May 2019 - tor-relays - lists.torproject.org

Questions to ask exit node providers
by F67 Group 08 Oct '19

08 Oct '19

We are thinking of running a Tor Exit Node. Does anybody have a list of questions to ask before purchasing a VPS or colocation? I came up with some basic questions: - Do you allow a Tor exit node? [with explanation] - What are the policies for handling abuse complaints? - How much uplink bandwidth do you provide? Any other questions one should ask? Thanks.

17 49

Emerald Onion's new relays
by Christopher Sheats 20 Aug '19

20 Aug '19

Hello, Beginning this Wednesday, 2019-Apr-03, Emerald Onion will be starting 40 new uncapped and unfiltered exit relays using HardenedBSD in Seattle. We will turn on 10 new relays per day and be monitoring performance. In tandem, we will be publishing our updated edge routing and Tor relay configurations on our Github. We'll also publish an updated transparency report (spoiler: zero new requests). This work is part of our efforts to saturate our new unmetered 10Gbps transit link in the Westin data center. There we peer with the Seattle Internet Exchange with a separate 10Gbps connection. We'll be using our existing IP scopes: 2620:18C::/36 23.129.64.0/24 We are in the process of creating an RPKI ROA for our prefixes, and we are still rebuilding our DNS resolver (thanks nusenu for the feedback). These things will be completed before we turn on the new relays. If you donated to Emerald Onion (a 501(c)(3)) nonprofit), thank you! We'll be naming the relays accordingly. We will still accept new donations for relay naming rights-- email me directly for more information. Lastly, and If you're unaware, I spoke about our work at DEFCON 26: https://www.youtube.com/watch?v=cs6a1i4Owic Cheers, -- Christopher Sheats Executive Director for Emerald Onion Email: yawnbox(a)emeraldonion.org Office (& Signal): +1-206-739-3390 Website: https://emeraldonion.org/

12 20

10 Years Torservers.net: Death or Future?
by Moritz Bartl 08 Aug '19

08 Aug '19

tl;dr: torservers.net needs a new home! I started torservers.net after a random chat at a local bar some time early 2010. I wore a Tor shirt, and the guy next to me asked if that was "The Onion", the satire magazine. He became pretty excited about Tor after I told him what it was about, opened his wallet and gave me a 100€ bill "to put towards the network". Eventually it turned out that he was an Oracle software developer, so it's kind of funny to think about this as "one of the few good things Oracle has ever done". I thought about it for a bit, and then decided to take the money, which cemented the idea that I have had for quite some time: to get a more beefy machine to "properly" run a Tor exit, sharing the costs with others. Only a few days after I announced this idea on or-talk [1] in May 2010, some crazy Swede wired me another 1000€ (Thanks!). So, bad luck, I really had to do this now! I am still surprised at how successful the fundraising was. In fact, when we finally created a legal envelope of protection around me by starting the Zwiebelfreunde association in 2011, it was already clear that we needed to find others to do the same, instead of growing larger ourselves. The network was a lot different then, and some people tell me we had 80% of the overall exit capacity for quite some time after Olaf shut down his fast Blutmagie exit. So I went on a tour to inspire others. So, here we are, almost 10 years later, with 23 partner organizations in 15 countries. [2] After I got a "real job" in 2013 (that quickly grew into "more than full-time"), and at the same time the first grant money for torservers.net, we tried in many different ways to "recruit" others to "take over". Looking back, of course a lot of things happened and it was a crazy (and fun!) time, but long story short, until now nobody stepped up to take over the core role of a "coordinator" of activities. There are many many offers for help, and even more ideas of what torservers.net could do and be, but all people involved heavily at the beginning (Thanks!) don't have time to coordinate all the wonderful help, and do a proper handover. We tried a couple of times, only to spend a lot of time "training" a poor person to get them somewhat up to speed, but eventually everyone decided they had better things to do than to become frustrated at trying to walk blindly without much guidance. This is not an easy role to step into. If we take the May 2010 announcement as "launch date", the 10 years anniversary will be on May 10th, 2020. My dream would be to celebrate this with a fresh board at Zwiebelfreunde that has taken over the association, and another group that coordinates the international platform that torservers.net was meant to be(come). Of course we will not simply give away the domains and the legal entity and all our exit relays to just anyone. But, hm, yeah, truth is, probably almost anyone! ;-) For some years now, we've talked about the idea of a "relaunch". The most promising idea is to organize a proper Tor Relay Operators Retreat, maybe 50 people or so, with all the great people who have dedicated their lives to this project at some point, and all the great new folks who are as excited as all of us were back then about contributing to the Tor network. It would likely to be possible to convince Open Technology Fund or some other money source to sponsor travel and venue. I've always imagined this to happen in a nice "holiday" setting. At some point, I *will* go with a group of people to this fine venue [3], as an example of how this could look like. So far, I've tried to talk to individuals about it in smaller groups, and never announced it to the broader community in the way I do now. However, I still believe that this can only really be moved forward _in person_. I will do my best to ignore all mails you write to me or in this thread. Please write, coordinate, do everything that you think would be good to do to move this forward, but I don't really have the capacity to lead a good discussion. The only capacity I can offer is that we *need* someone to step up, and grab me at some event in meatspace. Ideally at that point that person is willing to have the A record pointed at some new place under their control, and we can begin the transition. Otherwise we will probably simply kill it for the 10 years anniversary, and finally make room for something new altogether. This is a call for help! Thanks. :-) Moritz P.S.: I will at some point soon post another mail about what I was up to the past years, and what I will be up to in the next few years. Don't worry, I'll still be around. [1] http://archives.seul.org/or/talk/May-2010/msg00058.html [2] https://torservers.net/partners.html [3] For a real Tor Relay Retreat, we would need something larger, but I think this gives you a pretty good idea of how I imagine it to look like: https://www.homeaway.co.uk/p868562

