March 2023 - tor-relays - lists.torproject.org

recommended way to run 0.4.7 on armhf?
by ilf 25 Nov '23

25 Nov '23

What's the recommended way to run 0.4.7 on armhf? > The package repository [deb.torproject.org] does not offer 32-bit ARM > architecture (armhf) images (yet). https://support.torproject.org/apt/tor-deb-repo/ Debian has 0.4.7 in bullseye-backports. But Raspbian doesn't have bullseye-backports: http://raspbian.raspberrypi.org/raspbian/dists/ -- ilf If you upload your address book to "the cloud", I don't want to be in it.

3 6

Help Turkmens to bypass Internet censorship: run an obfs4 bridge!
by gus 02 Aug '23

02 Aug '23

Dear Relay operators community, The parliamentary elections in Turkmenistan are coming up very soon on March 26th[1], and the Turkmen government has tightened internet censorship and restrictions even more. In the last few months, the Anti-censorship community has learned that different pluggable transports, like Snowflake, and entire IP ranges, have been blocked in the country. Therefore, running a bridge on popular hosting providers like Hetzner, Digital Ocean, Linode, and AWS won't help as these providers' IP ranges are completely blocked in Turkmenistan. Recently, we learned from the Anti-censorship community[2] and via Tor user support channels that Tor bridges running on residential connections were working fine. Although they were blocked after some days or a week, these bridges received a lot of users and were very important to keep Turkmens connected. How to help Turkmens to access the Internet =========================================== You can help Turkmens to access the free and open internet by running an obfs4 Tor bridge! But here's the trick: you need to run it on a residential connection -- you won't need a static IPv4 --, and it would ideally be run on more robust hardware than just a Raspberry Pi (although that can help, we have found they can get overloaded). You can set up an obfs4 bridge by following our official guide: https://community.torproject.org/relay/setup/bridge/ After you setup a new bridge, you can share your bridge line with the Tor support team at frontdesk(a)torproject.org, and we will share it with users. A complete bridge line is composed of: IP:OBFS4_PORT FINGERPRINT cert=obfs4-certificate iat-mode=0 Check this documentation to learn how to share your bridge line: https://community.torproject.org/relay/setup/bridge/post-install/ Just sharing your bridge fingerprint is not the best, but it's fine. You can read more about censorship against Tor in Turkmenistan here: - https://gitlab.torproject.org/tpo/anti-censorship/censorship-analysis/-/iss… - Snowflake blocked: https://gitlab.torproject.org/tpo/anti-censorship/censorship-analysis/-/iss… Thank you for your support in helping to keep the internet free and open for everyone. Gus [1] https://en.wikipedia.org/wiki/2023_Turkmen_parliamentary_election [2] https://ntc.party/c/internet-censorship-all-around-the-world/turkmenistan/17 https://github.com/net4people/bbs/issues/80 -- The Tor Project Community Team Lead

7 24

Tor Relay Operator Meetup - April 15th, 2023 at 19 UTC
by gus 22 May '23

22 May '23

Hello, The next Tor Relay Operator Meetup will happen on April 15th, 2023, at 19 UTC. We're still working on the agenda, feel free to add your topics and/or questions on the pad: https://pad.riseup.net/p/tor-relay-op-meetup-april-keep onionsite: http://kfahv6wfkbezjyg4r6mlhpmieydbebr5vkok5r34ya464gqz6c44bnyd.onion/p/tor… WHERE Room link: https://tor.meet.coop/gus-og0-x74-dzn Registration No need for a registration or anything else, just use the room-link above. We will open the room 10 minutes before so you can test your mic setup. Please share with your friends, social media and other mailing lists! Gus -- The Tor Project Community Team Lead

2 2

PSA: Tor 0.4.5 reaches end of life (EOL) on 2023-02-15
by Georg Koppen 17 May '23

17 May '23

Hello! In case it affects you as you are still running your relay or bridge on Tor 0.4.5.x: the 0.4.5 series is going EOL on *2023-02-15* (roughly in 3 weeks from now). That's currently still 760 relays, which means roughly 7% of the advertised bandwidth of the network (and 387 bridges, which means roughly 9% of the advertised bridges bandwidth). Please make sure you have upgraded to the 0.4.7.x series by then. Supported releases in general can be found on the network team wiki.[1] Thanks, Georg [1] https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/CoreTorRele…

