- tor-relays - lists.torproject.org

Tor 0.2.5.10 is released!
by Nick Mathewson 27 Oct '14

27 Oct '14

Hi, all! I just sent a release announcement to the tor-announce mailing list. If you're not on that mailing list, you should subscribe; it is very low-volume. https://lists.torproject.org/pipermail/tor-announce/2014-October/000096.html Synopsis: There is a new stable out. Some packages are up-to-date, more packages should be up-to-date over the next week. Usually I don't announce a stable till there are packages, but people have been asking me about this one, and I'd rather have an official release announcement than a series of weird rumors. yrs, -- Nick

8 9

Relays alongside firewall
by Jan Nielsen 26 Oct '14

26 Oct '14

Hello. I recently enabled UFW on my relays. I have allowed in all necessary ports that my relay uses. I was looking at the logs and there are plenty of blocked incoming TCP connections. These connections are being blocked because they are attempting connection on ports that I have not opened e.g. 9001. However, the traffic appears to be relay traffic. Is ufw interfering with my relay? Are there additional steps to take when running a relay alongside a firewall? Here is a redacted snippet from my ufw log: Oct 26 15:10:29 [UFW BLOCK] IN=eth0 OUT= MAC=04:01:26:15:5a:01:xx:8a:xx:64:xx:f0:xx:xx SRC=202.108.xxx.xx DST=178.62.xxx.xxx LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=46331 DF PROTO=TCP SPT=49892 DPT=34449 WINDOW=5840 RES=0x00 SYN URGP=0 Oct 26 15:10:32 [UFW BLOCK] IN=eth0 OUT= MAC=04:01:26:15:5a:01:28:8a:1c:64:cb:xx:xx:xx SRC=202.108.xxx.xx DST=178.62.xxx.xxx LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=46332 DF PROTO=TCP SPT=49892 DPT=34449 WINDOW=5840 RES=0x00 SYN URGP=0 Oct 26 15:15:12 [UFW BLOCK] IN=eth0 OUT= MAC=04:01:26:15:5a:01:28:8a:1c:64:cf:xx:xx:xx SRC=60.186.xx1.xx DST=178.62.xxx.xxx LEN=60 TOS=0x00 PREC=0x00 TTL=49 ID=19751 DF PROTO=TCP SPT=52502 DPT=34449 WINDOW=5840 RES=0x00 SYN URGP=0

1 0

Iptables dump
by Sebastian Urbach 26 Oct '14

26 Oct '14

Dear list members, I want to offer my iptables dump so that everybody who's interested can use it to fill up the firewall with the "usual suspects". My system basically runs just TOR and SSH, so it's not a big surprise that the file contains almost only ip's which attacked SSH. Iptables is fed by fail2ban and then dumped every hour iptables-save so that this collection is automatically loaded via iptables-persistent after a reboot. I will publish this file just once so that this list is not stressed too much. If there is a certain amount of interest i'm willing to offer the file for download permanently. Please contact me if you are interested in that. -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ----------------------------------------- Definition of TOR: 10% luck, 20% skill, 15% concentrated power of will, 5% pleasure, 50% pain and 100% reason to remember the name! -----------------------------------------

1 0

Re: [tor-relays] BBC and UK Lottery blocking ip addresses running Tor
by Dan Hanley 26 Oct '14

26 Oct '14

Hi Matt I was in the unusual position where www.bbc.co.uk decided I was not UK resident (I am) and redirected me to www.bbc.com - where none of the links worked for me as that site decided I was UK resident. The BBC did make it clear that they understand Tor relays should not be an issue for them, but that they consider exits to violate their terms of service. It would seem they have stopped discriminating against relays, I doubt they'll ever be exit friendly :-( Dan > > ---------- Forwarded message ---------- > From: Matt Puckey <matt(a)puckey.org> > To: tor-relays(a)lists.torproject.org > Cc: > Date: Sat, 25 Oct 2014 18:19:21 +0000 > Subject: Re: [tor-relays] BBC and UK Lottery blocking ip addresses running > Tor > Dan Hanley: > > Looks like the BBC have changed their rules. I am still running a relay, > > but can now access www.bbc.co.uk in a normal fashion. > > > > Still blocked by national lottery, but I'm hopeful that they both use the > > same third party ip checker, and that the next lottery update will fix > the > > issue. > > Progress! > > I cried a little inside when I read, "We have asked our provider to give > us a way of differentiating Tor exit nodes from non-exit relays, to > allow us to block exit nodes only." > > Ugh. > > Did you have trouble reaching www.bbc.co.uk as well as iPlayer? That > would be strange. I haven't seen them block Tor relays & exits simply > getting to www.bbc.co.uk. > > --Matt > > > >

1 0

Re: [tor-relays] My VPS relay has just been hacked
by Libertas 26 Oct '14

26 Oct '14

For what it's worth, there's an operational security document on the Tor wiki: https://trac.torproject.org/projects/tor/wiki/doc/OperationalSecurity However, that document covers more advanced techniques mostly intended for serious attackers such as government agencies. Others have already mentioned to you the simplest options, which should keep you safe from automated botnet hackers. These include: allow only public key authentication on SSH, use fail2ban or sshguard, update frequently, and don't run anything unnecessary (a torrent client, an HTTP/FTP server). Some relevant links: https://help.ubuntu.com/community/SSH/OpenSSH/Keys (if you're only going to read/do one thing, make it this) https://www.debian.org/doc/manuals/securing-debian-howto/index.en.html#cont… -Libertas