10 20

Become a Fallback Directory Mirror
by gus 25 Jun '19

25 Jun '19

Dear Relay Operators, Do you want your relay to be a Tor fallback directory mirror? Will it have the same address and port for the next 2 years? Just reply to this email with your relay's fingerprint. If your relay is on the current list, you don't need to do anything. If you're asking: Q: What's a fallback directory mirror? Fallback directory mirrors help Tor clients connect to the network. For more details, see [1]. Q: Is my relay on the current list? Search [2] and [3] for your relay fingerprint or IP address and port. [2] is the current list of fallbacks in Tor. [3] is used to create the next list of fallbacks. Q: What do I need to do if my relay is on the list? Keep the same IP address, keys, and ports. Email tor-relays if the relay's details change. Q: Can my relay be on the list next time? We need fast relays that will be on the same IP address and port for 2 years. Reply to this email to get on the list, or to update the details of your relay. Once or twice a year, we run a script to choose about 150-200 relays from the potential list [3] for the list in Tor [2]. Q: Why didn't my relay get on the list last time? We check a relay's uptime, flags, and speed [4]. Sometimes, a relay might be down when we check. That's ok, we will check it again next time. It's good to have some new relays on the list every release. That helps tor clients, because blocking a changing list is harder. cheers, gus [1] https://trac.torproject.org/projects/tor/wiki/doc/FallbackDirectoryMirrors [2] https://gitweb.torproject.org/tor.git/tree/src/or/fallback_dirs.inc [3] https://gitweb.torproject.org/tor.git/tree/scripts/maint/fallback.whitelist [4] https://trac.torproject.org/projects/tor/attachment/ticket/21564/fallbacks_…

