- tor-relays - lists.torproject.org

Re: [tor-relays] Advice on dealing with ISP's response toDMCAtakedownnotice.
by tor＠t-3.net 30 Oct '13

30 Oct '13

Yeah. Not saying I see a good way to do it. Not really asking for it. Whiny, IDS-noticed, almost nuisance-type complaints are the only ones we've gotten. The complaints aren't even describing successful intrusions. Sucks if these whinebucket type of complaints are making it harder in real world terms for people to host exit nodes. On Wednesday 30/10/2013 at 8:56 am, Linus Nordberg wrote: > Hi, > > Sounds like you risk ending up with a censorship tool controlled by > those who control the list of attack signatures. > > I'd prefer if we educate service providers about this dangerous place > called the internet with the goal of making them turn down the volume > on > their sirens a notch. > > > tor(a)t-3.net wrote > Wed, 30 Oct 2013 07:56:28 -0400: > > | What he said. > | > | No DMCA so far but, one thing I keep getting is complaints about > "SQL > | injection attacks". Apparently snort or other IDS picks this stuff > up > | and emails the abuse box. Some but not all of the complaints are > | automated. > | > | It would be nice if something could detect these attack signatures > on > | the internet-bound packets from our exit node and drop them. With > | trends as they are, we'd see zero abuse complaints, if there were a > | good way to do that. > | > | > | > | > | On Wednesday 30/10/2013 at 6:41 am, Moritz Bartl wrote: > | > On 25.10.2013 19:13, krishna e bera wrote: > | >> > | >>> > | >>> ExitPolicy accept *:1723 # PPTP > | >> How are you getting PPTP to work over Tor? The ISP-supplied > modems > | >> i've > | >> seen won't pass IP protocol 47 (GRE) packets without putting the > | >> target > | >> machine in a DMZ. > | > > | > > https://trac.torproject.org/projects/tor/wiki/doc/ReducedExitPolicy> > contains it. > | > > | > It's more of a "catch all" exit policy, but gets rid of most DMCA > | > complaints. > | > _______________________________________________ > | > tor-relays mailing list > | > tor-relays(a)lists.torproject.org > | > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > | > | _______________________________________________ > | tor-relays mailing list > | tor-relays(a)lists.torproject.org > | https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

Re: [tor-relays] Advice on dealing with ISP's response to DMCAtakedownnotice.
by tor＠t-3.net 30 Oct '13

30 Oct '13

What he said. No DMCA so far but, one thing I keep getting is complaints about "SQL injection attacks". Apparently snort or other IDS picks this stuff up and emails the abuse box. Some but not all of the complaints are automated. It would be nice if something could detect these attack signatures on the internet-bound packets from our exit node and drop them. With trends as they are, we'd see zero abuse complaints, if there were a good way to do that. On Wednesday 30/10/2013 at 6:41 am, Moritz Bartl wrote: > On 25.10.2013 19:13, krishna e bera wrote: >> >>> >>> ExitPolicy accept *:1723 # PPTP >> How are you getting PPTP to work over Tor? The ISP-supplied modems >> i've >> seen won't pass IP protocol 47 (GRE) packets without putting the >> target >> machine in a DMZ. > > https://trac.torproject.org/projects/tor/wiki/doc/ReducedExitPolicy > contains it. > > It's more of a "catch all" exit policy, but gets rid of most DMCA > complaints. > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

2 1

Re: [tor-relays] Advice on dealing with ISP's response to DMCA takedownnotice.
by tor＠t-3.net 30 Oct '13

