- tor-relays - lists.torproject.org

Tor Browser and Relay
by Gary 11 Apr '18

11 Apr '18

Hello. I wish to know if it is possible to have Tor Browser use my relay for traffic instead of its own client on start up. At the moment if you change the proxy settings to your relay after startup 1) an observer would of noticed the specific Tor Browser traffic AND the relay 2) Tor Browser checks settings upon startup and if the proxy server setting is changed (eg 127.0.0.1:9050 instead of 127.0.0.1:9150) then it will refuse to start up. This isnt necessary a problem as you can just re-install / re-extract the bundle but upon start up you are still left with the default setting / specific Tor Browser traffic again. I am aware extra bytes will show up on relay search, is this better than not using Tor for my use at all? Thanks.

2 2

Let's increase the amount of exit relays doing DNSSEC validation
by nusenu 10 Apr '18

10 Apr '18

Dear Tor Exit Relay Operator, thanks for operating tor exit relays! In addition to forwarding packets exit relays also do DNS hostname resolution on behalf of tor clients. DNSSEC [1] is a standard that allows DNS clients to validate the authenticity of DNS records (if the domain owner choose to enable DNSSEC). By enabling DNSSEC on your exit relay DNS resolver you (and therefore also tor clients) are less prone to DNS-based attacks. A test of the tor network showed that only 74% of exit relay capacity does DNSSEC validation, please help us increase that number to >90% by enabling DNSSEC validation on your exit. Bellow is a list of tor ContactInfo strings from operators that currently do not enable DNSSEC validation yet. (The list is ordered by provided exit capacity - bigger operators are on the top) If you wonder "how do I enable DNSSEC?" I recommend a local caching unbound (https://unbound.net/) DNS resolver without using an upstream DNS forwarder. thanks for considering DNSSEC, nusenu -- https://mastodon.social/@nusenu twitter: @nusenu_ [1] https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions +-----------------------------------------------------------------------------------------------------------------------------------------------------------+ | apx <kenan(a)sly.mn> - 114x2PzqXhfPjQUMVqkcpi8DZN9du8GJGV | | abuse[__aT ]necto|doT--|onion | | http://tor.jonny.mobi <torsupport .AT. jonny .DOT. mobi> | | tor.noisebridge.net <admin(a)tor.noisebridge.net> | | tor-relay-admin robgjansen com | https://onioncount.github.io/ | | Walter Heukels <walter(a)badexample.net> | | ICSI Research <icsi.tor.abuse(a)gmail.com> | | Tor Admin <tor-admin AT ip dot fail> | | tor-relays(a)coldhak.ca | | drift(a)multinet.no - 1Geq8GGC7qTh7dfptneAYtpeARPAL8B2kh | | sirmatt ksu edu 0x94FBBB0A https://onioncount.github.io/ | | 0x7A8647DB Daniel Winzen <d(a)winzen4.de> - 1CHvjeMJum2Zfd3JEdb35RUEdz1jjQvdPT | | <zwiebeln at online de> please donate BTC 1K38x9xqK3YDzjehYFAEPzsESEC4ScH5wJ | | John L. Ricketts, PhD <john AT quintex dot com> | | Eran Sandler <eran(a)sandler.co.il> | | BPM/Squalala - contact42bpm(at)gmail(dot)com | | Institute of Networks and Security <office(a)ins.jku.at> | | dhalgren.tor(a)gmail.com | | Random Person <tor AT cusse.org> | | Jens Ostermann <root AT tor-operator dot org> | | 0x9F29C15D42A8B6F3 Nos oignons <adminsys(a)nos-oignons.net> - 17WLwtW63FrHeMAEVkALnwhfmizBxGXDW1 | | kl.forwarder(a)gmail.com | | Tor Reactor <0d0[AT]protonmail.com> | u42omsvzmh7momdk.onion | BTC:13LDJSosDpDbNbXTiRuETdi2Czhq98NijP | Ether:0xBcfe6D44ce74E773011070B45bf482E7044F22aa | | openinternet.io BTC: 15bx85H6pkkF4eHmkdVqnKDTHz28PDXcgu | | 0xDD7831FC Matthias Kretschmann <m AT kretschmann dot io> - 171qDmKEXm9YBgBLXyGjjPvopP5o9htQ1V | | Random Person <tor-admin(a)portaltodark.world> | | Bysmyyr You will find my name with google, then firstname(a)lastname.org | | tor AT garbage-juice dot com | | paul at coffswifi dot net | | Neel Chauhan <neel AT neelc DOT org> | BTC: 1KogNvxdcXydDUNrPgqgtgV3AWktKPqXpS | | TNinja <abuse-team _at_ tor _dot_ ninja> | | arisbe cni net | | support(a)xmission.com | | Felix <tornode.felix AT mailhero dot io> | | torproxy <torproxy AT protonmail dot com> | | DexterAdmin <dexter(a)prj.hu> | | Administrator admin(a)tor-hu.neuromorph.de | | relay(a)danwin1210.me | | relay-operator(a)riseup.net | | 0x6913c81c66f3c35d Gibberfish, Inc <info(a)gibberfish.org> | | Tor <tor(a)plutex.de> | | 0x547515FC HungaryTorExit <alice.middle.relay AT gmail dot com> | | <hostmaster at denetron dot