- tor-relays - lists.torproject.org

Re: [tor-relays] Help - My relay consensus has been stripped back to 20
by bigbudtor＠Safe-mail.net 05 Jan '15

05 Jan '15

> > Message: 3 > Date: Sat, 03 Jan 2015 02:30:55 +0100 > From: Sebastian Urbach <sebastian(a)urbach.org> > To: <tor-relays(a)lists.torproject.org> > Subject: Re: [tor-relays] Help - My relay consensus has been stripped > back to 20 > Message-ID: > <14aad6973e8.27ae.e04ee758f2dadc1889b5b423dda555f9(a)urbach.org> > Content-Type: text/plain; charset="UTF-8"; format=flowed > > On January 3, 2015 2:03:33 AM bigbudtor(a)Safe-mail.net wrote: > > Hi, > > > As i recall there was a mail from Giovanny a few days ago and he reported > his relay being down. But he had log file entries like: > > [warn] http status 400 ("Authdir is rejecting routers in this range.") > response from dirserver '128.31.0.39:9131'. > > Any of those in your log ? > No I don't see anything resembling that, although I am seeing these events messages in the logs every couple of hours: Dec 30 07:52:28.000 [info] router_pick_dirserver_generic(): No dirservers are reachable. Trying them all again. Dec 30 09:55:29.000 [info] router_pick_dirserver_generic(): No dirservers are reachable. Trying them all again. Dec 30 11:52:24.000 [info] router_pick_dirserver_generic(): No dirservers are reachable. Trying them all again. Dec 30 13:53:23.000 [info] router_pick_dirserver_generic(): No dirservers are reachable. Trying them all again. Dec 30 15:52:20.000 [info] router_pick_dirserver_generic(): No dirservers are reachable. Trying them all again. Dec 30 16:06:34.000 [info] router_upload_dir_desc_to_dirservers(): Uploading relay descriptor to directory authorities Dec 30 16:06:34.000 [info] directory_post_to_dirservers(): Uploading an extrainfo too (length 3891) Dec 30 16:06:34.000 [info] directory_post_to_dirservers(): Uploading an extrainfo too (length 3891) Dec 30 16:06:34.000 [info] directory_post_to_dirservers(): Uploading an extrainfo too (length 3891) Dec 30 16:06:34.000 [info] directory_post_to_dirservers(): Uploading an extrainfo too (length 3891) Dec 30 16:06:34.000 [info] directory_post_to_dirservers(): Uploading an extrainfo too (length 3891) Dec 30 16:06:34.000 [info] directory_post_to_dirservers(): Uploading an extrainfo too (length 3891) Dec 30 16:06:34.000 [info] directory_post_to_dirservers(): Uploading an extrainfo too (length 3891) Dec 30 16:06:34.000 [info] directory_post_to_dirservers(): Uploading an extrainfo too (length 3891) Dec 30 16:06:34.000 [info] directory_post_to_dirservers(): Uploading an extrainfo too (length 3891) Dec 30 17:52:19.000 [info] router_pick_dirserver_generic(): No dirservers are reachable. Trying them all again. Dec 30 19:53:18.000 [info] router_pick_dirserver_generic(): No dirservers are reachable. Trying them all again. Dec 30 21:39:02.000 [info] router_pick_dirserver_generic(): No dirservers are reachable. Trying them all again. Dec 30 23:33:58.000 [info] router_pick_dirserver_generic(): No dirservers are reachable. Trying them all again. Dec 31 01:32:55.000 [info] router_pick_dirserver_generic(): No dirservers are reachable. Trying them all again. Dec 31 02:52:13.000 [info] router_pick_dirserver_generic(): No dirservers are reachable. Trying them all again. Dec 31 05:05:32.000 [info] router_pick_dirserver_generic(): No dirservers are reachable. Trying them all again. I don't appear to have any routing issues, resolution issues or similar but don't have logs old enough to see if this is an unusual log event or not, it may be completely unrelated. As it stands I am afraid that there doesn't seem to be any real alternative other than decommissioning this exit relay. It is costing money and doing nobody any good right now.

2 2

Jump in brute force complaints
by Kura 05 Jan '15

05 Jan '15

I've noticed a rather large jump in abuse emails from admits about brute force attempts coming from my exit nodes. I've had a handful of these in past, as you'd expect but now they are arriving multiple times a day, some automated emails, some not. Has anyone else noticed a jump in abuse complaints? Curious as to whether it's a spike in the network being used for abuse, more admits reading logs or just my luck. -- Kura t: @kuramanga [https://twitter.com/kuramanga] w: https://kura.io/ [https://kura.io/] g: @kura [http://git.io/kura]

7 7

Re: [tor-relays] tor-relays Digest, Vol 48, Issue 12
by bigbudtor＠Safe-mail.net 04 Jan '15

04 Jan '15

-------- Original Message -------- On January 4, 2015 11:14:17 PM bigbudtor at Safe-mail.net wrote: > Hi, > > No dirservers reachable sounds like a pretty good reason why your not > getting anything anymore. Did you try to reach any of them manually ? That > sounds to me like there is either something wrong with the connectivity or > it is massive blocking. I can resolve the hostnames and then connect to the dir port on each of the directory authority servers manually using netcat. The relay is clearly still up and holding connections (down to around 80 inbound now, a few outbound and a small number of exit connections).

