- tor-relays - lists.torproject.org

Fwd: Upcoming Tor security releases to fix a denial-of-service issue
by Nick Mathewson 16 Mar '20

16 Mar '20

---------- Forwarded message --------- From: Nick Mathewson <nickm(a)torproject.org> Date: Mon, Mar 16, 2020 at 1:25 PM Subject: Upcoming Tor security releases to fix a denial-of-service issue To: <tor-talk(a)lists.torproject.org> Hello! Some time this week, we currently plan to put out a set of security updates for all supported versions of Tor. These releases will fix a pair of denial-of-service bugs: one that we are classifying at "low" severity, and one that we are classifying at "high" severity. Our recommendation will be for everybody, including relays and clients, to upgrade once packages are available for their platforms. Although these vulnerabilities are "only" denial-of-service issues, any denial-of-service attack against Tor could be leveraged by an attacker to aid in a traffic analysis attack. To the best of our knowledge, these vulnerabilities are not being exploited in the wild. Currently supported release series are 0.3.5, 0.4.1, 0.4.2, and 0.4.3 (alpha). If you have not yet upgraded to one of those, the time to do so is soon. For our policy and process for handing security issues, please see: https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/Securit… best wishes, -- Nick

1 0

Consensus Weight Dropping/Authority Issues?
by John Ricketts 16 Mar '20

16 Mar '20

Hello, I have been watching the consensus weight and bandwidth of all of my 50 exit nodes drop consistently over the past few months. I have not made any hardware changes in my data center and actual customers have not complained about any performance issues. Operating systems and Tor version are up to date. I'm dedicating a significant portion of bandwidth to these nodes - 10gbit/sec. Am I having issues with the bandwidth authorities? I'm growing frustrated with my performance to resources ratio, I should be doing far better than this. Please throw ideas at me - open to any ideas. Thanks! John Quintex Alliance Consulting

7 11

tor relay
by Станислав 14 Mar '20

14 Mar '20

hi.I start second instance of tor, but for some reason it stopped working.after updating the firmware on board pc engines apu2 Mar 09 13:48:46.000 [notice] Bootstrapped 0% (starting): Starting Mar 09 13:49:03.000 [notice] Starting with guard context "default" Mar 09 13:49:03.000 [warn] Unable to parse '/etc/resolv.conf', or no nameservers in '/etc/resolv.conf' (1) Mar 09 13:49:03.000 [warn] Couldn't set up any working nameservers. Network not up yet? Will try again soon. Mar 09 13:49:03.000 [notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Mar 09 13:49:04.000 [notice] Bootstrapped 5% (conn): Connecting to a relay Mar 09 13:49:04.000 [warn] Unable to parse '/etc/resolv.conf', or no nameservers in '/etc/resolv.conf' (1) Mar 09 13:49:04.000 [notice] Bootstrapped 10% (conn_done): Connected to a relay Mar 09 13:49:04.000 [notice] Bootstrapped 14% (handshake): Handshaking with a relay Mar 09 13:49:05.000 [notice] Bootstrapped 15% (handshake_done): Handshake with a relay done Mar 09 13:49:05.000 [notice] Bootstrapped 75% (enough_dirinfo): Loaded enough directory info to build circuits Mar 09 13:49:05.000 [notice] Bootstrapped 90% (ap_handshake_done): Handshake finished with a relay to build circuits Mar 09 13:49:05.000 [notice] Bootstrapped 95% (circuit_create): Establishing a Tor circuit Mar 09 13:49:06.000 [notice] Bootstrapped 100% (done): Done Mar 09 13:50:05.000 [notice] Self-testing indicates your DirPort is reachable from the outside. Excellent. Publishing server descriptor. Mar 09 13:50:08.000 [notice] Performing bandwidth self-test...done. Mar 09 13:51:32.000 [notice] Received reload signal (hup). Reloading config and resetting internal state. Mar 09 13:51:32.000 [notice] Read configuration file "/etc/tor/torrc1". Mar 09 13:51:32.000 [notice] Your ContactInfo config option is not set. Please consider setting it, so we can contact you if your server is misconfigured or something else goes wrong. Mar 09 13:51:32.000 [warn] MyFamily is set but ContactInfo is not configured. ContactInfo should always be set when MyFamily option is too. Mar 09 13:51:32.000 [notice] Tor 0.4.2.5 opening log file. Mar 09 13:51:32.000 [warn] Unable to parse '/etc/resolv.conf', or no nameservers in '/etc/resolv.conf' (1) Mar 09 13:51:32.000 [err] set_options(): Bug: Acting on config options left us in a broken state. Dying. (on Tor 0.4.2.5 ) Mar 09 13:51:32.000 [err] Reading config failed--see warnings above. For usage, try -h. Mar 09 13:51:32.000 [warn] Restart failed (config error?). Exiting. С уважением, Станислав

