- tor-relays - lists.torproject.org

Request for Feedback on Relay Node Update Management
by Alessandro Greco 19 Apr '24

19 Apr '24

Dear Tor-Relays Mailing List Members, I hope this email finds you well. I'm reaching out to share some observations and pose some questions regarding the management of relay node updates, particularly concerning their impact on stability and security of the service provided. Recently, I've noticed an interesting pattern with my relay node (ID: 47B72187844C00AA5D524415E52E3BE81E63056B [1]). I've followed TorProject's recommendations [2] and configured automatic updates, which has led to frequent restarts of the node to keep the Tor software up-to-date. While this practice ensures high security by keeping the software updated, it seems to compromise the stability of the node itself. The Uptime value of my node has remained at a maximum of a few hours. This situation has prompted me to reflect on what might be the best strategy to adopt. On one hand, frequent updates ensure optimal security, while on the other hand, continuous restarts may affect the user experience for those relying on the node's stability for their Tor activities. As such, I'd like to pose some questions to the community to gather feedback and assess best practices: 1. In your opinion, is it preferable to maintain automatic updates to ensure maximum security, even if frequent restarts may compromise the node's stability? 2. Or would it be more sensible to adjust the update frequency, perhaps performing them once or twice a week, to ensure greater stability of the node without excessively compromising security? 3. Have you had similar experiences with your relay nodes? How have you addressed this challenge and what were the outcomes? Thank you in advance for your time and cooperation. Best regards, Aleff. [1] https://metrics.torproject.org/rs.html#details/47B72187844C00AA5D524415E52E… [2] https://community.torproject.org/relay/setup/guard/debian-ubuntu/updates/ --- Browse my WebSite: aleff-gitlab.gitlab.io Use my PGP Public Key: pgp.mit.edu/pks/lookup?op=get&search=0x7CFCE404A2168C85 Join to support: - Free Software Foundation! (my.fsf.org/join?referrer=6202114) - Electronic Frontier Foundation! (eff.org) - Tor-Project (torproject.org) - Signal (signal.org)

6 11

issues with tor rpm : anyone sees what I am doing wrong ?
by Carlos 15 Apr '24

15 Apr '24

Hi, lacking competence or support to build bridges under DEBIAN 12, I tried FEDORA and this feeeeeels cool. Yep yet this worry some message : Errors during downloading metadata for repository 'tor': - Status code: 404 for https://rpm.torproject.org/fedora/repodata/repomd.xml (IP: 2620:7:6002:0:466:39ff:fe7f:1826) Error: Failed to download metadata for repo 'tor': Cannot download repomd.xml: Cannot download repodata/repomd.xml: All mirrors were tried here is my bash script before the error that I find absolutely fine... kindly prove me wrong, please. Carlos. (would PGP encryption make sense when sending these types of emails to tor-relays(a)lists.torproject.org ? can't see the mailing list PGP publicly) dnf update dnf install dnf-automatic -y systemctl enable --now dnf-automatic-install.timer echo "[tor]" > /etc/yum.repos.d/Tor.repo echo "name=Tor for Fedora $releasever - $basearch" >> /etc/yum.repos.d/Tor.repo echo "baseurl=https://rpm.torproject.org/fedora/$releasever/$basearch" >> /etc/yum.repos.d/Tor.repo echo "enabled=1" >> /etc/yum.repos.d/Tor.repo echo "gpgcheck=1" >> /etc/yum.repos.d/Tor.repo echo "gpgkey=https://rpm.torproject.org/fedora/public_gpg.key" >> /etc/yum.repos.d/Tor.repo echo "cost=100" >> /etc/yum.repos.d/Tor.repo dnf install tor -y dnf install obfs4 -y -- PGP updated every second week : please actualize our communication every time.

3 2

Node 6E02FDEA15122A492A799A58C4C11D02637B145A is marked as down, but logs display no issues
by 0N ODV 08 Apr '24

