- tor-relays - lists.torproject.org

(FWD) [tor-announce] Tor 0.3.0.7 is released, with a medium security fix for relays
by Roger Dingledine 21 May '17

21 May '17

For those of you who are not on tor-announce... now would be a good time to remember to subscribe to tor-announce. :) --Roger ----- Forwarded message from Nick Mathewson <nickm(a)torproject.org> ----- Date: Mon, 15 May 2017 18:57:59 -0400 From: Nick Mathewson <nickm(a)torproject.org> To: tor-announce(a)lists.torproject.org Subject: [tor-announce] Tor 0.3.0.7 is released, with a medium security fix for relays Hi, all! There's a new Tor release (0.3.0.7) available on the website. It fixes a bug affecting relays running earlier versions of 0.3.0.x that could allow attackers to trigger an assertion failure on those relays. Clients are not affected; neither are relays running versions before 0.3.0.x. If you're running a relay with one of the affected versions, you should upgrade. Source is available on the website now; packages should be available over the next several days. =========== Changes in version 0.3.0.7 - 2017-05-15 Tor 0.3.0.7 fixes a medium-severity security bug in earlier versions of Tor 0.3.0.x, where an attacker could cause a Tor relay process to exit. Relays running earlier versions of Tor 0.3.0.x should upgrade; clients are not affected. o Major bugfixes (hidden service directory, security): - Fix an assertion failure in the hidden service directory code, which could be used by an attacker to remotely cause a Tor relay process to exit. Relays running earlier versions of Tor 0.3.0.x should upgrade. should upgrade. This security issue is tracked as TROVE-2017-002. Fixes bug 22246; bugfix on 0.3.0.1-alpha. o Minor features: - Update geoip and geoip6 to the May 2 2017 Maxmind GeoLite2 Country database. o Minor features (future-proofing): - Tor no longer refuses to download microdescriptors or descriptors if they are listed as "published in the future". This change will eventually allow us to stop listing meaningful "published" dates in microdescriptor consensuses, and thereby allow us to reduce the resources required to download consensus diffs by over 50%. Implements part of ticket 21642; implements part of proposal 275. o Minor bugfixes (Linux seccomp2 sandbox): - The getpid() system call is now permitted under the Linux seccomp2 sandbox, to avoid crashing with versions of OpenSSL (and other libraries) that attempt to learn the process's PID by using the syscall rather than the VDSO code. Fixes bug 21943; bugfix on 0.2.5.1-alpha. _______________________________________________ tor-announce mailing list tor-announce(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-announce ----- End forwarded message -----

10 18

OrNetStats
by nusenu 20 May '17

20 May '17

Hi, if you want to compare your relay(s) with other operators: https://nusenu.github.io/OrNetStats/ Entries on the page link to compass (if you run more than one relay) or directly to atlas if you operate just one. regards, nusenu -- https://mastodon.social/@nusenu https://twitter.com/nusenu_

2 3

seized relays reported for blacklisting?
by nusenu 20 May '17

20 May '17

Hi Nicolas, according to aeris (CC) one(?) [1] of your relays got seized/compromised [2]. Did you report it to tor directory authorities, so they can blacklist the relay? thanks, nusenu [1] InFlames - C46A33E7E56F4F3FF2D36308A37E3DA21CD100FB [2] https://twitter.com/aeris22/status/865317501525045248 -- https://mastodon.social/@nusenu https://twitter.com/nusenu_

3 4

Bridge not being used
by Joel Cretan 19 May '17

19 May '17

Hi relay operators, I've run a number of relays, so I'm familiar with how this usually works for non-bridges. I'm working on a project that might want to connect through a bridge, so I thought I'd fire one of those up to offset the demands I'd be placing on the network. I've been operating this bridge for about 30 days with RelayBandwidthRate set at 5000 KBytes, which I thought might be attractive to some clients, since most bridges are so small. But checking my logs for the last few days, I don't seem to have had any clients at all recently. Is this expected for a bridge, as clients don't rotate their bridge very often, or is something possibly wrong? As far as I can tell, everything is working OK, because I can connect through it with my own Tor client. The server descriptor is published. I'll avoid pasting the whole torrc since it's a bridge, but I can do that with some parts removed if that would help. Thanks! jc

