- tor-relays - lists.torproject.org

Re: [tor-relays] Questions about exit enclaves
by Jef Heri 31 Mar '12

31 Mar '12

Hello Tom, --- On Mar 30, 2012 5:43 PM, "Tom Ritter" <tom at ritter.vg> wrote: > > On 03/30/2012 04:18 PM, Jef Heri wrote: > > > > Hello list, > > > > [snip] > > > > Is it correct that a exit enclave will act as a > > 'normal' exit node, as well as the exit enclave for its IP > > address (https://trac.torproject.org/projects/tor/ticket/800)? > > If so, is it possible to block exit to any IP other than the > > node's own IP via torrc file? If not, maybe I could only > > allow exists to white-list IPs, such as Tor Project web site > > IP, EFF IP, and etc? > > > > [snip] > > > > Thanks! > It's my understanding that if you put the following Exit Policy in your > torrc: > > ExitPolicyRejectPrivate 0 > ExitPolicy accept 97.107.139.108 > ExitPolicy reject *:* > > Where 97.107.139.108 is your IP address (that one's mine), you will > Exit Enclave to your site, not allow any other exit traffic, you will > be a normal tor relay (meaning you should check your bandwidth > limits/accounting), and you will become the preferred path for Tor > traffic to your site. Thank you. That was very helpful.

1 0

Bad Exit
by Matthias Bethke 30 Mar '12

30 Mar '12

I was wondering whether anyone could explain me how a node gets the "Bad Exit" flag? The thing is this, my router: http://torstatus.blutmagie.de/router_detail.php?FP=6c7c819f808ac125c69e1d98… As you can see, it has the "Bad Exit" flag even though it's not an exit and hasn't been for months. So I suppose that's something manually assigned? To do with POP/IMAP sniffing honeypots maybe? Seeing that quite a lot of people use unencrypted mail protocols over TOR, I wrote script about a year ago to try and warn them about it: - run ulogd and dsniff to capture logins - try and do a login to the account to see if it succeeded, to see whether it's just an unsuccessful hacking attempt (dsniff doesn't tell me and I was too lazy to write something myself to check the response) - if so, guess the full address. Either it's in the login or if not the server probably serves only one domain anyway and I use the reverse lookup - Send them a mail saying, hey, either you've been doing this yourself and it's a bad idea, or someone stole your credentials and is anonymously snooping around in your mail; in any case, change your password. I suppose someone is doing the reverse and has some fake accounts that they access via TOR and then see if there are any logins that are not theirs to flag the respective exit as a bad guy. Still sounds like a good idea to me but obviously it doesn't work when flagged as bad. Maybe someone can convince me otherwise or has an ide on how to coordinate the two things? Or am I completely off the track here and the reason for the flag is something different? cheers, Matthias

2 1

Exit node and VPN relakks.com
by Jonathan 21 Mar '12

21 Mar '12

Hey all, I have a server in a server farm on a 100mbit symmetrical line... I was looking at relakks.com as a VPN service. Anyone has any experience with these guys? Someone I know use it but only gets up to 2mbit on this line... Anyone has different experiences? I run a relay at home, but wanted to contribute with an exit node on the server as it has a big connection which does not get all fully used at the moment... Thanks, Jon

3 4

Re: [tor-relays] [tor] Re: Hosting relays in the Netherlands
by grarpamp 13 Mar '12

13 Mar '12

[sorry, same note, right tor-relays address this time :-] >> I got to a point where I want to make an active contribution to the >> Tor cause starting with running some nodes of my own, but I'm having >> difficulties on finding hosting companies (vps/dedicated) that allow >> running Tor services. >> >> I know that you've been resuming your servers in the Netherlands >> Would like to hear what's your experience with that. > > There is not much advice I can give you. I do not want to recommend any > of our ISPs, not because we're not happy with them (to the contrary), > but because it makes no sense to put more and more Tor exits into few > places. My strategy always is to find appropriate offers (cheap high > bandwidth) and then contact the ISP. This has evolved into a pretty > standardized two-step approach: First, I ask if they were okay "with > Tor" and reassigning IP space, and telling them that we're security > researchers and that we have worked with many ISPs successfully in the > past. Because the reassignment is somewhat of a special case, this > usually helps in reaching someone higher up in the support chain who can > make such decisions. Once they get back to me, I explain Tor a little > more and only then tell them about the caveats, but reassure them that > we have a volunteer team handling abuse around the clock etc. > > Depending on what you're able and willing to spend, a good approach > would be to look for data centers, and ask there for potential partners. > I wrote a small script that puts the GeoIP location of Tor nodes on a > map, which is somewhat helpful in finding "empty spots". A good idea > would be a script that extracts ASNs, sums up "their" Tor bandwidth, and > then not go with those that already have a high bandwidth exit, but > maybe some other AS in the same datacenters? Yes! Far better to look for new diverse holes and fill them than to essentially duplicate existing nodes. Bringing in tor-relays on this, as this topic comes up there once in a while too. I'll add that AS path info is available from route views looking glasses. Think of it like traceroute, but for BGP. It's quite handy. A node map showing current GEO, AS, and provider would be a cool idea. Lots of cities have datacenters and moms/pops of some sort. People could then find a gap near them, then poke around the phonebook, webhostingtalk, datacentertalk, [NA]NOG's, etc to find a diverse fill.