1 0

Re: [tor-relays] Help - My relay consensus has been stripped back to 20
by Sebastian Urbach 04 Jan '15

04 Jan '15

On January 4, 2015 11:14:17 PM bigbudtor(a)Safe-mail.net wrote: Hi, > > > > Message: 3 > > Date: Sat, 03 Jan 2015 02:30:55 +0100 > > From: Sebastian Urbach <sebastian(a)urbach.org> > > To: <tor-relays(a)lists.torproject.org> > > Subject: Re: [tor-relays] Help - My relay consensus has been stripped > > backto 20 > > Message-ID: > > <14aad6973e8.27ae.e04ee758f2dadc1889b5b423dda555f9(a)urbach.org> > > Content-Type: text/plain; charset="UTF-8"; format=flowed > > > > On January 3, 2015 2:03:33 AM bigbudtor(a)Safe-mail.net wrote: > > > > Hi, > > > > > > As i recall there was a mail from Giovanny a few days ago and he reported > > his relay being down. But he had log file entries like: > > > > [warn] http status 400 ("Authdir is rejecting routers in this range.") > > response from dirserver '128.31.0.39:9131'. > > > > Any of those in your log ? > > > > No I don't see anything resembling that, although I am seeing these events > messages in the logs every couple of hours: > > Dec 30 07:52:28.000 [info] router_pick_dirserver_generic(): No dirservers > are reachable. Trying them all again. > Dec 30 09:55:29.000 [info] router_pick_dirserver_generic(): No dirservers > are reachable. Trying them all again. > Dec 30 11:52:24.000 [info] router_pick_dirserver_generic(): No dirservers > are reachable. Trying them all again. > Dec 30 13:53:23.000 [info] router_pick_dirserver_generic(): No dirservers > are reachable. Trying them all again. > Dec 30 15:52:20.000 [info] router_pick_dirserver_generic(): No dirservers > are reachable. Trying them all again. > Dec 30 16:06:34.000 [info] router_upload_dir_desc_to_dirservers(): > Uploading relay descriptor to directory authorities > Dec 30 16:06:34.000 [info] directory_post_to_dirservers(): Uploading an > extrainfo too (length 3891) > Dec 30 16:06:34.000 [info] directory_post_to_dirservers(): Uploading an > extrainfo too (length 3891) > Dec 30 16:06:34.000 [info] directory_post_to_dirservers(): Uploading an > extrainfo too (length 3891) > Dec 30 16:06:34.000 [info] directory_post_to_dirservers(): Uploading an > extrainfo too (length 3891) > Dec 30 16:06:34.000 [info] directory_post_to_dirservers(): Uploading an > extrainfo too (length 3891) > Dec 30 16:06:34.000 [info] directory_post_to_dirservers(): Uploading an > extrainfo too (length 3891) > Dec 30 16:06:34.000 [info] directory_post_to_dirservers(): Uploading an > extrainfo too (length 3891) > Dec 30 16:06:34.000 [info] directory_post_to_dirservers(): Uploading an > extrainfo too (length 3891) > Dec 30 16:06:34.000 [info] directory_post_to_dirservers(): Uploading an > extrainfo too (length 3891) > Dec 30 17:52:19.000 [info] router_pick_dirserver_generic(): No dirservers > are reachable. Trying them all again. > Dec 30 19:53:18.000 [info] router_pick_dirserver_generic(): No dirservers > are reachable. Trying them all again. > Dec 30 21:39:02.000 [info] router_pick_dirserver_generic(): No dirservers > are reachable. Trying them all again. > Dec 30 23:33:58.000 [info] router_pick_dirserver_generic(): No dirservers > are reachable. Trying them all again. > Dec 31 01:32:55.000 [info] router_pick_dirserver_generic(): No dirservers > are reachable. Trying them all again. > Dec 31 02:52:13.000 [info] router_pick_dirserver_generic(): No dirservers > are reachable. Trying them all again. > Dec 31 05:05:32.000 [info] router_pick_dirserver_generic(): No dirservers > are reachable. Trying them all again. > > I don't appear to have any routing issues, resolution issues or similar but > don't have logs old enough to see if this is an unusual log event or not, > it may be completely unrelated. > > As it stands I am afraid that there doesn't seem to be any real alternative > other than decommissioning this exit relay. It is costing money and doing > nobody any good right now. No dirservers reachable sounds like a pretty good reason why your not getting anything anymore. Did you try to reach any of them manually ? That sounds to me like there is either something wrong with the connectivity or it is massive blocking. > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays -- Sincerely yours / Sincères salutations Sebastian Urbach ----------------------------------------- Definition of Tor: 10% luck, 20% skill, 15% concentrated power of will, 5% pleasure, 50% pain and 100% reason to remember the name! -----------------------------------------

1 0

odd list of connections
by TOR Zone 04 Jan '15

04 Jan '15

1 0

Someone broke the tor-relay speed record?
by Justaguy 04 Jan '15

04 Jan '15

https://globe.thecthulhu.com/#/relay/F528DED21EACD2E4E9301EC0AABD370EDCAD2C… Someone just got 149.08 MB/s on a non-exit relay. This is amazing! Would you mind saying what kind of hardware you use for this? Ipredator used https://ipredator.se/guide/torserver to get to 101MB/s. So your setup should be even more extreme. -- PGP fingerprint: 8516 5FFC 011A 6465 D042 6AC1 D719 1F41 B7CE EDFF OTR fingerprint OFTC: FF6D1AC2 13F38B15 EDB21522 D3530A6F 6EE01996 OTR fingerprint freenode: 293FAFD3 1155A465 C5B77015 B65E8AEC 63A1AF21 Full PGP public key: https://justaguy.pw

6 11

Location of Tor relays being incorrectly reported in Atlas
by Joshua Lee Tucker 03 Jan '15

03 Jan '15

Hi guys, Two of my Tor relays are being reported as being located within the USA within Atlas; these nodes are actually located within London, UK - the location is correctly identified when using an IP->Location service. I’m just wondering why this would occur? The two IP addresses are: 178.62.75.82 178.62.77.54 Thanks guys, Joshua Lee Tucker

7 6

Re: [tor-relays] HardwareAccel: Current proper use???
by Sebastian Urbach 03 Jan '15