08 Apr '24

Hi all, our node sacco.osservatorionessuno.org[1] has been marked down for more than a couple of days. It is at the latest version from Tor's Debian repository and I tried to restart both the service and the server. The process is running, and the 9001 and 9030 ports are open and succesfully reachable from the outside. The notice log I temporarily enabled to look for the issue apparently does not show any warning signs. Here is an anonymized output of the log: [notice] Tor 0.4.8.10 opening new log file. [notice] We compiled with OpenSSL XXX and we are running with OpenSSL XXX. These two versions should be binary compatible. [notice] Tor 0.4.8.10 running on Linux with Libevent XXX, OpenSSL XXX, Zlib XXX, Liblzma XXX, Libzstd XXX and Glibc XXX as libc. [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://support.torproject.org/faq/staying-anonymous/ [notice] Read configuration file "/etc/tor/torrc". [notice] Based on detected system memory, MaxMemInQueues is set to 720 MB. You can override this by setting MaxMemInQueues by hand. [notice] Opening Socks listener on 127.0.0.1:9050 [notice] Opened Socks listener connection (ready) on 127.0.0.1:9050 [notice] Opening OR listener on XXX:9001 [notice] Opened OR listener connection (ready) on XXX:9001 [notice] Opening OR listener on [XXX]:9001 [notice] Opened OR listener connection (ready) on [XXX]:9001 [notice] Opening Directory listener on XXX:9030 [notice] Opened Directory listener connection (ready) on XXX:9030 [notice] Opening Directory listener on [XXX]:9030 [notice] Opened Directory listener connection (ready) on [XXX]:9030 [notice] Parsing GEOIP IPv4 file /usr/share/tor/geoip. [notice] Parsing GEOIP IPv6 file /usr/share/tor/geoip6. [notice] Configured to measure statistics. Look for the *-stats files that will first be written to the data directory in 24 hours from now. [notice] Your Tor server's identity key fingerprint is 'sacco XXX' [notice] Your Tor server's identity key ed25519 fingerprint is 'sacco XXX' [notice] Bootstrapped 0% (starting): Starting [notice] Starting with guard context "default" [notice] Bootstrapped 5% (conn): Connecting to a relay [notice] Unable to find IPv4 address for ORPort 9001. You might want to specify IPv6Only to it or set an explicit address or set Address. [notice] Bootstrapped 10% (conn_done): Connected to a relay [notice] Bootstrapped 14% (handshake): Handshaking with a relay [notice] Bootstrapped 15% (handshake_done): Handshake with a relay done [notice] Bootstrapped 75% (enough_dirinfo): Loaded enough directory info to build circuits [notice] Bootstrapped 90% (ap_handshake_done): Handshake finished with a relay to build circuits [notice] Bootstrapped 95% (circuit_create): Establishing a Tor circuit [notice] External address seen and suggested by a directory authority: XXX [notice] Bootstrapped 100% (done): Done [notice] Now checking whether IPv4 ORPort XXX:9001 is reachable... (this may take up to 20 minutes -- look for log messages indicating success) [notice] Now checking whether IPv6 ORPort [XXX]:9001 is reachable... (this may take up to 20 minutes -- look for log messages indicating success) [notice] Self-testing indicates your ORPort XXX:9001 is reachable from the outside. Excellent. [notice] Performing bandwidth self-test...done. [notice] Self-testing indicates your ORPort [XXX]:9001 is reachable from the outside. Excellent. Publishing server descriptor. [notice] Heartbeat: It seems like we are not in the cached consensus. [notice] Heartbeat: Tor's uptime is XX hours, with XX circuits open. I've sent XX and received XX. I've received XXX connections on IPv4 and XXX on IPv6. I've made XXX connections with IPv4 and XXX with IPv6. [notice] While bootstrapping, fetched this many bytes: XXX (microdescriptor fetch) [notice] While not bootstrapping, fetched this many bytes: XXX (server descriptor fetch); XXX (server descriptor upload); XXX (consensus network-status fetch); XXX (microdescriptor fetch) [notice] Circuit handshake stats since last time: X/X TAP, X/X NTor. [notice] Since startup we initiated XXX and received XXX v1 connections; initiated 0 and received 0 v2 connections; initiated XXX and received XXX v3 connections; initiated XXX and received XXX v4 connections; initiated XXX and received XXX v5 connections. [notice] Heartbeat: DoS mitigation since startup: 0 circuits killed with too many cells, 0 circuits rejected, 0 marked addresses, 0 marked addresses for max queue, 0 same address concurrent connections rejected, 0 connections rejected, 0 single hop clients refused, 0 INTRODUCE2 rejected. [notice] Your network connection speed appears to have changed. Resetting timeout to XXXms after XXX timeouts and XXX buildtimes. We would appreciate any hint on how to proceed to debug the issue in order to keep the server useful. Thank you Giuio [1] - https://metrics.torproject.org/rs.html#details/6E02FDEA15122A492A799A58C4C1…

3 3

Re: [tor-relays] R: Re: Request for Feedback on Relay Node Update Management
by denny.obreham＠a-n-o-n-y-m-e.net 04 Apr '24

