- tor-relays - lists.torproject.org

Thanks for the advice on handling DMCA complaints.
by Christopher Jones 26 Oct '13

26 Oct '13

Hey all, I just wanted to thank the list members for giving me some great advice on working with my ISP to deal with the DMCA nastygrams. I restricted my exit policy to allow most legitimate TCP services and block the rest, which should hopefully disincentivize those damn P2P users from picking my relay as an exit in most cases. Does the Tor project run a database to track abuse complaints? Could be useful in terms of uncovering who the largest pains in the ass are (mine was from Irdeto on behalf on NBC Universal), as well as organizing targeted campaigns to put pressure on companies like Irdeto to at least perform some due diligence and not send out DMCA originating from exit relays. If not, maybe I’ll start working on a project to do so if there isn’t something else like it elsewhere. On another note, I discovered I prefer running Tor on FreeBSD over Linux. Ran CentOS for a bit, but somehow encrypting /tmp blew it up and the NOC had to re-install the OS. I went with FreeBSD instead and dig it immensely. Pf is much less of a headache than IPTables — I actually got port forwarding from 80 to 9091 and 43 to 9090 working. Administration is more straightforward. I like the clear separation of the base system from additional software added from ports. Compiling ports, while more time consuming, is a delight compared to some of the binary package management issues I’ve had in the past with Linux. FreeBSD also appears to manage memory more efficiently. I run Linux as a desktop OS, but for a server OS, FreeBSD has won me over with its simplicity, less convoluted security (no SELinux — yes I know you can turn it off, but I’m the masochist who leaves it on), better support for chroot jails. Just my opinion. One more question and I’ll probably feel stupid after reading the answers, but does “RelayBandwidthRate” apply separately to rx and tx rates or the combined throughput of them both? The server I run has an unmetered 100Mb/s connection. I’ve got RelayBandwidthRate set to 5MB and RelayBandwidthBurst set to 10MB. 12.5MB/s being the theoretical max, if I bumped up my bandwidth rate to, say, 8, would my relay overload the NIC or would it continue to behave? My server specs are as follows: FreeBSD 9.2 Dual Core Atom D2500 4GB RAM 2TB SATA drive (encrypted swap and /tmp) 100Mbit unmetered traffic 5 usable IPv4 addresses At last check, I had 1140 TCP connections according to lsof and vnstat is showing throughputs of 13-18Mbit/s rx and 14-19Mbit/s tx. Tor CPU usage is about 22-27% according to top. Does this look reasonable or should I tweak some things like max connections? Thanks, Chris

4 3

TCP: drop open request
by mett 26 Oct '13

26 Oct '13

Hi! Since yesterday, the kern.log of the relay I'm running is flooded with "TCP: drop open request from". I first thought it was a kind of DDOS on our servers but it seems to be related to Tor (When I stop Tor, kernel doesn't complain anymore). Does somebody have an idea of why this is happening and what to do to mitigate it? Thanks a lot.

3 3

Re: [tor-relays] [tor-talk] A new check
by grarpamp 25 Oct '13

25 Oct '13

>> > > We're considering launching a new check, >> > > >> > > It'd be appreciated if you could take a moment to look for false negatives, >> > > and let us know. >> > >> > I found 15 relays where check2 told me that I'm not using Tor. >> >> Very good idea! :) Did you also run the same test against >> check.torproject.org? Keep in mind that while it may be frustrating to some users config tests to find that they are temporarily using a false negative exit... this 'multihoming' could, and should in fact, be considered a feature since it keeps some exits out of the reach of anti-tor blocklists that simply parse all the IP's out of the descriptor set. Similar to how obfs and other design features keep Tor out of the reach of anti-tor entities, making an anti to do a little work to be an anti is a good thing. Thus having a good number of false negatives around can allow you to reach places you couldn't otherwise reach due to that type of blocking. That may cause philosophical stress to some places that indiscriminantly [1] block Tor IP's by default, but also keep in mind that Tor is dual use and such a policy is rather blind to that by definition... as would be indiscriminantly blocking all coffee shop IP's by default. So if the point of 'looking for false negatives' is to do something, like attempt to convince the operators to not multihome... the better thing to do would be to add regular false negative tests to the backend of the check service so that these exits come up positive therein. [1] Within a day ago I posted a link to a slashdot discussion of one particular instance of this.

