- tor-relays - lists.torproject.org

tor hidden services & SSL EV certificate
by Benoit Chesneau 31 Dec '15

31 Dec '15

I was at the talk this afternoon at the 32c3 and <i am wondering where can get a certificate for a .onion. Any service to suggest? Also where I should see to configure it correctly? - benoit

9 14

Tor Relay Meetup at 32c3 moved to 18:00
by Moritz Bartl 31 Dec '15

31 Dec '15

Sorry, due to some scheduling conflicts the meetup had to be moved to day 2 18:00. https://events.ccc.de/congress/2015/wiki/Session:Tor_Relay_Operators_Meetup Starts at 2015/12/28 18:00 Ends at 2015/12/28 20:00 Location Hall 13 See you! -- Moritz Bartl https://www.torservers.net/

2 1

'bug' bounty for weaknesses in Tor announced
by I 31 Dec '15

31 Dec '15

2 1

Delete
by Terry Mitchell 30 Dec '15

30 Dec '15

Please delete me from this list!! I probably should never have joined. Many thanks T.N.Mitchell -- T.N.Mitchell Binixica 195 07712 Mahon Menorca Spain Tel. 0034 971 153312 Mobile 0034 971153312

4 3

Sustained large spike in outbound traffic - what might be going on?
by David Tomic 29 Dec '15

29 Dec '15

Hello everyone, I noticed something a little bit "odd" on one of my exit relays recently, and I just wanted to ask whether anybody might be able to account for what was actually happening, and whether it's likely to warrant any further investigation? TLDR; I noticed a fairly significant spike - in excess of 30MB/s (yes, megabytes) - of outbound traffic compared to inbound. http://s2.postimg.org/cvfzqvrsp/graph.png It persisted steadily for just over an hour, until I noticed what was going on and restarted Tor (not the whole server, only Tor), at which point my traffic appeared to return to normal again. I have this relay running a a dedicated machine, with multiple physical NICs, and the ONLY thing which should be touching this NIC is my Tor traffic. Thoughts?

4 6

firefox display issue at https://globe.torproject.org
by Toralf Förster 21 Dec '15

21 Dec '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 This is the second time in a row that I suddenly can't see any longer anything on that side using my current ff profile. With an emptied/new profile it works well. B/c it happens now again I do wonder about the culprit. - -- Toralf, pgp: C4EACDDE 0076E94E -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAlZ4Zy8ACgkQxOrN3gB26U418AD/ZXdK/zMvVpJZuAnGeUOlbiKh fk6JTrg/Kfdlnzd3N1EBAI7YERw1W6dG9x5uWR/RQO5Kg4ZhbV8+KvUL4txGnAnE =2DqN -----END PGP SIGNATURE-----

1 0

Very unbalanced inbound/outbound connections
by Jannis Wiese 21 Dec '15

21 Dec '15

Hi operators, for a couple of days, I see a little bit more than twice as much inbound than outbound connections on my (non-exit, non-guard) relay [0]. I have no real concern about this but I want to explain it to myself somehow. As my relay has the HSDir flag, I started looking at the statistics: The graph for relays with HSDir flags went down by approx. 500 relays in the past days [1], but that’s pretty much traceable to a lot of relays updating from Tor 0.2.6.x to 0.2.7.x (there’s a similar behaviour around Nov 23rd [2] where the updates started as well as around June 08th [3] where updates from 0.2.5.x to 0.2.6.x started). On the other hand, the number of HSDir flags was fluctuating quite a lot looking at the year up to now [4] which never had this effect on my relay. After all, looking at the graphs in atlas (as well in arm) shows no significant (= something like twice as much) difference between the inbound and outbound traffic - so I’m scratching my head now. Another open question would be if HSDir connections are considered as in- or outbound. Up to now, I held the HSDir flag responsible for the slightly higher outbound traffic… So, again: Still no real concern from my side (as my relay is running fine - if it would be an attack, I would be able to feel that, right?), but I would like to understand what’s going on. :-) Maybe one of you here has an idea about this or experienced something similar. To all of you an early “happy holidays”! Cheers, Jannis [0] https://atlas.torproject.org/#details/8827944C4BDCBDAC9079803F47823403C11A9… [1] https://metrics.torproject.org/relayflags.html?graph=relayflags&start=2015-… [2] https://metrics.torproject.org/relayflags.html?graph=relayflags&start=2015-… [3] https://metrics.torproject.org/relayflags.html?graph=relayflags&start=2015-… [4] https://metrics.torproject.org/relayflags.html?graph=relayflags&start=2015-…

