July 2020 - tor-relays - lists.torproject.org

ContactInfo Information Sharing Specification Version 1 released
by nusenu 26 Jul '20

26 Jul '20

Hi, I'm happy to finally announce version 1 of the ContactInfo Information Sharing Specification: https://github.com/nusenu/ContactInfo-Information-Sharing-Specification This is an effort that started in 2017 as you can see on github. Tor's ContactInfo field was primarily intended to contain an email address and PGP key fingerprint but since this field accepts an arbitrary string it has been used for multiple other purposes (website urls, donation information, bitcoin addresses, ...). This is a specification to formalize the ContactInfo string to: - make provided information machine readable (could be used for Relay Search) - improve the ability to contact relay operators - allow the automatic attribution and verification that a relay is operated by a given entity - increase information sharing among tor relay operators Eran Sandler created a nice and simple to use generator based on the specification: https://torcontactinfogenerator.netlify.app/ If you used the generator and specification in the past, please regenerate your ContactInfo string, so it includes the version field. I'm particularly looking forward to seeing many use the verifyurl field. Overview of definied fields email pgp abuse operatorurl verifyurl keybase twitter mastodon matrix xmpp otr3 ricochet hoster cost uplinkbw trafficacct memory cpu virtualization bitcoin zcash donationurl offlinemasterkey signingkeylifetime sandbox os tls aesni autoupdate confmgmt dnslocation dnsqname dnssec dnslocalrootzone CIISSversion regards, nusenu -- https://mastodon.social/@nusenu

9 15

Re: [tor-relays] Become a Fallback Directory Mirror (deadline: July 23)
by tor-operator 26 Jul '20

26 Jul '20

Dear Gus or whoever it may concern; I was unable to reply before the deadline due to an unforeseeable issue which came up. That has now been cleared up and I hope it'll be fine to participate. At any rate, here are the ones which I'd like to opt-in: k0nslNET14: https://metrics.torproject.org/rs.html#details/8C5155E33148B13CEF02197037D8… k0nslNET1488: https://metrics.torproject.org/rs.html#details/239E373B108E04912B3AF8C32E99… k0nslNET7: https://metrics.torproject.org/rs.html#details/F1B6FA0ED8C60E9C7317AF027E7C… k0nslNET1889: https://metrics.torproject.org/rs.html#details/0E8FD4368083BD7817A42F3ECEDE… They all support IPv6 as well. All the best! Faithfully -k0nsl

1 0

an alternative to verifyurl
by nusenu 24 Jul '20

24 Jul '20

Hi, based on feedback I got about https://github.com/nusenu/ContactInfo-Information-Sharing-Specification I want to add an additional verification option based on DNS records to allow for the same verification as the verifyurl field provides but without the need to have a webserver and a proper TLS certificate. Explained by example: Lets say the operator has the domain example.com and runs a relay with fingerprint ABCF46A63F9C21FD315CD061B3EAA3EB05283ABC on IP addresses: 192.0.2.235 The operator would simply create the following DNS record for verification/linking: DNS A record: ABCF46A63F9C21FD315CD061B3EAA3EB05283ABC.example.com pointing to 192.0.2.235 If the relay has an IPv6 address as well an AAAA record is created for the same name pointing to the IPv6 address. Since we require a TLS certificate for verifyurl this will require DNSSEC to be enabled on the domain to be validated. Let me know if you have any feedback on this additional option. thanks! nusenu -- https://mastodon.social/@nusenu

1 0

generating graphs of "attributable" operators using ContactInfo/verifyurl
by nusenu 21 Jul '20

21 Jul '20

nusenu wrote [1]: > I'm generating some timeseries graphs now to see what (exit) fraction (stacked) > is managed by > https://torservers.net/partners.html > and those mentioned at the bottom of > https://lists.torproject.org/pipermail/tor-relays/2020-January/018022.html > + some custom additions for operators I had some contact before > over time (past 6 months). > spoiler: it used to be >50% until some malicious actor came along and reduced it to <50% I was still fiddling around with this by looking through the list of operators sorted by their network fraction of the overall capacity to add more to the "attributable" pool, but it is rather time consuming, especially if we aim to generate them on a regular basis. To allow for better automation/scalability in this effort I'd like to ask operators to use the ContactInfo string generator https://torcontactinfogenerator.netlify.app/ in particular the operatorurl and verifyurl fields. This will allow me to automate the time consuming job and generate some nice timeseries graphs. Please let me know if you have any questions. Looking forward to seeing many ContactInfo strings containing operatorurl and verifyurl fields. thanks, nusenu [1] https://lists.torproject.org/pipermail/tor-relays/2020-July/018660.html -- https://mastodon.social/@nusenu

