January 2023 - tor-relays - lists.torproject.org

13 Jan '23

Hi Where do I find the updated version of obfs4proxy for arm64? -m On Wed, Jan 11, 2023 at 7:00 AM <tor-relays-request(a)lists.torproject.org> wrote: > Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > > > Today's Topics: > > 1. Re: security update for obfs4proxy (meskio) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 10 Jan 2023 19:51:49 +0100 > From: meskio <meskio(a)torproject.org> > To: tor-relays <tor-relays(a)lists.torproject.org> > Subject: Re: [tor-relays] security update for obfs4proxy > Message-ID: <167337670907.1540.14665065923373201554@localhost> > Content-Type: text/plain; charset="utf-8" > > We have made public the details of the distinguishability bugs that were > affecting obfs4: > https://gitlab.torproject.org/tpo/anti-censorship/team/-/issues/91 > > https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/obfs… > > Most bridges are already upgraded, thank you all bridge operators for the > work > here. > > Quoting meskio (2022-10-14 11:28:44) > > Hello, > > > > The latest version of obfs4proxy (0.0.14) comes with an important > security fix. > > If you are running a obfs4 Tor bridge please upgrade as soon as possible. > > > > If you use debian you can find the Debian package in stable-backports: > > https://packages.debian.org/stable-backports/obfs4proxy > > > > If you use docker you'll find the latest version in docker hub: > > https://hub.docker.com/r/thetorproject/obfs4-bridge/ > > > > Or you can find the source code in the upstream repository: > > https://gitlab.com/yawning/obfs4 > > > > If you need help upgrading your relay, please use this mailing list or > the Tor > > Forum: > > https://forum.torproject.net/c/support/relay-operator/17 > > > > We appreciate a lot your effort and time! > > > > Thank you > > -- > meskio | https://meskio.net/ > -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- > My contact info: https://meskio.net/crypto.txt > -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- > Nos vamos a Croatan. >

2 1

security update for obfs4proxy
by meskio 10 Jan '23

10 Jan '23

Hello, The latest version of obfs4proxy (0.0.14) comes with an important security fix. If you are running a obfs4 Tor bridge please upgrade as soon as possible. If you use debian you can find the Debian package in stable-backports: https://packages.debian.org/stable-backports/obfs4proxy If you use docker you'll find the latest version in docker hub: https://hub.docker.com/r/thetorproject/obfs4-bridge/ Or you can find the source code in the upstream repository: https://gitlab.com/yawning/obfs4 If you need help upgrading your relay, please use this mailing list or the Tor Forum: https://forum.torproject.net/c/support/relay-operator/17 We appreciate a lot your effort and time! Thank you -- meskio | https://meskio.net/ -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- My contact info: https://meskio.net/crypto.txt -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Nos vamos a Croatan.

4 12

Netcraft spam
by jvoisin 10 Jan '23

10 Jan '23

Hello everyone, at Nos-Oignons[1], we're getting spammed, not only on abuse(a)nos-oignons.net, but also on our contact email, and so is our hoster and its upstream but Netcraft[2]. Of course, we started by diligently answering the emails, but now it does feel like a waste of everybody's time. We told them we're hosting tor nodes, and that there is little we can do to prevent morons from abusing the network and using our relays for bad things™, but the netcraft spam keeps coming, annoying everyone. Is this something other operators have seen too or are we alone? If so, is there anything that can be done to make them understand what's going on? Than,s 1. https://nos-oignons.net 2. https://www.netcraft.com/cybercrime/countermeasures/ -- Julien (jvoisin) Voisin GPG: 04D041E8171901CC dustri.org

4 3

I think I'm available 24/7
by fastliftednloud 09 Jan '23

09 Jan '23

I apologize for my newbie-ness. I'm game to do my part and operate a relay, something simple for a technologically simple guy, like a guard or middle relay. I'm about ready to try and install for operation on my windows PC. The resources say that if you want to operate a relay on windows you need to be available 24/7. I think I am, could someone confirm this for me please. I live where I work, I run a family farm so I work outside but I rarely leave the property and I can clock in and out as I see fit. This leads me to believe I'm G2G but I want to make sure of this before I start working on a relay install only to waste my time. Thanks for any useful info and while I'm here, sup people? I'm the new guy.

2 1

Short heads up (was: Re: Another attempt against Tor DDoS)
by Frank Steinborn 09 Jan '23

09 Jan '23

Hi friends, I made some smaller tweaks over the last few hours which should especially help relays on nearly OOM or thrashing situations (making use of Zswap + MGLRU if available). The rules themselves are just the same, so no changes there. Merry christmas, Frank ------- Original Message ------- On Sunday, December 4th, 2022 at 11:25 PM, Frank Steinborn <steinex(a)nognu.de> wrote: > > > Hi, > > I want to show you my anti DDoS solution for my relays (aswell ;-). It works without ipset, but with a mix of the recent and hashlimit iptables modules. > > What is does: > * If one IP address tries to make 7 SYN connection attempts per second, they are locked out for 300 seconds. If they try another connection in that timeframe, the timer is reset and they are locked out for another 300 seconds. > * Threre are no more SYNs allowed if 4 connections are already in use to the ORPort. > > It works very well for me. Other solutons are far more aggressive but I feel my solution works perfectly against the attacks, even if they are not that aggresive. > > On top of that, I feel its more easy to implement into ones existing firewall solution. > > You can find the repo here: https://github.com/steinex/tor-ddos > > Feel free to give it a shot and feedback would be much appreciated! > > Greetings, > steinex

