- tor-relays - lists.torproject.org

Vodafone Italia blocking traffic from IPs that belong to Tor relays
by fr33d0m4all 27 Nov '16

27 Nov '16

Hi, I just want to share my recent time experience with Vodafone Italia (mobile carrier). Some days ago, for the first time, I was surfing Vodafone.it site from my home network where I run a Tor non-exit relay, and when I surfed "https://ricarica.vodafone.it/" I've got the following error page: Access denied (403) Active policy for this site prohibits access from TOR Network. For further information, do not hesitate to contact us. Contact us: support+vodafone(a)reblaze.com For a reference, please provide the following paragraph: [MyIPAddress]://vodafone-rbzr2313438303139323634335aee0f47488438e0 [1480192643] I wrote to reblaze.com, I've explained that I'm running a non-exit relay and that even if Vodafone is saying that traffic from Tor (they say TOR -__- ) Network, no traffic from Tor network can reach the public network (and so their site) from my own relay. This was my email: Hi, today I've received the attached error when trying to pay on Vodafone Italia site and I want to point out that it is a false positive. The error is "Active policy for this site prohibits access from Tor Network." and I was surfing the web directly from my public IP address X.X.X.X. As you can see on ExoneraTor this IP address also hosts a Tor <<middle>> relay: https://exonerator.torproject.org/?ip=X.X.X.X&timestamp=2016-11-24 If you gave a close look to that Tor Relay, you can see that it is DEFINITELY NOT A TOR EXIT RELAY, so you/Vodafone can't receive any traffic from Tor Network from my relay, since it is only a transit Tor relay: https://atlas.torproject.org/#details/xxxxxxx (Exit policy is reject, so it is not an Exit relay). So, I understand that you want to block sessions coming from Tor network, but you should definitely get a list of Tor exit relays only, not the full list of Tor relays that includes Tor relays that will NEVER send traffic from Tor network to public network. I'd like to understand why you're blocking sessions coming from an IP address that hosts a non-exit relay. And this is their reply: Hi currently this web site policy is to block any IP that is identified as TOR Relay: "Looking up IP address X.X.X.X on or within one day of 2016-11-24. Tor clients could have selected this or these Tor relays to build circuits." we are not checking the "Reject Policy" we will check the issue with the web site administrators Thanks Reblaze Support . I think I won't receive any further info from Vodafone, BTW if they reply, I'll share their answer with you. Have a nice weekend, Fr33d0m4all -- _____________________________________________________________ PGP Key: 0DA8 7293 D561 3AEE A3C0 7F63 101F 316A F30E ECB4 IRC Nick: fr33d0m4all (OFTC & Freenode) _____________________________________________________________

4 3

new (?) : Average packaged cell fullness: 96.772%. TLS write overhead: 96%
by Toralf Förster 27 Nov '16

27 Nov '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I do wonder about a log message which seems not to appear before : ==> /tmp/notice.log <== Nov 26 20:10:45.000 [notice] Performing bandwidth self-test...done. Nov 26 20:19:44.000 [notice] New control connection opened from 127.0.0.1. Nov 26 20:31:13.000 [notice] Received reload signal (hup). Reloading config and resetting internal state. Nov 26 20:31:13.000 [notice] Read configuration file "/etc/tor/torrc". Nov 26 20:31:13.000 [notice] Tor 0.2.9.5-alpha opening log file. Nov 26 20:36:23.000 [notice] New control connection opened from 127.0.0.1. Nov 27 02:10:32.000 [notice] Heartbeat: Tor's uptime is 5:59 hours, with 41 circuits open. I've sent 406.63 MB and received 127.30 MB. Nov 27 02:10:32.000 [notice] Average packaged cell fullness: 96.772%. TLS write overhead: 96% Nov 27 02:10:32.000 [notice] Circuit handshake stats since last time: 0/0 TAP, 3640/3640 NTor. Nov 27 02:10:32.000 [notice] Since startup, we have initiated 0 v1 connections, 0 v2 connections, 0 v3 connections, and 16 v4 connections; and received 0 v1 connections, 1 v2 connections, 15 v3 connections, and 136434 v4 connections. - -- Toralf PGP: C4EACDDE 0076E94E -----BEGIN PGP SIGNATURE----- iHYEAREIAB4FAlg6otwXHHRvcmFsZi5mb2Vyc3RlckBnbXguZGUACgkQxOrN3gB2 6U617AEAh8aGU0wEv3x3OlAOCLBr1HlvVWMVi3ZThqVAvdUmDEAA/2Ruu29iGmO+ zoLs+JRpCno2YSDBfnDmW/vv5qjsmA14 =M7JX -----END PGP SIGNATURE-----

2 2

Tor relay questions
by Sec INT 24 Nov '16

24 Nov '16

Hi Ive been running a relay as a test for a broader rollout including an exit but Im not sure of a few things and am finding it difficult to get further information so here goes - my relay is running at the moment but on atlas it has a line through the uptime? Is this something with 'Accounting' soft? - for server monitoring Im using nagios but it is very difficult to set this up to monitor bandwidth use does anyone know of a tool to do this? (Im using webmin to record bandwidth use but it doesnt have any alerting on it) - on atlas i dont seem to have any bandwidth showing? - what is HSDir and V2dir on atlas flags mean? - ive seen the good/bad isp page but this seems quite old is there anywhere to get more up to date information on good isps? Im looking at implementing 4-5 relays any suggestions about where and any isps that may allow tor in these regions? Thanks for any help Snap

