- tor-relays - lists.torproject.org

minor typos in tor-instance-create
by tor relay 06 Aug '16

06 Aug '16

https://gitweb.torproject.org/debian/tor.git/tree/debian/tor-instance-creat… is: systemctl tor@$name start should be: systemctl start tor@$name mailto:tor@$name https://gitweb.torproject.org/debian/tor.git/tree/debian/tor-instance-creat… brdige -> bridge

2 2

tor-instance-create users: beware all your instances are always started
by tor relay 06 Aug '16

06 Aug '16

This is only relevant for debian users. If you assume you can manage your instances with the usual systemctl commands like systemctl disable/enable tor@myinstance beware that they have no effect. Note: systemctl start/stop works as expected. This is important to know especially if you have multiple configurations and want to enable/disable some of them to avoid running them concurrently. I don't know the reasoning behind that design decision but all your instances are enabled due to [1], you cannot use the well known systemctl disable command like systemctl disable tor@myinstance to disable a specific instance. If you want to disable them you can use the 'mask' command: systemctl mask tor@myinstance this is less convenient because this way you wont be able to run systemctl start tor@myinstance (on a masked unit) or move configuration files away (also less convenient than native disable/enable) [1] https://gitweb.torproject.org/debian/tor.git/tree/debian/systemd/tor-genera…

1 0

debian: log messages when upgrading tor package
by tor relay 05 Aug '16

05 Aug '16

When upgrading the tor package on debian I get the following syslog messages: systemd[1]: Failed to reset devices.list on /system.slice: Invalid argument systemd[1]: Failed to reset devices.list on /system.slice/system-tor.slice: Invalid argument Should I be concerned?

1 0

Got a visit from the police this morning..
by Stig Atle Steffensen 05 Aug '16

05 Aug '16

I never thought I would be one of those operators who had to deal with the police or anything like that. I've done all I can to set things up so that it's easy to see that I run a exit node. I have a disclaimer on my website : https://stigatle.no/index.php/tor-exit-node/ and if you go to the ip of the node, you'll see the same info: https://185.97.32.18/ I run this node - which is no secret: https://atlas.torproject.org/#details/04250C3835019B26AA6764E85D836088BE441… So, back to earlier this morning. Suddenly got a hard knock on my door, I was surprised because we never get visitors. I saw it was the police (2 officers), and they asked if we could talk in private, because they heard my kids (2 and 4) and my wife upstairs, I said yes, no problem, let them in. They would not let me know what it was about at first, they asked a lot about what I did yesterday, easy for me to answer since I was out climbing mountains all day long. Then asked a lot about who has access to my connection at home, It's just me, my wife, no one else. Then I start to ask a bit, and I thought about the exit node I run, I quickly confirmed that it was the exit node (which is in sweden and not in Norway where I live) that was the reason why they where at my house. All though - 2 second check would confirm to them that the server is not at my house, and the impression they gave me until I showed the Exit node was that they thought it was sent from my house. I have blocked the email ports on the exit node, but the issue was that a email had been sent through hotmail (web), threatening Angela Merkel, that's why they where at my house this morning. I got the chance to explain everything as best I could, explained how it all worked, and why I run a exit node, and I feel they got all the answers they needed. They then left - and for now that was that. I would be put on some kind of list, but that list would also explain that I operate a tor exit node. I'm happy with that, and hopefully this will be all that there's to it. I might have to do some more explaining if I travel to sweden\germany, but that's fine with me. Anyone else here that has this happen to you recently as well?..

