- tor-relays - lists.torproject.org

Re: [tor-relays] Failure from drain-fd
by starlight.2015q3＠binnacle.cx 04 Nov '15

04 Nov '15

At 23:58 10/28/2015 -0500, starlight.2015q3(a)binnacle.cx wrote: > Log debug file logfile001 If the volume of messages is too high, you might have luck with "domain" logging, which narrows it to particular functional realms, for example: setconf Log="[edge] debug file logfile001" where the "edge" domain relates to event processing. See Log [domain,...] in https://www.torproject.org/docs/tor-manual.html.en for details and the full list of message domains.

2 1

[tor-consensus-health] Possible Sybil Attack
by starlight.2015q3＠binnacle.cx 04 Nov '15

04 Nov '15

FYI list https://lists.torproject.org/pipermail/tor-consensus-health/2015-October/00… Fri Oct 30 22:25:10 UTC 2015 Over the last hour 58 new relays have appeared. New additions are... https://lists.torproject.org/pipermail/tor-consensus-health/2015-October/00… Fri Oct 30 23:25:07 UTC 2015 Over the last hour 75 new relays have appeared. New additions are...

7 10

Re: [tor-relays] tor relay + bridge
by tinychems＠ruggedinbox.com 02 Nov '15

02 Nov '15

Thank you for your reply. Regards!

1 0

tor relay + bridge
by tinychems＠ruggedinbox.com 02 Nov '15

02 Nov '15

Hi, I have a vps acc with 2 ips. I'd like to keep one free of tor, the other is tor only. Right now I run a relay - http://torstatus.blutmagie.de/router_detail.php?FP=e6277f0036890d4ff334c65e… Is it possible to run a bridge on the same server? I assume the same ip would be a problem, but I can get practically unlimited ipv6. Can I run one on only ipv4 and the other on only ipv6? Which do you suggest for each? Regards!

2 1

DirAuths are blocking my node on Amazon EC2. Why?
by Yousif Al Saif 02 Nov '15

02 Nov '15

Dear all, I have a Tor relay running on Amazon EC2 (IP range: 52.0.0.0/11) and for sometime I am receiving the messages: http status 400 ("Authdir is rejecting routers in this range.") response from dirserver 'X.X.X.X:80'. Please correct. The router disappeared from the Tor Directory and the consensus. Its a non-exit node and there seems to be some traffic going on. Was there a particular reason for the block or was this specific to my router only? Should I consider moving to a different provider or was I specifically targeted by the block and should not attempt moving somewhere else. My details: Nickname: Yankee2 IP: 52.25.145.191 Hash: CA631DB7F8E3E00A148D2D1D0BBD1B5710888D8E Best, Yousif

3 3

One of my nodes seems down by its tunnel quite a bit of traffic
by Eran Sandler 02 Nov '15

02 Nov '15

Hi all, I got a Tor Weather alert that my node is down: https://atlas.torproject.org/#details/98F44299592FC31FD3F2F8969D27374D00E96… Looking at it - it seems to have no flags at all (not sure why). It is tunnelling ~8-10Mb/sec so I assume its being used as a relay. Is there a way to understand why it has no flags? Eran

6 7

(no subject)
by 海洋 31 Oct '15

31 Oct '15

1 0

HoneyPot?
by Mirimir 30 Oct '15

30 Oct '15

Anyone know what HoneyPot was/is? https://atlas.torproject.org/#details/F77FD005BF74CD0B4C611389C3006452AEC60…

6 11

Re: [tor-relays] HoneyPot?
by Dhalgren Tor 29 Oct '15

29 Oct '15

Is the end of the month. Maybe they ran out of bandwidth and will be back 11/1. LeaseWeb over-limit rates are terrifying. BTW the exit policy includes 443.

