- tor-relays - lists.torproject.org

Your computer is too slow to handle this many circuit creation requests
by teamcat＠genocide.fun 07 Oct '22

07 Oct '22

Hello, After setting up a relay, I noticed that my log file was full of "Your computer is too slow to handle this many circuit creation requests" messages. This seems odd to me, as htop reports that my CPU and memory usage is nowhere near full. I'm running on two cores and 8 GB of RAM, and it's averaging about 40% usage on both cores and 2 GB of RAM usage. I've used the tor-ddos iptables rules that were suggested in a previous message thread, but it doesn't seem to have done anything to address the problem. (https://github.com/Enkidu-6/tor-ddos) I've also configured /etc/sysctl.conf to support a traffic flow as outlined in the github repo. Here is the link to the metrics page for my relay. https://metrics.torproject.org/rs.html#details/74181AB4D1A7D403ED9F190FAC92… Is this something that I should be concerned about, and work to mitigate? I am able to migrate my relay to much more powerful hardware, but obviously that would incur additional cost, so if there is some way to fully utilize my existing hardware I would prefer that. Regards, Evan

1 0

(FYI) Rejecting outdated snowflake proxies
by gus 06 Oct '22

06 Oct '22

Hello everyone, As part of scaling snowflake bridge and adding distributed snowflake server support[1], this week the Anti-censorship Team started to reject *outdated* snowflake proxies that can't support this feature (distributed server support). This will result in a loss of 30% of unrestricted NAT proxies. Read below the instructions how to check your snowflake proxy version: - WebExtension: 0.6.2. - Docker: To check the version: $ docker run thetorproject/snowflake-proxy -v should include "-allowed-relay-hostname-pattern" in the output. To update: $ docker pull thetorproject/snowflake-proxy - Standalone with Go Toolchain: To check the version: $ proxy -v should include "-allowed-relay-hostname-pattern" in the output. To update: $ go install git.torproject.org/pluggable-transports/snowflake.git/v2/proxy@latest If you need help, please check this Forum post: https://forum.torproject.net/t/please-update-your-snowflake-proxy-to-help-u… Thank you! gus [1] https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… -- The Tor Project Community Team Lead

2 1

Consensus weight tanking
by Me 06 Oct '22

06 Oct '22

Good day, Not sure if this would be the proper avenue to pursue this. I operate a couple of middle relays from my home server. All seemed well until this morning. Three days ago one was promoted to guard status while the other lags behind. This morning I check the Tor metrics page and the consensus weight graphs on both relays have bottomed out. The other metrics do not have appeared to have remained normal for daily operations. Any suggestions or input are greatly appreciated

2 1

Moving middle relays to bridges?
by Isaac Grover, Aileron I.T. 05 Oct '22

05 Oct '22

Good morning, According to tor metrics, there have been nearly three times the number of relays as bridges over the last three months so I would like to move my handful of middle relays to bridges. They will keep their same IP address. Is there a best practice with regards to doing this so the directories don't get confused? Make your day great, Isaac Grover

3 2

Thoughts about potentially abusive config option for exit nodes
by abuse-node49＠posteo.de 03 Oct '22

03 Oct '22

I did not manage to find anywhere on the new website the current config options of the torrc. So I ask the question here, although it may be already outdated. This is the third time I have had contact with the police about Exits Relays. That's why it occurred to me that someone might be acting targeted, because I run more than one node. Looking for configurations that allow dedicated IP addresses, I found the torrc-config option 'StrictNodes 1' in conjunction with 'ExitNodes [IP/Nickname/Key]' on the web. There were also hints that something had been changed before, but I tried it on a local installation. The goal was to use a specific exit address. StrictNodes 1 ExitNodes [MY_EXIT_NODE_IP] First I had a typo and the Tor service did not start. After the correction it worked and I got into the network. The conclusion remained that Tor accepts these configuration lines. The problem with this is, should this config line really allow a dedicated exit as the sole exit point into the network, the operator of that exit could be targeted and harmed with illegal traffic. In Metrics it is easy to show whole Tor families that always belong to a single operator. It would be nice if the developers remove the possibility to specify a dedicated IP address/nickname/key, if not already done. The config option 'Exitnodes {COUNTRY_CODE}' should remain though. Kind regards, Olaf

1 0

bridge distribution
by potlatch 28 Sep '22

28 Sep '22

[0] FB45183DD82D572CA2B2641C1AB0EB0D8CE7B858 Sent with [Proton Mail](https://proton.me/) secure email.

3 2

bridge distribution
by potlatch 24 Sep '22

24 Sep '22

People, I have a bridge [0] with a bridge distribution mechanism of "non". It's been that way since May 2022. What gives? Should I remove it from the network as unless> potlatch Sent with [Proton Mail](https://proton.me/) secure email.