6 8

Open call for proposals for improving the health of the Tor relay operator community and the Tor network
by gus 11 May '23

11 May '23

Hello, We accomplished a number of things in our fight against malicious relays over the last 2 years[1]. One area we still need to focus on is strengthening our relay operator community. We're therefore currently collecting proposals from you or anyone else interested that could help to impove the health of the Tor relay operator community and, thus, provide our users a more trusted Tor network. We're accepting both new and old proposals, and we're open to any ideas you may have. Although there are various proposals for improving the network and the Tor relay operator community, not all of them are being enforced at the moment. Nevertheless, some proposals that can help on increasing trust have been adopted by a meaningful fraction of the Tor community (e.g. providing valid contact information). Another great example of such proposals is the "Expectations for Relay Operators"[2] document, where we guide relay operators to keep the Tor community and the network safe, healthy, and sustainable. We'd love to hear your proposal on how to make it more difficult for attackers to run relays while keeping it easy for good contributors to join our network. You can share your proposals on this GitLab ticket[3] and our tor-relays mailing list. It is worth noting that at the moment we are only trying to map these proposals to get an overview over the various options available. We're not in the process of approving any of them. If you have any experience, positive or negative, with Sybil-resistance and online abuse mitigation projects, we welcome your opinion as well. Since in this debate we have seen previous bad actors trying to game this process and thus lowering the effectiveness of our defenses, the Tor team will take all measures to stop people acting in bad faith and enforce the Tor Code of Conduct and policies. During the Tor Relay Operator Meetup on Saturday (March 4, 2023 - 19UTC), we will be discussing some of these proposals we've collected so far. Thank you, Gus [1] https://blog.torproject.org/malicious-relays-health-tor-network/ [2] https://gitlab.torproject.org/tpo/community/team/-/wikis/Expectations-for-R… [3] https://gitlab.torproject.org/tpo/community/relays/-/issues/55 -- The Tor Project Community Team Lead

4 11

Relay Bandwidth
by sysmanager7 03 Apr '23

03 Apr '23

Greetings all! Setting up a new Digital Ocean Tor Relay. DO is giving me 3000 Gig a month. Is there a tutorial that I can use to calculate the bandwidth? I've searched around the web and for some reason people seem to dance around the question. They give examples not relevant to me and zero math showing how the came to their answer. As usual, any help will be appreciated :-) Sysmanager7 Sent with [Proton Mail](https://proton.me/) secure email.

4 3

Re: [tor-relays] Selecting Exit Addresses
by denny.obreham＠a-n-o-n-y-m-e.net 31 Mar '23