30 Oct '13

Reply to the email, say that you found a misconfiguration in your Tor daemon which could have accounted for this problem and you've repaired it, and hopefully this problem is resolved for the future. Put the below as your exit policy in torrc, and I'd stop/start the service to be sure it grabbed it. Using the below exit policy, we've had our exit node running for a couple months or so doing pretty good bandwidth, and not had a single warez-related complaint. Seen some complaints about SQL injection attacks but perhaps those will annoy your ISP less. ExitPolicy accept *:20-23 # FTP, SSH, telnet ExitPolicy accept *:43 # WHOIS ExitPolicy accept *:53 # DNS ExitPolicy accept *:79-81 # finger, HTTP ExitPolicy accept *:88 # kerberos ExitPolicy accept *:110 # POP3 ExitPolicy accept *:143 # IMAP ExitPolicy accept *:194 # IRC ExitPolicy accept *:220 # IMAP3 ExitPolicy accept *:389 # LDAP ExitPolicy accept *:443 # HTTPS ExitPolicy accept *:464 # kpasswd ExitPolicy accept *:531 # IRC/AIM ExitPolicy accept *:543-544 # Kerberos ExitPolicy accept *:554 # RTSP ExitPolicy accept *:563 # NNTP over SSL ExitPolicy accept *:636 # LDAP over SSL ExitPolicy accept *:706 # SILC ExitPolicy accept *:749 # kerberos ExitPolicy accept *:873 # rsync ExitPolicy accept *:902-904 # VMware ExitPolicy accept *:981 # Remote HTTPS management for firewall ExitPolicy accept *:989-995 # FTP over SSL, Netnews etc ExitPolicy accept *:1194 # OpenVPN ExitPolicy accept *:1220 # QT Server Admin ExitPolicy accept *:1293 # PKT-KRB-IPSec ExitPolicy accept *:1500 # VLSI License Manager ExitPolicy accept *:1533 # Sametime ExitPolicy accept *:1677 # GroupWise ExitPolicy accept *:1723 # PPTP ExitPolicy accept *:1755 # RTSP ExitPolicy accept *:1863 # MSNP ExitPolicy accept *:2082 # Infowave Mobility Server ExitPolicy accept *:2083 # Secure Radius Service (radsec) ExitPolicy accept *:2086-2087 # GNUnet, ELI ExitPolicy accept *:2095-2096 # NBX ExitPolicy accept *:2102-2104 # Zephyr ExitPolicy accept *:3128 # SQUID ExitPolicy accept *:3389 # MS WBT ExitPolicy accept *:3690 # SVN ExitPolicy accept *:4321 # RWHOIS ExitPolicy accept *:4643 # Virtuozzo ExitPolicy accept *:5050 # MMCC ExitPolicy accept *:5190 # ICQ ExitPolicy accept *:5222-5223 # XMPP, XMPP over SSL ExitPolicy accept *:5228 # Android Market ExitPolicy accept *:5900 # VNC ExitPolicy accept *:6660-6669 # IRC ExitPolicy accept *:6679 # IRC SSL ExitPolicy accept *:6697 # IRC SSL ExitPolicy accept *:8000 # iRDMI ExitPolicy accept *:8008 # HTTP alternate ExitPolicy accept *:8074 # Gadu-Gadu ExitPolicy accept *:8080 # HTTP Proxies ExitPolicy accept *:8087-8088 # Simplify Media SPP Protocol, Radan HTTP ExitPolicy accept *:8332-8333 # BitCoin ExitPolicy accept *:8443 # PCsync HTTPS ExitPolicy accept *:8888 # HTTP Proxies, NewsEDGE ExitPolicy accept *:9418 # git ExitPolicy accept *:9999 # distinct ExitPolicy accept *:10000 # Network Data Management Protocol ExitPolicy accept *:11371 # OpenPGP hkp (http keyserver protocol) ExitPolicy accept *:12350 # Skype ExitPolicy accept *:19294 # Google Voice TCP ExitPolicy accept *:19638 # Ensim control panel ExitPolicy accept *:23456 # Skype ExitPolicy accept *:33033 # Skype ExitPolicy reject *:* On Thursday 24/10/2013 at 9:11 pm, Christopher Jones wrote: > > I’ve been running an exit relay for about 3 days and, sure enough, > some BitTorrent bugger caused sh3lls.net to send me a DMCA nastygram: > >> >> We have got the following complain, please remove all illegal torrents >> immediately from your server: >> >> Evidentiary Information >> Title: Suits (TV) >> Infringement Source: BitTorrent >> Initial Infringement Timestamp: 17 Oct 2013 22:06:17 GMT Recent >> Infringement Timestamp: 17 Oct 2013 22:06:17 GMT Infringing Filename: >> Suits Season 3 Episode 6 (The Other Time) (HDTV x264)-ASAP (1GBps >> SeedBox).mp4 URL if applicable: >> Infringing File size: 364405400 >> Infringers IP Address: 64.32.14.34 >> Bay ID: 7fbb4256bfca558d5a809b9f6536b5fd5e4e782d|364405400 >> Port ID: 33788 > > I followed through with the templates provided by the Tor Project as a > response to the DMCA takedown notification. A day later, the ISP sent > me this: > >> >> Dear Christopher >> Whether you run Tor or not, we even told you in past, it's your >> responsibility to stop all abuse >> If Tor is causing it, stop the program Tor on your server, if we get >> another complain we will have to suspend/terminate your services >> >> tor always always gets lots and lots of abuse and complains >> >> Update us within 24 hours >> >> Thanks > > I was never provided with the full text of the original DMCA > complaint, so I was unable to respond. Furthermore, I was never > “even told…in the past” that I had to stop all abuse caused by > Tor. Tor is not singled out in the ToS or AUP. And I was certainly > never told anything in the past about abuse and Tor specifically. As I > said, first warning. Then there’s the “tor always always gets lots > and lots of abuse and complains [sic]”. Which is kind of bizarre, > because their position on tor seems a bit cagey. Does the claim about > lots of abuse mean they won’t allow exit nodes? Or is that just a > “hint” that I’d be better off not trying to run it? > > And this is an ISP I picked from the good list. > > Suggestions are welcome. I’m running with the default exit node > policy, which should block most of the abuse-laden ports. > BitTorrent’s a little harder to deal with. I’ve no qualms working > with the ISP to mitigate their concerns, but I’m not sensing their > returning the same spirit of cooperation. > > .cpj_______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >

3 2

Filtering TOR Non-exit Relay - Just Curious
by Nelson 29 Oct '13

29 Oct '13

Tor Exit Relay have the ability to filter traffic by allowing the operator make choices based on personal preferences for personal, legal (ex: country of origin) and for other reasons. Non-exit Relays do not have the ability to set "Relay Policies" (torcc??), and why would they, considering that all this traffic is encrypted anyway, as I understand it, and one would not ever know what type of traffic it is, or its origin, based on the bandwidth graph. I checked my smoothwall firewall logs it does not seem to show the traffic flowing on my relay, I guess this would be obvious because it's Tor traffic; unless I'm not filtering the logs correctly. Running a Tor relay seems straightforward and one could just fire-it-up and easily contribute to the network. But my curiosity gets the best of me. I was looking to add additional URL Filter rules for my smoothwall as a more centralized way of controlling what gets to the LAN for my users. While checking for additional blocklists I came upon P2P rules and I started to compare the new blocklists with my old ones and then I stumbled upon PeerBlock which has been around for a while. On Windows 7, PeerBlock seemed to provide two things I was looking to test on a TOR Relay: 1. Real Time Traffic Logging (ip's and ports logged) 2. The ability to filter traffic. Apparently I am able to do both with PeerBlock, although I'm sure there are more suitable and capable tools available out there that do this, but I'm not aware of or have used any of these tools. In peerblock I can create new custom lists and completely block specific ip ranges (ex: warez, torrents etc.), and I am able to see what traffic is allowed or blocked based on policies created. 1. What problems, if any, arise from using peerblock and Tor together? 2. Why do we not have the ability to at least set our own policy for the type of traffic on a relay just like an Exit Relay?

6 9

"stable" flag voting differences
by starlight.2013q4＠binnacle.cx 28 Oct '13

28 Oct '13

I observed an interesting behavior in the authority votes regarding relay stability and am curious if anyone can comment. Have a new relay, about ten days old. Relay is marked Fast Guard Running Stable Valid One 10 minute network outage three days ago and then a 68 minute outage one day ago for repair. Overall about 4680 seconds down over the last week, and if one uses a 646220 second timeframe per this post https://lists.torproject.org/pipermail/tor-relays/2013-July/002255.html It works out to about 99.27% uptime, which seems within the 98% threshold quoted in the posting. What was interesting was that Faravahar gabelmoo maatuska tor26 urras all immediately removed the "stable" flag when the relay came back online after maintenance, while dannenberg moria1 left the stable flag in place. The two remaining authorities dizum turtles have never set the stable flag due to heavy link congestion between AS286/AS3265 for 'dizum' and congestion within AS6461 for 'turtles'. Then exactly 24-hours after the end of the outage the five naysayers turned the stable flag back on. Mainly a point of curiosity, but I'd guess from this that the first five authorities listed above are using a much shorter window for evaluating stability while the second two are using the seven-day window. I couldn't find per-authority logging of this category of information so it's hard to know. Perhaps it's relevant that the node was removed from the consensus directory briefly immediately after the outage ended. Finally it is interesting that 'dizum' and 'turtles' have set the "guard" flag even though they consider the relay unstable. This is a recent development. Earlier the two impaired-path authorities had the guard flag set off.

