March 2023 - tor-relays - lists.torproject.org

Storing ed25519_master_id_secret_key[_encrypted] on a smartcard?
by telekobold 04 Mar '23

04 Mar '23

Dear fellow relay operators, currently, I'm operating a Tor relay (Middle/Guard) and a Tor Bridge. Offline keys [1],[2] are a good way to secure a Tor relay, but I'm wondering if there is a standard way or something like a hacking guide how to store your ed25519_master_id_secret_key[_encrypted] on a smartcard or hardware token like a Nitrokey or Yubikey? This would even be more secure than storing it on a "normal" USB device. Unfortunately I have not found much about this on the internet. Kind regards telekobold [1] https://support.torproject.org/relay-operators/offline-ed25519/ [2] https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorRelaySecurity/Offl…

1 1

RFC: does a private exit would work?
by Toralf Förster 04 Mar '23

04 Mar '23

tl;dr; restricted access + usage of an exit longer: An exit is sooner or later abused. A reduced exit policy does not prevent that. What about setup a tor exit relay with 'PublishServerDescriptor = 0' ? Having an access line like for bridges would restrict the access. An alternative could be a port knockig + iptables solution. Objections and comments are welcome. -- Toralf

5 5

Preferred range for ephemeral ports
by binarynoise 03 Mar '23

03 Mar '23

Hello everyone, I just set up a snowflake proxy on my pi at home. Unfortunately I can only forward 255 ports to my pi (at once, or is there a way to trick my Fritz!box into allowing more?). Which is the preferred range for -ephemeral-ports-range when it needs to be restricted to allow the most users to connect? Is 60000:60250 ok? Greetings binarynoise

2 1

removing tor versions from "recommended versions" before they reach EOL
by nusenu 01 Mar '23

01 Mar '23

Hi, the tor 0.4.5.x end of live versions are still on the recommended versions list: https://consensus-health.torproject.org/#recommendedversions > consensus client-versions 0.4.5.6, 0.4.5.7, 0.4.5.8, 0.4.5.9, 0.4.5.10, 0.4.5.11, 0.4.5.12, 0.4.5.14, 0.4.5.15, 0.4.5.16, 0.4.7.7, 0.4.7.8, 0.4.7.10, 0.4.7.11, 0.4.7.12, 0.4.7.13 > server-versions 0.4.5.6, 0.4.5.7, 0.4.5.8, 0.4.5.9, 0.4.5.10, 0.4.5.11, 0.4.5.12, 0.4.5.14, 0.4.5.15, 0.4.5.16, 0.4.7.7, 0.4.7.8, 0.4.7.10, 0.4.7.11, 0.4.7.12, 0.4.7.13 it would probably be better to stop recommending tor versions a month before they reach their eol date so relay operators get to see a log entry and have some time to react. kind regards, nusenu -- https://nusenu.github.io

2 1