August 2019 - tor-relays - lists.torproject.org

DoS attack on Tor exit relay
by potlatch 08 Aug '19

08 Aug '19

Hello Tor users, Help me with a problem please. I have a small exit/backup & directory VPS in Finland [1]. This last week the server (and Tor) have been overwhelmed with non-Tor IP addresses. This may be a small version of a DoS attack. I took the server down for a few days but when I restarted it the attack was there before Tor users. Eventually, the load caused kernal crash. I noticed this last week, that my Consensus Weight had dropped from 5500 to 68. Does anyone have an efficient way to defeat this ongoing attack? --potlatch [1] 9B31F1F1C1554F9FFB3455911F82E818EF7C7883 TorExitFinland Sent with [ProtonMail](https://protonmail.com) Secure Email.

7 10

10 Years Torservers.net: Death or Future?
by Moritz Bartl 08 Aug '19

08 Aug '19

tl;dr: torservers.net needs a new home! I started torservers.net after a random chat at a local bar some time early 2010. I wore a Tor shirt, and the guy next to me asked if that was "The Onion", the satire magazine. He became pretty excited about Tor after I told him what it was about, opened his wallet and gave me a 100€ bill "to put towards the network". Eventually it turned out that he was an Oracle software developer, so it's kind of funny to think about this as "one of the few good things Oracle has ever done". I thought about it for a bit, and then decided to take the money, which cemented the idea that I have had for quite some time: to get a more beefy machine to "properly" run a Tor exit, sharing the costs with others. Only a few days after I announced this idea on or-talk [1] in May 2010, some crazy Swede wired me another 1000€ (Thanks!). So, bad luck, I really had to do this now! I am still surprised at how successful the fundraising was. In fact, when we finally created a legal envelope of protection around me by starting the Zwiebelfreunde association in 2011, it was already clear that we needed to find others to do the same, instead of growing larger ourselves. The network was a lot different then, and some people tell me we had 80% of the overall exit capacity for quite some time after Olaf shut down his fast Blutmagie exit. So I went on a tour to inspire others. So, here we are, almost 10 years later, with 23 partner organizations in 15 countries. [2] After I got a "real job" in 2013 (that quickly grew into "more than full-time"), and at the same time the first grant money for torservers.net, we tried in many different ways to "recruit" others to "take over". Looking back, of course a lot of things happened and it was a crazy (and fun!) time, but long story short, until now nobody stepped up to take over the core role of a "coordinator" of activities. There are many many offers for help, and even more ideas of what torservers.net could do and be, but all people involved heavily at the beginning (Thanks!) don't have time to coordinate all the wonderful help, and do a proper handover. We tried a couple of times, only to spend a lot of time "training" a poor person to get them somewhat up to speed, but eventually everyone decided they had better things to do than to become frustrated at trying to walk blindly without much guidance. This is not an easy role to step into. If we take the May 2010 announcement as "launch date", the 10 years anniversary will be on May 10th, 2020. My dream would be to celebrate this with a fresh board at Zwiebelfreunde that has taken over the association, and another group that coordinates the international platform that torservers.net was meant to be(come). Of course we will not simply give away the domains and the legal entity and all our exit relays to just anyone. But, hm, yeah, truth is, probably almost anyone! ;-) For some years now, we've talked about the idea of a "relaunch". The most promising idea is to organize a proper Tor Relay Operators Retreat, maybe 50 people or so, with all the great people who have dedicated their lives to this project at some point, and all the great new folks who are as excited as all of us were back then about contributing to the Tor network. It would likely to be possible to convince Open Technology Fund or some other money source to sponsor travel and venue. I've always imagined this to happen in a nice "holiday" setting. At some point, I *will* go with a group of people to this fine venue [3], as an example of how this could look like. So far, I've tried to talk to individuals about it in smaller groups, and never announced it to the broader community in the way I do now. However, I still believe that this can only really be moved forward _in person_. I will do my best to ignore all mails you write to me or in this thread. Please write, coordinate, do everything that you think would be good to do to move this forward, but I don't really have the capacity to lead a good discussion. The only capacity I can offer is that we *need* someone to step up, and grab me at some event in meatspace. Ideally at that point that person is willing to have the A record pointed at some new place under their control, and we can begin the transition. Otherwise we will probably simply kill it for the 10 years anniversary, and finally make room for something new altogether. This is a call for help! Thanks. :-) Moritz P.S.: I will at some point soon post another mail about what I was up to the past years, and what I will be up to in the next few years. Don't worry, I'll still be around. [1] http://archives.seul.org/or/talk/May-2010/msg00058.html [2] https://torservers.net/partners.html [3] For a real Tor Relay Retreat, we would need something larger, but I think this gives you a pretty good idea of how I imagine it to look like: https://www.homeaway.co.uk/p868562