11 13

Syslog: Kernel TCP: Too many orphaned sockets
by Tristan 05 Aug '16

05 Aug '16

I looked at my exit relay's syslog for no specific reason, and saw that it was flooded with the following message: kernel: [1736405.162223] TCP: too many orphaned sockets These messages occur multiple times per second, but they only flood the log every couple of hours. What is this, and what does it mean? -- Finding information, passing it along. ～SuperSluether

3 4

Any security tips on running a TOR relay?
by Andrew 05 Aug '16

05 Aug '16

Hi, I've got a spare server for two (freebsd) and I'd like to start running TOR relays on them. Is there any security concerns I need to deal with, or is the ports compile + updates good enough to keep my systems decently secure. I actively monitor the machines, but as you know, the game is prevention, not reaction to security incedents :) Thanks, AB49K

5 11

Two bridge relay questions
by Tor-Node.net 05 Aug '16

05 Aug '16

Hi! I run an obfs4 bridge. 1) Why is the advertised bandwidth 56.72 KB/s when the relay is on a (shared) gigabit connection? According to my experiments it should be several MB/s. 2) Where can I submit my bridges to help people in Iran, China etc, besides the Tor BridgeDB? Kind regards Tor-node.net

3 2

Exit relay funding
by Michael McConville 04 Aug '16

04 Aug '16

Hi, everyone. I'm an experienced Tor relay operator and a mostly dormant community member. My main relay these days is on a dedicated server running OpenBSD and moving 3-4 MB/s. It costs me $35/month. https://atlas.torproject.org/#details/CDAB3AE06A8C9C6BF817B3B0F1877A4B91465… Sadly, I have to shut it down at least temporarily if no one can help me pay for it. Is anyone interested? You can search the mailing lists to see that I've been contributing for a few years, and I can give more verification if you'd like. Thanks for your time, Michael McConville

23 40

Re: [tor-relays] tor-relays Digest, Vol 67, Issue 11
by Flipchan 04 Aug '16

04 Aug '16

Auto update with cron, audit it like a normal server tor-relays-request(a)lists.torproject.org skrev: (4 augusti 2016 14:00:07 CEST) >Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > >To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > >You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of tor-relays digest..." > > >Today's Topics: > > 1. Re: experiences with debian tor 0.2.8.6 package from > deb.torproject.org (tor relay) > 2. Any security tips on running a TOR relay? (Andrew) > 3. Re: Exit relay funding (Petrusko) > 4. Re: experiences with debian tor 0.2.8.6 package from > deb.torproject.org (Peter Palfrader) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Thu, 4 Aug 2016 08:01:32 +0200 (CEST) >From: tor relay <torrelay3(a)mailbox.org> >To: tor-relays(a)lists.torproject.org >Subject: Re: [tor-relays] experiences with debian tor 0.2.8.6 package > from deb.torproject.org >Message-ID: <249633305.6901.1470290492290(a)office.mailbox.org> >Content-Type: text/plain; charset="utf-8" > >https://trac.torproject.org/projects/tor/ticket/19825 >

1 0

Tor relay on pfSense
by Edwin Garzón 04 Aug '16

04 Aug '16

Hello you have an updated tutorial for "Set Up Tor relay on pfSense 2.3.2" Thanks Edwin

1 0

Re: [tor-relays] is explicit DirPort needed anymore under Tor 0.2.8.6?
by Tristan 03 Aug '16

03 Aug '16

I'd like to peep in here and say that Orbot (Tor on Android) is still using version 2.7.5. Until someone updates the app to 2.8.6, those users will still need a DirPort.