2 1

Reg : Torperf measurements
by Sambuddho Chakravarty 11 Mar '12

11 Mar '12

Hi all The section on Performance data in the Tor metrics page https://metrics.torproject.org/data.html , says that you are recording data by running Torperf on 'moria', 'torperf' and 'siv'. I know 'moria' is a exit node. But what are 'torperf' and 'siv' ? Tor directory listing doesn't list them.

2 2

pluggable transport proxy
by Scott Bennett 19 Feb '12

19 Feb '12

A recent posting--sorry, but I deleted it before realizing that I had something to say as a followup--referred to proposal #180 (see https://gitweb.torproject.org/torspec.git/blob/HEAD:/proposals/180-pluggabl… for the text), and after reading the section titled "Notes on plugins to write", it seemed to me that the first note might be satisfied by tcpproxy with little or no modification. The developers might wish to look at its description at http://www.spreadspace.org/tcpproxy/ It handles IPv4, IPv6, and cross-protocol tunneling, as well as optionally doing remote DNS resolution. FWIW, I like the mentions of possibly allowing the use of such proxies with ordinary relays, too. This might provide an opening to allow unpublished, extra ORPorts of ordinary relays to be distributed and used in a manner similar to bridges. Allowing pluggable proxies for ordinary relays ought also to facilitate development and testing of UDP- and SCTP-based transports for tor in a way that would avoid disrupting existing tor network operation. Scott Bennett, Comm. ASMELG, CFIAG ********************************************************************** * Internet: bennett at cs.niu.edu * *--------------------------------------------------------------------* * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * * -- Gov. John Hancock, New York Journal, 28 January 1790 * **********************************************************************

1 0

30% drop in exit throughput since Feb 8
by Andy Isaacson 19 Feb '12

19 Feb '12

Noisetor is showing a significant, sustained drop in bandwidth usage starting approximately February 7-8. We've checked our setup and logs and there doesn't appear to be any sign of a causative factor here. Throughout January and the first week of February we were averaging 400-500 Mbps. There was a pretty smooth decline down on the 8th, stabilizing at a "new normal" of 200-300 Mbps which we've maintained since then. (All these numbers are based on Munin graphs of eth0 throughput using the if_ plugin.) I have some hacky Python that summarizes the torstatus.blutmagie.de data, and it appears that other exits didn't see a similar drop; but our drop came a few hours to days after torservers added a significant amount of new bandwidth. (However, total exit BW reported in torstatus did not increase much; if anything it seems to have gone down slightly.) Around the same time, Amunet rose from ~150 Mbps to ~450 Mbps and has remained in that range since. Thoughts? -andy

3 3

Can bridge run in tiny VPS
by tor-relays＠nickcoleman.org 14 Feb '12

14 Feb '12

After reading on Hacker News about Tor's request for bridges for Syria and Iran, I thought perhaps I could use my el-cheapo VPS for this. I use it to run an anonymous forwarding proxy for my own use. It gets very little use, so I can do without the proxy for a few months. Mem is limited to 128MB, with bursts to 256MB. Bandwidth is 500GB up and down per month. Tor can have half of this (note the up *and* down). The caveat is that, because it is a dirt cheap VPS, I don't get a warning about any violation of the TOS. If I go outside the guidelines, they cancel my account. So I need to be fairly certain, or somehow limit Tor, that its memory use in normal circumstances will not exceed ~100MB. Is it feasible to run a bridge within these limits? If so, any suggestions on config options welcome. thanks, Nick

5 4

HardwareAccel
by Sebastian Urbach 03 Feb '12

03 Feb '12

Hi, Does anyone know how to use the HardwareAccel feature correctly ? Somehow im not able to get this working on my Intel cpus wit the hardware AES engine built in. It would be great to get it up and running because 24 cores could do some nice work for tor ;-) Thanks in advance -- Mit freundlichen Grüßen / Yours sincerely Sebastian Urbach -------------------------------------------------------- Religion is something left over from the infancy of our intelligence, it will fade away as we adopt reason and science as our guidelines. -------------------------------------------------------- Bertrand Arthur William Russell (1872-1970), British philosopher, logician, mathematician, historian, and social critic.

