- tor-relays - lists.torproject.org

Running tor on OpenBSD with hardware acceleration
by Farid Joubbi 12 Oct '16

12 Oct '16

Hello, I have a relay running on OpenBSD. LibreSSL that comes with OpenBSD does not have support for hardware acceleration. I get this when I start tor: "[notice] We were built to run on a 64-bit CPU, with OpenSSL 1.0.1 or later, but with a version of OpenSSL that apparently lacks accelerated support for the NIST P-224 and P-256 groups. Building openssl with such support (using the enable-ec_nistp_64_gcc_128 option when configuring it) would make ECDH much faster." How do I enable support for hardware acceleration? My guess is that I have to compile and install OpenSSL, then compile Tor to use the new OpenSSL. Does anyone here have any experience with this on OpenBSD? Anything that I have missed and should be aware of? Thanks.

3 3

Moving multiple instances to another VPS
by pa011 12 Oct '16

12 Oct '16

I have to move a multiple instances Exit from one VPS to another. Apart from creating the same instances on the new machine with **tor-instance-create** I would then just copy the whole directory /var/lib/tor/keys to the new VPS - or should I copy all /var/lib/tor/ to not miss anything from the original one? Am I miss anything else? Thanks Paul

4 5

Re: [tor-relays] ISP, Abuses , Intrusion Prevention etc.
by Gareth Llewellyn 11 Oct '16

11 Oct '16

On 9 Oct 2016 11:36, "pa011" <pa011(a)web.de> wrote: > > - what forces drive ISP's to behave like they do with abuses? > - maybe Exit volunteers and here especially the big ones could ask some questions to their ISP to get more light on this I set up my own ISP (AS28715) so I could run Tor exits etc without any trouble. > > I do refer to my old questions -still unanswered: > > -is it just the more work for rather poor money handling(forwarding) > those abuses ? Yes. Every abuse ticket is a person answering that abuse ticket instead of helping a customer who is potentially paying for support. It's also that some of the abuse emails can be quite threatening (e.g. blacklisting the entire /24 or reporting the "crime" to local Police etc) some of the smaller ISPs can get intimidated by those threats. > - to whom else do ISP's have to report what they are doing with received > abuses? In the UK; No one. > - must ISP's answer to the origin of the abuse? No. But is polite to do so. > - who is getting a copy of all that conversation(if at all)? Depends on the ISPs policies / any applicable laws. (In the UK and at least as far as my ISP is concerned; no-one) > - can an ISP loose its license (with too many or badly handled abuses)? AFAIK; No. In the UK I guess one could appeal to Court if an ISP wasn't preventing its network from being used to your detriment but I'm not sure how far you'd get. > - are there any regulatory burdens for them - if so which ones? Yes. Lots depending on the country. > - are ISP's treated different in different parts of the world? Very much so.

7 6

new warn message: Duplicate rendezvous cookie in ESTABLISH_RENDEZVOUS.
by Toralf Förster 10 Oct '16

10 Oct '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Today I got this for the first since I run exits: Oct 06 08:23:03.000 [warn] Duplicate rendezvous cookie in ESTABLISH_RENDEZVOUS. Something I should worry about ? - -- Toralf PGP: C4EACDDE 0076E94E, OTR: 420E74C8 30246EE7 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAlf2Dz0ACgkQxOrN3gB26U5LMAD+POAhOITGeYh5CFdOwFxgfzMf 510EN+mxt+3nTAFXgrIA/1BUXnr1DXh61y5ttIxSoVGJb95r8FTrnKiDTZ23yBkV =vFhm -----END PGP SIGNATURE-----

9 13

'No space left on device' glitch causing log failure
by Geoff Down 10 Oct '16

10 Oct '16

Hi all, these are the last entries in my log, but my bridge is still listed on Atlas and client functionality is fine. Latest stable version on OSX10.4. Needless to say, the disk is not full and 'tor' can write to that directory just fine now. Oct 05 22:52:09.000 [warn] Couldn't open "/Users/tor/tor/state.tmp" (/Users/tor/tor/state) for writing: No space left on device Oct 05 22:52:09.000 [warn] Unable to write state to file "/Users/tor/tor/state"; will try again later Oct 05 23:10:27.000 [warn] Couldn't open "/Users/tor/tor/cached-consensus.tmp" (/Users/tor/tor/cached-consensus) for writing: No space left on device Oct 05 23:11:32.000 [warn] Error writing to "/Users/tor/tor/cached-descriptors.new": No space left on device Oct 05 23:11:32.000 [warn] Unable to store router descriptor {more of the same until Oct 05 23:11:34.000} GD -- http://www.fastmail.com - Access all of your messages and folders wherever you are