2 2

Re: [tor-relays] seized relays reported for blacklisting?
by nusenu 19 May '17

19 May '17

Hi Nicolas, thanks for your fast response. Nicolas Simond: > I'll do but I don't know if this has been done since I haven't received > any response. Ok so you tried to contact them already? (what email / channel did you use?) > But all relay have disapeared from the atlas. Are you saying that more than one of your relays was seized? I found the following relays (down) with your contactinfo, did all 3 get seized? +----------+-----------------+---------------------+ | FP | nickname | last_seen | +----------+-----------------+---------------------+ | 96D67782 | darkstar | 2017-05-17 09:00:00 | | 6B356C10 | dustofnightmare | 2017-05-17 09:00:00 | | C46A33E7 | InFlames | 2017-05-13 16:00:00 | +----------+-----------------+---------------------+ Atlas is currently hardly working since its backend (onionoo.torproject.org apparently has some availability issues). Atlas also only shows relays that have been running at some point within the last 7 days (which should not be a problem in this case). -- https://mastodon.social/@nusenu https://twitter.com/nusenu_

1 0

DirCache 0
by Paul 18 May '17

18 May '17

Running a relay on small RAM I putted "DirCache 0" to save memory. As one can read here https://www.torproject.org/docs/tor-manual.html.en "Setting either DirPort or BridgeRelay and setting DirCache to 0 is not supported. (Default: 1) " I cant set a DirPort as well, which means I cant publish a DirPortFrontPage Exit-notice. Any idea how to circumvent this problem. Thanks Paul

2 1

Strange behaviour Tor 0.2.9.10 - off topic
by Felix 18 May '17

18 May '17

Hi everybody I walked through the March postings and found: > (Please don't put -- in your emails. Some people use broken > mail readers that hide everything below a -- .) Indeed it's not broken, it's *Usenet Signature Convention* https://tools.ietf.org/rfc/rfc3676.txt (chapter 4.3.) That's old school - how we saved bandwidth in ancient times :) -- Cheers, Felix

2 1

TROVE-2017-002: deb.torproject.org 0.3.0.x repos no longer updated? - help yourself
by Felix 18 May '17

18 May '17

Hi If you suffer from: (and https://www.freshports.org/security/tor/ is still on 3.0.6) > To help the 1.3% cw-fraction / 87 FreeBSD relays I filed > a ticket here: > https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=219364 and you are on FreeBSD source you upgrade to 3.0.6 and then put a small hack in place: Go to ports security/tor and edit the 3.0.6 distinfo to: SHA256 (tor-0.3.0.7.tar.gz) = 9640c4448ef3cad7237c68ed6984e705db8fb2b9d6bb74c8815d01bb06527d02 SIZE (tor-0.3.0.7.tar.gz) = 5779422 Change the 3.0.6 Makefile to: PORTVERSION= 0.3.0.7 Copy tor-0.3.0.7.tar.gz from https://dist.torproject.org/ to /var/ports/distfiles/ # cd /usr/ports/security/tor && make deinstall clean # cd /usr/ports/security/tor && make install And voila 3.0.7 shows up. Works as well for jails (/usr/jails/myjail/var/ports/distfiles/). If you come from some older versions please check ports/UPDATING, libevent is 2.1.8 now. -- Cheers, Felix

1 0

Re: [tor-relays] Strange behaviour Tor 0.2.9.10
by Geoff Down 18 May '17

18 May '17

Further information. Curl error Failed to receive SOCKS5 connect request ack. and from earlier, Tor log Mar 19 11:52:37.000 [notice] Tried for 32496 seconds to get a connection to [scrubbed]:80. Giving up. -- http://www.fastmail.com - A no graphics, no pop-ups email service