1 0

tor relay - vps maintenance - what to do ?
by dlugasny＠protonmail.com 21 Jul '20

21 Jul '20

Hi, in the next three days, my VPS provider planning to shutdown ("maintenanance") for 6 hours my VPS where tor relay is running (with some services). What should I do ? I suspect that my VPS will be copied and reviewed (by not authorized persons) afterwards. How do You react in such a situations ? I appreciate any advice. Cheers Dlugasny Sent with [ProtonMail](https://protonmail.com) Secure Email.

6 5

Directory Authority servers still using excessive bandwidth
by Neel Chauhan 20 Jul '20

20 Jul '20

Hi tor-relays@, I have noticed that despite fixing bugs in the past, the directory authority relays are still using excessively high amounts of bandwidth, when looking at Relay Search: Examples: * https://metrics.torproject.org/rs.html#details/7EA6EAD6FD83083C538F44038BBF… * https://metrics.torproject.org/rs.html#details/9695DFC35FFEB861329B9F1AB04C… * https://metrics.torproject.org/rs.html#details/BD6A829255CB08E66FBE7D374836… And many more. I'm asking since I'm having an issue with low consensus weights on a symmetrical "Gigabit" pipe, and I am suspecting the overloaded authority servers are a factor. Are they? It could also be my current ISP's (Wave Broadband) crap peering, but would I really want to use Comcast? -Neel === https://www.neelc.org/

1 0

Re: [tor-relays] Error from LZMA encoder
by nottryingtobelame＠protonmail.com 20 Jul '20

20 Jul '20

This bridge is on Digital Ocean, so I checked my logs and it doesn't appear that my memory usage ever maxed. It hovers right around 80 with the highest spike at about 87%. Is that insufficient? Thank you for the reply.

1 0

Error from LZMA encoder: Unable to allocate memory; NULL stream while compressing
by nottryingtobelame＠protonmail.com 20 Jul '20

20 Jul '20

My bridge was running fine, then started throwing the same error over and over. See my last two days of logs here: https://pastebin.com/7FNXC6PZ. Function doesn't seem to be affected as the heartbeats still show users. Can or should I do anything about this?

2 1

trouble with tor relay software on debian
by Keifer Bly 20 Jul '20

20 Jul '20

Hi all, So my middel guard relay at https://metrics.torproject.org/rs.html#details/79E3B585803DE805CCBC00C1EF36… As well as my bridge at https://metrics.torproject.org/rs.html#details/EF36AE38C162E96E0645E1DF25EF… Are not updating, though I had configured them to be updated by unattended upgrades they are stuck on tor 4.3.5. When running sudo apt update && sudo apt install -y --only-upgrade tor This is the return, it's a google drive link to the screenshot as copy pasting the text ended up in a jumbled mess. https://drive.google.com/file/d/1ULtvt8B28tTwN5DI7oLmfj7mbfBIDh6A/view?usp=… It says ip address not found, I wonder why this is as I had imported tors keyring before hand. What's also going on is, I am trying to see how much traffic my relay has pushed but am not able to open the log file, when using less /var/log/tor/notices.log I am only seeing a black screen with (END) and that's it. I wonder why this is. Thanks very much, --Keifer <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> Virus-free. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> <#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

3 2

Snowflake-proxy restricted NAT
by dmz21 19 Jul '20

19 Jul '20

Hi, I've been running a Snowflake (the stand-alone Go-proxy kind build from source) as a Debian service. I was working fine before, showing a handful of anonymous connections per day. Recently it shows a new log message: "NAT type: restricted" after "starting" and I have not seen any new connections. I'm guessing that a restricted NAT does not allow any client to connect to my VM. Please tell me if I'm wrong. I don't think that I have made any relevant changes to my network or hypervisor setup, recently. I don't know how to configure my OpenWrt router such that I have a suitable NAT to a specific IP in my DMZ. Can anyone tell me what I could try in order to restore my Snowflake-proxy to being useful to others again? kind regards and thanks

2 2