- tor-relays - lists.torproject.org

Re: [tor-relays] Snowflakes
by entensaison＠use.startmail.com 31 Oct '20

31 Oct '20

Hi Toralf and Gus, Thanks for your replies! On Wednesday, October 28, 2020 at 4:11 PM, Toralf Förster <toralf.foerster(a)gmx.de> wrote: > On 10/26/20 5:32 PM, entensaison(a)use.startmail.com wrote: >> Hi everybody, >> I'm not sure this is the right list to ask, but is it useful to run >> snowflake proxies? > I'd say yes. > > FWIW I do run it as a ordinary Linux service (git clone + go build) > instead as a plugin in my browser here under Gentoo Linux at my > desktop. > So the proxy runs even if I close the browser. > > FWIW the plugin tells me : > > Number of users your Snowflake has helped circumvent censorship in > the > last 24 hours: 5 > > :-) > > -- > Toralf > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

How to manually change overloaded Guard?
by petrarca＠protonmail.ch 31 Oct '20

31 Oct '20

Since tonight I can't get any usable Tor connections anymore; restarting Tor gives the following error message: Guard TOR2DFNrelB ($0ED0EA324C931CF41CB5272BFB1D015B3D5772A9) is failing more circuits than usual. Most likely this means the Tor network is overloaded. Success counts are 152/217. Use counts are 45/59. 167 circuits completed, 13 were unusable, 2 collapsed, and 51 timed out. For reference, your timeout cutoff is 60 seconds. Any idea how to change the Guard - just restarting Tor doesn't help?

2 1

Snowflakes
by entensaison＠use.startmail.com 28 Oct '20

28 Oct '20

Hi everybody, I'm not sure this is the right list to ask, but is it useful to run snowflake proxies? I only recently realized they can be run by ordinary people. On the new website I don't see how you would find that out, there doesn't seem to be any link pointing to them. Metrics only shows a hundred snowflake users. What is the reason they are not advertised for? (towards humans) Have a nice day!

3 2

Re: [tor-relays] Fw: Can't update tor relay on Debian, and notice about tor log file
by Keifer Bly 27 Oct '20

27 Oct '20

Torix, I just tried your workaround, the issue still occurs. Thank you. --Keifer On Tue, Oct 27, 2020 at 1:58 PM <torix(a)protonmail.com> wrote: > Dear Keifer, > > Just guessing here, but have you tried reverting your sources.list to http? > > As for the notices and notices.1, this seems like normal linux log > rotation. See if you don't have an /etc/logrotate.d/tor file that gives > the structure of how the tor log is handled. Mine is set to rotate to a > new file daily, so notices.log is renamed to notices.log.1, and the new log > is notices.log. Notices.log.1 is zipped up to notices.2.tgz, and so on, and > the last 5 days of files are kept before being deleted. > > --Torix > > > Sent with ProtonMail <https://protonmail.com> Secure Email. > > ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ > On Tuesday, October 27, 2020 8:30 PM, Keifer Bly <keifer.bly(a)gmail.com> > wrote: > > Hi all, so for my bridge at > > > https://metrics.torproject.org/rs.html#details/EF36AE38C162E96E0645E1DF25EF… > > > > I am some reason unable to update tor and obfs4 to the newest version. Upon running sudo apt update && sudo apt install -y --only-upgrade tor > > > > I am getting an error saying that updating from such a resprrtory can’t be > done securely and is therefor disabled by default. I have the following > entered in Debian file /etc/apt/sources.list: > > > > > > deb https://deb.torproject.org/torproject.org focal main > deb-src https://deb.torproject.org/torproject.org focal main > > > > So am not sure why it thinks this is insecure. > > > > Another thing I noticed, it seems that for some reason, for the tor > traffic log file, it switches from writing to notices.log to notices.log.1 > automatically after a while, this happened on both my bridge and my relay > though I did not tell it to do this. > > > > I wonder why the update error is happening, thank you. > > >

1 0

recently saw 4 tor relays in row on tails. bug in tor?
by BRBfGWMz 26 Oct '20

26 Oct '20

I recently saw a series of 4 relays connected to each other: itomori, MediumSlesmn, hotbrownie, pellidos itomori, docto, Geheimschreiber, 420isGay Dont most relays in the network of length 3? Bug in tor? \-- Sent using MsgSafe.io's Free Plan Private, encrypted, online communication For everyone. https://www.msgsafe.io

3 3

relay got suspended
by Paul Geurts 25 Oct '20

25 Oct '20

hi y'all, one of my relays got suspended today, because of heavy ddos traffic. *Hello,* *Today your VPS IP address was heavily attacked by a large DDoS, so we were forced to suspend the VPS and null the IP for the time being, since it had overloaded our upstream provider. We are keeping an eye on the situation, however in the meantime you will want to get your site behind a DDoS filter such as CloudFlare.* *Let us know if you have any further questions.* *Thank you!* *Adam* has any of you see this behauvior? I think there is no use in putting a relay behind a ddos filter, or is there? In that case I'll just spin up another one. relay in question is this one, almost 7 months with no interuption what so ever, no indication in the (munin) monitoring for high or higher traffic... because the vps is suspended I don't have the latest syslog so I don't know for sure whether anything has shown up there, but I am quite sure that yesterday there were no abnormal logging entries on this server. https://metrics.torproject.org/rs.html#details/CDE4149F0DC65A7BE1AE440340BE… rgds,. Paul