04 Apr '24

You should tweak your web server as presented in this section: https://github.com/Enkidu-6/tor-ddos?tab=readme-ov-file#first-step-prep aring-your-system-for-high-number-of-connections This would most likely solve Out-Of-Memory problems I suspect you are experiencing. Denny On 04/02/2024 10:06 AM Alessandro Greco via tor-relays wrote .. My computer has: - 1 vCore CPU - 1 GB RAM - Maximum bandwidth: 1 GB/s So if I understand correctly, the problem should not be at the hardware level, right? Il mar, apr 2, 2024 alle 12:14, Frank LÃ½ via tor-relays <[1]tor-relays(a)lists.torproject.org> ha scritto: Hello Aleff, That is up to you. I strongly suspect that the hardware is the bottleneck, but detailed specifications are required in order to determine a conclusion. Tor is currently bounded by single-thread CPU performance, with a minimum recommendation of 1 GB of RAM for non-exit relays faster than 40 Mbit/s. If your hardware does not meet these RAM requirements, upgrade it, then adjust the relay bandwidth rate limit as necessary. Frank Mar 27, 2024, 7:00 AM by tor-relays(a)lists.torproject.org: > I want to thank you for all the support replies you sent in response to my previous communication. I have carefully read through all your insights and appreciate your efforts in trying to find a solution to the issue. > > After thorough consideration of the matter, I have concluded that the problem may not be due to configuration errors in the automatic updates, as initially speculated. Rather, it seems that the issue could be hardware-related, with my VPS computer potentially unable to handle a certain amount of traffic. > > It's worth noting that there are no bandwidth issues, and the connection speed is high. However, I have set a RelayBandwidthRate limit of 250 Mbits. Interestingly, despite this configuration, the Tor Metrics site detects a speed of approximately 10/13 MBytes, equivalent to about 90/110 Mbits. This led me to speculate that the machine might experience an overload of operations or connections, causing it to crash temporarily. As a result, at the time of restart, Tor Statistics records the maximum speed reached up to that point (without ever reaching the set limit). Subsequently, following this theory, the Tor service restarts automatically without causing any anomalies in the service. > > To address this situation, I have decided to reduce the RelayBandwidthRate limit from 250 Mbits to 100 Mbits, which falls within the minimum limits proposed by torproject. If this is the case, however, it is also true that it would be best to impose an upper limit of 80% when considering the bandwidth magnitude involving the crash event as the maximum point. I honestly don't know how I would be able to verify this and acquire this kind of data, probably doing trial and error is the way. Perhaps the ideal would be to lower the maximum bandwidth further to verify for sure that this is what it is? > > Currently, I am closely monitoring the situation to assess whether this modification has a positive impact on the issue. > > I will keep you updated on any progress, and I thank you once again for your support and understanding. > > Best regards, > > Aleff. > > --- > > Browse my WebSite: aleff-gitlab.gitlab.io > Use my PGP Public Key: pgp.mit.edu/pks/lookup?op=get&search=0x7CFCE404A2168C85 > Join to support: > - Free Software Foundation! (my.fsf.org/join?referrer=6202114) > - Electronic Frontier Foundation! (eff.org) > - Tor-Project (torproject.org) > - Signal (signal.org) > > martedÃ¬ 26 marzo 2024 11:21, torrelay.9puwh--- via tor-relays ha scritto: > >> Hi Alessandro, >> >> It's good to hear from you. I have a relay in a somewhat similar situation[1], although I've only just clocked it. If you're using Debian or one of its derivatives, then you can configure the unattended-upgrades package to perform a restart at a specific time if required. This means that your relay won't restart every time an upgrade is required, but will keep itself up to date. I think configuring a time for a daily restart (if upgrade required) would be a fairly good balance between stability and reliability. >> >> See what other people say or from your own experience, as Tor circuits are generally quite resilient and as long as you aren't a guard node I believe connections won't die because your relay is restarting. >> >> I would also note that Tor recommends [2] an uptime or 24/7 is nice, but not required and that restarts to the daemon or node are fine. Because of this, it might not be worth worrying too much about this issue. >> >> I hope you find some of this useful, >> Seth >> >> >> >> [1] https://metrics.torproject.org/rs.html#details/5FEB80D4DCC63180CB4D8 7C1222177BB099E55AE >> [2] https://community.torproject.org/relay/relays-requirements/ >> -------- Original Message -------- >> On 26/03/2024 08:54, Alessandro Greco via tor-relays tor-relays(a)lists.torproject.org wrote: >> >> > Dear Tor-Relays Mailing List Members, >> > >> >> > I hope this email finds you well. I'm reaching out to share some observations and pose some questions regarding the management of relay node updates, particularly concerning their impact on stability and security of the service provided. >> > >> >> > Recently, I've noticed an interesting pattern with my relay node (ID: 47B72187844C00AA5D524415E52E3BE81E63056B [1]). I've followed TorProject's recommendations [2] and configured automatic updates, which has led to frequent restarts of the node to keep the Tor software up-to-date. While this practice ensures high security by keeping the software updated, it seems to compromise the stability of the node itself. The Uptime value of my node has remained at a maximum of a few hours. >> > >> >> > This situation has prompted me to reflect on what might be the best strategy to adopt. On one hand, frequent updates ensure optimal security, while on the other hand, continuous restarts may affect the user experience for those relying on the node's stability for their Tor activities. >> > >> >> > As such, I'd like to pose some questions to the community to gather feedback and assess best practices: >> > >> >> > 1. In your opinion, is it preferable to maintain automatic updates to ensure maximum security, even if frequent restarts may compromise the node's stability? >> > 2. Or would it be more sensible to adjust the update frequency, perhaps performing them once or twice a week, to ensure greater stability of the node without excessively compromising security? >> > 3. Have you had similar experiences with your relay nodes? How have you addressed this challenge and what were the outcomes? >> > >> >> > Thank you in advance for your time and cooperation. >> > >> >> > Best regards, >> > Aleff. >> > >> >> > [1] https://metrics.torproject.org/rs.html#details/47B72187844C00AA5D524 415E52E3BE81E63056B >> > [2] https://community.torproject.org/relay/setup/guard/debian-ubuntu/upd ates/ >> > >> >> > --- >> > >> >> > Browse my WebSite: aleff-gitlab.gitlab.io >> > Use my PGP Public Key: pgp.mit.edu/pks/lookup?op=get&search=0x7CFCE404A2168C85 >> > Join to support: >> > - Free Software Foundation! (my.fsf.org/join?referrer=6202114) >> > - Electronic Frontier Foundation! (eff.org) >> > - Tor-Project (torproject.org) >> > - Signal (signal.org)_______________________________________________ >> > tor-relays mailing list >> > tor-relays(a)lists.torproject.org >> > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >> >> >> >> _______________________________________________ >> tor-relays mailing list >> tor-relays(a)lists.torproject.org >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >> _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays 1. file:///tmp/.webmin/reply_mail.cgi?new=1&to=Il