03 Jan '15

On January 3, 2015 10:41:42 AM usprey <usprey(a)gmail.com> wrote: Hi usprey, > Summary: > The documentation is still somewhat vague on the best use of the > "HardwareAccel" option. > > > *HardwareAccel* *0*|*1* The docu is not exactly a high-performance howto :-) > > > > If non-zero, try to use built-in (static) crypto hardware acceleration > > when available. (Default: 0) > > > I could not find a definitive answer in the archives or in > https://gitweb.torproject.org/tor.git/log/?qt=grep&q=hardwareaccel&showmsg=1 > . > > https://www.torservers.net/wiki/setup/server#aes-ni_crypto_acceleration claims > no intervention is needed in regards of aes-ni accelaration, but I would > like to add an explanation or source to this recommendation. > > Question_1: > If my CPU supports and have loaded aesni_intel on linux with OpenSSL is > 1.0.1.j-1, should I leave HardwareAccel off or explicitly enable it? You don't have to change anything with 1.0.1.j-1, leave the default. > > Question_2: > What does "*built-in (static) crypto hardware acceleration*" refer to? > Dedicated hardware, CPU-support or...? It specifically means that you have the aes_ni cpu capabilities / flag. I have seen this flag on dedicated systems and also on vps systems as well. If the cpu / bios provides the flag and all other requirements are met (as stated in the torservers.net docu) you can use that feature on any system. I would very much appreciate it if you would switch to text mail format, thanks. Thank you very much for running a relay ! > > Best regards > > > > ---------- > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > -- Sincerely yours / Sincères salutations Sebastian Urbach ----------------------------------------- Definition of Tor: 10% luck, 20% skill, 15% concentrated power of will, 5% pleasure, 50% pain and 100% reason to remember the name! -----------------------------------------

3 4

High speed exit question
by Kura 03 Jan '15

03 Jan '15

Hey guys, I recently decided to get myself an 8 core, 16 GB RAM machine to use for running an exit relay and was wondering, Tor only works on one core, even setting NumCPUs to 2 doesn't do a whole lot so, how is it even possible to get more than maybe, 300Mbps or so from one relay? Maybe I'm missing something but, running multiple Tor processes is just going to have multiple relays with different OR and Dir ports for each, right? -- Kura t: @kuramanga [https://twitter.com/kuramanga] w: https://kura.io/ [https://kura.io/] g: @kura [http://git.io/kura]

6 8

HardwareAccel: Current proper use???
by usprey 03 Jan '15

03 Jan '15

Summary: The documentation is still somewhat vague on the best use of the "HardwareAccel" option. > *HardwareAccel* *0*|*1* > > If non-zero, try to use built-in (static) crypto hardware acceleration > when available. (Default: 0) > I could not find a definitive answer in the archives or in https://gitweb.torproject.org/tor.git/log/?qt=grep&q=hardwareaccel&showmsg=1 . https://www.torservers.net/wiki/setup/server#aes-ni_crypto_acceleration claims no intervention is needed in regards of aes-ni accelaration, but I would like to add an explanation or source to this recommendation. Question_1: If my CPU supports and have loaded aesni_intel on linux with OpenSSL is 1.0.1.j-1, should I leave HardwareAccel off or explicitly enable it? Question_2: What does "*built-in (static) crypto hardware acceleration*" refer to? Dedicated hardware, CPU-support or...? Best regards

2 2

Re: [tor-relays] Reduced number of HSDir's
by SiNA Rabbani 03 Jan '15

03 Jan '15

There was a new line added to authority director configs, which was a response to the recent Sybil attack [1]: MinUptimeHidServDirectoryV2 96 hours That's only 4 days, I wonder if anything else has changed. --SiNA [1] https://lists.torproject.org/pipermail/tor-consensus-health/2014-December/0… "Be the change that you wish to see in the world." - Mahatma Gandhi ----- On Jan 2, 2015, at 2:51 PM, Sebastian G. <bastik.tor> bastik.tor(a)googlemail.com wrote: > 02.01.2015, 19:47 Kura: >> I think something must have happened, I restarted half a dozen or so >> of my relays over a week ago and none of them have been given the >> HSDir flag, which if I remember rightly is a 21 hour flag? I may be >> mistaken but, I would have expected that flag to be back with over a >> week of uptime. > > It used to be a 25 hour flag. 1 day plus an additional hour. > > I think (yes, that says I don't know) the period being longer than 24 > hours had something to do with an attack to get relays under adversary > control in the right position to become a HSDir for some > hidden-services. If one pays for a relays by days an additional hour is > an additional day for an attacker. > > I may have missed something, but maybe it was raised. > > I do remember that changes to Guards took place, like requiring them to > have more bandwidth and to reducing the number of Guards clients would > use. This was due to research. > > Regards, > Sebastian > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

Re: [tor-relays] Help - My relay consensus has been stripped back to 20
by bigbudtor＠Safe-mail.net 03 Jan '15

03 Jan '15

Thanks Sebastian, That explains the loss of guard status back in August at least. I totally missed that announcement. Back to the main issue, it does look like one or two others at least are having this problem. Is it simply as a result of being in a Lizard-blacklisted netblock? Bigbud is in 85.119.0.0/16. Is the current Lizard-blacklist published or is it only known to the directory authorities? thanks BB > Hi, > Found the snippet with the changes for the guards: > Tor Weekly News, 30th of July 2014 > Once directory authorities have upgraded, they will “assign the Guard flag > to the fastest 25% of the network”. Some experiments showed that “for the > current network, this results in about 1100 guards, down from 2500.” > > -- > Sincerely yours / Sincères salutations > > Sebastian Urbach

2 1

Help - My relay consensus has been stripped back to 20
by Sebastian Urbach 03 Jan '15

03 Jan '15

Hi, Found the snippet with the changes for the guards: Tor Weekly News, 30th of July 2014 Once directory authorities have upgraded, they will “assign the Guard flag to the fastest 25% of the network”. Some experiments showed that “for the current network, this results in about 1100 guards, down from 2500.” -- Sincerely yours / Sincères salutations Sebastian Urbach ----------------------------------------- Definition of Tor: 10% luck, 20% skill, 15% concentrated power of will, 5% pleasure, 50% pain and 100% reason to remember the name! -----------------------------------------

1 0

Help - My relay consensus has been stripped back to 20
by bigbudtor＠Safe-mail.net 03 Jan '15

03 Jan '15

On the 29th December one of our relays, bigbud (6911888F83565892FE23F1B03EB501D80E1E8780) which had a consensus of 630+ and had been running for nearly 18 months (100 days uptime running 2.5.8) suddenly started receiving much less traffic. I have seen a gradual reduction in traffic over the course of the last year but on the 29th the drop off was very significant and I saw in Atlas that the consensus is dropped to 20. When I look at the consensus files it shows that bigbud has a consensus of 20 and that Unmeasured was set to 1. Any ideas please? I upgraded Tor to 2.5.10 after I noticed the consensus drop. Is this something to do with the Lizard new relay flood or something or is there an actual problem with the relay? On a related note the relay lost guard status too a few months ago and I couldn't see why that would be.