4 4

tor relay and syslog logging
by Dr. Who 09 Oct '16

09 Oct '16

I'm trying to log locally (notice.log) and to a local syslog-ng server. It doesn't seem to work. I get no messages at all to my local syslog server. When I try to log some testlines manually (even as the tor system user) it seems to work. As I understood the configuration I can have multiple "Log " lines without problem, right? A test like: logger -p daemon.notice -t tortest Testing generates the expected lines in /var/log/messages What facility is used by tor when logging to syslog? I didn't find that information. System is a standard current debian 8.6 with tor Tor 0.2.8.8 (git-8d8a099454d994bd), the two Log-Lines are: Log notice file /var/log/tor/notices.log Log notice syslog Any idea what might be missing?

2 1

ISP, Abuses , Intrusion Prevention etc.
by pa011 09 Oct '16

09 Oct '16

My personal efforts over the last months as well as the recent discussion about Intrusion prevention showed, there are more and more ISP's not giving support any more for running Tor exits, either in not allowing new ones or even shutting down existing ones. Sure there are still chances to find new inexperienced ISP's, which in the willing to increase their customer base give allowance to run an Exit. But only a few weeks later their wish to get rid of you again increases with the same speed as the stack of abuses rises.Finally you are out again and on the back of their terms not even able to get your unused money back. Further doing it that way, is kind of leaving scorched earth behind you and not only yourself, but for Tor as a whole. So there are at least two questions: - what forces drive ISP's to behave like they do with abuses? - maybe Exit volunteers and here especially the big ones could ask some questions to their ISP to get more light on this I do refer to my old questions -still unanswered: -is it just the more work for rather poor money handling(forwarding) those abuses ? - to whom else do ISP's have to report what they are doing with received abuses? - must ISP's answer to the origin of the abuse? - who is getting a copy of all that conversation(if at all)? - can an ISP loose its license (with too many or badly handled abuses)? - are there any regulatory burdens for them - if so which ones? - are ISP's treated different in different parts of the world? - could there in the medium therm changes be made the way Tor operates to bring down the non linear increase of abuses Support terribly needed and appreciated! Paul

1 0

Intrusion Prevention System Software - Snort or Suricata
by pa011 09 Oct '16

09 Oct '16

One of my main ISP is going mad with the number of abuses he gets from my Exits (currently most on port 80). He asks me to install "Intrusion Prevention System Software" or shutting down the servers. He personally recommends Snort or Suricata. As far as I understand implementing such a software is not going together with Tor - am I right? Somebody having same or any experience? Thanks Paul

15 96

Relay uptime after restarting Tor service
by Zac 08 Oct '16

08 Oct '16

Hi, I run this relay: https://atlas.torproject.org/#details/02928855BFAD787F8B363F21860D1E7D156E0… and noticed that my uptime on Atlas is reset to zero when I need to restart the service, i.e. for updates or configuration changes. Is this expected behaviour, or should the uptime in fact be unaffected by such short down-times? Thanks, -- MrDetonia <mrdetonia(a)protonmail.com>

7 7

Digital Ocean - running Exit node locked
by pa011 07 Oct '16

07 Oct '16

Seems like even DO is not very much in favour of running Exits any more ? Anybody made the same experience - how to handle this please ? Thanks and Regards Paul "Hello -Although we do not specifically disallow TOR exit nodes, as the account holder you are responsible for all the traffic going through your droplet (including traffic that an exit node may generate). Also be aware that we do not allow some of the traffic types that come out of a typical TOR exit node (torrents, spam, SSH probes, hacking attempts, botnets, DDoS, etc). If you are unable to stop this sort of traffic, please reconsider running a TOR exit node as it may lead to your account suspension or termination. Please refer to our Terms of Service for greater detail on this issue: https://www.digitalocean.com/legal/terms/ Best, DigitalOcean Support "

2 2

Middle Relay changed to Exit Relay Bandwidth Change
by tmbates12 07 Oct '16

07 Oct '16

Recently I enable exits on my relay and traffic seemed to jump very high compared to the almost stagnant bandwidth increase wen it was just running as a guard middle relay. I was wondering if this was normal for the traffic to jump this much. Here's the Atlas link for my relay: https://atlas.torproject.org/#details/ABF5C38A93F2D7E77A226871AB0ADB052279B…