2 1

(no subject)
by 海洋 29 Oct '15

29 Oct '15

8e10f0be03478ac378eb8562bd71e3757734fd75

1 0

Failure from drain-fd
by starlight.2015q3＠binnacle.cx 29 Oct '15

29 Oct '15

On 27 Oct 2015, at 15:42, Brian Walker <torrelay(a)outlook.com> wrote: > >I've updated Tor to the newest beta: >Tor v0.2.7.4-rc (git-f55d23e1e66e9b0f) running > on Windows 8 [server] > with Libevent 2.1.5-beta, > OpenSSL 1.0.2d and Zlib 1.2.8. > >I'm still experiencing errors: >Oct 27 01:22:29.000 [warn] Failure from drain_fd. . . >Oct 27 03:22:31.000 [warn] Failure from drain_fd. . . >Oct 27 05:22:33.000 [warn] Failure from drain_fd. . . > >Is there something else to try? Perhaps a debug-level log will shed some light. Message volume is too huge for anything but file logging. You can configure it in 'torrc' LogTimeGranularity=1 Log debug file logfile001 dynamically on a control channel: SETCONF LogTimeGranularity=1 Log="debug file logfile001" When done: SETCONF Log="notice syslog" LogTimeGranularity=1000 Never tried this on Windows. Perhaps 'syslog' does not apply. . .use whatever's in 'torrc'.

1 0

Unsubscribe
by OM Healing 28 Oct '15

28 Oct '15

On Tuesday, October 27, 2015, Eran Sandler <eran(a)sandler.co.il> wrote: > Hi all, > > I got a Tor Weather alert that my node is down: > > https://atlas.torproject.org/#details/98F44299592FC31FD3F2F8969D27374D00E96… > > Looking at it - it seems to have no flags at all (not sure why). > It is tunnelling ~8-10Mb/sec so I assume its being used as a relay. > > Is there a way to understand why it has no flags? > > Eran >

1 0

Free Domain for Tor Nodes
by Eran Sandler 28 Oct '15

28 Oct '15

Hi all, I recently bought torexitnode.net to make it abundantly clear in reverse DNS lookup that this is a Tor exit node. I've set both of my exit relays tor4thepeople1.torexitnode.net and tor4thepeople2.torexitnode.net to use it and I was wondering if it would be interesting for other Tor relay users to use it as well. If so, I'll write a small something that will allow adding new subdomains to it. So that you can always add and update subdomains on it. Once its running you can ask your service provider (if they don't provide an interface already) to make a reverse lookup on the IP to that address. What do you think? Is this something people would want to use? Thanks, Eran

11 15

Failure from drain-fd
by Brian Walker 27 Oct '15

27 Oct '15

Anybody know what this means? My logs are littered with it. Tor v2.6.9 with Libevent 2.0.21-stable, OpenSSL 1.0.1o and Zlib 1.2.8 on Windows Server 2012 R2. Aug 06 13:26:35.000 [warn] Failure from drain_fd [3892 similar message(s) suppressed in last 7200 seconds] Aug 06 15:26:37.000 [warn] Failure from drain_fd [3526 similar message(s) suppressed in last 7200 seconds] Thanks

3 6

debian tor package comes with multi-instance support as of 0.2.7.4-rc-1
by nusenu 27 Oct '15

27 Oct '15

Hi, the debian tor package maintainer implemented the multi-instance feature request [1][2][3]. Thanks Peter! If you want to learn more about it, have a look at tor-instance-create(8): https://gitweb.torproject.org/debian/tor.git/tree/debian/tor-instance-creat… Once tor 0.2.7.x stable is release I'll start playing with it and change ansible-relayor [4] to make use of that new functionality on debian systems by default - instead of implementing it via the ansible role itself (current behavior). We have quite good multi-instance support across multiple systems now (Fedora, CentOS, Debian, OpenBSD). FreeBSD is still somewhat of a hack - but it works as well. [1] https://lists.torproject.org/pipermail/tor-relays/2015-February/006472.html [2] https://trac.torproject.org/projects/tor/ticket/14995 [3] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=791393 [4] https://github.com/nusenu/ansible-relayor

3 2

Re: [tor-relays] too many circuit creation requests
by starlight.2015q3＠binnacle.cx 25 Oct '15

25 Oct '15

>[warn] Your computer is too slow. . . Raspberries are cute but seriously underpowered for crypto-intensive applications such as Tor. You can (any/all of) 1) ignore the warnings 2) restart the relay to send-off any hidden services that might be causing the overload 3) buy a dirt-cheap used laptop or mini-tower on eBay to run the relay 4) buy a Beagle Board if you enjoy fiddling with miniature computers --much more powerful device The configured limit is reasonable for the device.