13 19

Auto Upgrading Tor Using Unattended Ugrades
by Keifer Bly 03 Jun '19

03 Jun '19

Hello all, So I am now auto upgrading tor using the method at https://trac.torproject.org/projects/tor/wiki/TorRelayGuide/DebianUbuntuUpd… Upon testing, this is what I got. Initial blacklisted packages: Initial whitelisted packages: Starting unattended upgrades script Allowed origins are: [] Checking: firefox-esr ([<Origin component:'main' archive:'stable' origin:'Debian' label:'Debian-Security' site:'security.debian.org' isTrusted:True>]) Checking: google-cloud-sdk ([<Origin component:'main' archive:'cloud-sdk-stretch' origin:'cloud-sdk-stretch' label:'cloud-sdk-stretch' site:'packages.cloud.google.com' isTrusted:True>]) Checking: google-compute-engine ([<Origin component:'main' archive:'google-compute-engine-stretch-stable' origin:'google-compute-engine-stretch-stable' label:'google-compute-engine-stretch-stable' site:'packages.cloud.google.com' isTrusted:True>]) Checking: google-compute-engine-oslogin ([<Origin component:'main' archive:'google-compute-engine-stretch-stable' origin:'google-compute-engine-stretch-stable' label:'google-compute-engine-stretch-stable' site:'packages.cloud.google.com' isTrusted:True>]) Checking: libavcodec57 ([<Origin component:'main' archive:'stable' origin:'Debian' label:'Debian-Security' site:'security.debian.org' isTrusted:True>]) Checking: libavfilter6 ([<Origin component:'main' archive:'stable' origin:'Debian' label:'Debian-Security' site:'security.debian.org' isTrusted:True>]) Checking: libavformat57 ([<Origin component:'main' archive:'stable' origin:'Debian' label:'Debian-Security' site:'security.debian.org' isTrusted:True>]) Checking: libavresample3 ([<Origin component:'main' archive:'stable' origin:'Debian' label:'Debian-Security' site:'security.debian.org' isTrusted:True>]) Checking: libavutil55 ([<Origin component:'main' archive:'stable' origin:'Debian' label:'Debian-Security' site:'security.debian.org' isTrusted:True>]) Checking: libpostproc54 ([<Origin component:'main' archive:'stable' origin:'Debian' label:'Debian-Security' site:'security.debian.org' isTrusted:True>]) Checking: libswresample2 ([<Origin component:'main' archive:'stable' origin:'Debian' label:'Debian-Security' site:'security.debian.org' isTrusted:True>]) Checking: libswscale4 ([<Origin component:'main' archive:'stable' origin:'Debian' label:'Debian-Security' site:'security.debian.org' isTrusted:True>]) Checking: python-google-compute-engine ([<Origin component:'main' archive:'google-compute-engine-stretch-stable' origin:'google-compute-engine-stretch-stable' label:'google-compute-engine-stretch-stable' site:'packages.cloud.google.com' isTrusted:True>]) Checking: python3-google-compute-engine ([<Origin component:'main' archive:'google-compute-engine-stretch-stable' origin:'google-compute-engine-stretch-stable' label:'google-compute-engine-stretch-stable' site:'packages.cloud.google.com' isTrusted:True>]) pkgs that look like they should be upgraded: Fetched 0 B in 0s (0 B/s) fetch.run() result: 0 blacklist: [] whitelist: [] No packages found that can be upgraded unattended and no pending auto-removals What I am attempting to do is automatically install new tor versions when they are released. Will this do that automatically? How can I keep this process running? Thanks. --Keifer

3 9

Relay Consensus Low
by Matt Westfall 02 Jun '19

02 Jun '19

My tor node: https://metrics.torproject.org/rs.html#details/B1B10104EB72A1FBBF6687B05F19… Doesn't ever go up above 8800 or so. One thing I notice in Nyx is that my connections never go above about 2000 in and out connections. I have advertised bandwidth of just shy of a gigabit in my config. I understand now that the "advertised bandwidth" is calculated based on observed traffic through the node, which while more reliable and avoids abuse, seems to be counter productive to a degree. Ultimately what do I need to do to get more traffic through my node? Cause I have a 2Gbps fiber sitting here basically doing nothing so I was giving 1Gbps to tor :) Config -------------- RunAsDaemon 1 ControlPort 9051 ORPort 9001 ORPORT [2001:559:c290::fffb]:9001 RelayBandwidthRate 45 MB # Throttle traffic to 100KB/s (800Kbps) RelayBandwidthBurst 50 MB # But allow bursts up to 200KB/s (1600Kbps) DirPort 9030 # ExitPolicy reject *:* # no exits allowed ExitPolicy reject6 *:* Any suggestions appreciated. Matt Westfall President & CIO ECAN Solutions, Inc. Everything Computers and Networks 804.592.1672