3 2

Re: [tor-relays] sudden drop
by Spencer Rhodes 02 Jan '15

02 Jan '15

Not sure if related, but I noticed today one of my exit relays was not operating properly. Turned out the bind server was not resolving properly. I turned off dnssec and it started working again... On January 2, 2015 6:45:30 PM EST, tor-relays-request(a)lists.torproject.org wrote: >Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > >To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > >You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of tor-relays digest..." > > >------------------------------------------------------------------------ > >Today's Topics: > > 1. Reduced number of HSDir's (Sebastian Urbach) > 2. Re: Reduced number of HSDir's (Austin Bentley) > 3. Re: Reduced number of HSDir's (Kura) > 4. Re: Reduced number of HSDir's (Sebastian G. <bastik.tor>) > 5. Help - My relay consensus has been stripped back to 20 > (bigbudtor(a)Safe-mail.net) > 6. Re: Help - My relay consensus has been stripped back to 20 (s7r) > > >------------------------------------------------------------------------ > >From: Sebastian Urbach <sebastian(a)urbach.org> >To: tor-relays(a)lists.torproject.org >Sent: Fri Jan 02 12:25:06 EST 2015 >Subject: [tor-relays] Reduced number of HSDir's > >Hi, > >https://metrics.torproject.org shows a big nose dive recently regarding >the >number of HSDir's. Did i miss anything relevant in the last days ? That > >seem to be the reason why i see increasing download numbers on my >system. > >Thanks for any lind of info. >-- >Sincerely yours / Sincères salutations > >Sebastian Urbach > >----------------------------------------- >Definition of Tor: >10% luck, 20% skill, 15% concentrated >power of will, 5% pleasure, 50% pain and >100% reason to remember the name! >----------------------------------------- > > > > > >------------------------------------------------------------------------ > >From: Austin Bentley <ab6d9(a)mst.edu> >To: tor-relays(a)lists.torproject.org >Sent: Fri Jan 02 13:29:33 EST 2015 >Subject: Re: [tor-relays] Reduced number of HSDir's > >No clue. I wonder if there's some backlash from a anti-attack mechanism >of >some sort? There was a few attempted attacks against the Tor network, >but >it wasn't anything worth discussing. Check out the post on the 31st >from >blog.torproject.org. > >On Fri, Jan 2, 2015 at 11:25 AM, Sebastian Urbach ><sebastian(a)urbach.org> >wrote: > >> Hi, >> >> https://metrics.torproject.org shows a big nose dive recently >regarding >> the number of HSDir's. Did i miss anything relevant in the last days >? That >> seem to be the reason why i see increasing download numbers on my >system. >> >> Thanks for any lind of info. >> -- >> Sincerely yours / Sincères salutations >> >> Sebastian Urbach >> >> ----------------------------------------- >> Definition of Tor: >> 10% luck, 20% skill, 15% concentrated >> power of will, 5% pleasure, 50% pain and >> 100% reason to remember the name! >> ----------------------------------------- >> >> >> _______________________________________________ >> tor-relays mailing list >> tor-relays(a)lists.torproject.org >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >> > > >------------------------------------------------------------------------ > >From: Kura <kura(a)kura.io> >To: tor-relays(a)lists.torproject.org >Sent: Fri Jan 02 13:47:51 EST 2015 >Subject: Re: [tor-relays] Reduced number of HSDir's > >I think something must have happened, I restarted half a dozen or so of >my relays over a week ago and none of them have been given the >HSDir flag, which if I remember rightly is a 21 hour flag? I may be >mistaken but, I would have expected that flag to be back with over a >week of uptime. > > >-- >Kura > >t: @kuramanga [https://twitter.com/kuramanga] >w: https://kura.io/ [https://kura.io/] >g: @kura [http://git.io/kura] >On 02/01/2015 18:30:00, Austin Bentley <ab6d9(a)mst.edu> wrote: >No clue. I wonder if there's some backlash from a anti-attack mechanism >of some sort? There was a few attempted attacks against the Tor >network, but it wasn't anything worth discussing. Check out the post on >the 31st from blog.torproject.org [http://blog.torproject.org] > > >On Fri, Jan 2, 2015 at 11:25 AM, Sebastian Urbach <sebastian(a)urbach.org >[mailto:sebastian@urbach.org]> wrote: > >Hi, > >https://metrics.torproject.org [https://metrics.torproject.org] shows a >big nose dive recently regarding the number of HSDir's. Did i miss >anything relevant in the last days ? That seem to be the reason why i >see increasing download numbers on my system. > >Thanks for any lind of info. >-- >Sincerely yours / Sincères salutations > >Sebastian Urbach > >----------------------------------------- >Definition of Tor: >10% luck, 20% skill, 15% concentrated >power of will, 5% pleasure, 50% pain and >100% reason to remember the name! >----------------------------------------- > > >_______________________________________________ >tor-relays mailing list >tor-relays(a)lists.torproject.org >[mailto:tor-relays@lists.torproject.org] >https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >[https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays] > > >_______________________________________________ tor-relays