May 2018 - tor-relays - lists.torproject.org

Re: [tor-relays] can dirport be disabled on fallback directory?
by starlight.2017q4＠binnacle.cx 20 May '18

20 May '18

On May 20, 2018 17:37:07 UTC, Damian Johnson atagar at torproject.org wrote: > >> There don't seem to be any examples of ORPort endpoints in the Stem >> repository. I think Dave plans to add some more documentation as part of Tor >> Summer of Privacy. > >Oh interesting. You're right. I recently added Stem's ORPort >capabilities but seems I forgot to add usage examples in the docs. >Thanks for pointing that out, I'll add it to my todo list. In the >meantime I provided an example here... > >https://blog.atagar.com/april2018/ Thank you! Does a command-line utility to make such requests exist or can one be created? The availability of a command tool for ORPort document downloads would bring DirPort one step closer to complete obsolesce.

1 0

Re: [tor-relays] can dirport be disabled on fallback directory?
by starlight.2017q4＠binnacle.cx 20 May '18

20 May '18

On May 20, 2018 10:08:17 UTC, gustavo <gfa(a)zumbi.xyz> wrote: > >On May 18, 2018 4:25:23 PM UTC, starlight.2017q4 at binnacle.cx wrote: >>Lately seeing escalating abuse traffic on the relay dirport, now up to >>20k rotating source IP addresses per week. > >How do you detect it? FIRST: your relays are not impacted by this issue because DirPort is disabled in their configuration. So you can stop reading here if you like. >Will tor log it in the logs where I can look for >it or do you monitor the TCP/IP stack ? > >I run two relays (milanese one of them) besides basic >OS level monitoring I don't monitor much else. > >I wonder if I should monitor more or what to search for >in logs (I run my relays without logs since I don't >have an use for) Simply perusing the /var/log/messages log lines for the relay on occasion should be sufficient for most operators. The daemon will complain about many if not all important problems. ---------- For those with DirPort configured, one can check for the problem by looking at the 'state' file with the command egrep '^BWHistory.*WriteValues' state and calculating the percent BWHistoryDirWriteValues is relative to BWHistoryWriteValues for the same samples. Should be under 5%, more like 1-3%. If 15% the attacker is harassing your relay. This particular abuse scenario can be mitigated by applying an 'iptables -m limit' rule set to incoming DirPort connection requests -or- by disabling DirPort in the config since clear-text DirPort is no longer required for the Tor network to function properly. Those running FallBack directories should probably send an update to this list if they apply this change as I belive the FallBackDir script excludes relays where ports differ from the whitelist or have changed in OnionOO historical data.

1 0

can dirport be disabled on fallback directory?
by starlight.2017q4＠binnacle.cx 20 May '18

20 May '18

Lately seeing escalating abuse traffic on the relay dirport, now up to 20k rotating source IP addresses per week. The simple solution is to disable dirport, but the relay is a fallback directory and I don't want to make a change that will negatively affect the relay's ability to function as such. Would disabling dirport be a problem? also: can a non-advertised dirport be left configured for local-system use while the public advertised dirport is disabled? does a command utility or method exist for querying dirport documents via tunnelled-dir-server? including miscellanous documents such as /tor/status-vote/current/consensus.z /tor/keys/all.z /tor/server/all.z /tor/extra/all.z /tor/server/fp/<fp1>+<fp2>+<fp3>.z /tor/extra/fp/<fp1>+<fp2>+<fp3>.z /tor/micro/d/<hash1>-<hash2>.z /tor/keys/fp/<v3ident1>+<v3ident2>.z thanks!

3 3

Help! I'm ripping my hair out trying to get Quintex on IPv6 exit
by John Ricketts 19 May '18

19 May '18

All, I've been trying to bring a relay up for testing IPv6. Relay name is QuintexAirVPN1. Metrics website says that the OR Port is unreachable on [2620:7:6000::ffff:c759:df51]:80 - which isn't where I set the ORPort - should be 443... https://metrics.torproject.org/rs.html#details/F7447E99EB5CBD4D5EB913EE0E35… Config is as follows: ORPort 443 ORPort [2620:7:6000::ffff:c759:df51]:443 Nickname QuintexAirVPN1 ContactInfo John L. Ricketts, PhD <john AT quintex dot com> DirPort 80 # what port to advertise for directory connections DirPortFrontPage /etc/tor/tor-exit-notice.html DisableDebuggerAttachment 0 Sandbox 1 ExitRelay 1 IPv6Exit 1 ExitPolicy accept *:* ExitPolicy accept6 *:* NumCPUs 2 Help!! LOL John L. Ricketts, PhD Quintex Alliance Consulting (325) 262-3488 john(a)quintex.com