1 0

Re: [tor-relays] tor-relays Digest, Vol 67, Issue 2
by Flipchan 01 Aug '16

01 Aug '16

What isp do u have in Sweden , i have had simular isp problems where i have got a letter in the mail (a real irl letter in paper^^). tor-relays-request(a)lists.torproject.org skrev: (1 augusti 2016 14:00:12 CEST) >Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > >To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > >You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of tor-relays digest..." > > >Today's Topics: > > 1. Re: Got a visit from the police this morning.. (Marco A. Calamari) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Mon, 01 Aug 2016 11:45:32 +0200 >From: "Marco A. Calamari" <marcoc_maillist(a)marcoc.it> >To: tor-relays(a)lists.torproject.org >Subject: Re: [tor-relays] Got a visit from the police this morning.. >Message-ID: <1470044732.4836.6.camel(a)marcoc.it> >Content-Type: text/plain; charset="UTF-8" > >On Sun, 2016-07-31 at 14:54 +0100, Jonathan Baker-Bates wrote: >> I think this issue has been discussed here before. >> >> The general opinion on the list is that it's not a good idea to >> run an exit at home. It's probably not worth the hassle. > >For the peace of the mind and of the home sure. > >OTOH if all put exit nodes on external providers, > the vulnerability of the Tor network raise a lot, > hoping that no one run it on VM without knowing/caring > of this .... > >JM2C > >> On 31 July 2016 at 14:13, Stig Atle Steffensen <stigatle@cryptol >> ab.net> wrote: >> > I never thought I would be one of those operators who had to >> > deal with the police or anything like that. >> > I've done all I can to set things up so that it's easy to see >> > that I run a exit node. >> > >> > I have a disclaimer on my website : >> > https://stigatle.no/index.php/tor-exit-node/ >> > >> > and if you go to the ip of the node, you'll see the same info: >> > https://185.97.32.18/ >> > >> > I run this node - which is no secret: >> > https://atlas.torproject.org/#details/04250C3835019B26AA6764E8 >> > 5D836088BE441088 >> > >> > So, back to earlier this morning. >> > Suddenly got a hard knock on my door, I was surprised because >> > we never get visitors. >> > I saw it was the police (2 officers), and they asked if we >> > could talk in private, because >> > they heard my kids (2 and 4) and my wife upstairs, I said yes, >> > no problem, let them in. >> > >> > They would not let me know what it was about at first, they >> > asked a lot about what I did yesterday, >> > easy for me to answer since I was out climbing mountains all >> > day long. >> > Then asked a lot about who has access to my connection at >> > home, It's just me, my wife, no one else. >> > >> > Then I start to ask a bit, and I thought about the exit node I >> > run, I quickly confirmed >> > that it was the exit node (which is in sweden and not in >> > Norway where I live) that was the reason why they where at my >> > house. >> > All though - 2 second check would confirm to them that the >> > server is not at my house, and the impression they gave me >> > until I >> > showed the Exit node was that they thought it was sent from my >> > house. >> > >> > I have blocked the email ports on the exit node, but the issue >> > was that a email had been sent through hotmail (web), >> > threatening Angela Merkel, that's why they where at my house >> > this morning. >> > >> > >> > I got the chance to explain everything as best I could, >> > explained how it all worked, and why >> > I run a exit node, and I feel they got all the answers they >> > needed. They then left - and for now that was that. >> > >> > I would be put on some kind of list, but that list would also >> > explain that I operate a tor exit node. >> > I'm happy with that, and hopefully this will be all that >> > there's to it. >> > >> > I might have to do some more explaining if I travel to >> > sweden\germany, but that's fine with me. >> > >> > >> > Anyone else here that has this happen to you recently as >> > well?.. >> > >> > >> > _______________________________________________ >> > tor-relays mailing list >> > tor-relays(a)lists.torproject.org >> > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-rela >> > ys >> > >> >> _______________________________________________ >> tor-relays mailing list >> tor-relays(a)lists.torproject.org >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > >------------------------------ > >Subject: Digest Footer > >_______________________________________________ >tor-relays mailing list >tor-relays(a)lists.torproject.org >https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > >------------------------------ > >End of tor-relays Digest, Vol 67, Issue 2 >***************************************** -- Sincerly Flipchan

1 0

outgooing UDP flooding on middle relay
by pa011 01 Aug '16

01 Aug '16

Hello, one of my middle relays got auto limited by the ISP because of "outgooing UDP flooding ". The VPS is pure debian8, fail2ban, pub key and nothing else installed - so I highly doubt the give reason for the traffic limitation. Also I cant find anything in the log files. Anybody having experience with such an issue? What to check for please? Paul

