- tor-relays - lists.torproject.org

ORCONN
by Yannick Krueck 03 Sep '14

03 Sep '14

Hello, I provide a Tor-Relay Server. I have a questions regarding the Tor control protocol. If i use "setevents orconn", i get a lot of Connections. Mostly i get first a "New/Launched" message, then a "Connected" message and then a "Failed/Closed" message. But sometimes i get only a "New"-message, and a "Connected" message, but I never receive a "Failed" or "Closed" message. In this case, i only get the IP Adress, but no LongName. For example: 650 ORCONN 81.219.94.108:1976 NEW 650 ORCONN 81.219.94.108:1976 CONNECTED => Never Receive a Closed oder Failed Message Additional i can not find the IP-Adress 81.219.94.108 on https://onionoo.torproject.org/details . The question: What or Who is 81.219.94.108? Another relay? A Bridge? A normal User (Entry Guard)? 81.219.94.108 is only an example, their are many more Nodes with the similar procedure. Thank you for answering my question Y. Krueck (Germany)

1 0

oniontip.com
by Sebastian Urbach 02 Sep '14

02 Sep '14

Hi, I like to suggest adding oniontip.com to the "Donate" section on the tor website. It's a nice possibility to help the Relay-Oerators. Have a nice day. -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ---------------------------------------------- Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. ---------------------------------------------- Benjamin Franklin (1706 - 1790), Inventor, journalist, printer, diplomat and statesman -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ---------------------------------------------- Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. ---------------------------------------------- Benjamin Franklin (1706 - 1790), Inventor, journalist, printer, diplomat and statesman

4 4

is a KVM fine for a first quick test to setup a tor exit node
by Toralf Förster 01 Sep '14

01 Sep '14

I do have here a Gentoo Linux and a KVM (Gentoo too) - now I'm wondering if I can just emerge the Gentoo Tor package here in the KVM and play with it or should I prepare few things before to avoid that it will be used by the Tor network immediately ? -- Toralf pgp key: 0076 E94E

2 1

Expired Key
by Sebastian Urbach 31 Aug '14

31 Aug '14

Hi, The key from deb.torproject.org archive is expired, a new one would be nice. The installation information in the docu should be updated to the new key id as well. Thanks -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ---------------------------------------------- Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. ---------------------------------------------- Benjamin Franklin (1706 - 1790), Inventor, journalist, printer, diplomat and statesman

2 1

Authdir is rejecting routers in this range
by Davíð Steinn Geirsson 29 Aug '14

29 Aug '14

Hi all, I rented a dedicated server to run a tor relay (100Mbit/s) to contribute to the network. On this machine, tor gives messages like these on startup: http status 400 ("Authdir is rejecting routers in this range.") response from dirserver '<...>'. Please correct. The server is hosted with https://fdcservers.net/. Did I just get unlucky in picking a provider? Is there a way to check these things before spending money on setup + monthly fees? Best regards, Davíð

4 5

Key expired problem - Ubuntu 12.04 LTS
by kingqueen 29 Aug '14

29 Aug '14

I'm experiencing difficulties running apt-get update as it complaints that the repository's key is out of date. Here's the error: W: A error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://deb.torproject.org precise Release: The following signatures were invalid: KEYEXPIRED 1409325681 KEYEXPIRED 1409325681 KEYEXPIRED 1409325681 KEYEXPIRED 1409325681 W: Failed to fetch http://deb.torproject.org/torproject.org/dists/precise/Release W: Some index files failed to download. They have been ignored, or old ones used instead. When I set the relay up, I used Option Two on this page https://www.torproject.org/docs/debian to install tor and deb.torproject.org-keyring . Updates worked for 10 weeks or so and now don't. I've tried going through the same processes again, to no avail. Any assistance very gratefully received.

2 1

Centos 7
by obx 28 Aug '14

28 Aug '14

There are no packages for centos 7 yet. Is there an ETA? Is there anything we can do/contribute?