2 2

Relay advocate introduction
by Colin Childs 18 May '18

18 May '18

Hello tor-relays! My name is Colin Childs, I have been the support and translation coordinator at the Tor Project for a number of years. I am also a founding director of a TorServers partner named Coldhak here in Canada. Recently, my role within the Tor Project has changed, and I am starting as the new relay advocate (as well as localization coordinator, until this responsibility can be reassigned). My job will be improving the health / happiness of the relay operator community, expanding the relay operator community, and helping improve the community bonds between operators. A few of the things I will be working on are: 1. Open a #tor-relays IRC channel (this is now open, everyone should join!) 2. Reach out to realy operator groups / individuals to introduce myself and solicit feedback (beginning today) 3. Plan a relay operators meet-up at PETS in July (details to come in another email) 4. Form a team of trusted technical and legal volunteers able to help operators around the world. 5. Organizing a larger "relay operator summit" event 6. Working with operators to resolve some of the recent issues brought up on this list (DNS provider, DNSSEC, EOL releases, etc..) While reaching out to operators is point 2 in that list, if you have suggestions or feedback that you'd like to send, please do not hesitate to reach out to me! I would love to hear from all of you with the things you would find most helpful from me / the Tor Project. While I cannot guarantee we can facilitate every request, we will do our best to help! I look forward to working with all of you in the future, and I hope you're having a great week!

9 11

Bridge to Relay Balance Notice
by Keifer Bly 18 May '18

18 May '18

Hello List, There are some things I have noticed, I have been getting emails from this list regarding people setting up groups of new relays. I have also noticed that according to https://metrics.torproject.org/networksize.html, there are around 6-7 thousand public relays running in the network, and only about 1,500 to 2,000 bridge relays running (I’m guessing a fair number of which aren’t even obfuscated). Seeing as there is only roughly ¼ the number or bridges available as there are public tor relays, I think that it would be a good idea for new people running groups of relays to run one of their new relays as a bridge, especially with censorship growing in some countries such as the United Kingdom and even I’ve heard some US isps starting to block websites. Please let me know what you all think, thank you.

2 1

Re: [tor-relays] Unusual load returning?
by starlight.2017q4＠binnacle.cx 18 May '18

18 May '18

At 19:25 5/15/2018 +0000, r1610091651 <r1610091651(a)telenet.be> wrote: >I've noticed unusual load on the relay. Notice the huge change in load >between 3-8 am (CET). ... >Wondering if others experienced it recently? One here. Perhaps isolated probes? May 18 11:23 Tor[]: Circuit ... : 10279/10279 TAP, 296594/296595 NTor. May 18 17:23 Tor[]: Heartbeat: uptime is 68 days ... May 18 17:23 Tor[]: Circuit ... : 654119/660742 TAP, 318906/318907 NTor.

1 0

Obfs4 Bridge Advertised Bandwidth
by nottryingtobelame＠protonmail.com 18 May '18

18 May '18

Hello, I am running a bridge and I have my RelayBandwidthRate set to 1024 KB (8 Mbps). However, the Relay Search page never shows the full Advertised Bandwidth. Right now it is showing 259 KiB/s. Sometimes it creeps higher but not by much. Just wondering what the reason for that big of a difference would be. Thanks!

2 1

FallbackDir maintenance
by Nurtic-Vibe 18 May '18

18 May '18

Due to a disk outtage, the FallbackDir 8C00FA7369A7A308F6A137600F0FA07990D9D451 is currently offline. I will keep you posted with updates. Cheers, Nurtic-Vibe

1 1

lets stop using central big DNS resolvers (Google, Level3, OpenDNS, Quad9, Cloudflare)
by nusenu 18 May '18

18 May '18

Dear Exit Relay Operators, I'd like to invite you to check your exit's DNS resolver by having a look at the following list of exits using resolvers outside their AS (especially if it is Google, OpenDNS, Quad9 or Cloudflare). You can search the list for you contactinfo, relay nickname or relay fingerprint (first 8 characters): https://gist.github.com/nusenu/cb766ff7945fafd9f90ee7f211a2508f#file-tor-dn… I extended the "DNS on Exit Relays" section in the Tor Relay Guide to include specific instructions what is recommended for Tor exit operators with regards to DNS on exit relays. https://trac.torproject.org/projects/tor/wiki/TorRelayGuide#DNSonExitRelays If you found yourself on the list above and changed your DNS to a local (same host or same AS) resolver or found a false-positive, please drop me an email (off-list is also ok). The goal is to be bellow the following thresholds within one year: - not have any single remoteAS entity control more than 10% exit capacity - reduce the overall remoteAS share to bellow 20% exit capacity the longer version of this can be found at: https://medium.com/@nusenu/who-controls-tors-dns-traffic-a74a7632e8ca thanks for helping with DNS decentralization on the tor network, nusenu -- https://mastodon.social/@nusenu twitter: @nusenu_

14 24