2 2

Allow user to provide feedback?
by Eric Hocking 21 Dec '15

21 Dec '15

Would it be possible for there to be a way for users to provide feedback on the current tor relay/server they are using? Ex: users submit feedback such as let's say "relay is slow" when another user uses the proxy, they could see the user provided feedback of the relay

2 1

IPv6 Only Exit Node
by Hans Wurscht 20 Dec '15

20 Dec '15

Hi I would like to operate an IPv6 only exit node. I.e. it's fine if tor relays through IPv4, but I want exiting traffic only through IPv6 (because I don't want my (only) IPv4 to be blocked, abused and such). The way I thought this would work is with the ExitPolicy set as below. But atlas says my IPv6 Exit Policy Summary would be "ExitPolicy reject *:*". Now I'm wondering if my ExitPolicy is wrong defined or if that's a bug of some kind. I'm running Tor v0.2.7.5 (git-6184c873e90d93b2) on Linux with Libevent 2.0.21-stable, OpenSSL 1.0.1k and Zlib 1.2.8. # No IPv4 exit, no exit to my own subnet, no exit to private network, no exit to link local ExitPolicy reject6 [2A02:168:4A06::]/42:* # Block my subnet ExitPolicy reject6 [FC00::]/7:* # Block private IPv6 ExitPolicy reject6 [FE80::]/10:* # Block link-local IPv6 ExitPolicy reject6 [2002::]/16:* # Block 6to4 addresses ExitPolicy reject6 *:25 # SMTP ExitPolicy reject6 *:119 # NNTP ExitPolicy reject6 *:135-139 # NetBIOS ExitPolicy reject6 *:445 # Microsoft AD ExitPolicy reject6 *:563 # NNTP over TLS ExitPolicy reject6 *:1214 # Kazaa ExitPolicy reject6 *:4661-4666 # ? ExitPolicy reject6 *:6346-6429 # Gnutella ExitPolicy reject6 *:6699 # WinMX ExitPolicy reject6 *:6881-6999 # BitTorrent ExitPolicy accept6 *:* # All else ExitPolicy reject private:* # Block private IPv4 ExitPolicy reject *:* # Block all IPv4 ## If set, and we are an exit node, allow client to use us for IPv6 traffic IPv6Exit 1 -- tor.x2a.ch | https://atlas.torproject.org/#details/6FAAD7CC7EBB008AEF2E5AE1BB9082CD8BD60…

4 4

expected IPv6 traffic for an exit relay
by Toralf Förster 20 Dec '15

20 Dec '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I opened my exit for IPv6 after Moritz encouraged us to do so here at this list. I do observe a traffic of 1-2 GB. for IPv6, IPv4 is always abound 300 GB/day. The exit is configure for 8 MB/sec throughgput (==20 TB/month). I do wonder, what are expected values for IPv6. Furthermore between 11th of August and 25th of September I observed a traffic of about 30-40 GB per day for IPv6 - but why only in this time frame ? - -- Toralf, pgp: C4EACDDE 0076E94E -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAlZsQtUACgkQxOrN3gB26U6q3QD/X8RceaLv8uKKcUtcO1CbugCK f2nu+JG8xBVJe+kBFCYA/jSddQ7auahsc5YSmuqgJY1fzWu43xN5kWvGG89tyzxe =/91J -----END PGP SIGNATURE-----

2 3

Re: [tor-relays] Opt-In Trial: Fallback Directory Mirrors
by Raul Fournier 18 Dec '15