2 2

Traceroute measurement from Tor relays
by Karsten Loesing 28 Oct '13

28 Oct '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello Tor relay operators, We could use your help in a pilot project to improve Tor security. As you may be aware, the anonymity of a connection over Tor is vulnerable to an adversary who can observe it in enough places along its route. For example, traffic that crosses the same country as it enters and leaves the Tor network can potentially be deanonymized by an authority in that country who can monitor all network communication. Researchers have been working to figure out how Tor traffic gets routed over the Internet [0-3], but determining routes with high confidence has been difficult. That's where you come in. To figure out where traffic travels from your relay, we'd like you to run a bunch of "traceroutes" - network measurements that show the paths traffic takes. This is a one-time experiment for now, but, depending on what we find out, regularly making such measurements may become a part of Tor itself. We have already gotten some results thanks to Linus Nordberg of DFRI and Moritz Bartl of torservers.net, and now it's time to ask all relay operators to help. We would like to start this right away. We have written some shell scripts to automate most of the process. The easiest way for you to get them is with git, using the following commands: git clone https://bitbucket.org/anupam_das/traceroute-from-tor-relays git checkout f253f768d14e3368e4fe4de9895acd2715a19412 You can also just download the files directly by visiting [4]. Detailed instructions for setting up and running the experiment are in the README. Basically the experiment does traceroutes to three groups: all "routable IP prefixes", all Tor relays, and then all /24 subnets. These kinds of measurements are not uncommon, and they will not be done at a high rate. By default the scripts will periodically move the results to our server [5] via SSH, although you can keep the results around and/or not send them automatically if you wish (see the README). The traceroute data recorded is not sensitive or private at all. We plan to make the code and data public, following Tor's practice of open cooperation with the research community [6]. The measurements will work best if you have the "scamper" tool from the Cooperative Association for Internet Data Analysis (CAIDA) installed (see the README for installation instructions). This is a standard and open-source tool that handles the many modern complexities of Internet routing measurement. If you are not able to run scamper, the script will also work with the more-common but less-accurate and slower "traceroute" utility. We do not currently have support for Windows relays. The output will take up around 500KB (110MB if you disable automatic removal after upload) disk space if you use scamper; on the other hand if you use "traceroute" utility each output will be around 4MB (1GB with automatic removal after upload disabled). * *Depending on whether you run scamper or traceroute the total time required varies but results for traceroutes to "routable IP prefixes" and all Tor relays should finish within one week (possibly earlier). We would like to request relay operators to upload those results once finished.* * This experiment is in collaboration with several researchers, but the leads are Anupam Das, a Ph.D. student at the University of Illinois at Urbana-Champaign, and his advisor Nikita Borisov. Based on a review of the scripts of commit f253f768d14e3368e4fe4de9895acd2715a19412, we believe that they operate as described above. Please do read through them yourself, and let us know if you have any questions or concerns. And also feel free to contact any of us for help or with suggestions. Because of you, Tor is the "king" of anonymous communication. With your help, we will keep improving to face the new challenges to privacy and freedom online. Thank you, Karsten Loesing <karsten(a)torproject.org> Anupam Das <das17(a)illinois.edu> Nikita Borisov <nikita(a)illinois.edu> [0] "Protecting anonymity in the presence of autonomous system and internet exchange level adversaries" by Joshua Juen. Master's Thesis, UIUC. 2012. <https://www.ideals.illinois.edu/handle/2142/34363> [1] "Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries" by Aaron Johnson, Chris Wacek, Rob Jansen, Micah Sherr, and Paul Syverson. ACM CCS 2013. <http://freehaven.net/anonbib/cache/ccs2013-usersrouted.pdf> [2] "AS-awareness in Tor path selection" by Matthew Edman and Paul F. Syverson. ACM CCS 2009. <http://freehaven.net/anonbib/cache/DBLP:conf/ccs/EdmanS09.pdf> [3] "Sampled Traffic Analysis by Internet-Exchange-Level Adversaries" by Steven J. Murdoch and Piotr Zieliński. PETS 2007. <http://freehaven.net/anonbib/cache/murdoch-pet2007.pdf> [4] https://bitbucket.org/anupam_das/traceroute-from-tor-relays/downloads [5] ttat-control.iti.illinois.edu [6] https://metrics.torproject.org/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJSZ+aXAAoJEMIuYwomKaxNouoH/AyS9oUXuilXH5Wat4l41OGy Zdx8I4VOIox4MPpEEvgulzxJUg5+XvEcMwECwe9/fiIw1M0RAALzicme8xGbG5c7 6OndBNqtTg2dN+4SXC90bMPHtaTS7KiNxkvq4h3z5EqFg38Nymwm2xA7dsEIE7Mh T/k7wch/uE++wWKFXpa8MNKUCC+RpIWUdx00F717F8av/fLlhFuwmjKiMqqNDH5D ntLn2i67Tqe17hOJxVNgPJuf7MDfsTgMTGVCClSWtn95EDrL6WMh2RIteUt+Gb94 3KxS7uIqzyXIN2BhcZ+kk55g7LAWmL+AMKGyGsa88+j8c782hVzRSoL9ii+EZ0U= =ygb9 -----END PGP SIGNATURE-----