3 2

Re: [tor-relays] Advantage in more exits in the same /8?
by Jesse Victors 27 Aug '14

27 Aug '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA384 On 08/27/2014 04:03 PM, tor-relays-request(a)lists.torproject.org wrote: > Not to drift too far off course, but I think you have your masking > back wards or confused at least. > > a /8 is 16M addresses 18.0.0.0/8 for example, so not a small block, > and a /16 has 64K. > > two consecutive /16's say 128.30.0.0/16 and 128.31.0.0/16 make a /15 > (120.30.0.0/15) > > the real concern is administrative control not addressing. for exmaple > both the /8 and /15 mentioned above and some other smaller patches of > addressing are all on MIT campus and part of the same administrative > domain in the sense that all traffic passes through a small set of > routers at some point. Being a university it doesn't imediately imply > root access to all servers. this isn't true of all (or even most) > /8's, nor does even a /24 with 256 addresses need to be in a single > geographic or andministrative zone. > > -Jon Thanks Jon, You're right, I had my ranges weird, even in my title, thanks for the correction. To clarify, because the nodes are physically close to one another, they are in the same /24, namely x.x.x.x - x.x.x.y. Yes, the real issues is the traffic concentration to a specific set of routers, which is why I'm asking. I'm trying to get a sense of where to draw the line, but from the responses so far it looks like I've got room to spare. - -- Jesse V. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQF8BAEBCQBmBQJT/lfPXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQxMjgyMjhENjEyODQ1OTU1NzBCMjgwRkFB RDk3MzY0RkMyMEJFQzgwAAoJEK2XNk/CC+yAYCwH/i6Ci/SS6dpXr703mlajr31C fXX2WOKVWoGGTkPDXkQJM18+uI0DGRaieahmQ99VAGwA8+PAFhq9QsISLZ/Bby9g rZCOkY9E9xel2uu80hiMlP99h4WkjJtbgeX1cGXXOoJq1d+MLHIzQqgzZvmVry2+ piIUsXRO693r+TiU6BzZjnpBm+Omo6BzvOuJmUq34/XztdrGWSfoCvpwlesbMJZc sNGN1N5wQ3U1FcQTkwJc2wVyTpQNyu+tgvZyqwusIwAlH7J9cN/zg+eNZ+3ZpPUv 7DjiKhwQCQUqv/LHC5sK7FmQNELLwXPGvTaflvjfhF9uSBWCAX9JVEBNsHrB1M0= =77pe -----END PGP SIGNATURE-----

1 0

Re: [tor-relays] Advantage in more exits in the same /8?
by Jesse Victors 27 Aug '14