5 12

Don't use Google's DNS server
by Philipp Winter 29 Jul '16

29 Jul '16

I created a new diagram that illustrates the popularity of DNS resolvers used by exit relays. The diagram shows nine autonomous systems that hosted the most popular resolvers at some point over the last months. These autonomous systems are owned by Google, INIT7, LeaseWeb, Visual Online, OVH, OpenDNS, NForce Entertainment, Cyberdyne, and Level3. The x axis shows time and the y axis shows the fraction of DNS requests that the respective AS can observe: <https://nymity.ch/dns-traffic-correlation/img/exit-resolvers-2015-05.png> The two most popular setups are Google's 8.8.8.8 and local resolvers, i.e., exit relays doing their own resolution. Occasionally, Google got to see more than 40% of all DNS requests exiting the Tor network. That is concerning, particularly given Google's role in the PRISM program. No other autonomous system is getting even close. Please refrain from using 8.8.8.8. Instead, set up your own resolver, or at least use the one provided by your ISP. Here's Peter's quick guide on how to set up your own resolvers [1]: On Thu, Jan 08, 2015 at 04:11:09PM +0100, Peter Palfrader wrote: > o apt-get install unbound > o remove all nameserver entries in /etc/resolv.conf and add one for the > local recursor. Either manually or use (untested): > sed -i -e 's/^nameserver /#&/; $a nameserver 127.0.0.1' /etc/resolv.conf > o prevent anything else from modifying that file ever again: > chattr +i /etc/resolv.conf Note that running your own resolver is not universally safer because the exposure of DNS requests to network adversaries is greater. It's a tricky trade-off that we are currently trying to understand better [2], but increased exposure to network-level adversaries seems less bad than having Google see almost half of all DNS requests. If you are wondering how I created the above diagram, have a look at the measurement method [3]. [1] <https://lists.torproject.org/pipermail/tor-relays/2015-January/006147.html> [2] <https://nymity.ch/dns-traffic-correlation/> [3] <https://lists.torproject.org/pipermail/metrics-team/2016-February/000078.ht…> Cheers, Philipp

10 15

Re: [tor-relays] cheap unmetered non-exit VPS offers
by Tor-Node.net 28 Jul '16

28 Jul '16

Markus Koch <niftybunny(a)googlemail.com> wrote: > exit allowed? I can vouch for www.stayon.no VPS with dedicated, unmetered 1 Gbps connection. 1 GB RAM / 1 CPU @ 2.6 GHz Price: 149 NOK/month (~ 16 EUR / 17 USD). Tor exit friendly. Their abuse departement will ask you to block destination IPs if it's something serious. Kind regards Tor-node.net

2 1

AWS abuse handling
by Snehan Kekre 28 Jul '16

28 Jul '16

Hi All, I have a *free* membership for a year on Amazon's AWS (*capped* at 15GB/month of traffic each way). I've been running an exit node with a reduced exit policy on an ec2 instance for months and have received my first abuse notice. I'm sure a few on this mailing list may have received the same or similar abuse notification from Amazon. Besides shutting down the exit, what measures did you take to deal with this? What would be the consequences of ignoring their email and continuing to run it? Note: I'm a student and am running on a really tight budget at the moment (reason for not hosting it on a paid vps) Any suggestion(s)/help is appreciated :) Best, Snehan ----------------------------------------------- The contents of the Abuse notice: Hello, We've received a report(s) that your EC2 instance(s) Instance Id: IP Address: has been has been operating as a TOR Exit node. Operating a TOR Exit node is forbidden in the AWS Acceptable Use Policy (hxxps://aws.amazon.com/aup/) We've included the original report below for your review. Please take action to stop the reported activity and reply directly to this email with details of the corrective actions you have taken. If you do not consider the activity described in these reports to be abusive, please reply to this email with details of your use case. If you're unaware of this activity, it's possible that your environment has been compromised by an external attacker, or a vulnerability is allowing your machine to be used in a way that it was not intended. We are unable to assist you with troubleshooting or technical inquiries. However, for guidance on securing your instance, we recommend reviewing the following resources: * Amazon EC2 Security Groups User Guide: hxxps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.… (Linux) hxxps://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/using-network-securi… (Windows) * Tips for Securing EC2 Instances: hxxps://aws.amazon.com/articles/1233 (Linux) hxxps://aws.amazon.com/articles/1767 (Windows) * AWS Security Best Practices: hxxp://media.amazonwebservices.com/AWS_Security_Best_Practices.pdf If you require further assistance with this matter, you can take advantage of our developer forums: hxxps://forums.aws.amazon.com/index.jspa Or, if you are subscribed to a Premium Support package, you may reach out for one-on-one assistance here: hxxps://console.aws.amazon.com/support/home#/case/create?issueType=technical Please remember that you are responsible for ensuring that your instances and all applications are properly secured. If you require any further information to assist you in identifying or rectifying this issue, please let us know in a direct reply to this message. Regards, AWS Abuse " ---------------------------------------------------------------------------