7 12

Relays will be getting clock skew warnings today
by Roger Dingledine 14 Mar '20

14 Mar '20

Hi folks! One of the directory authorities, dizum, has a wrong clock today. And it is causing warning lines for every relay who interacts with it. :( The log lines will look like this: Mar 14 16:17:40.121 [warn] Received directory with skewed time (DIRSERV:45.66.33.45:80): It seems that our clock is behind by 2 hours, 0 minutes, or that theirs is ahead. Tor requires an accurate clock to work: please check your time, timezone, and date settings. I contacted the directory authority operator and he is working on fixing it. Hopefully he'll get it fixed today, and we can point the flood of concerned mails to this thread. :) Thanks, --Roger

1 0

Any tor relay watchdog services?
by Layer13 13 Mar '20

13 Mar '20

Hello, I'm writing to query about tor relay watchdogs and ask if there are any services to check if tor reachable from the internet and if not it would send me an automated email telling me that my relay is down. A little bit of backstory on why I need this: so a couple of days ago (13 to be exact) my server had an issue and rebooted, since that reboot I didn't start my relay node and it was down for 13 days until I noticed it today.

3 2

website support
by potlatch 13 Mar '20

13 Mar '20

Hello Tor, I have a few exit relays on the Tor network but generally I'm flying blind. Why isn't there an index of tor relays that can be accessed? Why isn't the tor access via it's website able to deliver me to the software pages? Why is the graphic display of tor connections over 5-years old? I thought tor was expert in data delivery and security. potlatch(a)protonmail.com Sent with [ProtonMail](https://protonmail.com) Secure Email.

4 3

tor relay
by Станислав 10 Mar '20

10 Mar '20

system openwrt.I have a bunch of odhcpd+unbound.on a unbound works dns-over-tls in end face log torrc these errors.are what could be the problem? the unbound is not configured correctly. Mar 09 15:13:37.000 [warn] Unable to parse '/etc/resolv.conf', or no nameservers in '/etc/resolv.conf' (1) Mar 09 15:23:37.000 [warn] Unable to parse '/etc/resolv.conf', or no nameservers in '/etc/resolv.conf' (1) Mar 09 15:33:37.000 [warn] Unable to parse '/etc/resolv.conf', or no nameservers in '/etc/resolv.conf' (1) Mar 09 15:43:37.000 [warn] Unable to parse '/etc/resolv.conf', or no nameservers in '/etc/resolv.conf' (1) Mar 09 15:53:37.000 [warn] Unable to parse '/etc/resolv.conf', or no nameservers in '/etc/resolv.conf' (1) Mar 09 16:03:37.000 [warn] Unable to parse '/etc/resolv.conf', or no nameservers in '/etc/resolv.conf' (1) Mar 09 16:13:37.000 [warn] Unable to parse '/etc/resolv.conf', or no nameservers in '/etc/resolv.conf' (1) Mar 09 16:23:37.000 [warn] Unable to parse '/etc/resolv.conf', or no nameservers in '/etc/resolv.conf' (1) Mar 09 16:33:37.000 [warn] Unable to parse '/etc/resolv.conf', or no nameservers in '/etc/resolv.conf' (1) Mar 09 16:43:37.000 [warn] Unable to parse '/etc/resolv.conf', or no nameservers in '/etc/resolv.conf' (1) С уважением, Станислав