3 2

IPv6 Tor authority is down?
by shruub 09 Jan '23

09 Jan '23

Hello, so to also enable IPv6 on my relay I followed the post-install article which said that one should ping all IPv6 authorities with the following command: "ping6 -c2 2001:858:2:2:aabb:0:563b:1526 && ping6 -c2 2620:13:4000:6000::1000:118 && ping6 -c2 2001:67c:289c::9 && ping6 -c2 2001:678:558:1000::244 && ping6 -c2 2607:8500:154::3 && ping6 -c2 2001:638:a000:4140::ffff:189 && echo OK.". This generally works fine except for 2607:8500:154::3, and further testing with an online tool confirms that the ping does not succeed. So I now wonder if I can simply ignore that and enable IPv6, or if this isn't recommended (and probably also what I could do in this case). Thanks a lot. -- Best, shruub

2 2

Closing tor-relays-fr mailing list
by Chre 07 Jan '23

07 Jan '23

Hi all here, Many of us, French relay operators and Tor volunteers, thought it would be useful to restart the tor-relays-fr list, to discuss Tor relays in French. Having lost access to the original list created in 2012, we asked The Tor Project to create a new one. Arma was kind enough to respond, and despite his questions about the relevance of such a list, agreed to play along. This new tor-relays list was created on 9/22/2020. Thank you Tor Project! https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays-fr But... after over two years of existence, this list is clearly not very active. Probably because most people running Tor relays are fluent enough in English to discuss directly on... tor-relays. So we announce the closing of this list at the end of this year 2022, and we invite interested people to use on tor-relays (in English) ! It's here: https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays https://forum.torproject.net/c/support/relay-operator/17 And it's still possible to ask questions in French on the official Tor project forum: https://forum.torproject.net/c/in-your-language/19 Good luck to everyone, and keep supporting the Tor project! Issue running here: https://gitlab.torproject.org/tpo/community/team/-/issues/63 <3 -- Chre

1 0

Bridge distribution mechanism thoughts
by a tor op 06 Jan '23

06 Jan '23

I have a few questions, I have two obfs4 bridges updated with sw, one old since a few years and the other very new. The older one I now notice all of a sudden have gotten distribution mechanisms 'none'. It had 'moat' earlier, what would make it change like this? It usually has between 50-100 users according to metrics page. The new bridge should be somewhat not/little used for some time according to lifecycle info on relays found online. I do however wonder if I should expect to see some users after 16 days? Another wonder about the new bridge is yet again distribution mechanism, it has 'email', is that really much used? Generally speaking I want my time and money to get the most use possible of course. How much use does the 'telegram' mechanism get? Maybe someone can give some comments before I (possibly) change it manually on either of those bridges. A tor op