com> | | uwe.kerner(a)yahoo.com | | Network Operations <tor(a)t-3.net> | | D5BACC8B1873BE240578026A278C70D69142FC5B Torexit Wall <torexitwall at firemail dot cc> | | see https://www.artikel5ev.de/torcontact/ | | [admin] <at> [bin] <dot> [ovh] bitcoin donations to 1JLqxShorKdrQYDZ3sPSN1CtKiGf2XknED | | <tor AT fkraus DOT com> | | 145tXZyQEfdmpYhmbFtYe84kjghB5ymPA4 swraysford at gmail | | J. Random Hacker <anonymizer(a)ccc.de> | | abuse(a)signal.center || noc(a)signal.center || tor(a)signal.center | | Any Body <info(a)vif.com> | | Cheena <cheena @ cheena . net> | | hello(a)libre.zone - 14EQvWT8AWRvJEUpSL9SQgaYRgt164Sza4 | | florentin aatt rochet ddoott be; LTC: LhRqJZu6U87BJNSUbkACHzVQsK39hJ3sMB | | tor at localhost dot lu | | Damien Desfontaines <spam.tor2(a)desfontain.es> | | Please see http://tor-exitnode-readme.noteleport.trade for contact information | | Somebody <mail(a)typhoon31.de> | | Tor Admin <tor -at- cs -dot- bu -dot- edu> | | TOR Administrator <tor AT corewars dot net> | | tor-relay-admin robgjansen com | | ury.tor.abuse(a)yandex.ru | | dobby_potter at aol.com or send Hedwig | | 2048R/EFC737D8 Tim Cinel <email(a)timcinel.com> | | 0x3C68C8DBCBA783EF Joel R. Voss <jvoss at altsci dot com> | | www.tocici.com <nospam AT tocici dot com> | | torexit(a)ilias.berlin | | <onions at mit dot edu> | | George Shuklin <george.shuklin(a)gmail.com> | | 022F 0FF2 CB04 2342 7178 334F BA3F 9725 266C DD10 | | kernelcorn at torproject.org, PGP 0xAD97364FC20BEC80 | | contact(a)tor-node.com | | <abuse at flokinet dot is> | | babut(a)yandex.ru | | <rok AT sent dot com> | | Tor Admin <tor(a)remote.sx> | | Arisia-TOR(at)proton - guess the rest of the domain (dot)com 13pMCL54qJ1L4GdWioGMRzYLYRbDTvkBvq | | Dennis Emory Hannon / BackplaneDNS - abuse at BackplaneDNS(dot)org / xmvf6csufv8o453 | | abuse(a)itbible.co.uk || BTC : 1GkNdAJfWD4aaf1wnCkxVX6VgxGJhHJjzY | | 4096R/34650013 La Quadrature du Net <tor(a)laquadrature.net> | | Steve <abuse AT now-dns dot com> | | Random Person <nobody AT example dot com> | | Itzhak Daniel <itzhak+tor(a)itk98.net> | | Tsen <tsenchi.ng AT yandex dot com> | | torprojectperso(a)outlook.fr | | < E52EE9DB AT protonmail dot ch > | | Josef Gajdusek <atx.tor ZAVINAC atx BODKA name> | | https://t.me/darkachfeedbackbot | | kurtixtr53 [AT] protonmail [DOT] com | | Brandon Kuschel <kusch023 AT NOSPAM umn dot edu> | | 0xBC71BC44 Duncan Townsend <duncant AT alum DOT mit DOT edu> | | Random Person <hiredpg ATSINE geeemail-no-eees dot com | | tequilaray at gmx dot com | | IEX NOC <noc(a)iextreme.org> | | 2048g/D72C4234 Andrey Lelikov <torinfo(a)lelik.org> | | Saint <griffin(a)cryptolab.net> | | petani <protprot AT papuasia dot org> | | LaMarre TAO Totalement, Amplement, Owned :P torrelayslamarre(a)gmail.com | | tor(a)diiv.com | | E745A4CC726A94229B2B2DEE58C4B928A3E218F6 | | 0x408B52D5 corcra corcra(a)riseup.net | | tor(at)h0sted(dot)net [tor-relay.co] | | managetor at gmail dot comma | | dalesolutions2016 at yahoo dooto commmo | | peterhrding1232 at gmail dot com | | 256E/7FEE2C1E Sid <sid(a)karunaratne.net> | | 4096R/0125D5C0 Philip Hands <phil(a)hands.com> | | Giulivo Navigante <giulivo dot navigante at gmail dot com> | | abuse(a)redbarnnetworks.com | | <tor AT jd dot nl> | | Person <e4b816 AT gmail dot com> | | Owner <tor [aat} fonts4eva d0t xyz> | | Zdravko Tzenov <torzpi222 AT gmail dot com> | | 0xC49D4040 seadog007 <007seadog(a)gmail.com> | | tor AT busybear DOT se | | <tor AT busybear DOT se> | | Tor node administrator <toradmin AT paulgreeff dot com> | | James Pichardo james(a)pichar.do | | watchme <mydisco .AT. s y s t e m l i DOT o r g> | | Nathan Fraser <ndf(a)metarace.com.au> | | tor(a)openended.eu - 1NBKmjqCAqxtnZ5cS7gHGKFwd2arWB6oxn | | amNzYWx6ZWJlckBnbWFpbC5jb20K (base64) | | 8192R/0xB431B67770E4AA38 Mikal Villa <meeh(a)sigterm.no> - 1LoveJttCUrrjwHxntwUp6PeEvL2UkFyWp | | 4096R/25B4C293 Matthias Urlichs <matthias(a)urlichs.de> | | 0x3BF1E275 Scott <scott AT spacepirates dot com> | | http://torexitnodev6.dynv6.net | | Fred Gilbert <fredglbrt1 AT gmail DOT com> | | 1024R/0FCE8549 Alexander Oelzant <alexander(a)oelzant.priv.at> | | Random Person <tor AT loah dot be> | | karpet RepoMAn Rat Capital-G Pot Commie! [tor-relay.co] | | OctaneZ-TOR <OctaneZ+toroperator(a)gmail.com> | | Luca Saiu <positron AT gnu dot org> | | Bert Bos <bert(a)phonk.net> | +-----------------------------------------------------------------------------------------------------------------------------------------------------------+