9 21

How to find (and test) my obfs4 bridge?
by Tor-Node.net 28 Jul '16

28 Jul '16

Hi! I know the format for an obfs4 bridge is obfs4 IP:port fingerprint cert=XX iat-mode=0 I know my IP, port and fingerprint, but where can I find the "cert"-value? Kind regards Tor-node.net

2 1

switching between exit and guard
by Markus Koch 27 Jul '16

27 Jul '16

Hi there, now I am getting abuse mails nearly every day and digital ocean looks like getting pissed off. Is it technical possible to switch between exit and guard so I only run an exit for 14 days a months (less abuse mails per month if it is a exit only 14 days). Or is this a really bad idea? Markus PS: I am also getting my first bullet proof exit note tomorrow ... lets see how this works out ...

6 10

Established connections per port
by ken＠kenbaker.co.uk 24 Jul '16

24 Jul '16

Hi, I've been contacted by my VPS supplier. It seems that my exit nodes are generating a huge number of established connections (10K - 35K), most of which are unreplied. This is causing some grief. Is there a way, inside or outside of tor, for limiting the number of connections per port? Maybe a kernel or networking parameter? I'm afraid I'm not a networking expert. TIA: K.

2 1

Introduction
by Cr1m3Pi 21 Jul '16

21 Jul '16

Greetings all, I wanted to take a minute and introduce myself. I'm Cr1m3Pi and am a new relay operator. https://atlas.torproject.org/#details/8D3ABE5B3B4ADE5C1A40BF7D5277830BCDB5D… The relay is running on a RPi3 {hey, every little bit helps, right?} while I get my feet wet as an operator. Any advice regarding security and general maintenance is appreciated. Cr1m3Pi

14 15

Re: [tor-relays] Best bandwidth setup for exit node
by Tristan 15 Jul '16

15 Jul '16

"It's also worth noting that the Tor network only uses about 50% of the advertised bandwidth. But this is a good thing, because it helps reduce latency and congestion." Yes, but less than 1/3 of all Tor relays are exits ( https://metrics.torproject.org/relayflags.html) and exit bandwidth is much lower than total bandwidth: https://metrics.torproject.org/bwhist-flags.html

1 0

Best bandwidth setup for exit node
by Tor-Node.net 15 Jul '16

15 Jul '16

Hi! I have a VPS on a 6 TB (rx + tx) per month plan. What is most useful for the Tor network: a) Run it at full speed for about seven days per month (AccountingMax) or b) Throttle network speed by setting RelayBandwidthRate and always be online? Kind regards Tor-node.net