27 Aug '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA384 > Message: 5 > Date: Tue, 26 Aug 2014 19:50:21 +0200 > From: Anders Andersson <pipatron(a)gmail.com> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Advantage in more exits in the same /8? > Message-ID: > <CAKkunMYKgXKT1OEbV5Lft9edqLhvAJsbxv7QkHQn6dCbpuj36Q(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > On Tue, Aug 26, 2014 at 3:47 PM, Jesse Victors > <jvictors(a)jessevictors.com> wrote: > >> I run some relays and an exit in a university setting. The nodes are in the same /8 block and are physically close to one another as well. Is there any advantage in turning one of the relays into another exit? This is something that my ISP would be agreeable to, but I'm also pondering the effects on the Tor network as a whole. > Just want to be clear here: Do you really mean /8 and not /24? There's > only one university I can find with a /8 block. Anders, no I literally mean the same /8. The university has its own /16 and recently required another /16, but since my nodes are physically close to one another they are in the same /8. My concern is that too many nodes in a small block can result in a large concentration of Tor circuits in that block. No circuit should use any two nodes from the same /16 unless forced to, so my question really revolved around how many is too many Tor circuits and how much is too much traffic through the same /8 or /16 in people's opinion. - -- Jesse V. On 08/27/2014 06:00 AM, tor-relays-request(a)lists.torproject.org wrote: > Message: 2 > Date: Tue, 26 Aug 2014 16:24:42 +0200 > From: Moritz Bartl <moritz(a)torservers.net> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Advantage in more exits in the same /8? > Message-ID: <53FC98AA.2000607(a)torservers.net> > Content-Type: text/plain; charset=ISO-8859-1 > > Hi Jesse, > > On 08/26/2014 03:47 PM, Jesse Victors wrote: >> > It seems to me that too many nodes under the same ISP is >> > problematic because it concentrates too much traffic in >> > the same AS, but on the other hand, Tor could use more exits. >> > More importantly, how many is too many nodes in the same /8, >> > or in the same /16? Where would you draw the line? > Very good question. Ideally, the Tor client would be AS-aware, and you > would not have to worry about it. For the interested reader, see for > example [1]. Until then, my thinking is that I compare to other > locations. https://compass.torproject.org/ is very helpful for that: For > example, if you group by AS, the largest AS right now (i3d, NL) in > regards to exit capacity has 11%, and OVH tops the overall network at > 10% consensus weight. > > As a rough rule, I'd avoid to push more than 1-2Gbit/s of traffic at one > ISP. On the plus side, as long as you don't top the list, you're > weighing down other locations. And universities are a preferred location. > > Make sure to use the MyFamily statement correctly: Unless relays are on > the same /16, Tor might pick multiple of them for a circuit. Also, if > you want to push more than ~100 Mbit/s on a single machine, you need > AES-NI or run multiple relays, for more than 400 Mbit/s you need to run > multiple relays in any case. The multi-relay initscript can be quite > helpful for that. > > [1] http://freehaven.net/anonbib/#ccs2013-usersrouted > [2] https://www.torservers.net/wiki/setup/server#multiple_tor_processes > > -- Moritz Bartl https://www.torservers.net/ Thanks Moritz, Ok, so I think 1-2 Gbit/s is a good number, that just seems like an awful lot of data to me and I'd rather see that spread out more diversely of course. I'm aware that no circuit should contain two nodes from the same /16 unless forced to, and the MyFamily value further helps with that. My concern was not with a single circuit using multiple nodes there, but rather many circuits preferring that AS. Diversity helps security. That being said, by your advice I'm nowhere near that threshold, so I could keep going. Thanks for the tips on the multiple Tor instances and the optimization tips. - -- Jesse V. /CS, Network Security / -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQF8BAEBCQBmBQJT/e7iXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQxMjgyMjhENjEyODQ1OTU1NzBCMjgwRkFB RDk3MzY0RkMyMEJFQzgwAAoJEK2XNk/CC+yAu0wIAK3rn17vEWQZTZy5KVBgOnUI TstJAkqO9Wjkfxf++E/5h8OMRdU1f3rV2mArJgGbgc344ttueM8iPntneaK4jI9W 4FrEqiMf7X6boYZXyeG81gYaGT6nf8ePSK5+1xY3pGR+2R3gXbDt/AU/LIZFsL2w r+9znukltzWBudfM76Fzd7jJcrwC+2giguHKU1/oxpKDh1xWuQC4maOYxZexGSLw JFz/O9Ca/CIDH/5Pbm6uJFe3Ec1zzm6z8cgsfBmGY8GHj3xBM8bNttP+a+fW7J5Z W01uoYss6tuw3jhVAp/+LKm4GcXsdtUjJIAX56yvEURCa6L9CbuTYha4cBI4zFw= =OHSc -----END PGP SIGNATURE-----

