- tor-relays - lists.torproject.org

how long till the axe falls on little guard relays?
by starlight.2014q3＠binnacle.cx 25 Aug '14

25 Aug '14

The guard status of the relay here is hanging on by a thread (consensus 5-in-favor 4-against) and this had me wondering until I read [tor-relays] don't worry (to much) if your relay is loosing the guard flag https://lists.torproject.org/pipermail/tor-relays/2014-July/005043.html Looking at the Consensus Health page it's clear that about 1000 other relays are also separated from Guard Oblivion by a single vote. I'm curious if anyone knows roughly when the next authority will upgrade to a version with the new criteria and the little guards get the chop.

5 5

Relay "kingqueen" lost Named attribute
by kingqueen 22 Aug '14

22 Aug '14

hi, Does anybody know why my relay "kingqueen" has lost its Named attribute? https://atlas.torproject.org/#details/7B48192A59A903F914ECF73ADBC3711F3E8EA… Thank you KQ

3 3

Re: [tor-relays] OnionTip.com distributes Bitcoin donations to all BTC addresses set in ContactInfo
by Tim 21 Aug '14

21 Aug '14

On 14 Aug 2014, at 22:00, Alexander wrote: >> On 2014-08-14 10:25, Mike Cardwell wrote: >> >> On the other hand. It costs you nothing to stick a bitcoin >> address in a config file to find out. > > Not being a lawyer, does accepting money for running a Tor relay make it > a commercial operation (in some countries) and put you in a different > legal position? > > Best regards, > Alexander Also not being a lawyer, if BTC isn't legal tender in your country (if such a concept exists), are you really accepting "money"? Tim

3 3

reaching out to relay ops that run outdated versions
by Nusenu 19 Aug '14

19 Aug '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 FYI: I just sent out the email bellow to ~160 relay operators - I hope this results in some actual improvements. It is a bit disappointing to see even torservers.net, DFRI, icetor, Frenn vun der Enn, Calyx, Cymru in the recipients list. The recipient list is based on the following output (limited to relays faster than 999KB/s): grep -v 0.2.5.6 Tor_query_EXPORT.csv |grep -v 0.2.4.23|grep -v 0.2.6.0|head -n 344 (csv is from torstatus.blutmagie.de) > Hello, > > you are receiving this email because you are using an outdated tor > version on your tor relay. (your email address was taken from your > relay's contact info field) > > Tor v0.2.4.23 has been released on 2014-07-28 [1] to address a > security issue that makes de-anonymization attacks easier [2] - > please update to Tor v0.2.4.23 or v0.2.5.6. > > To find out your current version run the following command on your > relay: tor --version > > If you are using Linux: Package managers can be used to > automatically update Tor without requiring manual admin > intervention. > > > It is recommended to use the official APT/YUM repos from > torproject.org to get timely updates: APT: > https://www.torproject.org/docs/debian.html.en YUM: > https://www.torproject.org/docs/rpms.html.en > > > thanks for running a relay and making the tor network safer! > > > [1] > https://lists.torproject.org/pipermail/tor-announce/2014-July/000093.html > > [2] > https://lists.torproject.org/pipermail/tor-announce/2014-July/000094.html > -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJT8IfkAAoJEDcK3SCCSvoecIMP/0NX+C4+h55BXaQt2RSwA472 PyEIjSRUwrlnc0navJ1pSHOusCWnrCiMFXQaQqcdCliODzEytPoaLynItiwAtKzp UhDja4Sp/Lag9m9CiNJ/0C9k9OeHQbKcEffLAnTVUOZmcBFwo2CsROruGgveOic6 gE13Yi9LuoHdtMfDDRgLoQyL5hqa1kogpj9maMjXZwEwXhZvNpd7GEUd79WjtVm+ eFoYTW4mgPXcU0fZOtuZxAAkrd/blEzr67o4aKiMeaNDo6zmXIBe1URsPkRf50dO kQ0m4/GSicdVyOnsId+f6RcpAD/LD7QiqIyxv/XZ9uEDqtI2RvxBxNeU9kXU8KK+ y4fsXKZ4pvXgj5Nqv7niNJlftegr1rrdRB7wAtZ/2ETpEL3dqC+aBo0bL+ctk1zZ RlXZkPTOTmGEh5pDxXr8P1rxukgivOsPw3tWmeCjb2+HeiRi117LNeccvwW3SZYE pDLVSJIhxpkFKxtJ8N4vTyqoQzX/N+g1gkOZ/yuF4aCIpfLFTxjUUkMt8wyEI+v2 HMiAXyeHBFh541b9ScTrLao21sxPDsQHq1mNf3RHRKESgiejWLZz74wojUU/drIP coZVoJ7U3aFqb6xgIlJzv8u+IcPld6Xsy3U8MUtD+4q2v7t9y6u6QBrj454YCQrQ Ms0g2ocOvRCTKWUgtbdx =BK/o -----END PGP SIGNATURE-----

