May 2022 - tor-relays - lists.torproject.org

How to reduce tor CPU load on a single bridge?
by David Fifield 18 Dec '22

18 Dec '22

The main Snowflake bridge (https://metrics.torproject.org/rs.html#details/5481936581E23D2D178105D44DB6…) is starting to become overloaded, because of a recent substantial increase in users. I think the host has sufficient CPU and memory headroom, and pluggable transport process (that receies WebSocket connections and forwards them to tor) is scaling across multiple cores. But the tor process is constantly using 100% of one CPU core, and I suspect that the tor process has become a bottleneck. Here are issues about a recent CPU upgrade on the bridge, and observations about the proportion of CPU used by different processes: https://bugs.torproject.org/tpo/anti-censorship/pluggable-transports/snowfl… https://bugs.torproject.org/tpo/anti-censorship/pluggable-transports/snowfl… I have the impression that tor cannot use more than one CPU core—is that correct? If so, what can be done to permit a bridge to scale beyond 1×100% CPU? We can fairly easily scale the Snowflake-specific components around the tor process, but ultimately, a tor client process expects to connect to a bridge having a certain fingerprint, and that is the part I don't know how to easily scale. * Surely it's not possible to run multiple instances of tor with the same fingerprint? Or is it? Does the answer change if all instances are on the same IP address? If the OR ports are never used? * OnionBalance does not help with this, correct? * Are there configuration options we could set to increase parallelism? * Is migrating to a host with better single-core performance the only immediate option for scaling the tor process? Separate from the topic of scaling a single bridge, here is a past issue with thoughts on scaling beyond one bridge. it looks as though there are not ways to do it that do not require changes to the way tor handles its Bridge lines. https://bugs.torproject.org/tpo/anti-censorship/pluggable-transports/snowfl… * Using multiple snowflake Bridge lines does not work well, despite that we could arrange to have the Snowflake proxy connect the user to the expected bridge, because tor will try to connect to all of them, not choose one at random. * Removing the fingerprint from the snowflake Bridge line in Tor Browser would permit the Snowflake proxies to round-robin clients over several bridges, but then the first hop would be unauthenticated (at the Tor layer). It would be nice if it were possible to specify a small set of permitted bridge fingerprints.

7 57

relayor v22.0.0-rc is released
by nusenu 03 Dec '22

03 Dec '22

Hi, relayor v22.0.0-rc is released. relayor is an ansible role that helps you with running tor relays with minimal effort (automate everything). https://github.com/nusenu/ansible-relayor#main-benefits-for-a-tor-relay-ope… Changes since relayor v21.2.0-rc: * MetricsPort support improvements: * generate nginx reverse server config for remote prometheus scraping on the relay (we do not install nginx) * generate htpasswd file for HTTP basic auth of MetricsPort on the relay * debian/ubuntu: support new alpha repos (branch name is no longer included in the repo name). * FreeBSD 12.3 is supported kind regards, nusenu -- https://nusenu.github.io

2 4

[Workshop] Sysadmin 101 for (new) relay operators - June 4th @ 1900 UTC
by gus 14 Jun '22

14 Jun '22

Join us June 4th at 1900 UTC for new and prospective Tor relay and bridge operators on the basic "sysadmin foo" required to contribute to the network! ## Sysadmin 101 for new relay operators So you want to contribute to the open-source Tor network by running a relay or maybe a bridge? The Tor network is the most important tool for evading surveillance and bypassing internet censorship. And Tor relays and bridges are vital to the health and integrity of the Tor network. Millions of users rely on relays and bridges to stay safe, and how you configure and maintain that relay or bridge is critical. Volunteers aren't a nice enhancement. They are a core feature. Running a relay or a bridge raises frequent questions: * Should I run a relay or a bridge? * Should I run a relay or a bridge from a residential/home internet connection? * Which operating system should I run for my Tor node (hint: the one you are most comfortable with securing and maintaining) * More generally, what does it take to keep that relay or bridge operating safely, but both you and Tor users? This workshop will start with a presentation approaching some of the core issues that arise when running a Tor node. The session will move into an "ask me anything" discussion to approach other common and less common questions. The 90-minute event will be geared towards current and prospective Tor bridge and relay operators, particularly those relatively new to running public internet services. Seasoned Linux and BSD Tor operators will be attending the event ready to address the discussion. ## How to join the workshop The workshop is entirely free, and participants need to fill out this registration form. The event will take place on BigBlueButton, an online video conference platform, on June 4th at 1900 - 2030 UTC. You can register here: https://nc.torproject.net/apps/forms/cDLPxryHJcP5kMeW ## Facilitators The workshop will be facilitated by: * George (@gman999) - Tor *BSD Diversity Project member, Serge bridge directory authority maintainer, long-time relay operator and a wide variety of other contributions. * Kushal Das (@kushal) - RPM Tor maintainer and member of the Tor Community team. -- The Tor Project Community Team Lead

