- tor-relays - lists.torproject.org

Arm Release 1.4.5
by Damian Johnson 30 Apr '12

30 Apr '12

Hi all. A new release of arm [1] is now available which includes numerous fixes of mounting importance [2]. In particular this corrects several issues around arm's connection panel, terminal glitches due to disruption of the curses module by readline [3], and incompatibility with tor's new development releases [4][5]. This release does not include any new features, nor are any planned in the near future. Most of my attention is going to stem right now [6][7], and my next foray into arm will be to work with Ravi to migrate it to the new library this summer [8]. That said, if you encounter any problems then let me know! -Damian [1] http://www.atagar.com/arm/ [2] http://www.atagar.com/arm/releaseNotes.php [3] https://gitweb.torproject.org/arm.git/commitdiff/b86e5bf [4] https://lists.torproject.org/pipermail/tor-talk/2012-April/023961.html [5] https://trac.torproject.org/projects/tor/ticket/3313 [6] https://gitweb.torproject.org/stem.git [7] https://trac.torproject.org/projects/tor/wiki/doc/stem [8] https://www.torproject.org/about/gsocProposal/gsoc12-proposal-stemImproveme…

1 0

"who has used my bridge" in vidalia bridge bundle?
by eliaz 24 Apr '12

24 Apr '12

After running bridge relays in the TBB for a long time I now get "who has used my bridge" results quite quickly after restarts. But in the stable bridge bundle, this function seems not to work - I've had the bundle running for well over a day and am still getting the msg "no clients have used your relay recently," while the Bandwidth Usage is sailing away to beat the band. Is there a way to fix this? - eli ---- gpg: 0xC3E1E38D

2 4

What to do about icecat.biz abuse complaints?
by Steve Snyder 15 Apr '12

15 Apr '12

I often get abuse complaints from icecat,biz saying that a "RIP attempt" was seen from the IP address of my exit node. Apparently this involves too many connections in a given period of time. I've tried to contact them but get no answer from the e-mail address included in the abuse reports. The Administrator listed in the icecat.biz whois says he just provides the network and can't provide any info about the company or who to contact within it. The abuse reports each say that my IP address will be blacklisted for a week. Fine with me. I'd just as soon they blacklist it forever but as they are unresponsive to e-mail communication I can't tell them that. Short of turning my exit node into a middle node, what can I do about these frequent abuse reports?

5 6

Mystery of bridge utilization
by Steve Snyder 02 Apr '12

02 Apr '12

I've got 2 bridges, with 1 IP address in each of 2 servers in the same geographical area. The IP addresses are not consecutive. Both servers have the same hardware and software configurations. Both were established in mid-January and (excepting a few brief periods of down time) have been running since then. So why then in March did one server handle 200GB of traffic while the other handled only 2GB? (Yes, a x100 difference.) Also: is there something I can do to make my under-utilized bridge more attractive to the Bridge Authorities? Thanks.

3 3

hardware accel option in tor alpha
by Sebastian Urbach 02 Apr '12

02 Apr '12

Hi, I want to use the "hardware accel" feature with the actual tor alpha version 0.2.3.12-alpha1. My CPUs support the Intel AES NI function and the kernel module is enabled and running well. Im running OpenSSL 1.0.1, the debian dev told me that there is no dynamic loadable aes ni shipped though its supporting th function. Im pretty confused about the options int the torrc right now. I have enabled "hardware accel" but did not define any dynamic loadable engine anymore because there is no one according to the debian dev and also the output from "openssl engine". The debug log does not show any enabled aes / evp functions what so ever. Im stuck right now, does anybody have some advice, woudl be awesome ;-) ? Thanks -- Mit freundlichen Grüßen / Yours sincerely Sebastian Urbach -------------------------------------------------------- Religion is something left over from the infancy of our intelligence, it will fade away as we adopt reason and science as our guidelines. -------------------------------------------------------- Bertrand Arthur William Russell (1872-1970), British philosopher, logician, mathematician, historian, and social critic.

2 3

How does Tor use nameservers?
by Steve Snyder 01 Apr '12

01 Apr '12

I am attempting to load-balance DNS resolution requests. Suppose, in Linux, you have a /etc/resolv.conf with this contents: nameserver aaa.bbb.ccc.ddd nameserver eee.fff.000.111 nameserver 222.333.444.555 How does a Tor exit node use these 3 nameservers? Are they used in a round-robin fashion with the next name resolution request being handled by the next nameserver in rotation? Is the first nameserver ("aaa.bbb.ccc.ddd" above) always used first, with the second being used if the first exceeds some time-out threshold, and the third used only if the first 2 fail? Does a middle node use name resolution at all, or is the relaying based purely on IP addresses? Thanks.

2 1

Questions about exit enclaves
by Jef Heri 01 Apr '12

01 Apr '12

Hello list, I hope this is the correct list to send these questions, if not I apologize and please tell me where I should send this message. I want to setup a Tor node to run as a exit enclave for a web site (WordPress) and message board (vBulletin). However, I have found little documentation on how to accomplish this on a remote server, e.g. https://trac.torproject.org/projects/tor/wiki/doc/ExitEnclave . Is there a more throughout document/manual for exit enclaves? Is it correct that a exit enclave will act as a 'normal' exit node, as well as the exit enclave for its IP address (https://trac.torproject.org/projects/tor/ticket/800)? If so, is it possible to block exit to any IP other than the node's own IP via torrc file? If not, maybe I could only allow exists to white-list IPs, such as Tor Project web site IP, EFF IP, and etc? I believe someone who sends messages to tor-talk maintains a hardened (OS(?) and) Tor, meant to be run as a node only, from remote server space. Does anyone have a link for that software? I looked at the Tor web site but I didn't find information. I am thinking about using that software as the exit enclave. Lastly, is it possible (and smart - re anonymity and resources) to use the exit enclave to offer hidden service address? Thanks!