3 12

Bandwidth settings
by Torix 17 May '17

17 May '17

This is a newbie question, but I'm not sure where else to ask it. I had an older desktop box from a decade ago, so I put Debian tor on it as per the directions and set it up as a middle node (exit policy to reject *:*) at home. I added arm and vnstat to be able to look at it. I've never done anything with tor before, so I know nothing but what I've read in the past 2 weeks. My question is about bandwidth. I made a mistake at first with Kbytes and kbits, but currently have it set at 200KBytes steady, 300KBytes burst. This translates in the default arm display to 1.5Mb/s and 2.3Mb/s. I use Verizon Fios. When I did a speed test from Verizon, I got 60 Mbps up and 70 Mpbs down. I currently have not set any accounting max daily limit. It seems to me that I could add 10 times the bandwidth and still be at 15/23 Mbps out of 60-70 Mpbs, or only a quarter of my total bandwidth. Were I to do this, 1. would we notice at home, where we don't stream video; just run browsers and remote desktop about 8 miles away to work. 2. or would Verizon notice first the bandwidth or the amount of data going through our connection? Which would be the first limit? Bandwidth or data? In terms of data, I've already run 11.5 GB through tor yesterday, out of about a 17GB theoretical maximum at these bandwidth settings. Would 170GB/day be outrageous to Verizon if I cranked the bandwidth up? Would we notice it? Hoping someone might be able to add to my vast experience of 3 days up. Sent with [ProtonMail](https://protonmail.com) Secure Email.

4 4

Fallback Directory Update: May 2017
by teor 17 May '17

17 May '17

Dear Relay Operators, We have rebuilt the list of fallback directory mirrors in Tor[0] for the upcoming 0.3.1 release. The new list will also be backported to Tor 0.2.8 and later. If you're asking: Q: What's a fallback directory mirror? See [1]. Q: Is my relay on the list? Search [2] for your relay fingerprint or IP address and port. (I used to BCC this email to all operators on the list, but that's a lot of work!) Q: What do I need to do if my relay is on the list? Keep the same IP address, keys, and ports. Email me or this list if the relay's details change. Q: Can my relay be on the list next time? We need fast relays that will be on the same IP address and port for 2 years. Email me to get on the potential relay list[3], or to update the details of your relay. Every release or two we run a script to choose about 150-200 relays for the list. Q: Why didn't my relay get on the list this time? We check a relay's uptime, flags, and speed[4]. Sometimes, a relay might be down when we check. That's ok, we will check it again next time. It's good to have some new relays on the list every release. That helps tor clients, because blocking the whole list is harder. Tim [0]: https://gitweb.torproject.org/tor.git/commit/src/or/fallback_dirs.inc?id=5b… [1]: https://trac.torproject.org/projects/tor/wiki/doc/FallbackDirectoryMirrors [2]: https://gitweb.torproject.org/tor.git/tree/src/or/fallback_dirs.inc [3]: https://gitweb.torproject.org/tor.git/tree/scripts/maint/fallback.whitelist [4]: https://trac.torproject.org/projects/tor/attachment/ticket/21564/fallbacks_… T -- Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ricochet:ekmygaiu4rzgsk6n xmpp: teor at torproject dot org ------------------------------------------------------------------------

1 0

WannaCry fallout FYI
by Jon Gardner 16 May '17

16 May '17

From the SNORT folks... http://blog.talosintelligence.com/2017/05/wannacry.html?m=1 ".... Additionally, organizations should strongly consider blocking connections to TOR nodes and TOR traffic on network. Known TOR exit nodes are listed within the Security Intelligence feed of ASA Firepower devices. Enabling this to be blacklisted will prevent outbound communications to TOR networks." <>< Jon L. Gardner Mobile: +1 979-574-1189 Email/Skype/Jabber: jon(a)brazoslink.net AIM/iChat/MSN: jlg(a)mac.com

8 14

Tor and ufw
by je suis 15 May '17

15 May '17

Hello everyone One of my friends got a ransomware and, even if I am on Linux and I take care when browsing, with such a proof beside me I thought I'd secure myself a bit, so I got ufw. I am running a middle relay, and so far it went just fine with ~2.5MB bandwidth, even if only in the daytime, morning to evening (laptop...; I do plan in getting a RaspberyPi in the future). I followed this page for setting up ufw with tor: https://help.ubuntu.com/community/TorDedicatedUser , even if I have Archlinux. I didn't use all in there, only the part right below "Traffic redirection", with ufw in the command line. Now, if I see the relay with 25kB, it's a miracle. So, obviously, I did something wrong. Is there a page with proper explanations for dummies like me? If it helps, my net comes from a router that handles cable TV and phone, as well. Vlad

