- tor-relays - lists.torproject.org

Re: [tor-relays] tor-relays Digest, Vol 3, Issue 11
by Gijs Peskens 14 Apr '11

14 Apr '11

My ISP also send me a message about abuse (virusses) ,and after I send them a reply that I'm running a tor node and that if they receive further abuse complaints they should just forward them to my mail for me to handle myself I didn't receive any abuse mail again :) I think my ISP is actually running some IDS with sinkholethinghies (I don't know anything about IDS'es yet, will research into it) and I can access a page with info on my IP wich shows some activity: 2011-04-05 21:56:55,85.223.49.156,29272,20507,NL,UTRECHT,AMERSFOORT,,tcp,sinkhole,,,REMOVED,DE,,1,,,Windows,2000 SP2+, XP SP1+ (seldom 98) 2011-04-05 22:26:35,85.223.49.156,45924,20507,NL,UTRECHT,AMERSFOORT,,tcp,sinkhole,,,REMOVED,US,,1,,,Windows,2000 SP4, XP SP1+ 2011-04-04 21:04:06,85.223.49.156,20507,NL,GET /search?q=0 HTTP/1.1,downadup,Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; InfoPath.2; .N... 2011-04-05 02:29:02,85.223.49.156,20507,NL,GET /?REMOVED HTTP/1.0,sality,KUKU v5.02c =REMOVED,,30184,Windows,2000 SP4, XP SP1+,,80,www.REMOVED.info,,,,REMOVED,8560,... 2011-04-05 22:02:01,85.223.49.156,20507,NL,GET /search?q=0 HTTP/1.1,downadup,Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; InfoPath.2; .N... 2011-04-06 01:13:53,85.223.49.156,20507,NL,.,downadup,,,21901,,,,80,,,,,REMOVED,US 2011-04-07 20:08:37,85.223.49.156,20507,NL,GET /tatoshko.biz?data=REMOVED== HTTP/1.0,machbot,MachBot,,10988,Windows,2000 SP4, XP SP1+,,80,853c9e57.biz,,,,87.10... 2011-04-11 16:46:41,85.223.49.156,47015,20507,NL,UTRECHT,AMERSFOORT,,tcp,sinkhole,,,REMOVED,US,,1,,,Linux,2.6 (newer, 2) 2011-04-11 15:31:23,85.223.49.156,20507,NL,GET /search?q=15 HTTP/1.0,downadup,Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727),,45931,Windows,2000 SP... 2011-04-12 04:08:30,85.223.49.156,44022,20507,NL,UTRECHT,AMERSFOORT,,tcp,sinkhole,,,REMOVED,DE,,1,,,Windows,XP/2000 REMOVED= ip adresses (destination), dns names or things that look like http session specific things. I see one port number (destination) somewhat more (all cases of tcp,sinkhole except 1): 8560 might be a virus/trojan/worm specific port ? Might be a good idea to remove this port from your exit if you get a lot of complaints (and it's not used for anything usefull) The idea of setting up a local smtp out server with spam detection and clamav seems like a very good idea, maybe together with some tarpitting (if possible and easy) it would help a lot of users in need of smtp access and deter spammers (as they would spend hours and hours in tarpits at random when using tor) anyone can provide some good advice on how to set it up properly (I'm running FreeBSD)? Would also be _really_ nice to maybe somehow add some header that says it was send using a tor relay with admin details so my ISP (as I would probably need to set it to relay to their smtp) will not start bitching and moaning about that to me, is it possible ? Yes? How ? ;) What are the dangers of running an IDS myself ? Privacy wise I mean, could it be set up so that it knows about bad stuff hapening and in no way log other stuff ? 2011/4/13 <tor-relays-request(a)lists.torproject.org> > Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > > > Today's Topics: > > 1. Tor and Viruses (Porcelain Mouse) > 2. Re: Tor and Viruses (grarpamp) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 12 Apr 2011 20:46:21 -0700 (PDT) > From: Porcelain Mouse <porcelain_mouse(a)q.com> > Subject: [tor-relays] Tor and Viruses > To: Tor-Relays <tor-relays(a)lists.torproject.org> > Message-ID: <alpine.LFD.2.02.1104122018100.5770(a)localhost.localdomain> > Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII > > Greetings All, > > I've been running an exit for about 5 months, but had to stop due > to virus abuses. In the last two weeks, my ISP has partially blocked my > Internet access twice due to suspected virus infections. I'll spare you > the long story, but I was able to get a copy of their "evidence" and I'm > fairly certain it was connections made through my Tor relay. > > 1) How common is it that Tor is abused by viruses? What is the trend? > 2) Is this just standard virus-kit material, these days? > > I guess I was a little surprised. Obviously, this is a great idea for > hiding the infection site, so I'm sure it's being done. But still, I've > been fighting viruses for quite a while and I don't think I've read a > single virus description that mentioned Tor. I'm sure it's happening, but > I've never heard a single statistic about it, so I thought I would ask. > > Also, this type of abuse is *not* mentioned on the Tor wiki's Abuse FAQ > under "What should I expect if I run an exit relay?" I read that section > carefully and was prepared for most of the things mentioned. Again, I'm > not completely shocked. I'm just saying it didn't seem likely, according > to the FAQ. It would be nice to know how likely is this kind of abuse, > and what is the trend. (And, maybe someone can add the results to the FAQ > when we have an answer.) > > Thanks, > PMouse > > > ------------------------------ > > Message: 2 > Date: Wed, 13 Apr 2011 03:19:27 -0400 > From: grarpamp <grarpamp(a)gmail.com> > Subject: Re: [tor-relays] Tor and Viruses > To: tor-relays(a)lists.torproject.org > Message-ID: <BANLkTikwPS6JDqKMvaxxWhgq2dUoGELKKA(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > > my ISP has partially blocked my Internet access twice > > due to suspected virus infections. > > Virus is likely not the right word for things. Anyways... > > There's really no reason an operator cannot run something > like bro-ids.org and sink known bad traffic in real time. Yeah, > sure, everyone will bitch at me. But it is operator fiat, and > they're not sinking specific users, so well within common > carrier exceptions on that aspect. No different than operators > who block 'torrent' ports, smtp, etc. > > Speaking of smtp, one could even redirect that into their > system despam/clamav it and send it on its way. Better > than nothing. Especially for the legit senders. > > > ------------------------------ > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > End of tor-relays Digest, Vol 3, Issue 11 > ***************************************** >