1 0

cannot keep my bridge up
by Anonforpeace 02 Jan '23

02 Jan '23

Hello: I hope you can help me. I'm having trouble keeping my bridge up. Ports are forwarded. Running latest version of Tor. I had it running for at least roughly 7 to 10 days and then it went down and keeping it up is trouble. I even setup dynamic dns on my router using no-ip.com to see if that would help and still no. I've pasted logs from this morning here. Any help is appreciated. Dec 20 08:55:16 mxh-HP-Compaq-Pro-6300-SFF tor[17727]: Dec 20 08:55:16.929 [notice] Opened Extended OR listener connection (ready) on 127.0.0.1:34445 Dec 20 08:55:16 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: We compiled with OpenSSL 30000020: OpenSSL 3.0.2 15 Mar 2022 and we are running with OpenSSL 30000020: 3.0.2. These two versions should be binary compatible. Dec 20 08:55:16 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Tor 0.4.7.12 running on Linux with Libevent 2.1.12-stable, OpenSSL 3.0.2, Zlib 1.2.11, Liblzma 5.2.5, Libzstd 1.4.8 and Glibc 2.35 as libc. Dec 20 08:55:16 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Tor can't help you if you use it wrong! Learn how to be safe at https://support.torproject.org/faq/staying-anonymous/ Dec 20 08:55:16 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Read configuration file "/usr/share/tor/tor-service-defaults-torrc". Dec 20 08:55:16 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Read configuration file "/etc/tor/torrc". Dec 20 08:55:16 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Based on detected system memory, MaxMemInQueues is set to 2849 MB. You can override this by setting MaxMemInQueues by hand. Dec 20 08:55:16 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Opening Socks listener on 127.0.0.1:9050 Dec 20 08:55:16 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Opened Socks listener connection (ready) on 127.0.0.1:9050 Dec 20 08:55:16 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Opening OR listener on 0.0.0.0:443 Dec 20 08:55:16 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Opened OR listener connection (ready) on 0.0.0.0:443 Dec 20 08:55:16 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Opening Extended OR listener on 127.0.0.1:0 Dec 20 08:55:16 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Extended OR listener listening on port 34445. Dec 20 08:55:16 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Opened Extended OR listener connection (ready) on 127.0.0.1:34445 Dec 20 08:55:16 mxh-HP-Compaq-Pro-6300-SFF kernel: [137278.310446] audit: type=1400 audit(1671544516.974:36): apparmor="DENIED" operation="open" profile="system_tor" name="/sys/kernel/mm/transparent_hugepage/hpage_pmd_size" pid=17728 comm="obfs4proxy" requested_mask="r" denied_mask="r" fsuid=128 ouid=0 Dec 20 08:55:17 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Parsing GEOIP IPv4 file /usr/share/tor/geoip. Dec 20 08:55:17 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Parsing GEOIP IPv6 file /usr/share/tor/geoip6. Dec 20 08:55:17 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Configured to measure statistics. Look for the *-stats files that will first be written to the data directory in 24 hours from now. Dec 20 08:55:18 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Your Tor server's identity key fingerprint is 'h4ck3rspace 93695FBD832C2A29A2DE719CC82B29F06C0B4E09' Dec 20 08:55:18 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Your Tor bridge's hashed identity key fingerprint is 'h4ck3rspace 709E7C37DFE418F6A28B3F0352787606B51A66C6' Dec 20 08:55:18 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Your Tor server's identity key ed25519 fingerprint is 'h4ck3rspace WpmTmQmwNU2PXhaGrwguLXwxiPL3g/4hHuXZRZxZli0' Dec 20 08:55:18 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: You can check the status of your bridge relay at https://bridges.torproject.org/status?id=709E7C37DFE418F6A28B3F0352787606B5… Dec 20 08:55:18 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Bootstrapped 0% (starting): Starting Dec 20 08:55:18 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Starting with guard context "default" Dec 20 08:55:26 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Signaled readiness to systemd Dec 20 08:55:26 mxh-HP-Compaq-Pro-6300-SFF systemd[1]: Started Anonymizing overlay network for TCP. Dec 20 08:55:26 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Registered server transport 'obfs4' at '[::]:52812' Dec 20 08:55:27 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Bootstrapped 5% (conn): Connecting to a relay Dec 20 08:55:27 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Opening Socks listener on /run/tor/socks Dec 20 08:55:27 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Opened Socks listener connection (ready) on /run/tor/socks Dec 20 08:55:27 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Opening Control listener on /run/tor/control Dec 20 08:55:27 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Opened Control listener connection (ready) on /run/tor/control Dec 20 08:55:27 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Unable to find IPv4 address for ORPort 443. You might want to specify IPv6Only to it or set an explicit address or set Address. Dec 20 08:55:27 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Bootstrapped 10% (conn_done): Connected to a relay Dec 20 08:55:27 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Bootstrapped 14% (handshake): Handshaking with a relay Dec 20 08:55:27 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Bootstrapped 15% (handshake_done): Handshake with a relay done Dec 20 08:55:27 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Bootstrapped 75% (enough_dirinfo): Loaded enough directory info to build circuits Dec 20 08:55:27 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Bootstrapped 90% (ap_handshake_done): Handshake finished with a relay to build circuits Dec 20 08:55:27 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Bootstrapped 95% (circuit_create): Establishing a Tor circuit Dec 20 08:55:27 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: External address seen and suggested by a directory authority: 100.38.62.232 Dec 20 08:55:28 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Bootstrapped 100% (done): Done Dec 20 08:56:27 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Now checking whether IPv4 ORPort 100.38.62.232:443 is reachable... (this may take up to 20 minutes -- look for log messages indicating success) Dec 20 09:00:01 mxh-HP-Compaq-Pro-6300-SFF CRON[17784]: (root) CMD (timeshift --check --scripted) Dec 20 09:00:01 mxh-HP-Compaq-Pro-6300-SFF crontab[17820]: (root) LIST (root) Dec 20 09:00:01 mxh-HP-Compaq-Pro-6300-SFF crontab[17821]: (root) LIST (root) Dec 20 09:00:01 mxh-HP-Compaq-Pro-6300-SFF systemd[1]: run-timeshift-17784-backup.mount: Deactivated successfully. Dec 20 09:15:27 mxh-HP-Compaq-Pro-6300-SFF Tor[17727]: Your server has not managed to confirm reachability for its ORPort(s) at 100.38.62.232:443. Relays do not publish descriptors until their ORPort and DirPort are reachable. Please check your firewalls, ports, address, /etc/hosts file, etc. Dec 20 09:17:01 mxh-HP-Compaq-Pro-6300-SFF CRON[18262]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly) Sent with [Proton Mail](https://proton.me/) secure email.

4 5