2 1

Dealing with OVH Abuse Complaints
by teor 05 Oct '16

05 Oct '16

Hi, Does anyone have experience running a long-lived Exit on OVH / So You Start? We've just received a threat to shut down our OVH Exit due to abuse complaints. We were responding to these automated reports (mainly SSH brute force) with template responses, offering to block the destination IP and port if the remote site wanted us to. We never received a reply. What does OVH expect its Exit operators to do with complaints? Should we have blocked each complaining IP address as soon as we received a complaint? Tim T -- Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ricochet:ekmygaiu4rzgsk6n xmpp: teor at torproject dot org

8 7

TOR Services on Microsoft Azure
by Volker Mink 04 Oct '16

04 Oct '16

Hi. I read some pages on the internet about TOR-servers on cloud-services like Microsoft Azure or Amazon AWS. Just gave it a try on Azure and it works like a charm! You can sign up for free and receive credits worth ~200$. With this credits you can safely run an unlimited VPS for about 4-5 month. https://atlas.torproject.org/#details/0534295ACFD5A84312183B41D3FB275E9ADD9E E2 i think im going to give Amazon AWS also a try J regards, volker

7 11

The Onion Box v3.0: Web Interface for your Tor relay
by Ralph Wetzel 04 Oct '16

04 Oct '16

5 10

Question about relay speed
by Sheesh 03 Oct '16

03 Oct '16

Hello! I'm running a non-exit relay on my VPS with small amount of traffic/month. That means my advertised bandwidth is ~500 KB/s. I got a new VPS where I want to let a relay run with several MB/s - My question now is: should I let the slower relay run (aka do 500 KB/s positively contribute to the TOR network?) or move my relay key to the new server and run this one only? Thanks in advance!

7 13

Re: [tor-relays] help #3
by teor 02 Oct '16

02 Oct '16

> On 30 Sep 2016, at 14:37, Markus Koch <niftybunny(a)googlemail.com> wrote: > > Installed with apt-get and started simply as a demon aka service tor start > Thank you for helping Have you tried: >>> sudo su debian-tor --shell /bin/bash --command "ulimit -Sn" >>> sudo su debian-tor --shell /bin/bash --command "ulimit -Hn" What are the file descriptor limits set to? How much RAM does the system have? What are the TCP buffer limits in the kernel? Here's some background: In Tor, there are the 4 C/Linux error return values that can trigger that message: EMFILE ENFILE ENOBUFS ENOMEM On my system, "man 2 intro" lists them as: Too many open files...the limit on the number of open files per process... Too many open files in system. Maximum number of file descrip- tors allowable on the system has been reached... No buffer space available. An operation on a socket or pipe was not performed because the system lacked sufficient buffer space or because a queue was full. Cannot allocate memory. The new process image required more memory than was allowed by the hardware or by system-imposed mem- ory management constraints… T > > Markus > > > > > > > 2016-09-30 23:33 GMT+02:00 teor <teor2345(a)gmail.com>: >> >>> On 30 Sep 2016, at 14:01, Green Dream <greendream848(a)gmail.com> wrote: >>> >>> Have you double-checked the ulimit was applied correctly? Including >>> making sure it's applied to the user account running Tor? Here's how I >>> do that on Ubuntu/Debian, assuming the user account is "debian-tor": >>> >>> sudo su debian-tor --shell /bin/bash --command "ulimit -Sn" >>> sudo su debian-tor --shell /bin/bash --command "ulimit -Hn" >>> >>> Those should return the actual hard and soft limits being applied to >>> the debian-tor user. In my case it returns 64000, but you'll just want >>> to make sure it's what you're expecting. >>> >>>> nothing works and now I am running out of ideas >>> >>> It would be easier for people to help if you elaborate a bit -- >>> perhaps the exact commands you've already tried and the log messages >>> (if there are any other error or warning messages besides the one you >>> already listed). >> >> The debian packages should set the appropriate file descriptors for you. >> How are you launching your tor services? >> >> T >> >> -- >> Tim Wilson-Brown (teor) >> >> teor2345 at gmail dot com >> PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B >> ricochet:ekmygaiu4rzgsk6n >> xmpp: teor at torproject dot org >> >> >> >> >> >> >> T -- Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ricochet:ekmygaiu4rzgsk6n xmpp: teor at torproject dot org