2 1

Re: [tor-relays] tor-relays Digest, Vol 3, Issue 9
by Ray Waren 12 Apr '11

12 Apr '11

I have problems connecting to the tor network always stuck at "Authenticating to Tor". I ask for assistance in what I should try to get in touch with tor again. Thank you. 2011/4/11 <tor-relays-request(a)lists.torproject.org> > Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > > > Today's Topics: > > 1. Re: two relays serving same hidden service (prafull moulekhi) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 10 Apr 2011 23:59:08 +0530 > From: prafull moulekhi <prafullmoulekhi90(a)gmail.com> > Subject: Re: [tor-relays] two relays serving same hidden service > To: tor-relays(a)lists.torproject.org > Message-ID: <BANLkTi=G8-OyQsz0rr38=PJWHNb7bgwCOA(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > hi > my tor is not working.It's logs show "No certificate available" > > please help > > Prafull >

2 1

two relays serving same hidden service
by cmeclax-sazri 10 Apr '11

10 Apr '11

Suppose I have this setup: Dhole, Dingo, and Fennec are three computers on a LAN. Dhole and Dingo both have external IP addresses and both run Tor relays. Fennec runs a hidden service. Both Dhole and Dingo have the same hidden service address, paxamifrabolerfu.onion, pointing to Fennec's LAN address. Alice tries to connect to paxamifrabolerfu.onion. What happens? cmeclax

3 2

avoiding frequent MyFamily syncing on a dynamic Tor instance group
by tagnaq 07 Apr '11

07 Apr '11

Hi, I don't know if this is already done but it just came into my mind when writing something to sync MyFamily settings throughout multiple nodes: To avoid frequent reloads of many Tor instances, one could pre-emptively create keys (lets say keys for 30 nodes) and build a MyFamily set for it. As you add nodes use this MyFamily set although not all 30 keys are in use yet. This way one would not have to touch running instances when adding new ones. >From a security point of view this is probably quite a bad thing, but does someone already do that?

4 4

Re: [tor-relays] Request for help - Tor legal FAQ
by Marcia Hofmann 07 Apr '11

07 Apr '11

>> To make the FAQ as current and useful as possible, we want to make >> sure that we know about any legal issues that relay operators in the >> United States may have experienced over the past few years. > I understand the focus on USA, but wouldn't this be a good opportunity > to add legal information about other countries as well? It's fantastic idea, and we'd love to be able to do it. Unfortunately, all of our practicing lawyers are licensed in the United States, and we don't have the legal expertise to provide an FAQ like this on a country-by-country basis. :(