3 3

Problem with sendmail on relay
by Berta Gieselbusch 24 Nov '16

24 Nov '16

Good morning, I've setup my first relay. Until now everything seems to be working fine, but I keep getting mails from logcheck I don't know how to deal with. The reported errors are: "sm-mta[15148]: STARTTLS=client, relay=smtpin.rzone.de., version=TLSv1/SSLv3, verify=FAIL, cipher=ECDHE-RSA-AES256-GCM-SHA384, bits=256/256". Thank you for any hints! Best wishes Berta

3 4

Re: [tor-relays] 33C3 Ticket
by narkopolo＠riseup.net 22 Nov '16

22 Nov '16

I am in the same position. 2016-11-21 23:17 GMT+01:00 pa011 <pa011(a)web.de>: > Looking to meet other Exits in Hamburg - just need a ticket :-) > > Paul > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

7 10

Fwd: Spam mailout
by Petrusko 22 Nov '16

22 Nov '16

Hey, Here a copy of a mail containing an attached file logs_petrusko.zip containing .js sent to my mail address used for relays... This file edit here : https://framabin.org/?0b8d246a55e76e07#deg6j9x5HjLbtOhY9rA6FIiINzthE0t+qfYU… It smells like shit... I'm not 100% sure, but first time it happens on this mailbox. May be a new bot scanning relays informations...? Take care. ps: torrc contains this mail address obfuscated... not enough may be ? Here is the mail (name changed...), : Dear petrusko We've been receiving spam mailout from your address recently. Contents and logging of such messages are in the attachment. Please look into it and contact us. Best Regards, Marian Henderson ISP Support Tel.: xxx

4 4

33C3 Ticket
by pa011 21 Nov '16

21 Nov '16

Looking to meet other Exits in Hamburg - just need a ticket :-) Paul

1 0

Bug Log
by Kevin Zvilt 20 Nov '16

20 Nov '16

11/18/2016 17:28:08 PM.600 [NOTICE] Bootstrapped 85%: Finishing handshake with first hop 11/18/2016 17:28:08 PM.900 [NOTICE] Bootstrapped 90%: Establishing a Tor circuit 11/18/2016 17:28:10 PM.300 [NOTICE] Tor has successfully opened a circuit. Looks like client functionality is working. 11/18/2016 17:28:10 PM.300 [NOTICE] Bootstrapped 100%: Done 11/18/2016 17:28:11 PM.700 [NOTICE] New control connection opened from 127.0.0.1. 11/18/2016 17:28:11 PM.700 [NOTICE] New control connection opened from 127.0.0.1. 11/18/2016 17:32:25 PM.200 [NOTICE] Closing no-longer-configured Socks listener on 127.0.0.1:9150 11/18/2016 17:32:25 PM.200 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 11/18/2016 17:32:25 PM.200 [NOTICE] Closing old Socks listener on 127.0.0.1:9150 11/18/2016 17:32:25 PM.200 [NOTICE] Delaying directory fetches: DisableNetwork is set. 11/18/2016 22:38:05 PM.400 [NOTICE] Bootstrapped 85%: Finishing handshake with first hop 11/18/2016 22:38:06 PM.400 [NOTICE] Bootstrapped 90%: Establishing a Tor circuit 11/18/2016 22:38:06 PM.600 [NOTICE] Closing no-longer-configured Socks listener on 127.0.0.1:9150 11/18/2016 22:38:06 PM.600 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 11/18/2016 22:38:06 PM.600 [NOTICE] Closing old Socks listener on 127.0.0.1:9150 11/18/2016 22:38:07 PM.200 [NOTICE] Delaying directory fetches: DisableNetwork is set.

3 5

DoS from my tor guard VPS
by Arisbe 16 Nov '16

16 Nov '16

One of my tor guard relays is a medium size VPS operating in the Czech Republic. It's been up and stable for several years. Several weeks ago I was notified that my VPS was a source of UDP DoS traffic. It was shut down. Logs showed no intrusions. I installed a different instance of linux, changed my SSH port, added fail2ban and even installed clamav. I did not make changes to the tor exit policy. Then, this week I received the following: "Hello, surveillance system detected a disproportionate outgoing DoS traffic on your VPS torexitcz and then our network under a DDoS attack. Your server torexitcz has been stopped. This is another problem with your VPS. Your service will be terminated. Thanks for understanding." Can anyone offer an opinion as to how my relay was used for DoS? How can I avoid this in the future? My goal, as always is to provide stable nodes to the tor network while protecting myself and my VPS supplier. 4061C553CA88021B8302F0814365070AAE617270 185.100.85.101

5 4

Is my relay affected by cve-2016-8860?
by nusenu 15 Nov '16

15 Nov '16

https://blog.torproject.org/blog/tor-0289-released-important-fixes If you are unsure whether you are running a vulnerable tor relay, you can search your contact string on the following page (sorted by cw fraction): https://github.com/ornetstats/stats/blob/master/o/cve-2016-8860.txt (generated daily) If you are on that page you are likely running a vulnerable version (unless someone else is using your contactinfo as well) Unfortunately the opposite does not hold true - meaning you are not 100% safe if you are not listed (I tried to keep the false positives low for the price of a higher false-negative rate).

2 1