31 Mar '23

The second IP is still in "Exit Addresses" with the new configuration ... https://metrics.torproject.org/rs.html#details/3B85067588C3F017D5CCF7D8F65B… torrc: Address 209.141.39.157 OutboundBindAddress 209.141.39.157 ORPort 9001 IPv4Only Denny denny.obreham(a)a-n-o-n-y-m-e.net wrote .. > Thanks Marco. > > First, I had to change my ORPort to 9001 with your proposed configuration because > using 443 caused an error => "Could not bind to 0.0.0.0:443: Address already in > use. Is Tor already running?" > Probably because my other Tor instance (hidden service) is using it. > > Now I'm just waiting for the metrics to update to see if everything is as expected. > > Finally, thanks for the help with IPv6 because I cannot get it to work. Somehow > when I try to check IPv6 availability ( https://community.torproject.org/relay/setup/post-install/ > ), I get "ping6: connect: Network is unreachable". I don't have time to set it > up right now (I already spent hours last week) so I'll get back to you for that. > > Denny > > lists(a)for-privacy.net wrote .. > > Hi denny, > > > > > Hi, > > > > > > I just activated my first exit relay. ( > > > https://metrics.torproject.org/rs.html#details/3B85067588C3F017D5CCF7D8F65B > > > 5881B7D4C97C ) I had the following in my torrc (plus some other things): > > > > I've answered the rest to the list. > > If you want to enable IPv6 at Frantech/BuyVM: > > > > First create one in Stallion from your given subnet. > > This is what my /etc/network/interfaces looks like at Frantech > > > > > > # This file describes the network interfaces available on your system > > # and how to activate them. For more information, see interfaces(5). > > > > source /etc/network/interfaces.d/* > > > > # The loopback network interface > > auto lo > > iface lo inet loopback > > > > # The primary network interface > > allow-hotplug eth0 > > iface eth0 inet static > > address 104.244.73.43/24 > > gateway 104.244.73.1 > > # dns-* options are implemented by the resolvconf package, if installed > > dns-nameservers 127.0.0.1 107.189.0.68 107.189.0.69 > > dns-search for-privacy.net > > > > iface eth0 inet6 static > > address 2605:6400:0030:f78b::2/64 > > up ip -6 route add 2605:6400:0030::1 dev eth0 > > up ip -6 route add default via 2605:6400:0030::1 > > down ip -6 route del default via 2605:6400:0030::1 > > down ip -6 route del 2605:6400:0030::1 dev eth0 > > dns-nameservers ::1 IPv6ns1 IPv6ns2 > > > > > > -- > > ╰_╯ Ciao Marco! > > > > Debian GNU/Linux > > > > It's free software and it gives you freedom!

2 1

Re: [tor-relays] Selecting Exit Addresses
by denny.obreham＠a-n-o-n-y-m-e.net 31 Mar '23

31 Mar '23

OK, finally got a configuration that looks like it works: Address 209.141.39.157 OutboundBindAddress 209.141.39.157 ORPort 209.141.39.157:9001 IPv4Only ORPort XXX.XXX.XXX.XXX:443 NoListen ORPort XXX.XXX.XXX.XXX:9001 NoListen Where XXX.XXX.XXX.XXX is the IP I didn't want to be used by my Tor exit relay. (The IPv4 flag is probably useless, I just didn't think to take it out after adding the IP to the port.) I'll see if abuse reports for my second IP will stop showing up on abuseipdb.com. Unless you find I did something wrong, thanks for helping, Denny denny.obreham(a)a-n-o-n-y-m-e.net wrote .. > The second IP is still in "Exit Addresses" with the new configuration ... https://metrics.torproject.org/rs.html#details/3B85067588C3F017D5CCF7D8F65B… > > torrc: > > Address 209.141.39.157 > OutboundBindAddress 209.141.39.157 > ORPort 9001 IPv4Only > > Denny > > denny.obreham(a)a-n-o-n-y-m-e.net wrote .. > > Thanks Marco. > > > > First, I had to change my ORPort to 9001 with your proposed configuration because > > using 443 caused an error => "Could not bind to 0.0.0.0:443: Address already > in > > use. Is Tor already running?" > > Probably because my other Tor instance (hidden service) is using it. > > > > Now I'm just waiting for the metrics to update to see if everything is as expected. > > > > Finally, thanks for the help with IPv6 because I cannot get it to work. Somehow > > when I try to check IPv6 availability ( https://community.torproject.org/relay/setup/post-install/ > > ), I get "ping6: connect: Network is unreachable". I don't have time to set it > > up right now (I already spent hours last week) so I'll get back to you for that. > > > > Denny > > > > lists(a)for-privacy.net wrote .. > > > Hi denny, > > > > > > > Hi, > > > > > > > > I just activated my first exit relay. ( > > > > https://metrics.torproject.org/rs.html#details/3B85067588C3F017D5CCF7D8F65B > > > > 5881B7D4C97C ) I had the following in my torrc (plus some other things): > > > > > > I've answered the rest to the list. > > > If you want to enable IPv6 at Frantech/BuyVM: > > > > > > First create one in Stallion from your given subnet. > > > This is what my /etc/network/interfaces looks like at Frantech > > > > > > > > > # This file describes the network interfaces available on your system > > > # and how to activate them. For more information, see interfaces(5). > > > > > > source /etc/network/interfaces.d/* > > > > > > # The loopback network interface > > > auto lo > > > iface lo inet loopback > > > > > > # The primary network interface > > > allow-hotplug eth0 > > > iface eth0 inet static > > > address 104.244.73.43/24 > > > gateway 104.244.73.1 > > > # dns-* options are implemented by the resolvconf package, if installed > > > dns-nameservers 127.0.0.1 107.189.0.68 107.189.0.69 > > > dns-search for-privacy.net > > > > > > iface eth0 inet6 static > > > address 2605:6400:0030:f78b::2/64 > > > up ip -6 route add 2605:6400:0030::1 dev eth0 > > > up ip -6 route add default via 2605:6400:0030::1 > > > down ip -6 route del default via 2605:6400:0030::1 > > > down ip -6 route del 2605:6400:0030::1 dev eth0 > > > dns-nameservers ::1 IPv6ns1 IPv6ns2 > > > > > > > > > -- > > > ╰_╯ Ciao Marco! > > > > > > Debian GNU/Linux > > > > > > It's free software and it gives you freedom!