1 1

A Naïve Question About ARM
by Kenneth Freeman 13 May '17

13 May '17

This is possibly a naïve question, but I like to compile and run the alpha/unstable version of Tor, but for the life of me I can't figure out how to get ARM to run the latest version. I'm currently running Anosognosia (Fingerprint: 9536B457F01F40696B131A72BC102343759F46AA), but it's stuck in the unrecommended Tor 0.2.7.5 and I'd like it to run 0.3.0.5-rc. Please explain it to me like I'm eight. Thanks! P.S. I understand that ARM is crufty is shall be updated, and furthermore, I miss Vidalia.

2 2

niftybunny relays: MyFamily configuration needs an update
by nusenu 11 May '17

11 May '17

Hi Markus, thanks for running so many tor relays. One [1] of your relays recently got a new key (2017-04-27), please update your MyFamily setting accordingly to help protect tor clients from using your entry+exit at the same time. thanks, nusenu https://raw.githubusercontent.com/ornetstats/stats/master/o/potentially_dan… [1] https://atlas.torproject.org/#search/niftychinchilla -- https://mastodon.social/@nusenu https://twitter.com/nusenu_

1 1

schlarman.org relays: MyFamily configuration
by nusenu 09 May '17

09 May '17

Hi, thanks for running tor relays [1]. Please update your MyFamily [2] setting to help protect tor clients from using your entry+exit at the same time. thanks, nusenu [1] https://atlas.torproject.org/#search/contact:tor@schlarman.org [2] https://www.torproject.org/docs/tor-manual.html.en#MyFamily -- https://mastodon.social/@nusenu https://twitter.com/nusenu_

1 0

Relay has Low Consensus and No Exit Flag Following Upgrade
by Chris 07 May '17

07 May '17

Hello, I recently upgraded my tor exit relay's tor version to 0.2.8.12. The uptime is 51 days and it has valid, running and stable flags. However, it no longer has the exit node flag and the consensus is very low (20). It also is not listed as a directory. I suspect something else during the upgrade has broken it as I had some SELinux issues binding to the ports before - which I resolved. There are no errors in ARM although the log is non existent? - permissions error? The fingerprint is 575F2C60045805ABFDB2B7D7A78982F9571BC277 Where should I start to fix this? Best Wishes, Chris -- Protect your privacy: encrypt your communications GPG: CF7F98B2

5 5

Actual user demographics?
by Jivan Amara 03 May '17

03 May '17

The counter they made has a good point, that you really don't know who is using it; but to suggest that means it's entirely used by criminals is also ridiculous. What can be known is *how* TOR is being used by setting up studies at exits and seeing what kind of services people are connecting to. From that, some inference of *who* is using TOR is possible. Maybe it's the same guy buying cocaine from a black market seller that posts articles on a civil rights abuses site, but it would be silly to make that assumption. From the usage stats I've seen, the TOR website paints a prettier picture than the truth, but at the same time opponents paint a significantly darker one. On 05/03/2017 05:00 AM, tor-relays-request(a)lists.torproject.org wrote: > Good morning, > > I recently presented to a group of ten local police chiefs on the topic of Tor and its more common, though less publicized, civil usage, as opposed to the more publicized criminal usage. During my presentation I emphasized this fact, and they countered that because its usage is entirely anonymous, it is reasonable to assume that it could be used entirely by criminals and none of the oppressed as I had claimed. > > Which brings me to my question. Other than private individuals saying "Hey, I use Tor for X", how does the overall network know what the network is used for, even approximately? > > Make your day great, > Isaac Grover, Senior I.T. Consultant > Aileron I.T. - "Practical & Proactive I.T. Solutions" > > O: 715-377-0440, F:715-690-1029, W: www.aileronit.com -- Cheers, Jivan Amara --- Senior Full-Stack Developer Development(a)JivanAmara.net (619) 549-4497