2 1

User advisory to check for xz-utils backdoor
by pasture_clubbed242＠simplelogin.com 02 Apr '24

02 Apr '24

Greetings, I do not normally use mailing lists such as this one to inform subscribers of security notices, but this issue is extreme enough where it may benefit the anonymity of Tor users if relay operators are aware of it sooner. The near-universally used 'xz' compression library has been found to contain a backdoor in certain code branches. This backdoor has made it into some systems such as Debian Sid. Details regarding this backdoor are available here. https://www.openwall.com/lists/oss-security/2024/03/29/4 It is suspected that if your OpenSSH server links to the xz library, which Debian appears to do so, then this backdoor is remotely exploitable. If your OpenSSH server does not link to this library, then your system still contains many processes that run xz actions as the root user, some input of which may be less than trusted. For those needing a patch, I recommend you research your distribution's security advisory page for further information. References: Debian Sid Advisory: https://security-tracker.debian.org/tracker/CVE-2024-3094

2 1

Backdoor in upstream xz/liblzma leading to ssh server compromise
by hello＠relaymagic.org 02 Apr '24

02 Apr '24

Just wanted to bring this to everyone’s attention if you hadn’t seen it already. Developer discovered a backdoor in xz-utils https://www.openwall.com/lists/oss-security/2024/03/29/4 -- Sent from Canary (https://canarymail.io)

2 1

Tor relay operator research
by Ana Custura 29 Mar '24

29 Mar '24

Dear operators, We're conducting a study to understand relay operator motivations and needs, funded by OTF. We've already interviewed several of you and got feedback relating to community matters. Based on that feedback, we've put together a comprehensive survey: English: https://survey.torproject.org/index.php/751125?lang=en Spanish: https://survey.torproject.org/index.php/751125?lang=es If you have about 30 minutes to spare and fill this in, it would be much appreciated! Your responses are valuable and will be used by the Tor project to understand the needs of the community, and how you feel about some controversial Tor-related issues. The survey is anonymous. Cheers Ana PS: to find out more about the project, see https://www.opentech.fund/projects-we-support/supported-projects/the-tor-pr…

1 0

Announcement: Tor-Weather 2.0 Release
by Sarthik Gupta 27 Mar '24

27 Mar '24

Dear Tor-Relay Community, I hope this email finds you well. I am excited to announce the release of Tor-Weather 2.0, a significant rewrite of our Tor-Weather service. This release was primarily focused on refactoring the codebase, resulting in extensive changes. This initiative not only enhances the existing codebase but also accelerates the development of new features and addresses numerous bugs in the current service. Some of the key highlights of Tor-Weather 2.0 include: 1. Support for bridges: We have added support for tracking bridges. Creating subscriptions for bridges works the same way as creating those for relays. 2. Improved email templates: Emails have been completely revamped & will now offer both html & txt based mime-types. No more incorrectly spaced emails. 3. Added additional details in emails: We've added additional details to the emails. This includes, link to the relay's metric page, additional context for the subscription, etc. 4. Improved reliability & bug-fixes: The new deployment process should greatly improve the availability & reliability of the service. This also includes bunch of bug-fixes across the application. We believe that these updates will greatly benefit the Tor-Relay community and contribute to a more streamlined and efficient relay management experience. To start using Tor-Weather 2.0, simply visit [Tor-Weather](https://weather.torproject.org/login) and log in with your existing credentials. If you encounter any issues, please file a ticket in our [bug tracker](https://gitlab.torproject.org/tpo/network-health/tor-weather/-/iss…. Thank you for your continued support and participation in the Tor-Relay community. We look forward to hearing your thoughts on Tor-Weather 2.0 and continuing to improve our services to better serve your needs. Best regards, Sarthik Gupta & Network-Health Team

1 0

Re: [tor-relays] Request for Feedback on Relay Node Update Management
by denny.obreham＠a-n-o-n-y-m-e.net 26 Mar '24