mailing list >tor-relays(a)lists.torproject.org >https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > >------------------------------------------------------------------------ > >From: "Sebastian G. <bastik.tor>" <bastik.tor(a)googlemail.com> >To: tor-relays(a)lists.torproject.org >Sent: Fri Jan 02 14:51:26 EST 2015 >Subject: Re: [tor-relays] Reduced number of HSDir's > >02.01.2015, 19:47 Kura: >> I think something must have happened, I restarted half a dozen or so >> of my relays over a week ago and none of them have been given the >> HSDir flag, which if I remember rightly is a 21 hour flag? I may be >> mistaken but, I would have expected that flag to be back with over a >> week of uptime. > >It used to be a 25 hour flag. 1 day plus an additional hour. > >I think (yes, that says I don't know) the period being longer than 24 >hours had something to do with an attack to get relays under adversary >control in the right position to become a HSDir for some >hidden-services. If one pays for a relays by days an additional hour is >an additional day for an attacker. > >I may have missed something, but maybe it was raised. > >I do remember that changes to Guards took place, like requiring them to >have more bandwidth and to reducing the number of Guards clients would >use. This was due to research. > >Regards, >Sebastian > > > >------------------------------------------------------------------------ > >From: bigbudtor(a)Safe-mail.net >To: tor-relays(a)lists.torproject.org >Sent: Fri Jan 02 18:28:48 EST 2015 >Subject: [tor-relays] Help - My relay consensus has been stripped back >to 20 > >On the 29th December one of our relays, bigbud >(6911888F83565892FE23F1B03EB501D80E1E8780) which had a consensus of >630+ and had been running for nearly 18 months (100 days uptime running >2.5.8) suddenly started receiving much less traffic. > >I have seen a gradual reduction in traffic over the course of the last >year but on the 29th the drop off was very significant and I saw in >Atlas that the consensus is dropped to 20. When I look at the consensus >files it shows that bigbud has a consensus of 20 and that Unmeasured >was set to 1. > >Any ideas please? I upgraded Tor to 2.5.10 after I noticed the >consensus drop. Is this something to do with the Lizard new relay flood >or something or is there an actual problem with the relay? > >On a related note the relay lost guard status too a few months ago and >I couldn't see why that would be. > > > >------------------------------------------------------------------------ > >From: s7r <s7r(a)sky-ip.org> >To: tor-relays(a)lists.torproject.org >Sent: Fri Jan 02 18:39:52 EST 2015 >Subject: Re: [tor-relays] Help - My relay consensus has been stripped >back to 20 > >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >This was reported yesterday 01.01.2015 in IRC too, for this relay: > >3D7E274A87D9A89AF064C13D1EE4CA1F184F2600 > >The same it was pushing good amounts of traffic and the consensus >weight dropped to 20 with no modifications made to the Tor config file >or anything. You are the 3rd person who reports this, seams like worth >investigating further. > >I can see both of them are exits, but doubt this has anything to do >with it. > >Could it be a measurement problem from the bandwidth authorities? Why >would it happen only to very few relays in this case? > >On 1/3/2015 1:28 AM, bigbudtor(a)Safe-mail.net wrote: >> On the 29th December one of our relays, bigbud >> (6911888F83565892FE23F1B03EB501D80E1E8780) which had a consensus of >> 630+ and had been running for nearly 18 months (100 days uptime >> running 2.5.8) suddenly started receiving much less traffic. >> >> I have seen a gradual reduction in traffic over the course of the >> last year but on the 29th the drop off was very significant and I >> saw in Atlas that the consensus is dropped to 20. When I look at >> the consensus files it shows that bigbud has a consensus of 20 and >> that Unmeasured was set to 1. >> >> Any ideas please? I upgraded Tor to 2.5.10 after I noticed the >> consensus drop. Is this something to do with the Lizard new relay >> flood or something or is there an actual problem with the relay? >> >> On a related note the relay lost guard status too a few months ago >> and I couldn't see why that would be. >> _______________________________________________ tor-relays mailing >> list tor-relays(a)lists.torproject.org >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >> >-----BEGIN PGP SIGNATURE----- >Version: GnuPG v2.0.22 (MingW32) > >iQEcBAEBAgAGBQJUpyxIAAoJEIN/pSyBJlsRB6MH+wWzDQPlhf+H4KWkoX9J6jhc >GQbL3+YmmZP1Eh941hnE6zaHpk5OUZiDarovBxSdL0FPEyHWlvLJIsFR6VXmfq2s >RB4hId21mKR5HQLNy/at6KP4Xs7dv3Qyid/KCZK3qH82HtJ9Yt9lA6yNTT8uLWmV >zIr1SKAMltBiIVrBWZaNGtqy5NVrGiF3yx2VYuHT7ZORL1l8BVjvG2I9d+/n2n7r >3RdEUKXSeFp/UnLlN5M9ZhHEdQLkioKfUisnkHdPKu7LTvWlVIONCm0t5lHo62xh >MUmbBP+lrWMfmQE8sJaTgmlJKq26Gb+JtG7uXV8k+XOfDokQygnFclJwZtUnKrQ= >=9kZo >-----END PGP SIGNATURE----- > > > >------------------------------------------------------------------------ > >_______________________________________________ >tor-relays mailing list >tor-relays(a)lists.torproject.org >https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays -- Sent from my phone.