1 0

Best practices for the hosting provider of Tor exit nodes?
by Isaac Grover, Aileron I.T. 15 Sep '22

15 Sep '22

Good afternoon, As I'm reaching out to hosting providers worldwide to see if hosting Tor exit nodes is within their ToS and AUP, most hosting providers are requesting hardware specifications and bandwidth requirements; however, I would like to point them to a resource showing best practices for the hosting provider, and maybe one that shows expectations of the Tor exit node operator as well - for example SWIP'ing the IP address(es) to the exit node operator - so that the hosting provider knows what the exit node operator expects of them, and what they should expect of the exit node operator. Does such a resource exist, and if not, what would you request/add in such a resource? Make your day great, Isaac Grover

1 0

knock knock, police is here
by volker.mink＠gmx.de 13 Sep '22

13 Sep '22

Hi folks. On Tuesday morning police knocked on my door, performing a full house search. Some Nazis used TOR to send nazi-emails to several schools in Germany. Unfortunately their mails left one of my Exit Servers from dark- to clearweb, so an ip address, registered on my name, was the last stamp. Now im accused of Volksverhetzung (german, try to find a good translation). It means spreading bad nazi bullshit to the internet. I can take this down by showing them German Telemediengesetz §8, which protects TOR operators in Germany. Unfortunately they found some dope (yea, 420guy here) during the house search, which makes thing even more complicated. Now I am considering shutting down all my exits. I promise you guys, there is nothing more bad than a police house search in the early morning hourse. Even a burglary would be less worse. Burglars come, steal, go and you never hear again from them. Police comes, searches through all your belongings, destroys your privacy, is allowed to take ALL what they want - and they will send you bad bad letters afterwards. What are your thoughts about this? Best regards, volker

5 6

a characteristic of recent attacks?
by Scott Bennett 01 Sep '22

01 Sep '22

The vast majority of recent surges of unusual activity on my humble relay, which I take as likely being attacks, result in large changes in the hour-to-hour statistic shown below in these lines extracted from the hourly heartbeat message groups. Aug 31 19:02:28.549 [notice] Heartbeat: DoS mitigation since startup: 15 circuits killed with too many cells, 0 circuits rejected, 0 marked addresses, 14 same address concurrent connections rejected, 0 connections rejected, 5 single hop clients refused, 1706742 INTRODUCE2 rejected. Aug 31 20:02:28.546 [notice] Heartbeat: DoS mitigation since startup: 15 circuits killed with too many cells, 0 circuits rejected, 0 marked addresses, 14 same address concurrent connections rejected, 0 connections rejected, 5 single hop clients refused, 1706742 INTRODUCE2 rejected. Aug 31 21:02:28.549 [notice] Heartbeat: DoS mitigation since startup: 15 circuits killed with too many cells, 0 circuits rejected, 0 marked addresses, 14 same address concurrent connections rejected, 0 connections rejected, 5 single hop clients refused, 1706742 INTRODUCE2 rejected. Aug 31 22:02:28.544 [notice] Heartbeat: DoS mitigation since startup: 15 circuits killed with too many cells, 0 circuits rejected, 0 marked addresses, 14 same address concurrent connections rejected, 0 connections rejected, 5 single hop clients refused, 1770970 INTRODUCE2 rejected. Aug 31 23:02:28.556 [notice] Heartbeat: DoS mitigation since startup: 16 circuits killed with too many cells, 0 circuits rejected, 0 marked addresses, 14 same address concurrent connections rejected, 0 connections rejected, 5 single hop clients refused, 2013266 INTRODUCE2 rejected. The most recent such surge appears to have ended less than an hour ago. Note that there was no change in the count of "INTRODUCE2 rejected" for many hours leading up to the onset of unusual activity, though I've only shown three prior hours' worth. Then there is an increase of 63227 in this count during the first hour and another 41296 during the second hour. Often during these periods the input appears to be maxed out, and sometimes the output rate is still higher by several hundred KB/s. My question is, do other relay operators whose relays are being attacked see the same phenomenon? In addition, if someone knows of an effective way to turn such things aside at less cost than be simply leaving them to tor to deal with, I'd love to know about it, too, though I suspect there may be no such method. Thanks in advance for any relevant information! Scott Bennett, Comm. ASMELG, CFIAG ********************************************************************** * Internet: bennett at sdf.org *xor* bennett at freeshell.org * *--------------------------------------------------------------------* * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * * -- Gov. John Hancock, New York Journal, 28 January 1790 * **********************************************************************

2 2