3 3

high cpu usage, normal ?
by Gijs Peskens 05 Apr '11

05 Apr '11

I'm running an exit relay configured to give up to 6,4MB/s on an Athlon64 3000+ Freebsd box, and I'm seeing cpu usage between 30-60% is this considered normal ? Any means of getting it down? (except getting a faster cpu or hardware crypto)

3 2

help w/ Debian: Error binding network socket: Address already in use
by Olaf Selke 04 Apr '11

04 Apr '11

Kernel 2.6.32-5-amd64 #1 SMP Sat Oct 30 14:18:21 UTC 2010 x86_64 GNU/Linux Tor v0.2.2.23-alpha (git-b85eb949b528f4d7) Hi folks, on blutmagie exit Tor frequently logs Apr 04 15:27:48.706 [warn] Error binding network socket: Address already in use Apr 04 15:27:48.765 [warn] Error binding network socket: Address already in use Apr 04 15:27:48.775 [warn] Error binding network socket: Address already in use Apr 04 15:27:48.785 [warn] Error binding network socket: Address already in use Apr 04 15:27:48.864 [warn] Error binding network socket: Address already in use Apr 04 15:27:48.900 [warn] Error binding network socket: Address already in use I'm a little bit clueless what's wrong here. I've read http://hea-www.harvard.edu/~fine/Tech/addrinuse.html and found SO_REUSEADDR being used in connection.c. Tor opens about 1k new tcp connections/s and the average number of open tcp sessions is about 70k. anonymizer2:/tmp# netstat -tn | wc -l 70597 Any ideas why Tor can't bind to sockets? regards Olaf

2 2

Request for help - Tor legal FAQ
by Marcia Hofmann 04 Apr '11

04 Apr '11

Hi there, EFF is updating the Legal FAQ for Tor Relay Operators, which we first wrote about six years ago. https://www.torproject.org/eff/tor-legal-faq.html.en To make the FAQ as current and useful as possible, we want to make sure that we know about any legal issues that relay operators in the United States may have experienced over the past few years. To that end, does anyone on this list know about situations where... ...a relay operator has been sued or prosecuted for anything Tor-related? ...the police have seized servers that are running relays? ...someone has tried to use a legal demand (like a subpoena) to figure out who operates a relay? Please email me off-list if you know about an incident like this or anything else you think I should be aware of. Many thanks for your help! -- Marcia Hofmann, Senior Staff Attorney Electronic Frontier Foundation 454 Shotwell Street San Francisco, CA 94110 tel: (415) 436-9333 x. 116 | fax: (415) 436-9993 marcia(a)eff.org | http://www.eff.org

3 2

circuits that fail the exit policy repeatedly
by Scott Bennett 03 Apr '11

03 Apr '11

Upon occasion, I see very long sequences of info-level log messages to the effect that an exit stream has failed the exit policy. Is there any good reason why a relay should not return a DESTROY cell on a circuit whose exit connection attempts have failed the exit policy some threshhold number of times? After all, the exit policy is published information. Anyone making repeated attempts to violate it is either doing so in ignorance of a recent change to the exit policy, perhaps not yet propagated to the client causing the problem, or is doing so as some sort of cracking attempt. It seems to me that killing a circuit in this situation is appropriate to minimize waste of tor network resources. Any thoughts on this? Scott Bennett, Comm. ASMELG, CFIAG ********************************************************************** * Internet: bennett at cs.niu.edu * *--------------------------------------------------------------------* * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * * -- Gov. John Hancock, New York Journal, 28 January 1790 * **********************************************************************

1 0

Re: [tor-relays] Network Scan through Tor Exit Node (Port 80)
by Scott Bennett 03 Apr '11

03 Apr '11

On Thu, 10 Mar 2011 10:27:50 -0800 Chris Palmer <chris(a)eff.org> wrote: >On 03/10/2011 09:10 AM, mick wrote: > >> Using Tor to scan the internet is a good way to see how the internet >> looks from different perspectives at once, which can be quite valuable." >> >> Which says to me that you are using Tor to do this research. > >No, it says to you that using Tor to scan the internet is a good way to >see how the internet looks from different perspectives at once, which >can be quite valuable. > >> So which is it? > >The Observatory work was not done through Tor. Good. > >However, using Tor to scan the internet is a good way to see how the >internet looks from different perspectives at once, which can be quite >valuable, so I vociferously defend the idea of doing so. > Ah. "The ends justify the means." How enlightened. :-( Scott Bennett, Comm. ASMELG, CFIAG ********************************************************************** * Internet: bennett at cs.niu.edu * *--------------------------------------------------------------------* * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * * -- Gov. John Hancock, New York Journal, 28 January 1790 * **********************************************************************

2 1