2 1

Help configuring a relay on OS X
by Surf Norway 01 Oct '16

01 Oct '16

A few years ago I tried setting up a relay as a way to contribute back to the community, I have fast symmetrical fiber and a Mac mini running as a light file server. I never was able to get it to work and gave up. I recently bumped up the RAM to max and put an SSD drive in, upgraded to 10.11 and thought I'd give another go at setting up a relay. I've installed Xcode and the command line tools, installed MacPorts and used that to install Tor. I configured the torrc file as best I could and expect that's probably the problem with my setup. When I start Tor (v0.2.8.8) it identifies the OS, reads the torrc file and grabs a chunk of memory for MaxMemInQueues. Then it opens OR listener but on an invalid IP (0.0.0.0), complains that it can't write to the log file (permission denied), and closes partially-constructed OR & directory options. Before I go and change the log file permissions, what user should I be running as when I start Tor as a relay? Ideally I want it to start with the system and run by default in the background and uncommented "RunAsDaemon 1" in the torrc file. The mini sits and serves files normally and isn't usually in use as a normal computer/console. When I run Tor myself it's from a different machine in order to use the Tor browser. All I want the mini to do is act as a relay, nothing more. Thanks for any help. Sorry for the newbie question, but guess what... Surf

2 1

help #3
by Markus Koch 30 Sep '16

30 Sep '16

me again ... I need the knowledge of the almighty tor operators. I set up three new and shiny tor exists and got a not so shiny error message: [WARN]Failing because we have 4063 connections already. Please read doc/TUNING for guidance It was already in this mailing list: http://archives.seul.org/tor/relays/Feb-2016/msg00060.html I "tuned" it with ulimit https://gitweb.torproject.org/tor.git/tree/doc/TUNING/ and nothing works and now I am running out of ideas and getting pissed. They exits are running a Debian 7 x64 minimal install with the newest tor version. Any ideas how to fix it? Markus

4 4

How to get rid of 'Family' entries?
by theonionbox＠gmx.com 30 Sep '16

30 Sep '16

2 1

Request for Tor abuse complaints
by Sadia Afroz 29 Sep '16

29 Sep '16

Dear exit operators, Can you please share the abuse complaints you received while running an exit? We are researchers from Univ. of California, Berkeley and Univ. of Massachusetts Amherst are interested in understanding what kind of abuse happens through Tor. Thanks to Moritz Bartl from Torservers.net <http://torservers.net/> we analyzed over 1GB of complaints received over 6 years. Here is our preliminary analysis of the complaints: http://www1.icsi.berkeley.edu/~sadia/tor_abuse_complaints.pdf <http://www1.icsi.berkeley.edu/~sadia/tor_abuse_complaints.pdf> We will appreciate if you can share the abuse complaints you received. It will be valuable for us to better understand the abuse of Tor and to find solutions to reduce abuse. Best, Sadia

9 17

Hide TOR exit on my external IP?
by Volker Mink 29 Sep '16

29 Sep '16

2 2

"Potentially dangerous relay groups"
by nusenu 28 Sep '16

28 Sep '16

pa011(a)web.de wrote: > there is that list of "potentially_dangerous_relaygroups" you published. > Could yo please emphasize a bit more on what brings a relay on that list, apart from incorrect given MyFamily which doesnt seem to be always the case. > I mean I see quite a few well respected names on that list ? to quote from https://github.com/ornetstats/stats (1) "dangerous" in the sense that a tor client might has a chance to use more than one of these relays in a single circuit (2) these relays are aggregated based on contact information (3) if their groupsize is bigger than their effective family size and they are operated in more than one /16 network block they are listed (4) this list might contain false-positives (contact information is not authenticated) Does that answer your question? I probably should also filter entries where two out of guard_prob, middle_prob and exit_prob are 0 since that means that (1) is never the case - iff onionoo is right about these probabilities.