18 Dec '15

Feel free to opt-in my relay wagner 5525D0429BFE5DC4F1B0E9DE47A4CFA169661E33

1 0

I relay subscription
by David Smith 17 Dec '15

17 Dec '15

1 0

Re: [tor-relays] Webiron at it again...
by Juuso Lapinlampi 17 Dec '15

17 Dec '15

Bruteforce attacks generate a lot of traffic, so Webiron gets an excuse to blame the Tor network as a major source of abuse versus "regular" traffic. > "Tor: Please note as the abuse from Tor has gotten out of hand, we do > not give free passes to abuse coming from Tor exits. See the leader > board linked below for more details on the issue." We received this too. Quite oddly though, after sending them 6 or 7 email acknowledgements that our Tor exit IP-address is a Tor exit (duh), they have stopped sending us abuse complaints. Maybe we got a free pass after all, although I didn't request one. And yeah, Webiron's not to be taken very seriously.[1] I've lost their credibility a long time ago when they exclaimed that Tor exit operators would be held legally liable for the routed traffic - of course not. It's called fear mongering. -Wub [1]: https://lists.torproject.org/pipermail/tor-relays/2015-December/008259.html

1 0

ornetradar notifications from 2015-12-15
by nusenu 16 Dec '15

16 Dec '15

say hi to a bunch of new AWS servers http://article.gmane.org/gmane.network.onion-routing.ornetradar/738 subgroups: nickprefix: torpr http://article.gmane.org/gmane.network.onion-routing.ornetradar/736 Nickprefix: Willy http://article.gmane.org/gmane.network.onion-routing.ornetradar/739

1 0

Unused Tor exit nodes capacity
by Dirk Eschbach 16 Dec '15

16 Dec '15

Hello all, we are administrating 2 Tor Exits for privacyfoundation.ch [1]. In the last month we realized that the traffic which is going through our servers / throughput is by far less than the machines and the providers network can handle. We were internally and recently with Moritz from torservers.net looking at this problem but could not find a way to improve throughput. Even on the same machine the throughput between servers varies a lot with out any visible reason. I hope you can help. Our setup is two servers with a maximum of 4 tor processes (exit) each. Looking at CPU, Disk, RAM and so on the machines are not busy at all. Konsole output top - 09:57:49 up 16 days, 11:57, 1 user, load average: 1.14, 0.91, 0.81 Tasks:244 total, 3 running,241 sleeping, 0 stopped, 0 zombie %Cpu0 :12.5 us, 3.4 sy, 0.0 ni,79.7 id, 0.0 wa, 0.0 hi, 4.4 si, 0.0 st %Cpu1 :15.9 us, 5.4 sy, 0.0 ni,74.3 id, 0.3 wa, 0.0 hi, 4.1 si, 0.0 st %Cpu2 :14.3 us, 2.7 sy, 0.0 ni,77.0 id, 0.0 wa, 0.0 hi, 6.0 si, 0.0 st %Cpu3 : 9.5 us, 3.4 sy, 0.0 ni,80.3 id, 0.0 wa, 0.0 hi, 6.8 si, 0.0 st KiB Mem: 3877624 total, 2739880 used, 1137744 free, 1288 buffers KiB Swap: 4026364 total, 364264 used, 3662100 free. 10752 cached Mem Looking at the network connection it is without any problem possible to start big downloads without reducing TOR throughput. The servers are connected with 1 Gbit/s each. The big question now is: Why do the machines do not have more throughput ? Is the reason for this the way the distribution through the Tor network works. Moritz hinted it might have to do with the way the tor "bandwidth scanners" measure the ability of a server to handle traffic. Can you explain me / point me to documentation where this process is described and how this can be optimized. What are the criteria for tor exit node server traffic distribution ? How do the clients choose the exit ? I would be very happy if you could provide some answers / documentation which will set me on the right track. Thanks very much for you help. Dirk [1] https://globe.torproject.org/#/search/query=digiges