2 3

New OrNetStats Section: Largest Bridge Operators
by nusenu 07 Jun '22

07 Jun '22

Hi, OrNetStats got a new section today showing the largest bridge operators by advertised bandwidth grouped by ContactInfo: https://nusenu.github.io/OrNetStats/#bridge-operators-grouped-by-contactinfo This is possible because the Torproject started to publish bridge ContactInfos. The listing only includes operators with at least 50 Mbit/s aggregated advertised bandwidth. AROI support for bridges You can also protect your bridge ContactInfo against spoofing now. The same fields as for relays apply. If you have setup your AROI [1] on your relays already you can simply copy the ContactInfo to your bridges and publish the list of hashed bridge fingerprints under this URL: https://-your-hostname-/.well-known/tor-relay/hashed-bridge-rsa-fingerprint.txt After successful validation your bridges will be added to your operator level pages on OrNetStats. OrNetRadar will also be extended to support bridges. kind regards, nusenu [1] https://nusenu.github.io/OrNetStats/#authenticated-relay-operator-ids -- https://nusenu.github.io

3 3

Will pay but need someone
by paul＠coffswifi.net 07 Jun '22

07 Jun '22

5 4

[Event] Relay Operators Meetup - May 21, 2022 @ 1900 UTC
by gus 07 Jun '22

07 Jun '22

Hello relay operators, The next Tor relay operator meetup will happen on Saturday, May 21 @ 1900 UTC. Where: BigBlueButton - https://tor.meet.coop/gus-og0-x74-dzn No need for a registration or anything else, just use the room-link above. We're working on the agenda here: https://pad.riseup.net/p/tor-relay-meetup-may-2022-keep Everyone is free to bring up additional questions or topics at the meeting itself. Please share with your friends, social media and other mailing lists! cheers, Gus -- The Tor Project Community Team Lead

5 6

Does Tor work with Intel QAT acceleration
by Andreas Bollhalder 07 Jun '22

07 Jun '22

Hi all I have my first Tor relay up und running. It's currently installed on a little desktop computer with an Intel i5 9500T CPU. My Internet connection is 10Gb/s symetric. From this bandwidth, I would be able to spend a good part for supporting the Tor network. With that little machine, it seems that it would max out at somewhere at ~30 MBytes/s. For my definitive Tor relay hardware, I'm currently researching some options, which would be capable of handling Tor traffic at the rate of 200 to 300MBytes. Even it would be used nowadays, but who knows whats coming in the future and I hope this relay would last 5 years ore so. It looks to me, that with a normal CPU, it's impossible to reach my goal. But then I encountered, that Intel has the Quick Assist Technoloy (QAT) integrated in some of their products (ie. Atom C3xx8). This QAT can be used with OpenSSL as a hardware accelerator for encryption. There also exist dedicated PCIe cards with QAT (ie. Netgate CPIC-8955). Searching the Internet, I couldn't find any information if QAT would be helpful with Tor. But Tor uses the OpenSSL library and this can use the QAT acceleration. Is there anyone who has tried this und can share his expirience? Thanks in advance Andreas

4 6

[warn] Received a bad CERTS cell: Link certificate does not match TLS certificate
by Felix 07 Jun '22

07 Jun '22

Hi all I found a message in the logs: Apr 16 15:07:46.000 [warn] Received a bad CERTS cell: Link certificate does not match TLS certificate -- Cheers Felix

2 1

Debian is not allowing tor to update despite it being listed as a trusted respritory
by Keifer Bly 07 Jun '22

07 Jun '22

7 25

Weird spike in written bytes per second
by Marco Predicatori 07 Jun '22

07 Jun '22

Hi, the graph shows a marked difference between written bytes per second and read bytes per second om 2022-05-19 and 2022-05-20. In any other day the bytes are roughly the same. What might my node have "written" on those two days? https://metrics.torproject.org/rs.html#details/A4E74410D83705EEFF24BC265DE2… Thanks, Marco

3 3