomips : 3391.45 clflush size : 64 cache_alignment : 64 address sizes : 46 bits physical, 48 bits virtual power management: As you can see "aes" is not present. Testing OpenSSL speed in the default configuration. # openssl speed -elapsed -evp aes-128-gcm ... type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes 16384 bytes aes-128-gcm 32332.17k 40365.80k 42265.77k 42376.19k 43196.42k 43401.22k And now we force AES hardware acceleration usage: # OPENSSL_ia32cap="+0x200000200000000" openssl speed -elapsed -evp aes-128-gcm ... type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes 16384 bytes aes-128-gcm 59047.07k 104467.39k 141712.21k 151093.93k 158321.32k 156827.65k Almost 4 times faster! For Tor this leads to higher bandwidth utilization and lower CPU usage (which will actually make your VPS host happier :) But how to apply that to Tor? Well, for some initial testing I just chose to add the following line to /etc/init.d/tor (not using systemd here), right after "#! /bin/bash": export OPENSSL_ia32cap="+0x200000200000000" (but this will get overwritten and removed by the next Tor version upgrade). Seems to work just fine, my CPU usage is half of what it was before, at similar bandwidth levels. So now it has headroom to ramp up further. A word of caution, firstly always test as shown above to verify that it works. I believe if the underlying CPU actually doesn't support AES, all programs trying to use it, including "openssl speed", will crash outright, with an incorrect instruction error, or somesuch. So there is no risk to jeopardize encryption strength or security of Tor. Also even if it works now, it may stop working down the line if the host migrates your VPS to a node with older CPU, one which doesn't support AES. But migrations of customers between do not happen very often, and in fact all CPUs used today in a hosting environment should support AES, as that's been implemented in server (and even desktop) CPUs a very very long time ago. (Apologies for double-post, I realized tor-relays should have been the better place to post). -- With respect, Roman

5 4

Re: [tor-relays] Any IP allocations available out there?
by Paul Templeton 05 Sep '17

05 Sep '17

> If you're interested in becoming your own ISP (obtaining your own ASN, > IPv6 and IPv4 scopes), you'll need to apply via APNIC, as I did in the > US with ARIN. Here is an example: Would if I could - but here in AU you have to log all metadata for two years if you are an ISP. I either listen to what others have stated and host overseas or host overseas... I might be able to get a 20/20Mbs fibre for AU$250 - Just waiting to find out if they have data caps or not. Thanx all for your input. Paul PS - whats more important - More bandwidth for exit nodes or a faster presence in AU???

6 11

Re: [tor-relays] DIR Port. and NATO
by Dr Gerard Bulger 30 Aug '17

30 Aug '17

Roger, thank for the answer. Reason of no DIR port will be Accounting Max Enabled, although every unlikely I would reach the max I set, I use those settings to give me instant total usage within ARM While searching for some suitable wording if I ever get abuse complaints again, and searching the legal risks within Europe of Exits, I was rather surprised found NATO published a detailed appraisal of Tor. I thought it rather good, not very technical, and fair although it may be getting out of date. https://ccdcoe.org/sites/default/files/multimedia/pdf/TOR_Anonymity_Network… Gerry -----Original Message----- From: tor-relays [mailto:tor-relays-bounces@lists.torproject.org] On Behalf Of Roger Dingledine Sent: 30 August 2017 16:36 To: tor-relays(a)lists.torproject.org Subject: Re: [tor-relays] DIR Port On Wed, Aug 30, 2017 at 01:39:34PM +0100, Dr Gerard Bulger wrote: > DIR port on my relay and mini exit as being there on Atlas. > > The DIR port is open, indeed the DirPortFrontPage can be seen. > > Bandwidth is ???fast??? > > The exit is very limited in scope to avoid abuse claims, so few ports forwarded such as 443, but not 80. Is that the reason not showing? Check out your logs as the relay starts. Look for a log message like log_notice(LD_DIR, "Not advertising Dir%s (Reason: %s)", dir_port ? "Port" : "ectory Service support", reason); Common reasons include "AccountingMax enabled" and "BandwidthRate under 50KB". In general, it's fine for Tor to decide not to advertise your DirPort. Everything else is still working fine. Thanks for running a relay! --Roger _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

DIR Port
by Dr Gerard Bulger 30 Aug '17

30 Aug '17

DIR port on my relay and mini exit as being there on Atlas. The DIR port is open, indeed the DirPortFrontPage can be seen. Bandwidth is “fast” The exit is very limited in scope to avoid abuse claims, so few ports forwarded such as 443, but not 80. Is that the reason not showing? Gerry

2 1

Tor relay making normal internet unusable
by W Howard 30 Aug '17

30 Aug '17

Dear Group, I have some spare bandwidth and want to run an exit relay buy when I do the normal internet is so slow and I have to fill out so many captcha that it makes it unusable! Any ideas why? I think google etc block by default tor exit nodes. I was thinking about spinning up a vm and running tor on that. When I run as a bridge I don't see much traffic. Any ideas? Cheers!

4 5

IP Forwarding ON - on the host with tor relay - any risk ?
by Muppet96 28 Aug '17

28 Aug '17

Hi, on the one of my servers where tor relay is running I would like to configure openvpn server. In that case IP Forwarding needs to be enabled (ubuntu). Is there any security risk if this feature will be enabled on the tor-relay host ? Thanks Muppet96 Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1