1 0

Reduced number of HSDir's
by Sebastian Urbach 02 Jan '15

02 Jan '15

Hi, https://metrics.torproject.org shows a big nose dive recently regarding the number of HSDir's. Did i miss anything relevant in the last days ? That seem to be the reason why i see increasing download numbers on my system. Thanks for any lind of info. -- Sincerely yours / Sincères salutations Sebastian Urbach ----------------------------------------- Definition of Tor: 10% luck, 20% skill, 15% concentrated power of will, 5% pleasure, 50% pain and 100% reason to remember the name! -----------------------------------------

4 3

RPM upgrade issue.
by Sascha Siekmann 01 Jan '15

01 Jan '15

Hello, Happy New Year, everone! I've been chasing this down here for the last hour or so and I thought I might as well share it since others might also experience it. I am running https://atlas.torproject.org/#search/plutonium After running yum update this lead to a different fingerprint being generated for the same host. Nov 29 01:09:27 Installed: tor-0.2.5.10-tor.2.rh6_5.i686 Dec 29 19:21:07 Installed: torsocks-2.0.0-2.el6.i686 Dec 29 19:21:10 Updated: tor-0.2.5.10-1.el6.i686 Then, traffic collapsed by going down from <> 8MB/sec to pretty much nothing. I checked the logs and found permission errors. The group for Tor was changed from _tor to toranon, so the permissions were wrong after the rpm was installed. Also, /etc/tor/torrc had this line commented : ## The directory for keeping all the keys/etc. By default, we store ## things in $HOME/.tor on Unix, and in Application Data\tor on Windows. DataDirectory /var/lib/tor So it was defaulting to ~tor directory, tor/tor.log-20141230:Dec 30 03:13:01.000 [warn] Default DataDirectory is "~/.tor". This expands to "/.tor", which is probably not what you want. Using "/var/tor" instead [root@plutonium log]# rpm -qa | grep tor torsocks-2.0.0-2.el6.i686 tor-0.2.5.10-1.el6.i686 [root@plutonium log]# Dec 29 17:56:47.000 [notice] Heartbeat: Tor's uptime is 25 days 0:00 hours, with 1885 circuits open. I've sent 6843.34 GB and received 6761.80 GB. Dec 29 17:56:47.000 [notice] Average packaged cell fullness: 97.313% Dec 29 17:56:47.000 [notice] TLS write overhead: 2% Dec 29 17:56:47.000 [notice] Circuit handshake stats since last time: 16007/16007 TAP, 49264/49264 NTor. Dec 29 20:07:10.000 [warn] Couldn't open "/var/lib/tor/cached-microdesc-consensus.tmp" (/var/lib/tor/cached-microdesc-consensus) for writing: Permission denied Dec 29 20:07:10.000 [warn] Couldn't open "/var/lib/tor/cached-microdescs.new" (/var/lib/tor/cached-microdescs.new) for writing: Permission denied Dec 29 20:07:10.000 [warn] Couldn't append to journal in /var/lib/tor/cached-microdescs.new: Permission denied Dec 29 20:07:11.000 [warn] Couldn't open "/var/lib/tor/cached-microdescs.new" (/var/lib/tor/cached-microdescs.new) for writing: Permission denied Dec 29 20:07:11.000 [warn] Couldn't append to journal in /var/lib/tor/cached-microdescs.new: Permission denied Dec 29 20:08:10.000 [warn] Couldn't open "/var/lib/tor/cached-microdescs.new" (/var/lib/tor/cached-microdescs.new) for writing: Permission denied Dec 29 20:08:10.000 [warn] Couldn't append to journal in /var/lib/tor/cached-microdescs.new: Permission denied Dec 29 20:08:10.000 [warn] Couldn't open "/var/lib/tor/cached-microdescs.new" (/var/lib/tor/cached-microdescs.new) for writing: Permission denied Dec 29 20:08:10.000 [warn] Couldn't append to journal in /var/lib/tor/cached-microdescs.new: Permission denied Dec 29 20:09:11.000 [warn] Couldn't open "/var/lib/tor/cached-microdescs.new" (/var/lib/tor/cached-microdescs.new) for writing: Permission denied Dec 29 20:09:11.000 [warn] Couldn't append to journal in /var/lib/tor/cached-microdescs.new: Permission denied Dec 29 20:09:11.000 [warn] Couldn't open "/var/lib/tor/cached-microdescs.new" (/var/lib/tor/cached-microdescs.new) for writing: Permission denied Dec 29 20:09:11.000 [warn] Couldn't append to journal in /var/lib/tor/cached-microdescs.new: Permission denied Dec 29 20:29:31.000 [warn] Couldn't open "/var/lib/tor/cached-consensus.tmp" (/var/lib/tor/cached-consensus) for writing: Permission denied Dec 29 20:29:32.000 [warn] Couldn't open "/var/lib/tor/cached-descriptors.new" (/var/lib/tor/cached-descriptors.new) for writing: Permission denied Dec 29 20:29:32.000 [warn] Unable to store router descriptor I fixed the permissions, but I am seeing this message now that I have not seen before. Jan 1 21:36:02 p15186978 Tor[28986]: Invalid result from curve25519 handshake: 4 Jan 1 21:36:02 p15186978 Tor[28986]: onion_skin_client_handshake failed. Jan 1 21:36:02 p15186978 Tor[28986]: circuit_finish_handshake failed. Jan 1 21:36:02 p15186978 Tor[28986]: connection_edge_process_relay_cell (at origin) failed. Jan 1 21:36:04 p15186978 Tor[28986]: Performing bandwidth self-test...done. Should I be concerned about this message? [root@plutonium etc]# uname -a Linux plutonium 2.6.32-431.el6.i686 #1 SMP Fri Nov 22 00:26:36 UTC 2013 i686 i686 i386 GNU/Linux [root@plutonium etc]# cat /etc/redhat-release CentOS release 6.6 (Final) [root@plutonium etc]# Thanks, Sascha.

2 1

Relay is down
by Giovanny Andres Gongora Granada 01 Jan '15

01 Jan '15

Hi, My relay was up during 4 days, but now it's down. In the log it says: Dec 30 21:19:51.000 [warn] http status 400 ("Authdir is rejecting routers in this range.") response from dirserver '128.31.0.39:9131'. Please$ Dec 30 21:19:51.000 [warn] http status 400 ("Authdir is rejecting routers in this range.") response from dirserver '208.83.223.34:443'. Pleas$ Dec 30 21:19:51.000 [warn] http status 400 ("Authdir is rejecting routers in this range.") response from dirserver '131.188.40.189:80'. Pleas$ Dec 30 21:19:51.000 [warn] http status 400 ("Authdir is rejecting routers in this range.") response from dirserver '86.59.21.38:80'. Please c$ What could be happening? I restart it but it says the same on the log. Regards, Gio -- Mozilla Hispano: http://mozilla-hispano.org Mentor en mozilla-hispano.org: Gioyik <https://www.mozilla-hispano.org/documentacion/Usuario:Gioyik> Mozilla Colombia: Miembro en MozillaColombia <http://mozillacolombia.org/our-contributors/> twitter: Gioyik <https://twitter.com/Gioyik> Blog: gioyik.wordpress.com irc: gioyik

