- tor-relays - lists.torproject.org

URGENT: active OpenSSL "Heartbleed" attack on Tor Nodes
by starlight.2014q2＠binnacle.cx 08 Apr '14

08 Apr '14

Have been running Tor relay with AddressSanitizer and it crashed this morning. I thought it was related to the system being close to running out of free memory until I read about the new OpenSSL vulnerability. Anyone running a Tor relay with OpenSSL 1.0.1 should update the library or rebuild against an older version immediately!!!!

2 1

Tor download signatures
by Tora Tora Tora 05 Apr '14

05 Apr '14

OK, perhaps I have missed "the how" and "which" somewhere, but which signature am I supposed to verify the new Tor 0.2.5.3 tarball against? I tried the ones mentioned on Tor signing page and none seem to stick. A typical message is: # gpg --verify tor-0.2.5.3-alpha.tar.gz{.asc,} gpg: Signature made Sun 23 Mar 2014 02:40:49 AM UTC using RSA key ID 8D29319A gpg: Good signature from "Nick Mathewson <nickm(a)alum.mit.edu>" gpg: aka "Nick Mathewson <nickm(a)wangafu.net>" gpg: aka "Nick Mathewson <nickm(a)freehaven.net>" gpg: aka "[jpeg image of size 3369]" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: B35B F85B F194 89D0 4E28 C33C 2119 4EBB 1657 33EA Subkey fingerprint: EF00 F369 1387 FCC5 8CD6 8E13 9103 97D8 8D29 319A

3 2

Rapid multiple connections from same relay or client on data port
by Tora Tora Tora 04 Apr '14

04 Apr '14

I am running a latest 0.2.5.3-alpha Tor build. This time I am observing multiple connections within one minute established on a data port from the same address (not sure if client or relay). The latest flood of connections comes from One World Labs who claim to be a computer security company that also searches for leaked/stolen company information in the "dark Internet" or something along those lines. It seems to me that, since the circuits are connected randomly, the likelihood of the same relay having multiple connections to my single relay within such a short period of time is low. I think someone already pointed out earlier that some clients used to start a number of circuits before they needed them. I guess if such "broken" client chooses my relay as an entry point, I can imagine they might start many circuits fast. But then 0.2.5.3 release notes claimed improvements in DOS protection. >From a practical point, is there a rule at what point I should consider rapid multiple connections from the same address to my relay's directory/data port a DOS attack and take some measures?

1 0

Relay Hibernation and Wake Up Questions
by Nik 04 Apr '14

04 Apr '14

Hello, I'm somewhat new to running relays and have a couple separate but related questions about the hibernation and waking up process. 1) I have AccountingMax and AccountingStart set (to '1850 GB' and 'month 3 15:00', respectively). Yesterday, the last day of the accounting period, my relay went into hibernation at around 7:00. I started running this relay just last month, however, and it had only used approximately 440 GB of the AccountingMax quota. Tor then tried to wake up at 15:00. Is it expected behavior with Accounting{Max,Start} to hibernate on the last/first day of the period even if you're under quota? 2) I have the relay configured to run on port 443. When Tor woke up, it was unable to bind to 443, and so the relay stayed down. Again, is this known/expected behavior that if a relay is set to run on a privileged port it needs human/root intervention to re-bind after hibernation? By the way, I'm running Debian Stable and using the system packages, so I have (I'm assuming) an old-ish version of Tor (2.3.25). Sorry if this has been answered elsewhere before. Thanks, Nik

1 0

WorldHostingDays: Let's plan for this for next year!
by Moritz Bartl 03 Apr '14

03 Apr '14

Hrm. We just missed the WorldHostingDays: "WHD.global is the largest hosting event worldwide with over 4,800 attendees in 2013 from all over the world." http://www.worldhostingdays.com/ We should plan ahead for next year and go there, at least to distribute Torservers info material in front of the entrance. It's in Europa-Park, Rust, near Strasbourg: https://maps.google.com/maps?q=europa-park,rust A ticket is 350€, too much for us if you ask me. Maybe we can find an ISP that gets free registration codes and doesn't use them? -- Moritz Bartl https://www.torservers.net/

1 0

TTTT
by Sebastian Urbach 02 Apr '14

02 Apr '14

Dear list members, It will take a bit longer than expected to bring the scoreboard and surrounding systems up again. As it turns out one system was compromised and another machine ran in some hardware trouble. We need to change settings and possible buy new hardware as well. We are working as fast as possible to get everything back on track, so please stay with us. Sorry for the interruption. -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ---------------------------------------------- Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. ---------------------------------------------- Benjamin Franklin (1706 - 1790), Inventor, journalist, printer, diplomat and statesman

3 2

Lots of tor relays send out sequential IP IDs; please fix that!
by Jann Horn 01 Apr '14