2 1

reg : problem using the OPAddon script from the torflow package
by Sambuddho Chakravarty 02 Feb '12

02 Feb '12

Hi All I am trying to use the OPAddon script to measure circuit bandwidth. I use the following input configuration for pathrc input configuration: [GENERAL] # Set the host and port where Tor is # listening for control-connections control_host = 127.0.0.1 control_port = 9051 [CIRC_MANAGEMENT] # Size of the maintained pool of circuits idle_circuits = 3 # TODO: Configure ports to use [NODE_SELECTION] # Number of hops to be used in paths and # a minimum-value for advertised bandwidth pathlen = 3 min_bw = 1024 # Percentiles percent_fast = 100 percent_skip = 0 use_all_exits = yes # UniformGenerator with optionally ordered exits, # 'uniform = no' --> bandwidth-weighted selection uniform = no order_exits = no # Make use of guard-nodes (yes|no) or a specific # exit node (nickname or IDHex) for every path use_guards = yes #use_exit = xyz [GEOIP] # Use GeoIP use_geoip = no # yes|no for unique|equal country codes # ! comment out to don't care unique_countries = no # Maximum number of continent crossings: 0-n # ! comment out to enforce distinct continents # ! set >= pathlen to not care about #max_continent_crossings = 2 # Maximum number of ocean crossings: 0-n # ! comment out to don't care #max_ocean_crossings = 1 # If echelon is set, OP-Addon will try to find an # exit in the destination country of the current # request (exit_country may be used as backup) # yes|no # TODO: echelon = yes # Set country codes for single positions #entry_country = DE #middle_country = RU #exit_country = US # TODO: excludes = [".."] [RTT] # Frequently ping the latencies of complete circuits # yes|no ping_circs = no # Tor socks-properties socks_host = 127.0.0.1 socks_port = 9050 ping_dummy_host = 127.0.0.1 ping_dummy_port = 100 # Time interval to wait before triggering # pings and frequency of pings in seconds (float) initial_interval = 10 frequency = 5 # Close a circuit after n timeouts on measurings # Set to 0 to never close circs (int) timeout_limit = 1 [MODEL] # Set to 'yes' to measure latencies of single links # and enable circuit creation from the model # yes|no network_model = no # Min ratio of circs created with the backup-method, # controls growing of the model (float in [0,1]) # 0: no growing # 1: growing only min_ratio = 0.5 # RTT-threshhold in seconds when creating circs (float): # 0: no threshhold, choose from all proposals max_rtt = 0 # Minimum number of proposals to choose from (int) min_proposals = 100 [EVALUATE] # Evaluation mode: close every circuit after measuring performance # yes|no evaluate = yes # Number of latency-tests per circuit (int: 0-n) num_rtt_tests = 1 # Number of bandwidth-tests per circuit (int:0 or 1) # Requires stream-server.pl listening on the same host num_bw_tests = 1 # Total amount of circuits to test (int) num_records = 5 I run op-addon.py with the above config and it terminates throwing the following error pointing to PathSupport.py. WARN[Thu Feb 02 17:45:58 2012]:No event for: 650 STREAM 76 CLOSED 47 128.59.16.165:8041 REASON=DONE Traceback (most recent call last): File "<home directory>/torflow.saved/torflow-3c0dd74/TorCtl/TorCtl.py", line 712, in _eventLoop self._handleFn(timestamp, reply) File "<home directory>/torflow.saved/torflow-3c0dd74/TorCtl/TorCtl.py", line 1337, in _handle1 self._map1.get(event.event_name, self.unknown_event)(event) File "./op-addon.py", line 853, in stream_status_event return self.handle_bw_test(s) File "./op-addon.py", line 823, in handle_bw_test lifespan = stream.lifespan(stream.bw_timestamp) File "<home directory>/torflow.saved/torflow-3c0dd74/TorCtl/PathSupport.py", line 1326, in lifespan return now-self.attached_at TypeError: unsupported operand type(s) for -: 'NoneType' and 'float' NOTICE[Thu Feb 02 17:45:58 2012]:Tor closed control connection. Exiting event thread. Terminated I am not sure how to resolve this ... I am not sure if I am doing something wrong or not... Thanks Sambuddho

1 0