8 11

OT: folding@home
by Sebastian Urbach 28 Dec '14

28 Dec '14

Dear list members, I would like to invite any operator, who has some idle Cores (CPU or GPU) left,to join the folding@home distributed computing project: http://folding.stanford.edu/ There is now a brandnew team called Tor Project (Unofficial) with the id 227615. Hope to see some of you there :-) -- Sincerely yours / Sincères salutations Sebastian Urbach ----------------------------------------- Definition of Tor: 10% luck, 20% skill, 15% concentrated power of will, 5% pleasure, 50% pain and 100% reason to remember the name! -----------------------------------------

6 10

boost CPU on a Tor relay
by s7r 28 Dec '14

28 Dec '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, A Tor relay currently going 33MB/s could go a lot faster but CPU is at 93% usage - this is the bottleneck. Here is the output of /proc/cpuinfo processor : 0 vendor_id : GenuineIntel cpu family : 6 model : 26 model name : Intel(R) Core(TM) i7 CPU 950 @ 3.07GHz stepping : 5 microcode : 0x11 cpu MHz : 3068.000 cache size : 8192 KB physical id : 0 siblings : 8 core id : 0 cpu cores : 4 apicid : 0 initial apicid : 0 fpu : yes fpu_exception : yes cpuid level : 11 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf pni dtes64 monitor ds_cpl vmx est tm2 ssse3 cx16 xtpr pdcm sse4_1 sse4_2 popcnt lahf_lm ida dtherm tpr_shadow vnmi flexpriority ept vpid bogomips : 6132.24 clflush size : 64 cache_alignment : 64 address sizes : 36 bits physical, 48 bits virtual power management: it also goes down to processor 1 - processor 7 Any ideas how this could be boosted? OS is Debian wheezy. No aes-ni hardware acceleration, no openssl benchmarking or customization currently. advices? Thank you. - -- s7r PGP Fingerprint: 7C36 9232 5ABD FB0B 3021 03F1 837F A52C 8126 5B11 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) iQEcBAEBAgAGBQJUDuRTAAoJEIN/pSyBJlsRLqYH/iSCtC9r/7/DBCG2qqUGPEgY TELvt+UMGyMP6ncNJH+vDEdHO4BBlSMzFQdj2sKyO3hOT5492cIOaT3gGokaDApL W913yqUkIfiUT6FUWJ6g4/LUt25pMG25Ednr/ZJJXR/pR+Ym3T3ytg+MSwRBmpEe +h26Q7qvd/p4f6VhTR0sEsxQfDLVXrEsj3kn0BL0rLklN5zH/bqmIsK2hio5Nl3H KBvbvyt+JbLhA/4+jygT6AygHDH9arpXWEh3ZcJVn7mE0OmPAvukdlLUj70K5F7r cCeMakcGBbSzit5tY7jUmSvkUewVBhAxAZmv1hgNnuCoSrGPtQZseCbM06cry+k= =TyKF -----END PGP SIGNATURE-----

6 10

Re: [tor-relays] OT: folding@home
by teor 27 Dec '14

27 Dec '14

Some thoughts on the security of crowdsourced computing: Installing additional software increases the attack surface of your relay, even more so when the new software access the network. (Not to mention any additional libraries.) There is also the issue of the security of automatic updates to the any executables - Folding@home may have less of an issue with this than BOINC, as there is only one project involved. If you're willing to accept the additional risk, it seems like a worthy cause. (There's also a minor additional power cost, which really only impacts your provider and the environment…) > Date: Sat, 27 Dec 2014 12:54:24 +0100 > From: mikael <mikael(a)gutanet.sk> > > Hi, > some years ago I contributed to https://secure.worldcommunitygrid.org/ > via BOINC (https://boinc.berkeley.edu/) but stoped. > Forgive my paranoia, but I couldn't find proof that it really helps what > they write, that the provided cpu power could doesn't land at NSA for > example :/ > > Any different experience? > >> On 12/26/14 6:55 PM, Sebastian Urbach wrote: >> Dear list members, >> >> I would like to invite any operator, who has some idle Cores (CPU or >> GPU) left,to join the folding@home distributed computing project: >> >> http://folding.stanford.edu/ >> >> There is now a brandnew team called Tor Project (Unofficial) with the >> id 227615. Hope to see some of you there :-) >

3 2

News reporting exit node attacks
by Austin Bentley 27 Dec '14

27 Dec '14

Anyone have any more information on any of this stuff? They claim it's a 0day but I have yet to see proof.

3 4

Possible DDoS
by Christian Burkert 26 Dec '14

26 Dec '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi *, I'm running a non-exit Tor node for a few months now on a virtual server hosted in a professional datacenter. That's the node: https://globe.torproject.org/#/relay/4C246EA9C950B872FD77F761CEAAB41D93D976… Yesterday, December 25th, the support wrote me, that my server is under a DDoS attack with 2GBit/s lasting over more than two hours. So, the hoster black holed my traffic to protect the other customers. The hoster wanted to know which services I'm running and told me that if I continue running Tor and further attacks will happen, then I would have to bear the costs. Eventually, I took down the Tor node to avoid further confrontation. Now I seek for your interpretation of this event: - - Has there been more recent incidents against Tor nodes? - - How can I investigate it? - - How should one react to a hoster? I mean they could have made up the whole thing... Looking forward to your comments Chris -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Icedove - http://www.enigmail.net/ iQIcBAEBCgAGBQJUnUdDAAoJEHAzZ6ooPDSy0nMP/1lyHPPFBxpAOvEiWL+ijrvA SPViJvZH/cPUS/11M7qm+bsZa/fbiRk6kY8ADcY8abe1Z8lHzMYPGwZvKaIijiZG M8hjCHtMWLipO6iLmVfFskDtRn37Ga2ibEhGkVesDV53kPcotgg4i7tIqIuNb11X Gnkk+WpYwkrS9nPZjYNLmce093s4lux/N5GyRY/gQii+h9mfDJ++W+1ueNU94UQ0 bvK1wF7MdicWlu0kR49hCgFtDFh7uUjP87MPZmmQYHI82qWhTJxqOuuImrnJew2k pCFSzn03x/hXg1QFNPNLsqHU9OhUob3/z17Azcpbir15mY4/YE7Gq14/LBM+FKh0 LqGjzaVbQo0hs0kE2yFk5sEP0Dsv5aiOUItqFIMTG52FYZ6cUh/eTxMd6vblHwfU ujil0rFCRqtmbF6wIDBuXDxc0fmdaRMWTDfSlPxYGkfUaq1tSea1OAvjFpheOcNM wu9QiTSq9BTLY010iHSYQDknSr+gFkc/ooNLsPV1AAZFyMlG0epLww6tqR7C9hZq RyEX9piqGal7mU56gETxhDrD0Z/aKgXMbS+KvYfZhopGWEVg5vbWPGxAId53nhr6 hjvLyFmy68hBdbOB/pvp8qvw8veQR3niiHIxhxAl+BIQzXX45x0uVCPHFUpbbLp5 POIwpEJ46oaz7+cddAHf =TcPt -----END PGP SIGNATURE-----