12 23

log message: [WARN] Failing because we have X connections already.
by David S 27 Sep '16

27 Sep '16

greetings! i setup a new tor exit server and am seeing this in the log messages: 18:25:01 [WARN] Failing because we have 1352 connections already. Please read doc/TUNING for guidance. [11430 similar message(s) suppressed in last 21600 seconds] any ideas why? this is happening on a shared VPS, running ubuntu 16.04 and tor v0.2.8.8. i'm starting to think it's some limitation by the VPS provider. uname -a shows a old kernel (possibly centos 6): Linux km14133-25 2.6.32-042stab113.21 #1 SMP Wed Mar 23 11:05:25 MSK 2016 x86_64 x86_64 x86_64 GNU/Linux i've made sure tor has enough "max open files" available via limits.conf: # cat /proc/$(pgrep tor)/limits|grep "open files" Max open files 65536 65536 files i'm starting to scratch my head. maybe i should do some intense debugging on this box.. cheers, david

3 3

Strange difference between rx and tx traffic
by pa011 27 Sep '16

27 Sep '16

On one of my recently started Exits I do see a rather huge and increasing difference between in and out traffic that I don see on any other Exit so far. The rise doesn’t seem to be linear.. Any explanation for that - or can it just be on the back of a not fixed repetitive warning? Sep 27 06:42:46.000 [warn] eventdns: All nameservers have failed Sep 27 06:42:46.000 [notice] eventdns: Nameserver 8.8.8.8:53 is back up Thanks Paul eth0 / daily day rx | tx | total | avg. rate ------------------------+-------------+-------------+--------------- 11.09.2016 539,96 MiB | 88,50 MiB | 628,47 MiB | 59,59 kbit/s 12.09.2016 1,47 GiB | 1,06 GiB | 2,53 GiB | 245,60 kbit/s 13.09.2016 10,03 GiB | 9,86 GiB | 19,89 GiB | 1,93 Mbit/s 14.09.2016 17,35 GiB | 16,69 GiB | 34,04 GiB | 3,30 Mbit/s 15.09.2016 53,11 GiB | 51,59 GiB | 104,70 GiB | 10,17 Mbit/s 16.09.2016 99,08 GiB | 96,87 GiB | 195,96 GiB | 19,03 Mbit/s 17.09.2016 144,45 GiB | 140,66 GiB | 285,12 GiB | 27,68 Mbit/s 18.09.2016 190,05 GiB | 184,50 GiB | 374,55 GiB | 36,36 Mbit/s 19.09.2016 231,95 GiB | 223,90 GiB | 455,86 GiB | 44,26 Mbit/s 20.09.2016 291,30 GiB | 282,25 GiB | 573,55 GiB | 55,69 Mbit/s 21.09.2016 343,19 GiB | 332,33 GiB | 675,52 GiB | 65,59 Mbit/s 22.09.2016 347,57 GiB | 329,66 GiB | 677,22 GiB | 65,75 Mbit/s 23.09.2016 388,91 GiB | 373,21 GiB | 762,13 GiB | 74,00 Mbit/s 24.09.2016 381,35 GiB | 361,64 GiB | 742,99 GiB | 72,14 Mbit/s 25.09.2016 391,60 GiB | 364,34 GiB | 755,94 GiB | 73,39 Mbit/s 26.09.2016 374,59 GiB | 337,81 GiB | 712,40 GiB | 69,17 Mbit/s 27.09.2016 144,06 GiB | 131,67 GiB | 275,73 GiB | 70,89 Mbit/s ------------------------+-------------+-------------+--------------- estimated 382,03 GiB | 349,18 GiB | 731,21 GiB |

4 5

Re: [tor-relays] [OrNetRadar] niftybunny Digital Ocean 2016-09-22
by nusenu 27 Sep '16

27 Sep '16

Hi Markus, according to your contactinfo observed on the tor network, you run 21 relays, please consider fixing your MyFamily setting, especially because you run non-exit and exits. thanks, nusenu https://raw.githubusercontent.com/ornetstats/stats/master/o/potentially_dan… ornetradar(a)riseup.net wrote: > 2016-09-22 > ----------------------------------------------------------------------------------------------------------------------- > Up|Ext|JoinTime| IP | CC | ORp | Dirp |Version | ContactInfo | Nickname | eFamlen > ----------------------------------------------------------------------------------------------------------------------- > 1 | 0 |14:51:30| 188.166.63.113 | nl | 443 | 80 |0.2.8.7 | niftybunny(a)googlemail.com | cairospinymouse | 1 > 1 | 0 |15:07:01| 95.85.45.159 | nl | 443 | 80 |0.2.8.7 | niftybunny(a)googlemail.com | mullahspinymouse | 1 > 1 | 0 |15:24:30| 138.197.129.153 | ca | 443 | 80 |0.2.8.7 | niftybunny(a)googlemail.com | capespinymouse | 1

2 1