5 8

Webiron at it again...
by Schokomilch NOC 15 Dec '15

15 Dec '15

Monday we received their usual spam about our exit-node sending spam, and of course instead of implementing the TorDNSEL on their sites, they rather want us to block a whole /24 range. Anyhow, one line caught our eyes: "Tor: Please note as the abuse from Tor has gotten out of hand, we do not give free passes to abuse coming from Tor exits. See the leader board linked below for more details on the issue." They also include a link to some fancy unresolved abuse ranking[1]. From that ranking we can see that they currently have 116 unresolved Tor abuse cases and at least 500 unresolved non-Tor cases. Assuming that 616 cases are enough we can try to calculate with 99% certainty, the true interval of the difference in Tor and non-Tor abuse. We will use 500/616 = 0.812 as an estimate for all non-Tor abuse and we will use 116/616 = 0.188 as an estimate for all Tor abuse. One can easily calculate that there is a difference of 62.3% between the 81.2% non-Tor and 18.8% Tor abuse cases. However this percentage (62.3%) is just one impression of a sample. Imagine we would sample 100 hosters just like webiron and then see what their difference is. And we want to be 99% sure that our measured value is within the interval. The formula can be found here[2]. Then we would receive an interval from 0.51 to 0.73. What this boils down to: If we were to check 100 companies that send abuse reports like Webiron, in 99 cases we would find a difference between Tor and non-Tor abuse to range between 51% and 73%: Two concrete examples: Tor abuse could be as high as 24.5% (lower end of the interval -> 0.51 = 75.5 non-Tor - 24.5 Tor) or as low as 13.5% (higher end of the interval -> 0.73 = 0.865 Non-Tor - 0.135 Tor) I think that having a tiny bit less than 1/4 of all abuse reports originating from Tor is a pretty great value and not "out of hand" at all. P.S.: We are pretty sure that this calculation is correct, but don't take our word for it. Also on a funny note: Their mx server blocks our mx server, so we can't even reply to their email, even though the Tor-exit runs on a different IP than the mx. [1] https://www.webiron.com/abuse_web_leaderboard/ [2] http://www.kean.edu/~fosborne/bstat/06d2pop.html?ModPagespeed=noscript

3 2

Handling abuse request about stopforumspam.com
by Eran Sandler 15 Dec '15

15 Dec '15

Hi guys, One of my tor server seems to be getting a lot of abuse reports from the ISP from stopforumspam.com. http://www.stopforumspam.com/ipcheck/212.47.246.21 Any idea how to reduce those to a minimum in a reasonable way? Thanks, Eran

2 1

uptime "algorithm"
by Dr. Who 15 Dec '15

15 Dec '15

As far as understand it is the flag HSdir given to nodes with a fast enough connection and a long enough uptime. If I keep my tor relay version always up to the current stable version I sometimes do have to restart the process. So I get a drop in my uptime and loose the HSdir flag for several days. Other nodes who don't care about versions keep the flag, despite the fact they might use older/inefficient/insecure/buggy versions. Wouldn't it be better to monitor the reason for a drop in uptime? In case at the same time a restart occurs the version increases it might be given the HSdir flag again? someone understands what I mean?

6 5

Tor Relay Operators Meetup at 32c3: 28.12. 16:45
by Moritz Bartl 14 Dec '15

14 Dec '15

As usual: Let's all gather at 32c3 to discuss Tor relay operation! Monday, 28.12.2015 16:45-18:45 Hall 13 https://events.ccc.de/congress/2015/wiki/Session:Tor_Relay_Operators_Meetup See you there! -- Moritz Bartl https://www.torservers.net/