01 Apr '14

Well, the subject line pretty much says it all: Lots of Tor relays send out globally sequential IP IDs, which, as far as I know, allows a remote party to measure how fast the relay is sending out IP packets with high precision, possibly making statistical attacks possible that could e.g. pinpoint the entry guard a user or hidden service uses. This is how you can test whether a given relay has this issue: $ sudo hping3 -r --syn -p 443 176.199.74.186 --count 10 HPING 176.199.74.186 (eth0 176.199.74.186): S set, 40 headers + 0 data bytes len=46 ip=176.199.74.186 ttl=116 DF id=3025 sport=443 flags=SA seq=0 win=8192 rtt=33.5 ms len=46 ip=176.199.74.186 ttl=116 DF id=+38 sport=443 flags=SA seq=1 win=8192 rtt=32.7 ms len=46 ip=176.199.74.186 ttl=116 DF id=+42 sport=443 flags=SA seq=2 win=8192 rtt=32.5 ms len=46 ip=176.199.74.186 ttl=116 DF id=+34 sport=443 flags=SA seq=3 win=8192 rtt=32.3 ms len=46 ip=176.199.74.186 ttl=116 DF id=+36 sport=443 flags=SA seq=4 win=8192 rtt=33.2 ms len=46 ip=176.199.74.186 ttl=116 DF id=+36 sport=443 flags=SA seq=5 win=8192 rtt=36.4 ms len=46 ip=176.199.74.186 ttl=116 DF id=+35 sport=443 flags=SA seq=6 win=8192 rtt=33.9 ms len=46 ip=176.199.74.186 ttl=116 DF id=+56 sport=443 flags=SA seq=7 win=8192 rtt=31.7 ms len=46 ip=176.199.74.186 ttl=116 DF id=+46 sport=443 flags=SA seq=8 win=8192 rtt=33.4 ms len=46 ip=176.199.74.186 ttl=116 DF id=+34 sport=443 flags=SA seq=9 win=8192 rtt=33.7 ms In the last example, you can see that the "id" field has increased by 30-50 every second. That's an issue: It should be one of: - always 0 - totally random It can also be that it increments by one every time; that probably means that the relay uses per-IP counters or so, and as far as I know, that should be fine. After a bit of testing, I think that this issue is present on a lot of Tor relay nodes. Here are the first few in the alphabet that look suspicious (didn't want to scan the whole Tor network): 0000MiddlemanWV 65.199.52.129 9029 21948 +1 +3 +1 +8 000AAA420 86.56.139.182 9001 14461 +177 +176 +168 +145 0urHomeOnNativeLand 64.231.156.165 443 18012 +4 +16 +11 +12 0x05942 178.77.69.130 443 8387 +5 +6 +7 +4 1234bubs 2.108.151.161 443 17042 +19 +23 +22 +18 1294538115 86.195.35.119 50501 31861 +104 +116 +68 +114 2mpdhack 98.216.168.108 80 41481 +194 +162 +213 +174 404server 119.30.250.67 6699 53620 +195 +5 +1 +3 4144414D 2.120.211.98 443 28587 +1 +1 +1 +1 594ec291a82938230 199.127.56.76 49152 20690 +861 +893 +328 +338 5979ft 97.122.184.135 443 15586 +1 +1 +1 +1 69m3x1xans 98.219.70.159 443 63 +320 +286 953 +286 6cody5 76.108.230.244 443 28107 +59 +57 +73 +71 8930 71.127.151.26 443 3119 +111 +83 +53 +59 8Mu 128.71.234.171 443 19080 +578 +570 +292 +699 Absolution 94.247.41.130 9001 34427 +842 +688 +684 +636 Ace 121.211.92.6 9001 21567 +1 +1 +1 +1 Achim 79.251.152.183 452 8925 +1 +1 +1 +1 admtg 94.73.222.62 443 3025 +441 +286 +318 +286 Aeroplan 46.72.45.143 9001 29676 +166 +184 +189 +169 AetherTor 71.135.40.76 443 13379 +4 +3 +3 +3 alakazam 74.52.112.2 443 30616 +221 +234 +210 +249 aldgate 93.130.179.10 443 10989 +2 +13 +20 +4 AlfredJKwak 87.212.11.165 9031 13676 +22 +14 +2 +8 aliceandbob 66.85.144.247 9001 2869 +20 +7 +23 +30 AllCowsEatGrass 173.48.97.207 443 30159 +404 +783 +616 +401 amercury 195.64.199.236 9001 26102 +1 +1 +3 +1 amercury 87.224.217.221 9001 7043 +26 +6 +15 +13 amercury 94.31.242.41 9001 27049 +41 +33 +88 +81 AmurTor23 2.93.161.46 9002 48802 +4 +115 +14 +34 anonion 86.160.123.126 443 34526 +79 +94 +111 +57 AnonMan 173.69.9.25 443 23551 +24 +33 +43 +51 anonymous 94.208.144.120 9001 24891 +391 +392 26027 +354 anonymous123 117.16.24.142 443 6806 +19 +40 +56 +19 AnonymousW 173.57.117.197 443 9862 +1 +1 +1 +1 AnonymTorProxy2 78.42.56.35 9002 6479 +246 +266 +258 +234 ApophisGER 176.198.48.99 555 6287 +1 +2 +2 +8 ArnoNym 178.142.2.45 443 21741 +83 +112 +57 +32 Arrowslash 90.1.117.14 443 1572 +90 +166 +4 +180 Arruffapopoli 84.223.102.90 4433 56233 +59 +60 +57 +54 AsCI 158.110.41.101 9002 53052 +1 +1 +1 +1 Please, everyone, check whether your Tor relay node behaves this way, and if so, either change the behavior or take it offline until you can fix the issue. Tor is not designed to be secure if an attacker can measure traffic at both ends of a circuit (for a proof of concept for that, see <http://seclists.org/fulldisclosure/2014/Mar/414>), and if your relay has this issue, you're already allowing anyone to measure at your relay.