4 4

Actual user demographics?
by Isaac Grover, Aileron I.T. 02 May '17

02 May '17

Good morning, I recently presented to a group of ten local police chiefs on the topic of Tor and its more common, though less publicized, civil usage, as opposed to the more publicized criminal usage. During my presentation I emphasized this fact, and they countered that because its usage is entirely anonymous, it is reasonable to assume that it could be used entirely by criminals and none of the oppressed as I had claimed. Which brings me to my question. Other than private individuals saying "Hey, I use Tor for X", how does the overall network know what the network is used for, even approximately? Make your day great, Isaac Grover, Senior I.T. Consultant Aileron I.T. - "Practical & Proactive I.T. Solutions" O: 715-377-0440, F:715-690-1029, W: www.aileronit.com

3 2

tornull
by Dirk 01 May '17

01 May '17

Dear all, I was made aware of the Tor Null Advisory BL [1] which is also mentioned in trac here [2]. Block Botnets does not seem like a bad idea in principal. But the page has no listing of a responsible person neither any criteria listed which it chooses to identify "bad" IPs. Looking at some of the links I found 1 which had a date from 2011 [3]. As will I miss information an when and how often it is updated. Therefore it looks slightly suspicious to me. And it surely has an abuse potential. Does anyone have more information on the background or recommendations here ? best regards Dirk [1] https://tornull.org/ [2] https://trac.torproject.org/projects/tor/wiki/doc/ReducedExitPolicy [3] https://www.spamhaus.org/sbl/query/SBL113323

4 4

Fast relay dropped from use by Tor
by Sec INT 01 May '17

01 May '17

Hi This relay processed 7TB in April for Tor and processed 12 gb yesterday but today is hardly processing any data at all? Its barely doing 1000 b/sec? Its flagged as'fast, guard' etc so why is it not being used? I also checked on Atlas and this relay is not even listed anymore? Finger: B39AD54B73A70DA68F6FC26CD0A874DE762B7825 Is this BW auth issue? Oh and I checked the available bandwidth its 100mb/s up and down Snap

2 1

Is there any problems for users of my exit node if I have DNS lookups go out on a different interface?
by Anders Andersson 30 Apr '17

30 Apr '17

I plan to set up a Tor exit node (again), and the server has two external interfaces each with a dedicated IP. I'm going to use one of these exclusively for Tor. I also run a validating Unbound on the same machine, and all DNS lookups that are not cached will go out on the *other* interface by default. internet <--> IP 1 <--> unbound internet <--> IP 2 <--> tor, talking locally to unbound IP 1 and 2 should have the same routing path otherwise, because it's on the same network. I can't imagine how this could be problematic, but there has been so much talk about DNS lookups over the years, so I thought I'd better check with people who know more about this.

2 1

(no subject)
by Alex 29 Apr '17

29 Apr '17

-- реклама ----------------------------------------------------------- http://FREEhost.UA - мы размещаем больше 100 тыс. сайтов! Качественный хостинг для новичков и профи - http://goo.gl/EcgF4I

1 0

Law Enforcement Request
by teor 28 Apr '17

28 Apr '17

Hi all, Last week, we were contacted by Australian law enforcement, on behalf of German law enforcement, about one of our relays. It appears that some law enforcement agency had performed a guard discovery attack on a hidden service. One of our relays was that hidden service's guard. They requested that we provide a detailed network capture of that guard's traffic. We refused. (We do not keep detailed logs.) We also shut down the guard. T -- Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ricochet:ekmygaiu4rzgsk6n xmpp: teor at torproject dot org ------------------------------------------------------------------------

3 3

bind DNS Crash on Exit
by teor 26 Apr '17

26 Apr '17

Hi all, Are you using bind as a local caching resolver on your exits? The DNS resolver on our exit crashed over the weekend due to this bug: https://kb.isc.org/article/AA-01466 It hasn't been patched yet in Debian: https://security-tracker.debian.org/tracker/CVE-2017-3137 So I have added a file: /etc/systemd/system/bind9.service.d/restart-on-abort.conf With the text: [Service] Restart=on-abort This should work for any systemd/bind9 Linux system. T -- Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ricochet:ekmygaiu4rzgsk6n xmpp: teor at torproject dot org ------------------------------------------------------------------------

2 1