1 0

Note: 0.2.3 is deprecated
by Nick Mathewson 25 Oct '14

25 Oct '14

And please forgive me or sending one more email, please let me call your attention to these bits of the Tor 0.2.5.10 release notes: This release marks end-of-life for Tor 0.2.3.x; those Tor versions have accumulated many known flaws; everyone should upgrade. o Deprecated versions: - Tor 0.2.3.x has reached end-of-life; it has received no patches or attention for some while. If you're still running Tor 0.2.3 on a relay, I'd strongly suggest you upgrade to 0.2.4, or to 0.2.5 as soon as it's available for your operating system. If there's some issue that prevents you from running a more recent version of Tor, please let us know soon so that we can try to address it before 0.2.3 becomes totally obsolete and gets rejected from the network. best wishes, and thanks for running relays! -- Nick

1 0

Oniontip
by Sebastian Urbach 24 Oct '14

24 Oct '14

Dear list members, Since i was the One who asked to put Oniontip on the tor-website (donate section), what is the current discussion status ? -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ----------------------------------------- Definition of TOR: 10% luck, 20% skill, 15% concentrated power of will, 5% pleasure, 50% pain and 100% reason to remember the name! -----------------------------------------

1 0

Re: [tor-relays] Unstable router
by humbletoruser＠Safe-mail.net 23 Oct '14

23 Oct '14

Hello, thank you all for your suggestions. From: Julien ROBIN <julien.robin28(a)free.fr> > Take another well known product from well known trademarks > Linksys, D-Link, Netgear, Sitecom, TP-Link, or something compatible with OpenWRT for example. Okay, I'm going to try a new router. I don't use VoIP or TV-Services. Just a Tor Node and a hidden Service.

1 0

If you've ever run one of the Tor Browser default bridges...
by isis 21 Oct '14

21 Oct '14

...then please have a look at #13504: https://bugs.torproject.org/13504 Thanks! -- ♥Ⓐ isis agora lovecruft _________________________________________________________ OpenPGP: 4096R/0A6A58A14B5946ABDE18E207A3ADB67A2CDB8B35 Current Keys: https://blog.patternsinthevoid.net/isis.txt

1 0

Advisory: remote DoS when using Tor with recent OpenSSL versions built with the "no-ssl3" option.
by Nick Mathewson 21 Oct '14

21 Oct '14

Hello, relay operators! There's one important bugfix in the 0.2.5.9-rc release that relay operators should know about. If you have a version of OpenSSL that came out last week (like 1.0.1j, 1.0.0, ) and if your version of openssl is built with the "no-ssl3" flag, then it's possible to crash your Tor relay remotely if you don't upgrade to 0.2.5.9-rc or to 0.2.4.25 (when that's out). This appears to be an OpenSSL bug. The Tor releases in question contain a workaround for it. To tell if your version of openssl was built with 'no-ssl3': run "openssl s_client -ssl3 -connect www.torproject.org:443". If it gives you an output beginning with something like: CONNECTED(00000003) 140632971298688:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1257:SSL alert number 40 140632971298688:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:596: then you're fine and you don't need to upgrade Tor on your relay. But if it says something that starts like: unknown option -ssl3 usage: s_client args then you need to upgrade your Tor. === Some questions and answers: Q: Does this affect clients? A: No. Only relays. Q: Does this affect me if I'm running a version of OpenSSL other than 1.0.1j, 1.0.0o, or 0.9.8zc? A: No. Only those versions. Q: Does this affect me if I'm running a version of OpenSSL configured without the "no-ssl3" option? A: No. Only versions that were built with the "no-ssl3" option are affected. Q: Does the openssl team know? A: Yes. Have a look at this thread. http://marc.info/?l=openssl-dev&m=141357408522028&w=2 . Also, before I saw that thread, I informed them the other day. Q: Does this affect Tor packages? A: I don't think that we shipped any packages where we used the "no-ssl3" flag to diable ssl3. So only if you're using OpenSSL from another source (say, your operating system) will you be affected. Q: What can I do to remediate this problem? A: You can upgrade to the most recent Tor, or you can use a version of OpenSSL built without the "no-ssl3" flag. Downgrading your OpenSSL is not recommended. Q: What is the potential impact of this bug? A: If a relay is affected by this bug, anybody can make the relay exit remotely. It does not enable any data leaks or remote code execution. Still, the ability to selectively disable relays might enable a sophisticated attacker to do some kinds of traffic analysis more efficiently. So, fix your relay if it's affected. Q: Should we run in circles and freak out? A: Not this time. We should just make sure we fix affected relays. Q: Hey, Nick, you didn't explain this properly! A: Please send a follow-up message that explains it better. :) best wishes, -- Nick

1 1