1 0

Advice on dealing with ISP's response to DMCA takedown notice.
by Christopher Jones 25 Oct '13

25 Oct '13

I’ve been running an exit relay for about 3 days and, sure enough, some BitTorrent bugger caused sh3lls.net to send me a DMCA nastygram: > We have got the following complain, please remove all illegal torrents immediately from your server: > > Evidentiary Information > Title: Suits (TV) > Infringement Source: BitTorrent > Initial Infringement Timestamp: 17 Oct 2013 22:06:17 GMT Recent Infringement Timestamp: 17 Oct 2013 22:06:17 GMT Infringing Filename: Suits Season 3 Episode 6 (The Other Time) (HDTV x264)-ASAP (1GBps SeedBox).mp4 URL if applicable: > Infringing File size: 364405400 > Infringers IP Address: 64.32.14.34 > Bay ID: 7fbb4256bfca558d5a809b9f6536b5fd5e4e782d|364405400 > Port ID: 33788 I followed through with the templates provided by the Tor Project as a response to the DMCA takedown notification. A day later, the ISP sent me this: > Dear Christopher > Whether you run Tor or not, we even told you in past, it's your responsibility to stop all abuse > If Tor is causing it, stop the program Tor on your server, if we get another complain we will have to suspend/terminate your services > > tor always always gets lots and lots of abuse and complains > > Update us within 24 hours > > Thanks I was never provided with the full text of the original DMCA complaint, so I was unable to respond. Furthermore, I was never “even told…in the past” that I had to stop all abuse caused by Tor. Tor is not singled out in the ToS or AUP. And I was certainly never told anything in the past about abuse and Tor specifically. As I said, first warning. Then there’s the “tor always always gets lots and lots of abuse and complains [sic]”. Which is kind of bizarre, because their position on tor seems a bit cagey. Does the claim about lots of abuse mean they won’t allow exit nodes? Or is that just a “hint” that I’d be better off not trying to run it? And this is an ISP I picked from the good list. Suggestions are welcome. I’m running with the default exit node policy, which should block most of the abuse-laden ports. BitTorrent’s a little harder to deal with. I’ve no qualms working with the ISP to mitigate their concerns, but I’m not sensing their returning the same spirit of cooperation. .cpj

3 2

Re: [tor-relays] Traceroute measurement from Tor relays
by Jesse Victors 25 Oct '13

25 Oct '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 > That's where you come in. To figure out where traffic travels from > your relay, we'd like you to run a bunch of "traceroutes" - network > measurements that show the paths traffic takes. This is a one-time > experiment for now, but, depending on what we find out, regularly > making such measurements may become a part of Tor itself. We have > already gotten some results thanks to Linus Nordberg of DFRI and > Moritz Bartl of > torservers.net, and now it's time to ask all relay operators to help. > We would like to start this right away. How much bandwidth will this be taking up, and roughly how much will be uploaded/downloaded? I've cloned the repo, but I'm nervous about running this if it's going to be a significant bandwidth hog for a whole week. As Aaron said in Issue 39, it looks like it's going to be a lot of IPs and a large amount of packets. Also, ISPs may not take kindly to all these scans. What's the word on that? Has anyone run this tool, and what's their opinion? I'd be happy to help, but I'd like to know the full details of the various resources this tool will be consuming. Jesse V. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQF8BAEBCgBmBQJSacyDXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQxMjgyMjhENjEyODQ1OTU1NzBCMjgwRkFB RDk3MzY0RkMyMEJFQzgwAAoJEK2XNk/CC+yAhy4IAJ0OSiPjqFTq8bqyU+nXZX7R 6TgA1nmU3Q2tEc6CVBf+/eBpddyAmAG5SZ8/vXKGrUB2VtujaW/VMZ/9zaEMql2B KKGcPcYAy0wQUcJPFZEw0TMuRS5dVV+bEmUXEYh3DhfECVfsGMy8b1mP0UuxW9MN 8UQFiDbzT04lGo2vNOpFGk2DuH+WVHzDj1/Nqv249iobPQWqvebJtFbTnoWrt7m/ cAO3kJtSq43RJSQcImXqwOKDdnTLI5/7FSlP/0Mw5N7ROBMUVfA9/80mRY3VcxtX u6EHP8ZE0JPBOf6WAnwjJU1DBay9EUtHuPpYu1jO9pfuWDrPINyR7NgSg+wEWIQ= =yDvu -----END PGP SIGNATURE-----

1 0

Cheap non exit relay recommendation
by Christian Dietrich 24 Oct '13

24 Oct '13

I hope this is allowed, to due the fact that this is advertising. Currently i'm running two tor relays on a single dedicated server, pushing 404 mbit/s atm. (000000000000myTOR1 & 000000000000myTOR2) I will cancel it at beginning of november due to the fact that i miss tor relay multi core support and i plan to support other projects instead. Anyway, i can recommend my current hoster for non exit tor nodes, you will get: HP ML310e G8 Server (/w iLO4) Intel XEON E3-1230v2 (4x 3,3 GHz /w HT) 16 GB DDR3 ECC 2x 1 TB SATA RAID1 Disks 1000mbit unmetered traffic (pushed ~100 TB so far, no problems) 1 IPv4 Adress (5,-€ per additional) / /64 IPv6 for 69,99€ (currently ~96 USD) hXXp://goo.gl/pXkb78 Germany based. I think this is currently the best deal for non exit relays.

