August 2018 - tor-relays - lists.torproject.org

ExtOrPort settings for obsf4, obfs3 and firewall
by Cristian Consonni 02 Aug '18

02 Aug '18

Hi, Form the instructions to install obsf4: https://trac.torproject.org/projects/tor/wiki/doc/PluggableTransports/obfs4… --- ``` ExtORPort auto ``` [...] ``` [notice] Registered server transport 'obfs4' at '[::]:46396' ``` Remember the random port associated to your bridge needs to be open for incoming connections. You can find it from the logs: it's 46396 in this example. --- I can assume that using `ExtORPort auto` would mean that potentially any time Tor is restarted or reload a new port will be picked. Furthermore, in this thread[1] it is said: --- [...] ExtORPort tells tor to open a local-only (bound to localhost) socket for getting information from / communicating with obfsproxy --- So, if I want to be sure to know in advance which firewall port I should let open it is better that I choose a fixed port. Also, that port needs only to accept connections from localhost, i.e. the loopback interface? The only port that needs to be reachable from anywhere is the ORPort? Also, in this answer on Tor Stack Exchange[2] it is said that is possible to run both obfs3 and obfs4 from the same bridge. Is this useful/recommended? Also, in the answer: --- I had to make port forwards for the given obfs ports in iptables (easy with gufw) as well as in my hardware (internet-)firewall to make things work. So I am not so sure that the ExORPort is for local connections only as mentioned by Rodger (please let me know if I am wrong here). --- Thanks in advance (I am sorry for the flood of stupid question, but I prefer to ask a stupid question that having things not work and not understanding why...) C [1]: https://lists.torproject.org/pipermail/tor-relays/2014-February/003909.html [2]: https://tor.stackexchange.com/a/6735

3 7

Re: [tor-relays] AS awareness
by Isaac Grover, Aileron I.T. 02 Aug '18

02 Aug '18

Hi Conrad, Back in 2017 I used atlas to find lowly represented ASs and countries with regards to exits, sought out hosting providers in those areas, contacted each of them to determine if Tor exits were allowed per their TOS, and based on those responses, set up four exits with a restrictive policy all in different countries with different providers, and they were all shut down within two months. When asked why, each of them basically responded the same: 'we didn't know what a Tor exit was when you first asked'. So the challenge isn't necessarily that exits are or aren't allowed, but rather the providers haven't been properly educated or use a boilerplate TOS without proper vetting. Make your day great, Isaac Grover, Senior I.T. Consultant Aileron I.T. - "Practical & Proactive I.T. Solutions" Office: 715-377-0440, Fax:715-690-1029, Web: www.aileronit.com

1 0

new fingerprint
by TorGate 01 Aug '18

01 Aug '18

Hi, what is the best solution to change the tor fingerprint ? TorGate torgate(at)linux-hus.dk

2 2

DirCache on low-memory hosts
by Michael Brodhead 01 Aug '18

01 Aug '18

Those of you running relays on low-RAM hosts, what do you do about DirCache? When I first brought up my relay I noticed this message in the logs: [warn] Being a directory cache (default) with less than DIRCACHE_MIN_MEM_MB MB of memory is not recommended and may consume most of the available resources, consider disabling this functionality by setting the DirCache option to 0. When I DirCache to 0 I see another warning: [warn] DirCache is disabled and we are configured as a relay. This may disqualify us from becoming a guard in the future. As it turns out I can increase my VMs memory for free so that’s no big deal. Still, I’m curious. What do people do with relays without much memory? Skip DirCache? Are there ways to reduce the memory footprint and still cache directory info? Thanks, —mkb

2 1