9 17

Protecting your domain's reputation
by JusticeRage 19 Aug '14

19 Aug '14

Hello everyone! I am the operator of a somewhat recent exit node with SMTP allowed, and I have found out something worth sharing. Let me know if this is already known. As suggested by the Tor documentation, I set a reverse DNS which makes clear that my exit node belongs to the Tor network (tor-exit-readme.manalyzer.org) This week-end, I started to recieve weird e-mail delivery failure notifications, and even a line from a guy kindly asking me to stop sending him mail. The thing is, I was actually lucky to recieve all those, and I wouldn't have if I didn't have a catch-all address set for the whole domain. Looking at the source of the rejected e-mails, I found out that someone was forging e-mails which look like they come from my domain: Received: from tor-exit-readme.manalyzer.org (tor-exit-readme.manalyzer.org [95.130.11.147]) by smtp.craigslist.org (Haraka/2.5.0) with ESMTP id 66DDCADC-FEA4-4D62-8F08-2630AC1E0299.1 envelope-from <best_pharmacy5(a)manalyzer.org>; Mon, 18 Aug 2014 13:25:12 -0700 From: Levitra-Shop <best_pharmacy5(a)manalyzer.org> To: <rkdq8-4339052657(a)hous.craigslist.org> Subject: When It Comes Healthcare, Nothing Beats a Hometown Advantage, Rkdq8-4339052657 . (I got tons of these, all procedurally generated e-mail addresses.) The thing is, these e-mails don't just seem like they're coming from my domain: they ARE coming from my domain, since the machine sending them has a rDNS which belongs to it. From a mail server's perspective, they're actually very legitimate and probably won't be flagged as spam. I believe that someone is listing all the exit nodes which have a reverse DNS set up, and uses the domain to send out unwanted e-mail. This is a problem for operators for the following reasons: - The reputation of your domain is damaged, and legitimate e-mails sent from it may end up discarded - It strenghtens the idea that mail servers blindly reject everything that comes out of a Tor exit node The good news is, there is something you can do about it. This is exactly what Sender Policy Framework [1] was created for. Long story short, this is some information you can put in your DNS to indicate which machines are allowed to send e-mails for the domains, and which are not (hint: the exit node should not be listed in there). Here is a sample policy which says that only servers registered as MX in your DNS should send e-mails for the domain : tor-exit.domain.com. IN TXT "v=spf1 mx -all" If you need something more specific, I have found a nice wizard [2] which will help greatly. If you run an exit node and have a reverse DNS set up, I highly recommend you take ten minutes to look into this. Please note that this will NOT prevent Tor users from sending e-mail or restrain their freedom in any way; it will only prevent ill-intentioned people from spoofing your domain. I also think that there should be a note in the Tor documentation about this issue (I couldn't find anything regarding this). I hope this helps! [1] https://en.wikipedia.org/wiki/Sender_Policy_Framework [2] http://www.spfwizard.net/ -- JusticeRage

3 3

Web status page
by IceFish ThreeTwo 18 Aug '14

18 Aug '14

Is there a -- Sent from my iPhone

2 2

Include Tor Weather Link
by Spencer Rhodes 18 Aug '14

18 Aug '14

If another email goes out to operators of outdated Tor relays, I would suggest including some information and a link to the Tor Weather service, which has an option to notify via email if the software version is outdated. -- Sent from my phone.