6 10

Verizon.com blocked on Tor Middle Relay on FiOS
by Neel Chauhan 31 May '19

31 May '19

Hi, I have a Tor middle relay on Verizon FiOS. If I try to access Verizon.com on the FiOS connection running a Tor middle relay, I get this error: > Access denied, in accordance with Verizon Information Security Policy > Please contact us if there is a legitimate business need to access this > content. They gave an email address to the EdgeCast NOC that I contacted, but the EdgeCast support said I should contact FiOS and not EdgeCast, even though I think the blocking is on EdgeCast's side (if it was on FiOS then I would get a "Hmm. We’re having trouble finding that site" error from Firefox). Other Verizon sites such as Verizon Wireless and Verizon Media/Oath properties like AOL/Yahoo/Tumblr/HuffPost/etc. are not blocked on FiOS running Tor (heck, I can even sign up for Tumblr on exit relays), even though these other Verizon sites also use EdgeCast. For those who have middle relays on their home broadband connection (not bridge or exit), both on Verizon FiOS and other ISPs regardless of country or technology, please test for if Verizon.com is blocked. Thank You, Neel Chauhan

5 5

Tor relay operators meetup, 25/05/2019 @ RADIX hacklab, Athens
by Vasilis 28 May '19

28 May '19

Dear Tor friends and relay operators, Next Saturday (25.05.2019) a Tor relay operators meetup will take place at RADIX hacklab in Athens. When: Saturday, May 25th, 2019 Time: 19:00 / 7:00 PM Where: Kaniggos 34 & Stournari, Athens 10682, Greece Event link: https://radix.one/en/2019-05-18-tor-meetup/ Hope to see many of you there. Cheers, ~Vasilis -- Fingerprint: 8FD5 CF5F 39FC 03EB B382 7470 5FBF 70B1 D126 0162 Pubkey: https://pgp.mit.edu/pks/lookup?op=get&search=0x5FBF70B1D1260162

1 1

Tor Relay Operator Meeting at the Gulaschprogrammiernacht
by Christophe Kemp 27 May '19

27 May '19

Hello everyone, there will be a Tor Relay Operator Meeting at the Gulaschprogrammiernacht :) You will find soon more information here: https://entropia.de/GPN See you there! Best regards Chrëscht International Ambassador Frënn vun der Ënn A.S.B.L

1 1

VPNs and Ports
by grarpamp 25 May '19

25 May '19

>> On May 23, 2019, at 4:39 AM, Wallichii <wallichii(a)riseup.net> wrote: >> >> On Thu, 23 May 2019 04:15:36 -0500 >> Conrad Rockenhaus <conrad(a)rockenhaus.com> wrote: >> >>> I’ll be starting a free VPN service soon to allow users that are >>> blocked from using Tor at their location to access Tor. To prevent >>> abuse of the service, I plan on restricting the ability of the VPN to >>> only access 53, 80, 443, 8080, 8443, 9001, and 9030. Are there any >>> other ports I should consider keeping open for the service? >> >> IMO setting up a bridge will help more users because not everyone is >> going to trust someone on the internet giving free proxy, you should >> run a bridge if you want to help more users. That would be an input VPN... perhaps useful if DPI was breaking user's tor access protocols (to bridges or regular entry guards), but not their VPN traffic. Output VPN's could also be useful to allow tor users to bind their stack to it over tor, thus permitting UDP back and forth from clearnet... typical with voice video comms and a bunch of other applications that have been disabled for tor users becase tor only supports TCP. Operators would have to publish their VPN node info somewhere for users to use... or getbridges, getvpns. There are prior exploratory threads on this here before. Operators can also be running and supporting VPNGate.net service as both input and output.

1 0