5 10

Cheap VPS provider for an exit node
by Riccardo Mori 25 Oct '15

25 Oct '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi everyone, I have been running an exit Tor relay for 5 months with a PulseServers VPS and everything went fine until some days ago Kyle, the provider's owner, reduced the bandwidth to something above 10 Mbit/s. Adding the fact that he is an OVH reseller I am now searching a new VPS provider. Unfortunately I can't afford a 50$/month VPS so I am looking for something that has more than 5TB of monthly traffic with a reasonable price and preferably that it's not using OVH AS. What are you using? Is there anybody that can give me a hint? Thanks! Riccardo Mori -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWKmXTAAoJEE1LNuolWAxgnMAP/iWqUu0QpftVf8fzWNrs+UuJ bIpXdyYfjHTIcfk6cEZDNsJ+A3eNSYp2wt99QLLawiY95Jb7TNdzKBaiYCHtELHi R9iybldSH5snzpIDZE35SOSi+gleu334Yx0wSguVp4apxXKeaw4KMNC7nKXbWraH ijarl4LVBrkgoqs+l77DA/QtrmrY3zYQv1eRt6hHh3ah+XlW8HUMV1ipDblUtkot NH5sCe6FMg7fS0G33ZJprOq4a76jvmFJ89nfqyhZJjvey7ukuidYQLN+gFM5NWVs Pe3EYzv0tvOWZEnU+rPLEeF5iUQrTLPNlNhGirCQ74Mj9UMrVtKx7b9VoRedSua2 kx131c3VCCqc8CvheH6eztAt7WDE1GyA0JAGRCleTdhDxUdDdHZWgyrHp78aDvN7 6fYS0z4HFUyB/xTY7z3jP6z4IgxkeWv1McQXlyKQhn4ZSTRs9Z5ySpiKSi+L/Uar 145U4x6biuE5ZjkoTwJFNyLUdgduG+LPHfckyGHr0qsTm9TG+9FkEoVx02pijkVV zJRTuPPlOgOwabsFchj5Gzc+B3B1yZbNdjjFYMTyPv+LXP9MoFzC4Ytd2LyzLdCz TfOcvfbiWU2BK8GbzxD6Q5+nayZ20zFPQvvW7y6XKweiUZCkXmIFKWyDtZ0egCr5 fXY92u9AUOYgraHGOhps =7i7O -----END PGP SIGNATURE-----

3 3

too many circuit creation requests
by trshck_tor＠riseup.net 24 Oct '15

24 Oct '15

Hi all, I set up a new tor relay named trshck using a raspberry pi a few days ago. All was going fine until early today, when a lot of warning have started appearing in the log file: "[warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy." I've looked up this message and found some comments but nothing clear about how to solve the issue. I think this can be related with the recent acquisition of the HSDir flag. The relay is not configured to be an exit node. The number of open circuits has greatly increase in the last few hours: "Circuit handshake stats since last time: 4860/4984 TAP, 228464/229242 NTor." MaxAdvertisedBandwidth is not set, only: "RelayBandwidthRate 200 KB RelayBandwidthBurst 300 KB" What do you advice me to do? Regards, Joan Terrassa Hacklab

3 2

ntpd problems explanation
by I 23 Oct '15

23 Oct '15

2 2

Re: [tor-relays] Tor node break-in attempts
by starlight.2015q3＠binnacle.cx 23 Oct '15