4 3

Relay isn't getting HSDir flags
by Lucas Werkmeister 13 Dec '15

13 Dec '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi all! For some reason, my relay[1] isn't getting the HSDir and V2Dir flags. This is the full config, sans comments (sed '/^#\|^$/d' /etc/tor/torrc): SocksPort 0 DataDirectory /var/lib/tor ORPort 9001 Address 78.46.139.153 Nickname BotIfMuvasfo AccountingMax 7900 GB AccountingStart month 15 00:00 ContactInfo Lucas Werkmeister "6B89 5B8B 11A4 75B1 EC93 1698 FC46 2872 72AE 323F" <mail(a)lucaswerkmeister.de> DirPort 9030 # what port to advertise for directory connections ExitPolicy reject *:* # no exits allowed I reloaded the config several times since I uncommented the DirPort line, and even restarted the relay earlier today just in case enabling DirPort wasn't supported without restart. No luck - both Globe[1] and Atlas[2] don't show the HSDir or V2Dir flags. A few months ago, I had the relay running on a different server. I had enabled the DirPort there for a while, but eventually was forced to disable it since the server couldn't handle the load. But back then, the relay got the flags without any problem. Since I moved to a new server (copying over the torrc and data directories), this doesn't seem to be working anymore. (I am now on Debian 8, tor version 0.2.5.12; the old server was on Debian 7, tor version 0.2.4.27.) Any ideas on what the problem here could be? Thanks a lot, Lucas [1]: https://globe.torproject.org/#/relay/C527AD7D47E9DEC163537A444F4F790433CD67… [2]: https://atlas.torproject.org/#details/C527AD7D47E9DEC163537A444F4F790433CD6… -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJWbfIFAAoJEPxGKHJyrjI/B3AP/18uMBavSAQeHyYDr5D89bBQ JlTmDwWdolNc7SwNeaUTB8w+KYEatyVXJh7uAF4jrjKIS9eplMMU+1rcLS6C2tO4 4hvu9cYGwXepkuh742ikPIXivj7X08BqP+c38GYyXIC/mxdUJ44AZwGa3z4guWEl 6Qb9FtdxJ2NBMdtHjvmyFTUN2qYK0k6qYzoHygCyrf/OyoHjynkMRPKwaoHEgZhG yBIcf8AlOnKUf5+cVwkUZeurZ0l0KPl0hawUNDELciOMkGchMDyb6ui6u7LbCDVL gRiBToU6RJIiPo6vKw7UbAZeNeodNeXalmLMTL7vuKzhJjYgDae1bTJEQvMWdz6i nNxssOLHhBkTwdJosj1Kaw4a+opcqA8bPJY0KeAaZUnvAGro/lOwb0Tc7oDkbg2b Xb5IuQfWpZzpOuGldfisdqXRL1rySsnCaGSsFT9ulrkXaz42UDQE8pyxy8ErqL4j byhGiQF0F04sWldQPy3AjfZEImtBROx9PetESMLLyD6UYWffEGr6JLtIoolPEA0x OjMOGuyq91gJEZ2xIdlN+kJaylmnu/8kGKD6vAJwBxX8wVHWIyD5KbQOyL2RjCT8 gtiSFdIj8mZmvKUR5svWrgxfGoVGc5a76CUyLF+7Jd+d3DPPOlGXX+dJ/WErjgjH JbmjWbI1OIBai6gKvlSE =BmwK -----END PGP SIGNATURE-----

3 3

Webtropia threatening with penalty of 5.100€
by spriver 13 Dec '15

13 Dec '15

Hi, I am (or was) running a Tor Exit Node with about 200-250bmit/s on a VPS at Webtropia for several months with the common reduced exit policy (https://globe.torproject.org/#/relay/D218DF2C542CD1FB57FCF36DB6672A0DE6A8CB…) They never had a problem with the fact of running an exit, from time to time I got an abuse mail to which I responded with the "usual thing" (that I'm running an exit and the connections are not initiated by me. If some party wishes not to be contacted I would restrict acces [exit policy]). On Monday morning my server got shut down. I contacted them by asking, why the server was shut down, they responded that some spam was sent (abuse mailing from courbis.fr, axmo12.de claimed a brute force on SSH and the usual stuff from Webiron) and thus my server was blocked by them. They now claim that they are entitled to contractual penalty of 5.100,- € to be charged because I violate their Terms of Use. Their Terms do not forbid Tor itself, but spamming and other illegal things such as port scanning and DoS-attacks (https://www.webtropia.com/de/unternehmen/agb.html) They also told me that they cannot monitor if the traffic is really Tor traffic and that I should configure my server to prevent such abuse. How should I proceed there? Cheers!