26 Mar '24

Relays do restart for different reasons. For example, two of my relays (the upgrade process is automated on both) were restarted on March 23rd, practically at the same time. Different OS versions on different machines from different ISP for both relays. One was restarted because some libraries needed to be upgraded on the system: ``` The following packages will be upgraded: libbsd0 libc-bin libc6 libxslt1.1 locales 5 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. [...] Restarting services... [...] tor(a)default.service [...] ``` The server even needed to be rebooted afterward. The other one had a very different reason, as you can see from the syslog: ``` Mar 23 03:07:43 leslie kernel: [849147.801728] Out of memory: Killed process 930 (tor) total-vm:850180kB, anon-rss:620800kB, file-rss:0kB, shmem-rss:0kB, UID:111 pgtables:1652kB oom_score_adj:0 Mar 23 03:07:43 leslie systemd[1]: tor(a)Leslie.service: A process of this unit has been killed by the OOM killer. Mar 23 03:07:44 leslie systemd[1]: tor(a)Leslie.service: Main process exited, code=killed, status=9/KILL Mar 23 03:07:44 leslie systemd[1]: tor(a)Leslie.service: Failed with result 'oom-kill'. Mar 23 03:07:44 leslie systemd[1]: tor(a)Leslie.service: Consumed 2d 5h 54min 39.122s CPU time. Mar 23 03:07:44 leslie systemd[1]: tor(a)Leslie.service: Scheduled restart job, restart counter is at 1. Mar 23 03:07:44 leslie systemd[1]: Stopped Anonymizing overlay network for TCP (instance Leslie). Mar 23 03:07:44 leslie systemd[1]: tor(a)Leslie.service: Consumed 2d 5h 54min 39.122s CPU time. Mar 23 03:07:44 leslie systemd[1]: Starting Anonymizing overlay network for TCP (instance Leslie)... ``` That was the last time both relays were restarted (~ 3 days ago) Denny On 03/26/2024 04:54 AM Alessandro Greco via tor-relays wrote .. Dear Tor-Relays Mailing List Members, I hope this email finds you well. I'm reaching out to share some observations and pose some questions regarding the management of relay node updates, particularly concerning their impact on stability and security of the service provided. Recently, I've noticed an interesting pattern with my relay node (ID: 47B72187844C00AA5D524415E52E3BE81E63056B [1]). I've followed TorProject's recommendations [2] and configured automatic updates, which has led to frequent restarts of the node to keep the Tor software up-to-date. While this practice ensures high security by keeping the software updated, it seems to compromise the stability of the node itself. The Uptime value of my node has remained at a maximum of a few hours. This situation has prompted me to reflect on what might be the best strategy to adopt. On one hand, frequent updates ensure optimal security, while on the other hand, continuous restarts may affect the user experience for those relying on the node's stability for their Tor activities. As such, I'd like to pose some questions to the community to gather feedback and assess best practices: 1. In your opinion, is it preferable to maintain automatic updates to ensure maximum security, even if frequent restarts may compromise the node's stability? 2. Or would it be more sensible to adjust the update frequency, perhaps performing them once or twice a week, to ensure greater stability of the node without excessively compromising security? 3. Have you had similar experiences with your relay nodes? How have you addressed this challenge and what were the outcomes? Thank you in advance for your time and cooperation. Best regards, Aleff. [1] https://metrics.torproject.org/rs.html#details/47B72187844C00AA5D524 415E52E3BE81E63056B [2] https://community.torproject.org/relay/setup/guard/debian-ubuntu/upd ates/ --- Browse my WebSite: aleff-gitlab.gitlab.io Use my PGP Public Key: pgp.mit.edu/pks/lookup?op=get&search=0x7CFCE404A2168C85 Join to support: - Free Software Foundation! (my.fsf.org/join?referrer=6202114) - Electronic Frontier Foundation! (eff.org) - Tor-Project (torproject.org) - Signal (signal.org)

1 0

GeoIPFile option warning
by krishna e bera 25 Mar '24

25 Mar '24

I am seeing these warnings in Tor's notices.log: Mar 24 09:42:21.000 [notice] Configured to measure directory request statistics, but no GeoIP database found. Please specify a GeoIP database using the GeoIPFile option. Mar 24 09:42:21.000 [notice] Configured to measure entry node statistics, but no GeoIP database found. Please specify a GeoIP database using the GeoIPFile option. However the option is set in torrc and i verified the files are at those locations and readable by all: GeoIPFile /usr/local/share/tor/geoip GeoIPv6File /usr/local/share/tor/geoip6 Any hints how i could check whether the warnings are spurious or dump what the running config actually is? I know it is reading the torrc because introducing an error in the file stops it from loading.

2 1

Tor is not upgrading via apt from deb.torproject.org
by s7r 23 Mar '24

23 Mar '24

Hello all, I have recently found something interesting on my relays. On all relays and clients actually. As always I am using Debian and apt to get Tor from deb.torproject.org tor-nightly-main-bullseye main (for example). I also have the keyring installed, proper key and everything. Currently I am on: Tor version 0.4.9.0-alpha-dev. This build of Tor is covered by the GNU General Public License (https://www.gnu.org/licenses/gpl-3.0.en.html) Tor is running on Linux with Libevent 2.1.12-stable, OpenSSL 1.1.1w, Zlib 1.2.11, Liblzma 5.2.5, Libzstd 1.4.8 and Glibc 2.31 as libc. Tor compiled with GCC version 10.2.1 Since October 2023. If I manually check out deb.torproject.org with my browser I see there is another package released in February 2024, except it notes as the same version 4.9.0-alpha-dev but it has a different timestamp. $ apt update reports no errors, looks like is working fine, but it doesn't notify there's a newer version and does not apply any updates to Tor. This happens only to Tor package from nightly, rest of packages from debian.org deb are updated as usual. So, anyone else experienced this? Do I need to configure apt in a different way than we used to do? I maintain this style of setup for Tor since Debian 7 :-), any changes needed? Thank you! -s7r