5 8

Re: [tor-relays] Questions about exit enclaves
by Jef Heri 01 Apr '12

01 Apr '12

Hello Tom and Konstantinos, >>>>> On Mar 30, 2012 14:18:35, "Jef Heri" <jefheri1 at yahoo.com> wrote: >>>>> >>>>> Hello list, >>>>> >>>>> [snip] >>>>> >>>>> Is it correct that a exit enclave will act as a >>>>> 'normal' exit node, as well as the exit enclave for its IP >>>>> address (https://trac.torproject.org/projects/tor/ticket/800)? >>>>> If so, is it possible to block exit to any IP other than the >>>>> node's own IP via torrc file? If not, maybe I could only >>>>> allow exists to white-list IPs, such as Tor Project web site >>>>> IP, EFF IP, and etc? >>>>> >>>>> [snip] >>>>> >>>>> Thanks! >>>> On Mar 30, 2012 14:43:09, "Tom Ritter" <tom at ritter.vg> wrote: >>>> >>>> It's my understanding that if you put the following Exit Policy in your torrc: >>>> >>>> ExitPolicyRejectPrivate 0 >>>> ExitPolicy accept 97.107.139.108 >>>> ExitPolicy reject *:* >>>> >>>> Where 97.107.139.108 is your IP address (that one's mine), you will >>>> Exit Enclave to your site, not allow any other exit traffic, you will >>>> be a normal tor relay (meaning you should check your bandwidth >>>> limits/accounting), and you will become the preferred path for Tor >>>> traffic to your site. >>>> [snip] >>> On 30 March 2012 14:50:49, Konstantinos Asimakis <inshame at gmail.com> wrote: >>> >>> Wouldn't it be safer to accept connections only on port 80? Else he >>> would be exposing the whole machine. >> On 30 March 2012 14:43:09, "Tom Ritter" <tom at ritter.vg> wrote: >> >> Hm. I don't know. If you have a local firewall that blocks access to >> say, samba, from external addresses, but allows it locally - would tor >> allow you to access the port, because it appears that the connection >> from coming locally? >> >> If you're already exposing port 22 on the internet, I would argue >> allowing it through tor exit enclaving isn't increasing your risk any. >> But if tor lets you bypass the firewall - then there's a concern. >> >> -tom > On Mar 30, 2012 15:02:04, Konstantinos Asimakis <inshame at gmail.com> wrote: > > I bet it will bypass the firewall but until someone else answers play it > safe and allow only the ports you need. ;-) Thank you both for the interesting back and fourth. I think I tend to side with Konstantinos, and since my site will only offer SSL (not http), I guess I should setup to only accept connections from 443, correct? Thank you both.

1 0

Re: [tor-relays] Questions about exit enclaves
by Jef Heri 01 Apr '12

01 Apr '12

Hello Tom, --- On Mar 30, 2012 5:43 PM, "Tom Ritter" <tom at ritter.vg> wrote: > > On 03/30/2012 04:18 PM, Jef Heri wrote: > > > > Hello list, > > > > [snip] > > > > Is it correct that a exit enclave will act as a > > 'normal' exit node, as well as the exit enclave for its IP > > address (https://trac.torproject.org/projects/tor/ticket/800)? > > If so, is it possible to block exit to any IP other than the > > node's own IP via torrc file? If not, maybe I could only > > allow exists to white-list IPs, such as Tor Project web site > > IP, EFF IP, and etc? > > > > [snip] > > > > Thanks! > It's my understanding that if you put the following Exit Policy in your > torrc: > > ExitPolicyRejectPrivate 0 > ExitPolicy accept 97.107.139.108 > ExitPolicy reject *:* > > Where 97.107.139.108 is your IP address (that one's mine), you will > Exit Enclave to your site, not allow any other exit traffic, you will > be a normal tor relay (meaning you should check your bandwidth > limits/accounting), and you will become the preferred path for Tor > traffic to your site. Thank you. That was very helpful.

1 0

Bad Exit
by Matthias Bethke 31 Mar '12

31 Mar '12

I was wondering whether anyone could explain me how a node gets the "Bad Exit" flag? The thing is this, my router: http://torstatus.blutmagie.de/router_detail.php?FP=6c7c819f808ac125c69e1d98… As you can see, it has the "Bad Exit" flag even though it's not an exit and hasn't been for months. So I suppose that's something manually assigned? To do with POP/IMAP sniffing honeypots maybe? Seeing that quite a lot of people use unencrypted mail protocols over TOR, I wrote script about a year ago to try and warn them about it: - run ulogd and dsniff to capture logins - try and do a login to the account to see if it succeeded, to see whether it's just an unsuccessful hacking attempt (dsniff doesn't tell me and I was too lazy to write something myself to check the response) - if so, guess the full address. Either it's in the login or if not the server probably serves only one domain anyway and I use the reverse lookup - Send them a mail saying, hey, either you've been doing this yourself and it's a bad idea, or someone stole your credentials and is anonymously snooping around in your mail; in any case, change your password. I suppose someone is doing the reverse and has some fake accounts that they access via TOR and then see if there are any logins that are not theirs to flag the respective exit as a bad guy. Still sounds like a good idea to me but obviously it doesn't work when flagged as bad. Maybe someone can convince me otherwise or has an ide on how to coordinate the two things? Or am I completely off the track here and the reason for the flag is something different? cheers, Matthias

2 1