2 1

Dynamic IP
by Tim 18 Aug '14

18 Aug '14

Tim Wilson-Brown E: twilsonb(a)mac.com > Date: Mon, 18 Aug 2014 05:04:31 +0200 > From: Sebastian Hahn <mail(a)sebastianhahn.net> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Dynamic IP > Message-ID: <CD0E96E4-2BFA-4FAA-BC19-C3320AC46F08(a)sebastianhahn.net> > Content-Type: text/plain; charset=us-ascii > > Hi Tim, > >> Sebastien, I run a relay on a machine that has an internal private IP, behind a NAT router with a public IP. >> >> In my experience, I need to specify the NAT router's public IP in the torrc, otherwise tor doesn't include it in the router descriptor it submits to the consensus. > > This shouldn't happen typically, Tor tries to learn its IP address by > looking at the traffic it receives. > >> If that process isn't working for me, is this a bug I should report? > > Likely. Can you try again, noting the kind of log messages Tor might > emit? > I apologise, Sebastien, it appears I was not waiting long enough for the router to connect to a directory, then use the headers to find its IP. I had always assumed that the first series of failures to find an IP (before any directories were contacted) was permanent. This is the debug log output from a secondary test router that I configured on the same IP: Aug 18 17:47:20.558 [info] {CONFIG} int resolve_my_address(int, const or_options_t *, uint32_t *, const char **, char **)(): Guessed local hostname 'REDACTED.local' resolves to a private IP address (192.168.REDACTED.REDACTED). Trying something else. Aug 18 17:47:20.558 [info] {CONFIG} int resolve_my_address(int, const or_options_t *, uint32_t *, const char **, char **)(): Interface IP address '192.168.REDACTED.REDACTED' is a private address too. Ignoring. Aug 18 17:47:20.558 [info] {CONFIG} int resolve_my_address(int, const or_options_t *, uint32_t *, const char **, char **)(): Address 'REDACTED.local' resolves to private IP address '192.168.REDACTED.REDACTED'. Tor servers that use the default DirAuthorities must have public IP addresses. Aug 18 17:47:20.558 [info] {CONFIG} int router_pick_published_address(const or_options_t *, uint32_t *)(): Could not determine our address locally. Checking if directory headers provide any hints. Aug 18 17:47:20.558 [info] {CONFIG} int router_pick_published_address(const or_options_t *, uint32_t *)(): Success: chose address '121.REDACTED.REDACTED.REDACTED'. Once the test router appears in the consensus, I'll make similar changes to the primary router (and it will pick them up on the next restart!) Tim

1 0

Close friend
by IceFish ThreeTwo 18 Aug '14

18 Aug '14

Hello. I'm not going to use the term "Framily", Sprint can...nsfw. Anyways, my close friend just set up a Tor node. I'm pretty sure I read somewhere that the Family option in torrc is used so that nodes administrated by the same person never make a circuit with each other, which somehow protects anonymity. Should my friend and I put each other's fingerprints in the Family field? Seems logical since we know each other and if the point of theFamily field is to protect anonymity. Thanks! Ice Fish -- Sent from my iPhone

4 4

Dynamic IP
by Tim 17 Aug '14

17 Aug '14

> On Sun, 17 Aug 2014 00:42:13 +0200, Sebastian Hahn <mail(a)sebastianhahn.net> wrote: > > Date: Sun, 17 Aug 2014 00:42:13 +0200 > From: Sebastian Hahn <mail(a)sebastianhahn.net> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Dynamic IP > Message-ID: <90ABDCE9-CC09-4892-9935-F7B7C78832E9(a)sebastianhahn.net> > Content-Type: text/plain; charset=us-ascii > > Hi Tim, > >> On 16 Aug 2014, at 23:53, Tim <t_ebay(a)icloud.com> wrote: >> I'm running a relay on a similarly "dynamic" IP. >> If the line goes down, I'm reallocated a new one. But otherwise the IP is stable. >> If I don't notice the change, I notice the traffic drop, then I update the torrc, and everything works again. > > I think you're a little confused. It's not necessary to specify your own > IP address in Tor's configuration file. The various "address" options are > purely optional. Or I am confused, and you mean something completely > different? > Sebastien, I run a relay on a machine that has an internal private IP, behind a NAT router with a public IP. In my experience, I need to specify the NAT router's public IP in the torrc, otherwise tor doesn't include it in the router descriptor it submits to the consensus. How does tor autodetect its public IP, when it is running on a separate machine with a private network IP, behind a NAT router with a public IP? If that process isn't working for me, is this a bug I should report? If tor doesn't currently autodetect public IPs on middleboxes (as opposed to the tor relay machine itself), is this a feature that could be implemented? Or do we wish to discourage this use case? (It would involve trusting an external server to report tor's public IP correctly - and making other assumptions like the middlebox having a single public IP.) Tim

2 1