1 0

Re: [tor-relays] Selecting Exit Addresses
by denny.obreham＠a-n-o-n-y-m-e.net 31 Mar '23

31 Mar '23

Thanks Marco. First, I had to change my ORPort to 9001 with your proposed configuration because using 443 caused an error => "Could not bind to 0.0.0.0:443: Address already in use. Is Tor already running?" Probably because my other Tor instance (hidden service) is using it. Now I'm just waiting for the metrics to update to see if everything is as expected. Finally, thanks for the help with IPv6 because I cannot get it to work. Somehow when I try to check IPv6 availability ( https://community.torproject.org/relay/setup/post-install/ ), I get "ping6: connect: Network is unreachable". I don't have time to set it up right now (I already spent hours last week) so I'll get back to you for that. Denny lists(a)for-privacy.net wrote .. > Hi denny, > > > Hi, > > > > I just activated my first exit relay. ( > > https://metrics.torproject.org/rs.html#details/3B85067588C3F017D5CCF7D8F65B > > 5881B7D4C97C ) I had the following in my torrc (plus some other things): > > I've answered the rest to the list. > If you want to enable IPv6 at Frantech/BuyVM: > > First create one in Stallion from your given subnet. > This is what my /etc/network/interfaces looks like at Frantech > > > # This file describes the network interfaces available on your system > # and how to activate them. For more information, see interfaces(5). > > source /etc/network/interfaces.d/* > > # The loopback network interface > auto lo > iface lo inet loopback > > # The primary network interface > allow-hotplug eth0 > iface eth0 inet static > address 104.244.73.43/24 > gateway 104.244.73.1 > # dns-* options are implemented by the resolvconf package, if installed > dns-nameservers 127.0.0.1 107.189.0.68 107.189.0.69 > dns-search for-privacy.net > > iface eth0 inet6 static > address 2605:6400:0030:f78b::2/64 > up ip -6 route add 2605:6400:0030::1 dev eth0 > up ip -6 route add default via 2605:6400:0030::1 > down ip -6 route del default via 2605:6400:0030::1 > down ip -6 route del 2605:6400:0030::1 dev eth0 > dns-nameservers ::1 IPv6ns1 IPv6ns2 > > > -- > ╰_╯ Ciao Marco! > > Debian GNU/Linux > > It's free software and it gives you freedom!

1 0

Selecting Exit Addresses
by denny.obreham＠a-n-o-n-y-m-e.net 31 Mar '23

31 Mar '23

Hi, I just activated my first exit relay. ( https://metrics.torproject.org/rs.html#details/3B85067588C3F017D5CCF7D8F65B… ) I had the following in my torrc (plus some other things): SocksPort 0 ControlPort 9052 ORPort 209.141.39.157:443 I have 2 IPs on my server and I wanted Tor to use 209.141.39.157. I thought setting it with ORPort would suffice. But under "Exit Addresses" in the metrics it was my other IP. So I added the following in my torrc: Address 209.141.39.157 OutboundBindAddress 209.141.39.157 And now I have both IPs in the "Exit Addresses". How can I prevent my exit relay from using the other IP? Note that I have also another instance of Tor running a hidden service that I intended to run on the other IP. Denny

2 2