4 4

Re: [tor-relays] Possible DDoS
by Sebastian Urbach 26 Dec '14

26 Dec '14

On December 26, 2014 12:41:51 PM Christian Burkert <post(a)cburkert.de> wrote: Hi, > I'm running a non-exit Tor node for a few months now on a virtual server > hosted in a professional datacenter. Thank you ! > Yesterday, December 25th, the support wrote me, that my server is > under a DDoS attack with 2GBit/s lasting over more than two hours. So, > the hoster black holed my traffic to protect the other customers. I've seen this behaviour from some ISP's before and it's rather sad. If something like this happens my ISP is taking care of it without disabling my systems. I'm just getting a note with all the technical information and that's it. > The hoster wanted to know which services I'm running and told me that > if I continue running Tor and further attacks will happen, then I > would have to bear the costs. > Eventually, I took down the Tor node to avoid further confrontation. That's interesting, they gave you some infos like the time and the amount but nothing else ? Seems to me that they're pretty clueless and are fishing in the dark. Another reason for their behaviour could be that they want to get rid of you / your Tor node. Threatening customers is really sad, sounds like they heard the word Tor from you and then concluded "oh, than he basically asked for the attack". > > Now I seek for your interpretation of this event: > - - Has there been more recent incidents against Tor nodes? Nothing with that magnitude on my end for weeks. > - - How can I investigate it? You can ask your ISP for their logs regarding that attack. Do you have any logs on your system, maybe from a intrusion detection or anything else ? > - - How should one react to a hoster? I mean they could have made up the > whole thing... If you are already considering this than i would recommend changing to another ISP, sounds like there is already some distrust. > > Looking forward to your comments > Chris > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.12 (GNU/Linux) > Comment: Using GnuPG with Icedove - http://www.enigmail.net/ > > iQIcBAEBCgAGBQJUnUdDAAoJEHAzZ6ooPDSy0nMP/1lyHPPFBxpAOvEiWL+ijrvA > SPViJvZH/cPUS/11M7qm+bsZa/fbiRk6kY8ADcY8abe1Z8lHzMYPGwZvKaIijiZG > M8hjCHtMWLipO6iLmVfFskDtRn37Ga2ibEhGkVesDV53kPcotgg4i7tIqIuNb11X > Gnkk+WpYwkrS9nPZjYNLmce093s4lux/N5GyRY/gQii+h9mfDJ++W+1ueNU94UQ0 > bvK1wF7MdicWlu0kR49hCgFtDFh7uUjP87MPZmmQYHI82qWhTJxqOuuImrnJew2k > pCFSzn03x/hXg1QFNPNLsqHU9OhUob3/z17Azcpbir15mY4/YE7Gq14/LBM+FKh0 > LqGjzaVbQo0hs0kE2yFk5sEP0Dsv5aiOUItqFIMTG52FYZ6cUh/eTxMd6vblHwfU > ujil0rFCRqtmbF6wIDBuXDxc0fmdaRMWTDfSlPxYGkfUaq1tSea1OAvjFpheOcNM > wu9QiTSq9BTLY010iHSYQDknSr+gFkc/ooNLsPV1AAZFyMlG0epLww6tqR7C9hZq > RyEX9piqGal7mU56gETxhDrD0Z/aKgXMbS+KvYfZhopGWEVg5vbWPGxAId53nhr6 > hjvLyFmy68hBdbOB/pvp8qvw8veQR3niiHIxhxAl+BIQzXX45x0uVCPHFUpbbLp5 > POIwpEJ46oaz7+cddAHf > =TcPt > -----END PGP SIGNATURE----- > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays -- Sincerely yours / Sincères salutations Sebastian Urbach ----------------------------------------- Definition of Tor: 10% luck, 20% skill, 15% concentrated power of will, 5% pleasure, 50% pain and 100% reason to remember the name! -----------------------------------------

2 1

Tor Weather doesn't register my fingerprint
by Giovanny Andres Gongora Granada 26 Dec '14

26 Dec '14

Hi, Today I decided to run a Tor Relay and contribute to Tor Project on a Rackspace that I have free for it. I want to use Tor Weather to get notifications about my relay, but when I try to register my fingerprint it doesn't accept it. What could be needed to register it? My fingerprint is: 4C90453B94DAC00BE356283F427CECE024B9D224 This is the info about my relay: https://globe.torproject.org/#/relay/4C90453B94DAC00BE356283F427CECE024B9D2… Regards, Gio -- Mozilla Hispano: http://mozilla-hispano.org Mentor en mozilla-hispano.org: Gioyik <https://www.mozilla-hispano.org/documentacion/Usuario:Gioyik> Mozilla Colombia: Miembro en MozillaColombia <http://mozillacolombia.org/our-contributors/> twitter: Gioyik <https://twitter.com/Gioyik> Blog: gioyik.wordpress.com irc: gioyik

2 1