23 Oct '15

> > Attack counts are in the 100,000s. > This sort of thing posses no threat and is quite stupid as previously observed. Is mainly annoying for the mess it makes of /var/log/security. If you don't want to change the SSH port (best solution IMO), here's an 'iptables' rule that will fix it (adjust/rearrange as needed/desired). These lines assume they will go in /etc/sysconfig/iptables. You can run them manually by prefixing with the 'ipbables' command. I wrote this without looking at the default 'iptables' file for any distro and if you are using one, revise accordingly or rename the original and start from scratch. -N input_eth0 -A INPUT -i eth0 -j input_eth0 -A input_eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT -A input_eth0 -p tcp --dport 22 -d x.x.x.x -m recent --update --seconds 600 --hitcount 3 --name SSH_ATTACK -j DROP -A input_eth0 -p tcp --dport 22 -d x.x.x.x -m recent --set --name SSH_ATTACK -j ACCEPT ========== Because we all make mistakes, you should *TEST* the rule by KEEPING A LIVE CONNECTION active and logging in a second time or you may lock yourself out of your server. Use iptables -nvL to display the counters and look for the lock-out effect after 'hitcount' attempts. Also look in cat /proc/net/xt_recent/SSH_ATTACK for the login tries and lock-out. You can clear an IP with echo "-x.x.x.x" >>/proc/net/xt_recent/SSH_ATTACK ========== If you want a bigger hash table and more history than the default, you can create /etc/modprobe.d/xt_recent.conf and put something like options xt_recent ip_list_tot=16384 ip_pkt_list_tot=255 in it. ========== Some documentation at http://linux.die.net/man/8/iptables

1 0

Tor node break-in attempts
by Larry Brandt 22 Oct '15

22 Oct '15

Hello, I need some advise on a situation new to me. I operate a VPS exit node in Romania, a VPS guard node in the Czech Republic, a middle node and bridge in the US. All are SSH public key authentication protocol 2. Over the last 5 weeks all of these servers have been under attack by IPs in the range 43.229.52.00 to 43.229.55.255. Maybe 24 different IP addresses. I have contacted the operator in Hong Kong on four different occasions but I've received no relief from the attempted attacks nor have they communicated back to me--as I have requested. Attack counts are in the 100,000s. I have no personal information stored on any of these servers--only public info via Tor is available. And then, how the hell did they get the address of my bridge? I see break-in attempts all the time but never at this volume. The break-in attempts have been thwarted to date and will probably remain so. But I find the situation disconcerting and irritating. Should I ignore these efforts? Should I send abuse reports to someone? Who? Any sage advice out there? Did I give away any secure info just now? lol LB

3 2

Re: [tor-relays] Optimizing TOR Relay
by Volker Mink 22 Oct '15

22 Oct '15

Here we go. Thats the input i needed. Regarding to >> https://atlas.torproject.org/#details/E20FF09A9A800B16C1C7C16E8C0DF95F46F64… my advertised Bandwith is 681.33 KB/s , which is little more than 5MBps. So its kinda "maxed out" . > On 22 Oct 2015, at 01:42, 12xBTM <12xbtm(a)gmail.com> wrote: > > Here's your problem: > >> On 21.10.15 8:20, Volker Mink wrote: >> Upstream 5 MBps Tor bandwidth usage is more or less symmetric upstream / downstream. So you'll only ever get 5Mbps or less of tor traffic out of this connection. Tim