3 2

new warning with Tor 0.3.4.0-alpha-dev (git-efc105716283bbdf)
by Toralf Förster 10 Apr '18

10 Apr '18

This happenes here now with that version usually once a day. Feb 19 18:59:00.000 [warn] Our clock is 1 minutes, 1 seconds behind the time published in the consensus network status document (2018-02-19 18:00:00 UTC). Tor needs an accurate clock to work correctly. Please check your time and date settings! Feb 19 18:59:00.000 [warn] Received microdesc flavor consensus with skewed time (CONSENSUS): It seems that our clock is behind by 1 minutes, 1 seconds, or that theirs is ahead. Tor requires an accurate clock to work: please check your time, timezone, and date settings. -- Toralf PGP C4EACDDE 0076E94E

4 4

Relay down again
by smichel0 10 Apr '18

10 Apr '18

Hello! Former my relay was connected via a powerline adapter and I often had connection problems. Then I connected it directlia via a LAN to the router and it worked for 3 days. This morning it was down again since 6 h (no traffic, no flags but the netbook still said that there is a internet connection). I tried to restart the relay but that didn't work, so I rebooted the hole machine and now the relay is up again (Nick: SMichel). I tried to check the logs, but that didn't help me. I suppose that the connection problem or whatever will persist.

2 1

My Exit node has lost all flags.
by Alan 10 Apr '18

10 Apr '18

So I moved my Exit node from a Centos install to Debian on the same ip and copied over the keys to keep things the same. I've been monitoring the speed and checking things are running properly. Today as i'm looking at nyx all the flags disappear and replaced with just the word 'none'. Did I do something wrong? pic: http://clutterbuck.uk/nyx-no-flags.png