2 1

Re: [tor-relays] Dirport9030
by Nuno Rego 10 Mar '20

10 Mar '20

Problem solved. Cumprimentos; -- Securely sent with Tutanota. Get your own encrypted, ad-free mailbox: https://tutanota.com Mar 4, 2020, 21:37 by : > I have a problem.> > I am learning, and I have 4 active relays.> > I used the same configuration on the 4. Recently 2 of them lost the Guard, HSdir and V2Dir flags.> > On the page > https://metrics.torproject.org/rs.html#search/TugaOnion> I see that DirPort is 0 instead of 9030. I haven't changed anything, and in the relay configuration there is 9030. Any suggestions on how to solve the problem> > ? > > Cumprimentos; > > -- > Securely sent with Tutanota. Get your own encrypted, ad-free mailbox: > https://tutanota.com >

3 3

Re: [tor-relays] How to Limit Bridge Traffic
by entensaison＠use.startmail.com 06 Mar '20

06 Mar '20

Hi, On Thursday, March 5, 2020 at 8:24 PM, Imre Jonk <imre(a)imrejonk.nl> wrote: > Hi Eddie, > > On Wed, 2020-03-04 at 12:34 -0800, Eddie wrote: >> Does BandwidthRate apply to bridges. I can (hopefully) guess that >> RelayBandwidth doesn't. >> Does the AccountingMax apply. > I am almost certain that all three options apply to bridges as well. > Note that BandwidthRate applies to all TCP data (not the TCP headers > or > DNS traffic), while RelayBandwidth* applies to the _relayed traffic_ > only. > >> I noticed the following in the manual: >> >> If you have bandwidth cost issues, enabling hibernation is >> preferable >> to setting a low bandwidth, since it provides users with a >> collection >> of fast servers that are up some of the time, which is more useful >> than a set of slow servers that are always "available". >> >> Does that advice apply equally to bridges, assuming that the >> Accounting options do apply. Or would it more advantageous for a >> bridge to be constantly available, as switching bridges isn't as >> seamless as switching relays. > That's an interesting question. Bridges are required to provide at > least 1 Mbit/s bandwidth, but I can't find anything related to uptime > requirements (except for the two hours a day minimum). I'd say that > the > advice therefore also applies to bridges. The Tor client software can > be configured to use multiple bridges. I would say the recommendation to use AccountingMax does not apply for bridges. It's just a subjective impression but there are often people complaining that most bridges they get handed out don't work or stop working after a short time. Some of these people end up believing that they are unable to use Tor at all from their location, because their adversary successfully detected the bridge. (Which might be true in some cases.) In order to avoid confusion for people who depend on using bridges it seems to make more sense to limit the bandwith instead.

1 0

How to Limit Bridge Traffic
by Eddie 05 Mar '20

05 Mar '20

Hi, I'm quite happy to continue to run a couple of bridges on my VPC, but I need to understand how to manage the bandwidth so I'm not being charged for exceeding it's monthly allocation. Does BandwidthRate apply to bridges. I can (hopefully) guess that RelayBandwidth doesn't. Does the AccountingMax apply. I noticed the following in the manual: If you have bandwidth cost issues, enabling hibernation is preferable to setting a low bandwidth, since it provides users with a collection of fast servers that are up some of the time, which is more useful than a set of slow servers that are always "available". Does that advice apply equally to bridges, assuming that the Accounting options do apply. Or would it more advantageous for a bridge to be constantly available, as switching bridges isn't as seamless as switching relays. Cheers.

2 1