3 3

authority signatures consensus-health
by tor-server-creator＠use.startmail.com 10 Dec '15

10 Dec '15

hi, wondering what happened to consensus lately? weight-drops, list says was missing authority signatures ? thanks

3 2

Crash and obfs error
by Geoff Down 10 Dec '15

10 Dec '15

Hello all, a couple of quick questions. Tor exited with this error: Dec 09 06:35:34.000 [err] descriptor at 0x62ee080 begins with unexpected string "". Is another process running in our data directory? Exiting. I've a vague feeling it's happened once before - anything to worry about? Also, on restarting Tor with Obfsproxy already running, I got Dec 09 14:14:43.000 [warn] Server managed proxy encountered a method error. (obfs3 Could not set up listener (0.0.0.0:xx) for 'obfs3' (Address already in use).) Dec 09 14:14:43.000 [warn] Managed proxy at '/usr/bin/obfsproxy' failed the configuration protocol and will be destroyed. does this mean that Tor is running without obfsproxy now, and I need to stop both and restart? It's quite annoying that Tor doesn't remember its auto-picked port, and I have to change the port-forwarding rule every time. Thanks, GD -- http://www.fastmail.com - IMAP accessible web-mail

3 3

Bridge Accounting Period Resets Stats
by akashic＠sigaint.org 10 Dec '15

10 Dec '15

I'm running some bridges on VPS where I set 10GB monthly limit. I never come close to the quota, but the bridges reset with a new port and new stats every accounting period. This is undesirable because it means people who wrote down my bridge and port will no longer be able to connect. And Atlas take 6 more days to mark the bridge as fast again. I like port diversity, but monthly switch seems excessive if 25% of every month is spent resetting stats. Can I set a longer accounting period, like 6 months? Failing that, what's the risk if I just get rid of the quota? Throttle rate of 200KB/s could add to 4TB/mo in worst case, which will get a VPS account killed. What's a more realistic worst case if I keep 200KB throttle with no monthly accounting?

2 1

VPS/Tor Final Thoughts
by Kurt Besig 09 Dec '15

09 Dec '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I thought it might be helpful to any other volunteer that may have been silently following this thread to quickly post the issues with my VPS Tor server that were resolved. 1. Setting up iptables allowed connections to my server. 2. Adding my server's [ip address] to the /etc/torrc resolved the problem of tor attempting to connect to the "node" my server is on rather than the actual ip my server is on. 3. Checking the user groups and permissions necessary to allow access to tor files. Other thoughts: As mentioned numerous times arm is a comfy frontend, but certainly not necessary after investigating system tools such as lsof and utilizing nload or munin. Also having ntp installed and running is helpful I think. Again thanks for all the help and have a very happy holiday season! -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) iQEcBAEBAgAGBQJWaDXxAAoJEJQqkaGlFNDPGh4H/0uDGiSIq9dYjDBNSIrVRoBQ sBGjLdFhvdFSJ4dsTRPspAKC+6zg4FnGSj1isBFBmJOLIN71oIo6qXkrXoQgyS+Q crnNYucyC6Vo8vQdK72QabuAJZGE2+VXfwTw/82NhldIQnKJzyfnjNKZYamR486y KQJGzPHls2abZPu0zyx/ay7pZRUZWzGvfc1yShQ6yTsiVqCJk456aPRd0/rbkLMQ dG/TOHHSOAJzMsZXk92rzk0JNBBYhwkOTiNyPQDd+S68IWyLXp5wC0hE4KTdRmf/ Osa8NIB3FQyYeg6XAjxZ1PhYSc8Lp91+K220znS/2lXStxjrdUFY4TU7119iYpA= =a7HY -----END PGP SIGNATURE-----

1 0