8 9

minimum ram
by I 27 Oct '13

27 Oct '13

4 10

Thanks for the advice on handling DMCA complaints.
by Christopher Jones 26 Oct '13

26 Oct '13

Hey all, I just wanted to thank the list members for giving me some great advice on working with my ISP to deal with the DMCA nastygrams. I restricted my exit policy to allow most legitimate TCP services and block the rest, which should hopefully disincentivize those damn P2P users from picking my relay as an exit in most cases. Does the Tor project run a database to track abuse complaints? Could be useful in terms of uncovering who the largest pains in the ass are (mine was from Irdeto on behalf on NBC Universal), as well as organizing targeted campaigns to put pressure on companies like Irdeto to at least perform some due diligence and not send out DMCA originating from exit relays. If not, maybe I’ll start working on a project to do so if there isn’t something else like it elsewhere. On another note, I discovered I prefer running Tor on FreeBSD over Linux. Ran CentOS for a bit, but somehow encrypting /tmp blew it up and the NOC had to re-install the OS. I went with FreeBSD instead and dig it immensely. Pf is much less of a headache than IPTables — I actually got port forwarding from 80 to 9091 and 43 to 9090 working. Administration is more straightforward. I like the clear separation of the base system from additional software added from ports. Compiling ports, while more time consuming, is a delight compared to some of the binary package management issues I’ve had in the past with Linux. FreeBSD also appears to manage memory more efficiently. I run Linux as a desktop OS, but for a server OS, FreeBSD has won me over with its simplicity, less convoluted security (no SELinux — yes I know you can turn it off, but I’m the masochist who leaves it on), better support for chroot jails. Just my opinion. One more question and I’ll probably feel stupid after reading the answers, but does “RelayBandwidthRate” apply separately to rx and tx rates or the combined throughput of them both? The server I run has an unmetered 100Mb/s connection. I’ve got RelayBandwidthRate set to 5MB and RelayBandwidthBurst set to 10MB. 12.5MB/s being the theoretical max, if I bumped up my bandwidth rate to, say, 8, would my relay overload the NIC or would it continue to behave? My server specs are as follows: FreeBSD 9.2 Dual Core Atom D2500 4GB RAM 2TB SATA drive (encrypted swap and /tmp) 100Mbit unmetered traffic 5 usable IPv4 addresses At last check, I had 1140 TCP connections according to lsof and vnstat is showing throughputs of 13-18Mbit/s rx and 14-19Mbit/s tx. Tor CPU usage is about 22-27% according to top. Does this look reasonable or should I tweak some things like max connections? Thanks, Chris

4 3

TCP: drop open request
by mett 26 Oct '13

26 Oct '13

Hi! Since yesterday, the kern.log of the relay I'm running is flooded with "TCP: drop open request from". I first thought it was a kind of DDOS on our servers but it seems to be related to Tor (When I stop Tor, kernel doesn't complain anymore). Does somebody have an idea of why this is happening and what to do to mitigate it? Thanks a lot.

3 3

Re: [tor-relays] [tor-talk] A new check
by grarpamp 25 Oct '13

25 Oct '13

>> > > We're considering launching a new check, >> > > >> > > It'd be appreciated if you could take a moment to look for false negatives, >> > > and let us know. >> > >> > I found 15 relays where check2 told me that I'm not using Tor. >> >> Very good idea! :) Did you also run the same test against >> check.torproject.org? Keep in mind that while it may be frustrating to some users config tests to find that they are temporarily using a false negative exit... this 'multihoming' could, and should in fact, be considered a feature since it keeps some exits out of the reach of anti-tor blocklists that simply parse all the IP's out of the descriptor set. Similar to how obfs and other design features keep Tor out of the reach of anti-tor entities, making an anti to do a little work to be an anti is a good thing. Thus having a good number of false negatives around can allow you to reach places you couldn't otherwise reach due to that type of blocking. That may cause philosophical stress to some places that indiscriminantly [1] block Tor IP's by default, but also keep in mind that Tor is dual use and such a policy is rather blind to that by definition... as would be indiscriminantly blocking all coffee shop IP's by default. So if the point of 'looking for false negatives' is to do something, like attempt to convince the operators to not multihome... the better thing to do would be to add regular false negative tests to the backend of the check service so that these exits come up positive therein. [1] Within a day ago I posted a link to a slashdot discussion of one particular instance of this.

1 0