- tor-relays - lists.torproject.org

Fallback Directories - Upcoming Change
by David Goulet 08 Apr '21

08 Apr '21

Greetings! This is to announce that the Tor Project network team will soon change how fallback directories are selected as we are about to update that list. As a reminder, here is the fallback directory definition from the tor man page: When tor is unable to connect to any directory cache for directory info (usually because it doesn’t know about any yet) it tries a hard-coded directory. Relays try one directory authority at a time. Clients try multiple directory authorities and FallbackDirs, to avoid hangs on startup if a hard-coded directory is down. Clients wait for a few seconds between each attempt, and retry FallbackDirs more often than directory authorities, to reduce the load on the directory authorities Previously, we would ask this list for volunteers and then start a lengthy process over weeks to add/remove volunteers from an official list and then make sure the volunteered relays were matching a certain set of criteria. This process was very time consuming for our small team and so we are making a change to be more efficient and avoid to slip on the updates like we did in the previous versions. We will now select at random relays to become fallback directories that match those requirements: - Fast flag "Fast" -- A router is 'Fast' if it is active, and its bandwidth is either in the top 7/8ths for known active routers or at least 100KB/s. - Stable flag "Stable" -- A router is 'Stable' if it is active, and either its Weighted MTBF is at least the median for known active routers or its Weighted MTBF corresponds to at least 7 days. - DirCache is set to 1 (default) - As been around for at least 90 days. The above corresponds to more than 4000 relays at the moment in the consensus and so we'll randomly pick 200 from those at each release so we can have regular rotation and shift load over time over the entire network. Over time, we will remove or add more relays at each minor release if the set of fallback directories not working reaches a 25% threshold or more. Finally, it is very possible that we'll change those requirements over time as we assess this change. We'll do our best to inform this list in time. Thanks! Tor Network Team -- fegt0kLbq3rSb5UY2KTCr5TVsjOd2mko2FRZAZic23Q=

3 3

How best to convince people not to block Tor entirely when they cite DDOS attacks as the reason?
by Nils Erik Flick 07 Apr '21

07 Apr '21

Hi everyone, (Tor advocacy vs. panicked small-time hosting company suffering from "massive attacks") What advice can I offer to someone who's blocking traffic from Tor because their network is apparently experiencing sustained DOS attacks via some exits? They explained to me that they were aware of the value of anonymity online, but couldn't see a way to protect their hosting customers from "attacks making the systems inaccessible". In the end I offered some vague handwaving ("why don't you temporarily throttle traffic just from the nodes where the attacks come from"). I'm not going to do *their* job. But it would still be useful to have something better to point to than just a vague remark. This is a situation where the standard reasons why one needn't block Tor don't really work, and next time I'd like to be better prepared to argue why this isn't a reason either. So, is there some ready-made explanation I could send to such a company, that explains in technical detail how they can *properly* mitigate this without overblocking? K.

1 0

Relay Configurator
by Андрей Гвоздев 06 Apr '21

06 Apr '21

Did anyone use this website: https://tor-relay.co Is it safe to use? Is there an easy way to setup MyFamily if you want to run a few relays?

2 1

Relay Search without AS number/name information?
by nusenu 05 Apr '21

05 Apr '21

Hi, as many of you know AS level data (AS number and name) on Relay Search/onionoo is using a rather outdated geoip database from maxmind. That is the reason why Relay Search displays inaccurate or no AS information for many relays. Recently the geoip database used by tor (not Relay Search) switched [1] from maxmind's db to ipfire [2] for license reasons. Since tor only needs the country level information in only ships country level informat (but ipfire's geoip also contains AS level data). Today I read about the idea to remove AS level data from onionoo/Relay Search on the gitlab issue: https://gitlab.torproject.org/tpo/metrics/relay-search/-/issues/40004#note_… If you also have an opinion on whether Relay Search should improve its AS level information instead of removing it completely now is probably a good time to state it - especially if your tools depend on it. kind regards, nusenu [1] https://gitlab.torproject.org/tpo/core/tor/-/issues/40224 [2] https://location.ipfire.org/ -- https://nusenu.github.io

1 0

ISP
by Андрей Гвоздев 05 Apr '21

05 Apr '21

Which ISP is better? Scaleway or OVH?

6 6

We will start a test run with M1
by niftybunny to-surf-and-protect.net 04 Apr '21

04 Apr '21

Hi there, next week we will drop the first M1 Mac Minis in the datacenter. With the thread of bugs in the current BSD version of tor: Any known issue with the Mac version of Tor? Any other suggestions / comments from Tor relay operators with Macs? nifty

1 0

Many SSH requests
by Cristiano Kubiaki Gomes 03 Apr '21

03 Apr '21

Hi there, O noticed many ssh requests to my Debian VM running a Relay and I am wondering if this is normal or if this is happening only with me. Anyone else see this ssh attemptives? Is it normal? sshd[27004]: Failed password for root from 45.91.226.235 port 41012 ssh2 sshd[27004]: Received disconnect from 45.91.226.235 port 41012:11: Bye Bye [preauth] sshd[27004]: Disconnected from authenticating user root 45.91.226.235 port 41012 [preauth] sshd[27006]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=108.36.253.227 user=root It's many different ips and trying to access in many different ports. Thank you!

7 8

syn flood iptables rule
by Toralf Förster 02 Apr '21

02 Apr '21

The following 3 statements # Make sure NEW incoming tcp connections are SYN packets; otherwise we need to drop them. $IPT -A INPUT -p tcp ! --syn -m state --state NEW -j DROP # DDoS $IPT -A INPUT -p tcp -m state --state NEW -m recent --name synflood --set $IPT -A INPUT -p tcp -m state --state NEW -m recent --name synflood --update --seconds 60 --hitcount 10 -j DROP seems to work and to help here ata fast Tor relay. CPU went down from 109% to 95%. There're 500 connections less than before for a Tor fast relay. The /proc/net/xt_recent/synflood is quickly filled. Unfortunately I cannot change the "ip_list_tot" of "xt_recent" b/c I do use a non-modular kernel. Does anybody knows a circumvention? Are there any objections against this approach? -- Toralf

5 9

Is OVH a safe vps provider to run an exit relay on?
by Keifer Bly 02 Apr '21

02 Apr '21

7 9

bridge static or dynamic ip and multiple bridge config
by gi vi an 02 Apr '21

02 Apr '21

does bridge require static or dynamic ip? if more than one bridge can be configured per one isp connection, how do i configure? -- who am i ? https://mstdn.social/@gvian donate or patron: [+]₿ bitcoin (BTC): 3K7Ba2DFyyuGTukNqXEmogG4VgYp2RWnZV [×]gridcoin (GRC): SK7A2yq4rsoDSKc592dxSb3JSYeSSopbNB [÷]Ᵽ peercoin (PPC): PENnyj6dvEqaAKtqh9tV9KzRKc4N5EWfeH [=]pivx (PIVX): DNyihy8xWXkGyaLnipzWUrC3kjrbcvahHJ [<]blackcoin (BC): B4pCYCRhS6itEs2rsSAVbRnoKkL6thj3Bt

5 7