2 1

Abuses for non-exit relay
by Felix 08 Apr '18

08 Apr '18

Happy today Since November my ISP and I received a hand full of abuses for a non-exit. It is about scanning ports and addresses of a certain let's say victim ISP. I received one other abuse with another server. For now I kindly want to ask if some operator received similar abuses for non-exits ? [1] Under my perspective it could be: - ip-spoofing. A third entity uses my ip and sends sync requests to the victim. There will never be a statefull connection, but the victim feels offended. As result the only one who gets trouble is me. - I got hacked (Uhh, don't like these words) which I suspect is not the case. Then statefull connections are possible and by scanning etc the attacker interfers the victim. We should not discuss this here. - There is some way out of the code which enables an attacker to perform solicited or unsolicited interference. Like [2] or not known or whatever. It is difficult to discuss with my ISP because the world expects the non-exits connect only inside the Tor network and onion services. Some facts: - The victim ISP hosts no relay - The relays are guards and potentially fallbacks (fallback and non-fallback share an ip) - I firewall blocked (outbound) all victim ISPs subnets. I logged some outbound trials but this could not stop the abuses. Why? May-be the victim ISP has changing ip ranges which usually happens from time to time or I do not know their subnets completely. Interesting was that one destination ip was x.x.x.0 which is subnet zero. - Currently I firewall block (inbound) all victim ISPs subnets and found log entries scanning (syn) my server on a non Tor port. Before blocking inbound, was there a way that someone from the vicitm ISP ip range can drive my relay (not server) to act like an offender back to the victims ISP? Pretty weired stuff but please swarm help! I apologize for my may-be foolish thoughts and please don't hit me too hard, though. [1] [tor-relays] abuse email for non-exit relay (masergy) https://lists.torproject.org/pipermail/tor-relays/2017-September/013030.html [2] Re to [1] https://lists.torproject.org/pipermail/tor-relays/2017-September/013041.html -- Cheers, Felix

3 2

Re: [tor-relays] Lost HSDir flag
by teor 08 Apr '18

08 Apr '18

> On 8 Apr 2018, at 16:25, tschador(a)posteo.de wrote: > > Hi, > > every time Tor is restarted (for example after upgrading) the HSDir flag > of my relay (6A7551EEE18F78A9813096E82BF84F740D32B911) is lost for 4 > days. Why? The minimum uptime for HSDirs is 96 hours (4 days): https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt#n2524 Why 4 days? HSDirs rotate every 24 hours. If a relay has been up for 4 days, then it is likely to be up for the next 24 hours. So it is given the flag. (If a HSDir goes down, it takes a few hours for clients and services to find out it is down. If too many HSDirs go down at the same time, the services assigned to those HSDirs are unreachable for a few hours. The minimum uptime reduces the risk of HSDir downtime.) T

1 0

empty exit policy if ipv6 address is not surrounded by [..]
by Toralf Förster 07 Apr '18

07 Apr '18

Hi atagar, ./run_nyx gives an empty exit policy: line in that case - is this bug or a feature? :-) Example for a wrong line: ExitPolicy reject6 <snip>/32 Good is ExitPolicy reject6 [<snip>]/32 Tested with latest stem and nyx Git trees. -- Toralf PGP C4EACDDE 0076E94E

2 1

Estimation of bridge traffic / Bridge or relay needed?
by Olaf Grimm 07 Apr '18

07 Apr '18

How can I check bridge traffic if it only occurs temporarily? That would also mean that there are enough bridges. I use the Tor browser with the bridge feature for me. I have relays 2x Ubuntu, 1x CentOS and 1x LFS running. Three are working at full capacity. Now I intend to establish a FreeBSD system. The provider does not allow an exit relay so that only "relay" or "bridge" remains. It was not possible to find an exit relay provider with FreeBSD for my financial resources. Should I set up a relay or bridge on www.bhost.net or cloudflexy.org? BHOST wants to become active in ASIA in 2018 too. BHOST: USA, Netherland, UK Cloudflexy: France, Romania Investments must be meaningful. (Of course I can configure a bridge for tests, but I do not know if I made a mistake or if there is no need for a bridge.) A short answer is sufficient. Thank you! Olaf

6 7

Ubuntu LTS about to ship with a soon-to-expire Tor version?
by Roger Dingledine 06 Apr '18

06 Apr '18

Do we have any good Ubuntu contacts here? I noticed today that Ubuntu Bionic LTS will come out this month: https://wiki.ubuntu.com/Releases and they are currently on track to include Tor 0.3.2.10: https://launchpad.net/ubuntu/bionic/+source/tor which is scheduled to go end-of-life before the end of 2018: https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CoreTor… So we are on track for 4.5 years of sadness for Ubuntu users -- and since some of the most critical users of the Tor deb on Ubuntu are relay operators, this seems like a good time to try to rescue things. The best fixes I've thought of are to either: (A) Convince them to downgrade to Tor 0.2.9, which we will maintain for another few years. (B) Make a deal with them where they know that 0.3.2 will be abandoned soon, and that they'll move to our next LTS once it comes out. In the past we tried something like 'B' and it did not go smoothly. So I'm inclined to think 'A' is the better plan. See also this trac ticket where I'll aim to keep track of our progress: https://trac.torproject.org/25715 I'm also going to forward this note to tor-project@ in case there are better Ubuntu contacts there. Never a dull moment, --Roger

3 2