10 20

Running gigabit relay
by Mitar 07 Aug '19

07 Aug '19

Hi! I have Sonic Fiber which offers gigabit symmetric connection. I am thinking of using it for gigabit Tor relay, but I wonder what would be good hardware to use for something like that. Information I have found [1] is from 2010 so I wonder if there are any updates? Is there any simple small box I could use? Like Intel NUC? Information here [2] says that one can get 400 Mbps with AES-NI. And so with two processes limit per my public IP this would be around 800 Mbps then. Is this still a reasonable expectation? Do I have to care about the network card to serve gigabit (besides its being nominally gigabit)? What would be memory requirements for such a device? [1] https://www.mail-archive.com/or-talk@freehaven.net/msg14159.html [2] https://www.torservers.net/wiki/setup/server Mitar -- http://mitar.tnode.com/ https://twitter.com/mitar_m

11 21

Configuring SQM on nodes
by Mitar 07 Aug '19

07 Aug '19

Hi! Has anyone tested how does configuring SQM on Tor nodes influence the quality of circuits over the node? Throughput, latency? So given that circuits have 3 hops in serial I would assume that any buffering/latency issues on nodes combine in a bad way. So using some smart queue management (SQM) might improve things? https://www.bufferbloat.net/projects/bloat/wiki/More_about_Bufferbloat/#why… So besides bandwidth measurements of nodes, should we also measure latency contributions by nodes? I think this is the whole idea behind the Bufferbloat movement, that it does not matter for user experience the final throughput if you have bad latency. That what most users perceive as "fast" is in fact good latency experience. Tor have notions of sustained and burst bandwidth, but this to me looks like just simplified QoS configurations. Shouldn't a better configuration be "do not increase latency by more than X"? Then if you hit the bandwidth limit, you are obviously increasing the latency more because some packets are not getting through. But it also captures the behavior better than "bursting is allowed up to Y". Mitar -- http://mitar.tnode.com/ https://twitter.com/mitar_m

1 0

Tor server setup of keys
by potlatch 05 Aug '19

05 Aug '19

I have not installed a Tor relay since the gpg server change. I started a new relay today and found that the instructions for ubuntu Bionic did not work for me. Specifically, url https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E8… | gpg --import gave me an error message that --import is not an option of curl. Has anyone come across this and worked out the problem? -potlatch Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

New Fallbacks from June 2019
by teor 04 Aug '19

04 Aug '19

Dear Relay Operators, Thanks to everyone who opted-in their relays as fallback directory mirrors. We rebuilt the list of fallbacks in June 2019. [0] The new list will be released in Tor 0.4.1.4-alpha/rc. It was backported to all supported Tor releases. [1] The FallbackDir flags on Consensus Health [2] and Relay Search [3] might take a week or two to update. Don't worry if your relay missed out this time. It's still helping Tor users. And we will rebuild the fallback list again in 6-12 months time. We are tracking future fallback changes in this ticket [4]. To opt-in your relays, add a comment to the ticket [4], or reply to this thread. If you have multiple relays, you can opt-in as many as you like. (We picked up to 7 per operator this time, and we may pick more next time.) T [0]: See: https://gitweb.torproject.org/tor.git/tree/src/app/config/fallback_dirs.inc https://trac.torproject.org/projects/tor/ticket/28793 [1]: 0.2.9, 0.3.5, 0.4.0, and 0.4.1: See https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CoreTor… [2]: https://consensus-health.torproject.org/graphs.html Which uses stem's cached fallback list at: https://gitweb.torproject.org/stem.git/log/stem/cached_fallbacks.cfg [3]: For example, this relay is a new fallback, but its flag isn't shown yet: https://metrics.torproject.org/rs.html#details/1211AC1BBB8A1AF7CBA86BCE8689… [4]: https://trac.torproject.org/projects/tor/ticket/30972