6 5

ARM Launch Permissions
by Alex Chang-Lam 13 Jul '16

13 Jul '16

I'm running a tor non-exit relay with ARM (or rather nyx), and yet though I launch arm with sudo -u $USER arm, I'm still unable to view connections. On start, connections are displayed, but disappear after a time. Likely an easy fix, but so far I'm stumped. [ARM_NOTICE] We were unable to use any of your system's resolvers to get tor's connections. This is fine, but means that the connections page will be empty. This is usually permissions related so if you would like to fix this then run arm with the same user as tor (ie, "sudo -u <tor user> arm"). Alex -----BEGIN PGP MESSAGE----- Version: GnuPG v2 owFVUn1MlHUcP0BuB0nKbiZvxTdg467gMGZem4oddNRN4CYZOJDwOZ7f3T30vNye F+8OF0FDgoRgmZMmKjBjjc2QlEMUGTEuxuTF6pYyU8FGUUMkRrXJW78H5sjt+ef5 /D6/7+fl+6sPCVCo/MZdEeEzU/aP/W7+YVHkVgatmuIZ4CWWpVgbECByPLAcm4hc lAg8ogk3OCnRDobsTNDgM54Q7QhT3C5tAhAsCW4kgmjnJJsdTEATEltkB4Jn1m8J EslBogRx771rzJbhBJDlBJGiaZBYwkIjrAhHKeSEIo5lUZFIcaygAzOLSQQvJvwf xgMQkJTgwK4QmQAWSZR/CYcDETwQVhEbwwkoBukgg/oA0W7sEBAhuMFKudb5AgdW TF53ITEOROpCgvNxusIs80FTmrEAchE4ERbasCcJCA9yA2cFNyfxILgFETHxAu5H 4OijiBdklk0uguMx/EySg3ZKAPxZKRatW2AQgbOIdkIuDj0T0EHYsLpcjgUBYhyi e2OAJEgEjSM5EM9QgrDGlxckIlJORa2ZAycn0STQOL3sCcfGGpSshlh5yxurwYge BIJBcjzcm7C2eg2FTcY8XdseGZKPU+R7MVpclYFGrmr/qE0KP5VCGegvPyBFcNDW p69qZm7LqnkobaxisLq0+I2kQTbHs/jow9Yx1xV31FZzRnnba9PNk3cCTi2Uvj9d cyjR0ackk8vqH1QTmb7vjuSc3rG7LunwvdpDyf9wLStKfXezYiEuUh/8WYB2NH8s n7ehw4+dF6q81jI15Ic9f/XG3byzs67zgapKW8kLgfN8eqEUM2EK/aVu9zn/iyVS Xnhmb+TE5QxLi+9C7K7ud8IeJP729WZVVUxK9IupZ4p7Dtj3rP45VXTqeD/Rzxr2 x325L+rTzw/0eryryy2dlzbfvzW8fN5ckE5P+lvm/k65dm6kdW/33ZWfZ6qUJyrq ypMrYnel1nx/XBmmGQzJHqnb3qTxflJakqqurpyeb8+drf3mRGHOX3Ml0Y+PGE1O bfnOIWN73su/7ij7YSKIGV76QlkZTnrj9Z0XPf8WzOp3XiIHmp9Lus9kaXVGPStE 9Fy3feWLblR7gvVTTHXnnbjpxv2vhJ4d2Pbm3qxjI6On1RUN2pvipn2512tXhn8a H7860NyfMGp4ovL8rugYUUQ4F+tvlBZ0zfSpXZFVrck9A28vtp5UtscKjcE1Tb4F /eiVvm1xK5kTNd6G29tPOuc1Y5fD6FcfGmZf73oYeM23FOGT2kjqCUx9G+Kqb5gs 6VCcCehKD298abwtb6n/WKe298ek4onQjrceWZZvjabpPhqC21tUA7ame/8B =B9un -----END PGP MESSAGE-----

2 2

Source build, then update it
by Petrusko 13 Jul '16

13 Jul '16

1 0

Exit node situation in Finland
by Nurmi, Juha 12 Jul '16

12 Jul '16

Greetings Tor Relay mailing list, I decided to write little bit about Finnish exit node situation. I am maintaining this exit node campaign in Finland: http://campaigns.ahmia.fi/finnish-tor-campaign/index_en.html In Finland: - Running an exit node is absolutely legal - ISP may cut your connection because it is listed as malware host - The National Cyber Security Center Finland (NCSC-FI) is able to "whitelist" your IP address so the ISP does not get those automated malware detections - Sebastian Mäki got police visit because his exit node - The National Bureau of Investigation is using exonerator.torproject.org so basically they are considering this information before they rush to your home - There has been warming up phase that maybe Finnish libraries start some Tor activity I am doing a lot of local advocacy work here :) Best, Juha

9 14