5 9

Low traffic on a small relay
by Leandro Noferini 31 Mar '14

31 Mar '14

Ciao a tutti, I have a relay CyberTorValley on a house adsl. I set up this relay to start in night and stop on morning when my adsl is poorly used but the relay makes only a few traffic, say 35-40 mb at night. The poor traffic is due to limited time the relay is up? Is there a way to change the bandwitdth on the run? I found this wiki reference https://trac.torproject.org/projects/tor/wiki/doc/BandwidthLimitChangeContr… in tor web site but it is not linked anywhere. -- Ciao leandro http://6xukrlqedfabdjrb.onion/blog/ gpg fingerprint: 54A4 2612 FD50 0313 7FED 6A91 DA5C 1552 E7A4 D6C2 "Noi di Es Toch narriamo un breve mito: all'inizio il Creatore disse un'immensa bugia. Perché non c'era proprio nulla, ma il Creatore parlò dicendo: Esiste. Ed ecco, affinché la menzogna di Dio potesse essere la verità di Dio, l'universo cominciò subito a esistere..."

1 0

Setting up AWS cloud-relay - don't reserve expensive storage!
by Nick Sheppard 31 Mar '14

31 Mar '14

Hi all, I set up an AWS EC2 cloud Tor relay a month ago and made an expensive mistake. Perhaps others may learn from my example! I followed the instructions on the tor-project website, and found that it actually is quite a simple process, as it says. I did notice that the AWS setup screens I was seeing were different from the screenshots on the website, but they were asking me similar questions so I just went with the defaults where the website said "No changes". I didn't look closely enough. Everything went to plan and I watched the relay work for a month. However, on the AWS EC2 Management console I neglected to click on "Services" then "Billing" to see how much they were charging me. At the end of the month I got a bill for 120 dollars. And Amazon were quite right - they were charging me for the 1024 GB of storage I had accidentally asked for by not changing the default when I set up the instance. The first 30 GB were free, the other 994 I was paying for. And I was only actually using 1.5 GB ... There doesn't seem to be any way of shrinking the storage of an existing instance (though it can be expanded, now, with EBS, Elastic Block Storage), so I had to terminate it (which deletes the storage) and create another instance with a more reasonable 10 GB (of which df tells me I'm now using 11%). So ... if you've recently set up an AWS EC2 cloud relay with the Tor AMI, check your storage, and your billing! I think the option to specify your storage amount (with its default of 1024 GB) may have been introduced when AWS introduce EBS instead of just instance-backed storage (which may have defaulted to the size of the AMI??). In any case, I think the tor-project website AWS screenshots urgently need to be changed to reflect the current setup procedure, with a warning not to accept the 1024 GB default and an explicit recommendation about the amount of storage to ask for (was my guess of 10 GB reasonable?). Oh well, I have gained 100 dollars worth of wisdom from the episode. My way of "Don't look too closely, and hope for the best at the end of the month" was *not* a good idea. Nick Sheppard

7 20

tor relay recommended upgrade procedure?
by Zenaan Harkness 30 Mar '14

30 Mar '14

Currently running Debian's stable/wheezy version of tor which 0.2.3.25 on my first relay, gracemissionstor. I discovered the torproject deb repository here (of course): https://www.torproject.org/docs/debian The following google search: debian upgrade site:torproject.org didn't give much. But the following search: "tor relay" upgrade site:torproject.org gave: https://blog.torproject.org/blog/lifecycle-of-a-new-relay and the FAQ which includes: https://www.torproject.org/docs/faq.html.en#UpgradeOrMove which relates how to keep the same relay id when upgrading. Is there a recommended procedure for upgrading tor relay? Should I upgrade asap now that I've realised torproject has more recent (0.2.4) stable version of tor? Or should I just wait until I have to reboot the server (don't know when that could be) or until a security alert comes around from tor developers? Perhaps I should just rely on the debian package to do the right thing regardless (which for most services is to restart the service, but I guess could be 'do nothing until next reboot' if the packager decided that was wise). Seeking some guidance on this issue thanks, Zenaan

4 7