2 2

ORPort // DirPort
by Fabio De Sicot 04 Aug '19

04 Aug '19

Hello everyone I have a problem I wasn't able to fix until now. Could you help me whit this? ------------------------ - when I start tor I receive this error: [...........] Aug 03 09:48:29.000 [notice] Have tried resolving or connecting to address '[scrubbed]' at 3 different places. Giving up. Aug 03 09:48:40.000 [notice] Have tried resolving or connecting to address '[scrubbed]' at 3 different places. Giving up. [...........] Aug 03 10:07:09.000 [warn] Your server () has not managed to confirm that its ORPort is reachable. Relays do not publish descriptors until their ORPort and DirPort are reachable. Please check your firewalls, ports, address, /etc/hosts file, etc. Aug 03 10:07:09.000 [warn] Your server () has not managed to confirm that its DirPort is reachable. Relays do not publish descriptors until their ORPort and DirPort are reachable. Please check your firewalls, ports, address, /etc/hosts file, etc. - I verified, and ports 9051, 9001 and 9030 were not filtered # firewall-cmd --get-active-zones internal interfaces: eth0 # firewall-cmd --zone=internal --list-allinternal (active) target: default icmp-block-inversion: no interfaces: eth0 sources: ports: 9051/tcp 9051/udp 9001/tcp 9001/udp 9030/tcp 9030/udp protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: - I checked my torrc file # cat /usr/local/etc/tor/torrcNickname xxxxxx ORPort 9001 <<<< ControlPort 9051 <<<< DirPort 9030 <<<< # # RunAsDaemon 0 ExitRelay 0 CookieAuthentication 1 ContactInfo xxxxxxx - I verified the internal ip # ifconfig eth0eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 192.168.0.8 netmask 255.255.255.0 broadcast 192.168.0.255 inet6 fe80::1874:3d84:ac42:fa97 prefixlen 64 scopeid 0x20<link> ether b8:27:eb:90:a2:b8 txqueuelen 1000 (Ethernet) RX packets 1118761 bytes 398404534 (379.9 MiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 1095304 bytes 428598871 (408.7 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 - and I verified that on my router the port forwarding was active # Port Forwarding Name Port Range Protocol IP Address Enable TOR 9051 TCP&UDP 192.168.0.8 x ORPORT 9001 TCP&UDP 192.168.0.8 x DIRPORT 9030 TCP&UDP 192.168.0.8 x ------------------------ Thanks in advance Regatds -- Fabio De Sicot # https://fosstodon.org/@jolek78 <https://fosstodon.org/@jolek78>

2 1

Tor relay has low consensus weight
by Piers 04 Aug '19

04 Aug '19

Hi, i have been running a tor relay (link: https://metrics.torproject.org/rs.html#details/858BEC79D7355EC0631E98D47CF1…) on a raspberry pi 2 for 15 days, however i think there might be a problem with it. My consensus weight is only 43 and thus the relay doesn't get used much. Please advise if there is an issue -- Many thanks, -Piers

3 2

Unutilized bandwidth
by Alec Larsen 31 Jul '19

31 Jul '19

Hello, I've only recently joined this list, so I apologise in advance if this is not the appropriate place for my question. For the past month, I have been operating an exit node ( 89094DFA4158C7A1583EC3A332CDCBC74A28CC0E ) from UnitedIX in Chicago, IL, US. The server has a dedicated gigabit port, and I had hoped to be able to relay around 200 TB of traffic per month, but for some reason my advertised bandwidth has been hovering at just 12 MiB/s since the first few days. The server itself is an older Supermicro PfSense server with a Xeon E3-1270v3 at 3.5ghz and 32gb of RAM. It is currently running the latest stable release of FreeBSD (12.0p7) and Tor (0.4.0.5). As far as I can tell, the machine is mostly idle: * The Tor process is the most active, and I've yet to see it go above 5% CPU. * Memory usage is under 1.5gb. * Running `speedtest-cli` (even to different servers using the `--server` option) consistently gives 600mbps+ in both directions to most destinations. * There's nothing interesting in `dmesg` or the debug logs. Does anyone have suggestions for what the bottleneck here might be? I'm happy to share more details about my configuration if that would be helpful. Thank you in advance for any help that you are willing to provide! I think Tor provides a lot of value, and I would like to provide as much bandwidth as I can to the network. -- Alec

6 7