3 2

Port for obfsproxy
by GDR! 23 Oct '13

23 Oct '13

Hello, I'm new here, running a relay for the past year. I'm looking to implement obfsproxy running on port 80 and emulating HTTP traffic. The official manual says I should add this line to torrc: ServerTransportPlugin obfs2,obfs3 exec /usr/bin/obfsproxy managed However, it runs on a random port (30000+) which kind of defeats the whole purpose of running an obfuscated bridge. I also haven't seen a way to force faking HTTP traffic. The manual page is very terse and doesn't explain how to do any of this. How do I configure obfsproxy to look like a HTTP server? -- Zapisz moj nowy prywatny adres email: gdr(a)gdr.name Teraz na wlasnym serwerze. Zawsze czysto - zawsze sucho - zawsze pewnie. Klucz PGP to nadal 4ED3D2B7

7 13

Re: [tor-relays] My Relay speed has dropped nearly to zero - Why?
by Jesse Victors 22 Oct '13

22 Oct '13

On 10/19/2013 06:00 AM, tor-relays-request(a)lists.torproject.org wrote: > Message: 3 > Date: Sat, 19 Oct 2013 00:55:42 -0400 > From: Torop <torop(a)optonline.net> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] My Relay speed has dropped nearly to zero - > Why? > Message-ID: <526210CE.80409(a)optonline.net> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > On 10/18/2013 11:46 PM, David Carlson wrote: >> > On October 8 something caused my non-exit relay speed to drop from >> > around 50 KB to less than 10 KB according to Atlas graphs. I have >> > checked with my ISP and run speed tests that verify my upload speed to >> > be .96 Mb and download to be over 3 Mb, as they have been for years. I >> > am running Tor 0.2.4.17-rc on Windows 7 and my consensus weight has >> > dropped to 26. What could have caused this? >> > > Same here. See the below and do the math on how much data I was and am > now pushing per 24 hours, as well as open circuits. > > > Oct 07 09:04:41.242 uptime 15 days 22:00 hours, 791 circuits open. > I've sent 55.41 GB and received 57.06 GB. > Oct 08 09:04:41.237 uptime 16 days 22:00 hours, 1255 circuits open. I've > sent 63.95 GB and received 65.80 GB. > > Oct 17 23:04:41.236 uptime 26 days 12:00 hours, 87 circuits open. > I've sent 90.08 GB and received 92.16 GB. > Oct 18 23:04:41.259 uptime 27 days 12:00 hours, 87 circuits open. > I've sent 91.85 GB and received 93.96 GB. I've been seeing the same. My bandwidth limit is around 3 MB/sec, but it's been consistently at 400-600 KB/sec. I don't think it started that early for me though, not sure though. I was going to blame it on psad, but I can't see any evidence of that. The fact that all three of us experience this is interesting. Jesse V.

5 7

Relay security, re: local network
by Joe 21 Oct '13

21 Oct '13

Hi, I'm planning to run a Tor relay on a spare computer at home. Security is a concern, and not only regarding the machine running the relay but also my other computers. Are there any (theoretical or otherwise) known attacks a person can perform on a running Tor relay to take remote control of it, and assuming the said person could pull that off, is it possible to extend this control to the other computers behind the same router? I am aware of possible DDOS attacks and other risks related to running an exit, but i am comfortable in taking these chances in my environment. I would run the relay on a yet-undecided-Linux distro, possibly Mint Debian or some flavor of Ubuntu which i am more familiar with, and use full-disk encryption with strong passwords. Are there any risks to my other computers worth consideration? Thanks.

11 13

rm /var/lib/tor/keys/* before changing exit policy?
by Martin Kepplinger 21 Oct '13

21 Oct '13

Really quick not too important question. When switching a relay to become an exit node or the other way round, does it make sense to delete /var/lib/tor/keys/* beforehand and start it over this way? I was thinking, if the relay has the guard flag, it would make sense, but maybe even if it doesn't. I don't know. I'll do it I guess. thanks martin

4 4