1 0

Re: [tor-relays] Optimizing TOR Relay
by Volker Mink 21 Oct '15

21 Oct '15

Its a Pi1, model B with 512MB RAM. RelayBandwidthRate 10000 KB # Throttle traffic to 1000KB/s (800Kbps) RelayBandwidthBurst 20000 KB # But allow bursts up to 2000KB/s (1600Kbps) MaxAdvertisedBandwidth 10000 KB (anything to change here?) I have a 60MBit Internet Connection at home with a static IP-Adress. Downstream about 65MBps, Upstream 5 MBps. Message: 1 Date: Tue, 20 Oct 2015 20:10:44 -0400 From: 12xBTM <12xbtm(a)gmail.com> To: tor-relays(a)lists.torproject.org Subject: Re: [tor-relays] Optimizing TOR Relay Message-ID: <5626D804.7070306(a)gmail.com> Content-Type: text/plain; charset=windows-1252 If this is a raspberry pi 2, set in Torrc: "NumCPUs 4" What is your advertised bandwidth? I can personally say that a RPi2 has no trouble moving 20Mbps, which would run you a ~50Mbps connection to get that kind of utilization. If you're talking about a RPi1, you don't have enough bandwidth dedicated to get the usage you want. On 20.10.15 8:08, Volker Mink wrote: > -now without HTML- > > Hi Folks. > > Some Stats: > fingerprint: E20FF09A9A800B16C1C7C16E8C0DF95F46F649B0 > cpu: 0.0% tor, 12.3% arm mem: 149 MB (34.4%) pid: 2200 > cpu: 20.0% tor, 10.2% arm mem: 149 MB (34.4%) pid: 2200 > > load average: 0,30, 0,36, 0,33 > %Cpu(s): 18,0 us, 3,1 sy, 0,0 ni, 75,3 id, 0,2 wa, 0,0 hi, 3,5 si, 0,0 st > KiB Mem: 445044 total, 349348 used, 95696 free, 79872 buffers > KiB Swap: 102396 total, 0 used, 102396 free, 119044 cached > > 2200 debian-t 20 0 168m 149m 42m R 23,4 34,5 940:35.09 tor > > This looks like my raspberry is more on idle than serving the TOR network. How can i improve this? > Bandwith limit is more than my internet connection can cover. > > Starting another tor-process? How to manage this? > Editing some Lines in the torrc-file to speed it up? > > Help is appreciated. > Kind regards, > volker > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >

4 3

webiron requesting to block several /24 subnet
by Dhalgren Tor 21 Oct '15

21 Oct '15

>snake oil service like webiron A most excellent characterization! As a sales maneuver WebIron has been grandstanding for months saying that Tor operators are "unwilling to cleanup" when they know full-well that tor operators can not / should not filter traffic due to minor brute- force login attempts. For contrast, Fail2ban in 2012 was modified to silently block login attacks without spamming Tor operators in a reasonable gesture of politeness. SSH brute-force attacks have been a fact-of-life for 20 years. Hardly anyone thinks it worth the effort to spam abuse@ desks over it when a simple rate-limit does the job nicely. WebIron has become so obnoxious that Spamhaus placed their domain on the Domain Block List last Friday http://www.spamhaus.org/query/dbl?domain=webiron.com and in addition, the IP of their reporting system appears on the Spamhaus snow-shoe list and thereby on the big-bazooka Zen DNSBL. http://multirbl.valli.org/lookup/23.239.20.29.html Spamhaus is highly conservative, highly respected and only lists egregious unrepentant abusers. The only reason to comply is in deference to the overworked abuse-desk of your ISP if they do not have an automated system for dealing with this nonsense.

1 0

Optimizing TOR Relay
by Volker Mink 21 Oct '15

21 Oct '15

-now without HTML- Hi Folks. Some Stats: fingerprint: E20FF09A9A800B16C1C7C16E8C0DF95F46F649B0 cpu: 0.0% tor, 12.3% arm mem: 149 MB (34.4%) pid: 2200 cpu: 20.0% tor, 10.2% arm mem: 149 MB (34.4%) pid: 2200 load average: 0,30, 0,36, 0,33 %Cpu(s): 18,0 us, 3,1 sy, 0,0 ni, 75,3 id, 0,2 wa, 0,0 hi, 3,5 si, 0,0 st KiB Mem: 445044 total, 349348 used, 95696 free, 79872 buffers KiB Swap: 102396 total, 0 used, 102396 free, 119044 cached 2200 debian-t 20 0 168m 149m 42m R 23,4 34,5 940:35.09 tor This looks like my raspberry is more on idle than serving the TOR network. How can i improve this? Bandwith limit is more than my internet connection can cover. Starting another tor-process? How to manage this? Editing some Lines in the torrc-file to speed it up? Help is appreciated. Kind regards, volker

3 2