5 8

Problem with relay and ovh??
by Keifer Bly 07 Mar '24

07 Mar '24

Hi, So my relay at https://metrics.torproject.org/rs.html#details/79E3B585803DE805CCBC00C1EF36… Goes offline at sporadic times. Upon checking the tor log file, there does not appear to be anything written causing tor to crash: Feb 18 00:36:34.000 [notice] Tor 0.4.8.10 opening new log file. Feb 18 00:36:34.630 [notice] We compiled with OpenSSL 101010ef: OpenSSL 1.1.1n 15 Mar 2022 and we are running with OpenSSL 101010ef: 1.1.1n. These two versions should be binary compatible. Feb 18 00:36:34.634 [notice] Tor 0.4.8.10 running on Linux with Libevent 2.1.8-stable, OpenSSL 1.1.1n, Zlib 1.2.11, Liblzma 5.2.4, Libzstd 1.3.8 and Glibc 2.28 as libc. Feb 18 00:36:34.634 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://support.torproject.org/faq/staying-anonymous/ Feb 18 00:36:34.636 [notice] Read configuration file "/etc/tor/torrc". Feb 18 00:36:34.637 [notice] Based on detected system memory, MaxMemInQueues is set to 1462 MB. You can override this by setting MaxMemInQueues by hand. Feb 18 00:36:34.640 [notice] Opening OR listener on 0.0.0.0:9001 Feb 18 00:36:34.640 [notice] Opened OR listener connection (ready) on 0.0.0.0:9001 Feb 18 00:36:34.640 [notice] Opening OR listener on [::]:9001 Feb 18 00:36:34.640 [notice] Opened OR listener connection (ready) on [::]:9001 Feb 18 00:36:34.640 [notice] Opening Directory listener on 0.0.0.0:9030 Feb 18 00:36:34.640 [notice] Opened Directory listener connection (ready) on 0.0.0.0:9030 Feb 18 00:36:35.000 [notice] Configured to measure directory request statistics, but no GeoIP database found. Please specify a GeoIP database using the GeoIPFile option. Feb 18 00:36:35.000 [warn] You are running Tor as root. You don't need to, and you probably shouldn't. Feb 18 00:36:35.000 [notice] Your Tor server's identity key fingerprint is 'udeserveprivacy 79E3B585803DE805CCBC00C1EF36B1E74372861D' Feb 18 00:36:35.000 [notice] Your Tor server's identity key ed25519 fingerprint is 'udeserveprivacy b7n+DkH5IsJHJexEqilhQ5tC0LRd9Td888RZpYkxEvc' Feb 18 00:36:35.000 [notice] Bootstrapped 0% (starting): Starting Feb 18 00:36:49.000 [notice] Starting with guard context "default" Feb 18 00:36:50.000 [notice] Unable to find IPv6 address for ORPort 9001. You might want to specify IPv4Only to it or set an explicit address or set Address. Feb 18 00:36:50.000 [notice] Bootstrapped 5% (conn): Connecting to a relay Feb 18 00:36:50.000 [notice] Bootstrapped 10% (conn_done): Connected to a relay Unless the old file is being overwritten when tor restarts. But is there a known problem with OVH that causes this? Thanks. Oddly there is no definite time when this happens, sometimes the relay operates no problem for weeks on end and then it happens, other times it only makes it a day or two. --Keifer

3 4

Next Tor Relay Operator Meetup - March 2nd, 2024 @ 19.00 UTC
by gus 05 Mar '24

05 Mar '24

Hello Tor Relay operators, Please save the date! The next Tor Relay Operator Meetup will happen on Saturday, March 2nd at 2024 at 19.00 UTC. We're still working on the agenda for this meetup, however feel free to add your topics directly to the ticket or just reply to the mailing list: https://gitlab.torproject.org/tpo/community/relays/-/issues/86 Meetup details - Room link: https://tor.meet.coop/gus-og0-x74-dzn - When: March 2nd, 19.00 UTC - Duration: 60 to 90 minutes - Tor Code of Conduct: https://community.torproject.org/policies/code_of_conduct/ - Registration: No need for a registration or anything else, just use the room-linkabove. We will open the room 10 minutes before. best, Gus -- The Tor Project Community Team Lead