4 3

FreeBSD and Libressl from the ports
by Felix 25 Oct '20

25 Oct '20

Hi everybody :: That post went as well to tor-bsd(a)lists.nycbug.org but is reposted here for a potential higher attendance :: This is for those who run FreeBSD and Libressl from the ports. Because of the issue [0] we can not compile from source. Maybe you can use Libressl from the base system or you overwrite the security/libressl or security/libressl-devel port with an older version like 3.2.0 and compile from there. (Uhh, you can go with Openssl until the fix is in place) Please find the ports files in [1]. Libressl 3.2.0 works with Tor 4.4.x like a charme. Libressl 3.2.1 and 3.2.2 cause an issue with some Tor auths. Libressl 3.2.2 is/was devel and sits as well in non-devel, so we can not switch back this time :( . [0] https://gitlab.torproject.org/tpo/core/tor/-/issues/40128 [1] https://svnweb.freebsd.org/ports/head/security/libressl/ -- Cheers, Felix

1 0

My Tor exit node not visible
by netaudit 21 Oct '20

21 Oct '20

Hi there, I've set up a new Tor exit node around 15 hours ago but despite it had been such a time and my exit is visible from outside world I still get little to no traffic at all. I also cannot see my servers IP on bulk tor exit node list. I checked the logs and everything seems alright too: [notice] Self-testing indicates your DirPort is reachable from the outside. Excellent. [notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor. Can you please tell me what I am missing here? Thank you Sent with [ProtonMail](https://protonmail.com) Secure Email.

6 6

ContactInfo Spec Version 2 is released
by nusenu 20 Oct '20

20 Oct '20

Hi, I'm happy to announce version 2 of the ContactInfo Information Sharing Specification. https://nusenu.github.io/ContactInfo-Information-Sharing-Specification/ It comes with an easy to use ContactInfo generator, which is maintained by Eran Sandler: https://torcontactinfogenerator.netlify.app/ Example ContactInfo string as defined by this specification: email:tor[]example.com url:https://example.com proof:uri-rsa uplinkbw:100 ciissversion:2 In words this ContactInfo string means: - the technical contact for this relay can be reached at tor(a)example.com - the entity responsible for this relay has a website at https://example.com - the proof file to verify the url can be fetched from https://example.com/.well-known/tor-relay/rsa-fingerprint.txt - this tor instance can provide a bandwidth up to 100 Mbit/s - this string implements version 2 of this specification The spec has many fields to choose from but I'd like to highlight these 3 fields, also used in the example above, as some of the most relevant: - email - url - proof The proof field allows operators to make their URL value verifyable (protected against spoofing) by placing their relay fingerprints in a text file located on their website. If no website is available DNS TXT records can be used instead. Now that version 2 is out, we will work on parsing to provide operators with an easy way to check their strings (and maybe also their proofs) interactively. I intend to use the data as input for OrNetStats as operators start to set their ContactInfo strings. I have operator-level graphs in mind, showing the operator how his set of relays evolved over time. See https://raw.githubusercontent.com/nusenu/tor-network-observations/master/pn… for an example. The timespan will likely be significantly smaller than the one used in this example. The release of version 2 marks the deprecation of version 1. I aim to support version 2 for at least 2 years and aim to make future releases backward compatible. I've no plans to significantly change or extend the amount of fields, with the exception of one potentially interesting use-case (see the bottom of this email). Many changes that went into version 2 are directly related to your comments after publishing version 1, thanks for that! We also got feedback for the generator and are tracking them here: https://github.com/erans/torcontactinfogenerator/issues Changelog ---------- Most notable changes since version 1: - 'operatorurl' got renamed to just "url" - "verifyurl" field simplified/replaced with "proof" (no longer requires a webserver) - email field is no longer mandatory - UTF-8 support - xmr (monero) field added - bitcoin field renamed to btc - zcash field renamed to zec - PGP keys should be on keys.openpgp.org (verifying keyserver) - removed fields: KIST, ricochet Future Idea Since some had concerns about spam: It would be trivial to add support for an encrypted email address when the operator has a webserver and a verified url field. If there is some demand for this and the Tor Project is willing to publish a GPG key that can be used for encryption I'll add support for it. That would mean only the persons at the torproject having access to that key could fetch the encrypted address and decrypt it with their private key, others would only see "encemail:y" or similar. kind regards, nusenu

3 2

Collaborative Bad-Abuse-Sender Blocklist
by Matt Corallo 19 Oct '20

19 Oct '20

Hi all, I run a few relatively-small exit nodes, and still get a decent flow of the usual Fail2Ban, blocklist.de, and such garbage to abuse PoCs. I tend to proactively find appropriate abuse/noc contacts to provide a response informing them of how they can appropriately block all Tor exits from their SSH ports if they wish, but often get either no or indignant responses about how sending a stream of garbage abuse reports is a useful service to the internet (nevermind that most large providers don't bother handling abuse reports anymore because of exactly this behavior). After a reply or two I usually add senders to a blocklist and bounce them at the mailserver with a notice about spam not being useful. Is there any interest in building up a shared blocklist of senders who feel its their right to send Fail2Ban emails in non-machine-parsable formats and not bother handling replies to their emails they expect others to handle, or does anyone already have such a list? Matt

4 6