1 3

Worse throughput with 0.4.8.x, on a slow CPU
by Roman Mamedov 04 Mar '24

04 Mar '24

Hello, Ater upgrading from Tor 0.4.7.13 to 0.4.8.9, I get a much worse bandwidth numbers. The CPU is Atom C2338 with two cores at 1.75 Ghz. Multiple Tor instances are running to take advantage of both cores. On the older version it gets about 80+80 Mbit total in+out. On the new one the average is at most 45+45 Mbit. There are frequent periods where the bandwidth drops to 5-10 Mbit for 3-5 seconds, while all Tor processes continue to use 100% of both CPUs, then gradually climbs back up. Does anyone notice anything similar? Here's how it looks for a few days on 0.4.8 then a roll-back: ------------------------+-------------+-------------+--------------- today 461.94 GiB | 470.84 GiB | 932.78 GiB | 153.98 Mbit/s ######################################## 12/12/23 462.81 GiB | 475.67 GiB | 938.48 GiB | 91.12 Mbit/s ####################### 12/11/23 434.72 GiB | 443.08 GiB | 877.80 GiB | 85.23 Mbit/s ###################### 12/10/23 446.13 GiB | 459.56 GiB | 905.70 GiB | 87.93 Mbit/s ####################### 12/09/23 464.79 GiB | 473.17 GiB | 937.96 GiB | 91.07 Mbit/s ####################### 12/08/23 454.67 GiB | 463.48 GiB | 918.16 GiB | 89.14 Mbit/s ####################### 12/07/23 463.82 GiB | 472.84 GiB | 936.65 GiB | 90.94 Mbit/s ####################### 12/06/23 670.01 GiB | 680.55 GiB | 1.32 TiB | 131.13 Mbit/s ################################## 12/05/23 808.50 GiB | 817.32 GiB | 1.59 TiB | 157.85 Mbit/s ######################################### 12/04/23 854.09 GiB | 866.43 GiB | 1.68 TiB | 167.05 Mbit/s ########################################### 12/03/23 782.20 GiB | 799.00 GiB | 1.54 TiB | 153.52 Mbit/s ######################################## 12/02/23 805.18 GiB | 817.91 GiB | 1.59 TiB | 157.59 Mbit/s ######################################### 12/01/23 733.80 GiB | 745.35 GiB | 1.44 TiB | 143.61 Mbit/s ##################################### 11/30/23 742.48 GiB | 756.56 GiB | 1.46 TiB | 145.54 Mbit/s ##################################### 11/29/23 657.90 GiB | 673.66 GiB | 1.30 TiB | 129.28 Mbit/s ################################# In general, are there any tweaks to reduce relay CPU usage on a slow processor? I did seemingly most of what is possible, ethtool, iptables, sysctl, etc. How long before the Rust-based Tor will be ready for use on relays? -- With respect, Roman

4 5

Re: [tor-relays] bridges for Lox
by Holonet 04 Mar '24

04 Mar '24

> On 27 Feb 2024, at 15:39, boldsuck <lists(a)for-privacy.net> wrote: > On Dienstag, 27. Februar 2024 14:52:00 CET Corl3ss via tor-relays wrote: >> On 26/02/2024 21:03, Toralf Förster via tor-relays wrote: >>> On 2/26/24 20:07, meskio wrote: >>>> At the moment we're >>>> looking for 10 new bridges for Lox. >>> 9 left >> >> And one more added, so 8 left. > +1 = 7 left Added one. 6 left.

4 3

bridges for Lox
by meskio 28 Feb '24

28 Feb '24

Hello, We are developing a reputation based bridge distributor called Lox[0] and are preparing to make a call for users to test it in Tor Browser Alpha. In order to do this, we need to have some new bridges that can be distributed by Lox. Do you want to give us a hand running a bridge (or few) for Lox? At the moment we're looking for 10 new bridges for Lox. Rdsys, the new bridgeDB, will not automatically assign bridges to Lox for now, but will instead accept bridges with the 'BridgeDistribution lox' configured in torrc. To set up a bridge for Lox, configure a normal obfs4 bridge[1] and simply include the following line in torrc: BridgeDistribution lox As Lox is only going to be released for testing, you might not see a lot of traffic on Lox bridges at the moment. However, these bridges will be very useful for us to improve Lox and see what works and what does not. Thank you [0] https://gitlab.torproject.org/tpo/anti-censorship/lox [1] https://community.torproject.org/relay/setup/bridge/ -- meskio | https://meskio.net/ -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- My contact info: https://meskio.net/crypto.txt -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Nos vamos a Croatan.

5 13

Re: [tor-relays] tor-relays Digest, Vol 157, Issue 19
by badgerfighter 27 Feb '24

27 Feb '24

+1 incoming. On Tuesday, February 27th, 2024 at 04:17, tor-relays-request(a)lists.torproject.org <tor-relays-request(a)lists.torproject.org> wrote: > > > Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > > > Today's Topics: > > 1. bridges for Lox (meskio) > 2. Re: bridges for Lox (Toralf F?rster) > 3. Re: bridges for Lox (Toralf F?rster) > 4. Re: bridges for Lox (meskio) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 26 Feb 2024 20:07:45 +0100 > From: meskio meskio(a)torproject.org > > To: tor-relays tor-relays(a)lists.torproject.org > > Subject: [tor-relays] bridges for Lox > Message-ID: 170897446522.1760.2953283832616396350@localhost > > Content-Type: text/plain; charset="utf-8" > > Hello, > > We are developing a reputation based bridge distributor called Lox[0] and are > preparing to make a call for users to test it in Tor Browser Alpha. In order to > do this, we need to have some new bridges that can be distributed by Lox. Do you > want to give us a hand running a bridge (or few) for Lox? At the moment we're > looking for 10 new bridges for Lox. > > Rdsys, the new bridgeDB, will not automatically assign bridges to Lox for now, > but will instead accept bridges with the 'BridgeDistribution lox' configured in > torrc. > > To set up a bridge for Lox, configure a normal obfs4 bridge[1] and simply > include the following line in torrc: > BridgeDistribution lox > > As Lox is only going to be released for testing, you might not see a lot of > traffic on Lox bridges at the moment. However, these bridges will be very useful > for us to improve Lox and see what works and what does not. > > Thank you > > > [0] https://gitlab.torproject.org/tpo/anti-censorship/lox > [1] https://community.torproject.org/relay/setup/bridge/ > > -- > meskio | https://meskio.net/ > -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- > My contact info: https://meskio.net/crypto.txt > -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- > Nos vamos a Croatan. >

1 0

Tor Relay Automatic PMTU Testing
by pasture_clubbed242＠simplelogin.com 22 Feb '24

22 Feb '24

Greetings, I believe there is a larger sized guard relay that has been having MTU issues for about a week. All connections with packets above a certain size are dropped. This results in partially loaded or broken webpages, broken file downloads, etc. Do Tor directory authorities test MTU (implicitly by speed test?) when testing relays? Wondering if anyone else noticed this or if it would be handled automatically by dir authorities. Thanks all

3 3

VPS w/FDE suggestions?
by MRob 22 Feb '24

22 Feb '24

Hello- Im looking for <= $6/mo VPS suggestions for general non-tor server and also for tor. Some super-cheap hosts pre-install O/S and give root but I want to install O/S myself so can put in FDE. Hard to see which hosts can do this. I tried Linode before and yes, could get FDE ($5 1GB, 1CPU, 25GB, 1TB) Is IONOS any good? Can I get FDE there?? ($2 1GB, 1CPU, 10GB, ?TB) ($3 2GB, 2CPU, 80GB, ?TB) ($6 4GB, 2CPU, 160GB, ?TB) Others caught my eye: hudsonvalleyhost ($3.95 1GB, 1CPU, 25GB, 20TB) ($6.95 2GB, 2CPU, 50GB, 20TB) liquidweb ($5 1GB, 1CPU, 30GB, 1TB) digitalocean ($6 1GB, 1CPU, 25GB, 20TB) ovhcloud ($4.20 2GB, 1CPU, 20GB, 100Mbps unmetered) ($5.50 2GB, 2CPU, 40GB, 500Mbps unmetered) brownrice ($5.95 3GB, 1CPU, 10GB, unlimited)

4 4

Relay again saying it's new
by Keifer Bly 21 Feb '24

21 Feb '24

Hi, So my relay at https://metrics.torproject.org/rs.html#details/79E3B585803DE805CCBC00C1EF36… is again saying it's new despite that it's been running for a few years now. Second time this has happened. Thanks. --Keifer

1 0

7000 concurrent connections
by snowmanonahoe＠skiff.com 20 Feb '24

20 Feb '24

Hello all, I'm interested in running a relay. I should meet all the requirements for a guard/middle, except handling 7000 concurrent connections, which I'm unsure of. The website seems to tell me to try it and see what happens, but what exactly am I watching out for? Is the router going to fail entirely, slow down, or something else? Thanks in advance.

2 1

webtunnel bridge docker image still uses 0.4.7.13
by Carlo P. 20 Feb '24

20 Feb '24

Hi, with Tor version 0.4.7.x being EOL, the docker image for the webtunnel bridge deserves an update, as it still uses 0.4.7.13 ! Regards, C. -- Sent with https://mailfence.com Secure and private email

2 1

Getting spammed with 404 "Consensus is too old" warnings
by snowmanonahoe＠skiff.com 17 Feb '24

17 Feb '24

Hello all, Obfs4 bridge. Here is the exact warning text: Received http status code 404 ("Consensus is too old") from server 203.0.113.45:443 while fetching consensus directory. They appear in irregular intervals between 2 and 45 minutes. The heartbeat messages indicate the relay is working fine. The IP address is the same every time, and it's not mine. Anything to worry about?

1 0

Next Tor Relay Operator Meetup - 2024-01-27 @ 19:00 UTC
by gus 12 Feb '24

12 Feb '24

Dear Tor relay operators and volunteers, Save the date: the next Tor Relay Operator Meetup will happen on Saturday, January 27 at 19 UTC! We're still working on the agenda for this meetup, however feel free to add your topics directly to the ticket or just reply to the mailing list: https://gitlab.torproject.org/tpo/community/relays/-/issues/84 Where: Room link: https://tor.meet.coop/gus-og0-x74-dzn When: January 27, 19:00 UTC Tor Code of Conduct: https://community.torproject.org/policies/code_of_conduct/ Registration No need for a registration or anything else, just use the room-linkabove. We will open the room 10 minutes before so you can test your mic setup. Please share with your friends, social media and other mailing lists! cheers, Gus -- The Tor Project Community Team Lead

2 3

Way to be notified when relay goes offline?
by Keifer Bly 09 Feb '24

09 Feb '24

Hi, So my relay at https://metrics.torproject.org/rs.html#details/79E3B585803DE805CCBC00C1EF36… went offline for a few days, and I was unaware. Is there a way to be notified when a relay goes offline? Thanks. --Keifer

10 10