2 1

Ongoing scan from FDCServers block
by linenoiz＠Safe-mail.net 27 Aug '14

27 Aug '14

For the past week or so I've been seeing unsolicited echo replies coming from FDC servers block and one that looks like it is owned by China(?) Most of the entries are from 67.159.54.101 and I am seeing around one per minute. I verified by running tcpdump for a couple minutes (no longer, I'm not an illegal wiretapper!) that I'm not sending echo requests. IPTables is configured to drop and log this invalid traffic. Any idea what they are trying to accomplish? Some convoluted way of pinging me because they don't get an ICMP unreachable back? And why every minute? DENY IN=eth0 OUT= MAC=xxx SRC=67.159.54.101 DST=yyy LEN=40 TOS=0x08 PREC=0x20 TTL=55 ID=61817 PROTO=ICMP TYPE=0 CODE=0 ID=10249 SEQ=0 DENY IN=eth0 OUT= MAC=xxx SRC=67.159.54.101 DST=yyy LEN=40 TOS=0x08 PREC=0x20 TTL=55 ID=61817 PROTO=ICMP TYPE=0 CODE=0 ID=58375 SEQ=0 DENY IN=eth0 OUT= MAC=xxx SRC=67.159.54.102 DST=yyy LEN=40 TOS=0x08 PREC=0x20 TTL=55 ID=39417 PROTO=ICMP TYPE=0 CODE=0 ID=62498 SEQ=0 DENY IN=eth0 OUT= MAC=xxx SRC=50.117.112.42 DST=yyy LEN=40 TOS=0x00 PREC=0x00 TTL=56 ID=28340 PROTO=ICMP TYPE=0 CODE=0 ID=30728 SEQ=0 DENY IN=eth0 OUT= MAC=xxx SRC=50.117.112.42 DST=yyy LEN=40 TOS=0x00 PREC=0x00 TTL=56 ID=28334 PROTO=ICMP TYPE=0 CODE=0 ID=30728 SEQ=0 DENY IN=eth0 OUT= MAC=xxx SRC=50.117.112.42 DST=yyy LEN=40 TOS=0x00 PREC=0x00 TTL=56 ID=28335 PROTO=ICMP TYPE=0 CODE=0 ID=54277 SEQ=0

2 1

managing bandwidth quotum
by Kees Goossens 26 Aug '14

26 Aug '14

Dear all, A question on how to manage a bandwidth quotum of my internet provider. I run a non-exit relay on a hosted server with 1000 GB bandwidth per month. In essence, should I A- only set the AccountingMax, and let the relay figure out the RelayBandwidthRate & RelayBandwidthBurst by itself B- set the AccountingMax, and set RelayBandwidthBurst to whatever the provider will allow (much higher than the average rate) C- set the AccountingMax, and set RelayBandwidthRate to the average rate (quotum/31 days), and optionally set RelayBandwidthBurst D- only set the RelayBandwidthRate to the average rate, and hope that I don’t go too much over my quotum This could perhaps be rephrased as: - is it better to offer a high bandwidth for part of the month and then hibernate, or - should I offer a lower average bandwidth for the whole month? Details: I’ve set “AccountingMax 450 GB” with the appropriate accounting start (conservative, since I log in occasionally too). 450 GB / 31 days => 168 KB / sec average Setting “BandwidthRate 168 KB” seems to severely underutilise the relay. Setting “BandwidthRate 1000 KB”, to force usage of the relay, uses the relay bandwidth at a much larger rate (2670 KB/s consensus weight), and will cause hibernation after ~25 days. Thanks. Kees

3 2

Advantage in more exits in the same /8?
by Jesse Victors 26 Aug '14

26 Aug '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA384 Hey everyone, I run some relays and an exit in a university setting. The nodes are in the same /8 block and are physically close to one another as well. Is there any advantage in turning one of the relays into another exit? This is something that my ISP would be agreeable to, but I'm also pondering the effects on the Tor network as a whole. It seems to me that too many nodes under the same ISP is problematic because it concentrates too much traffic in the same AS, but on the other hand, Tor could use more exits. More importantly, how many is too many nodes in the same /8, or in the same /16? Where would you draw the line? - -- Jesse V. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQF8BAEBCQBmBQJT/JACXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQxMjgyMjhENjEyODQ1OTU1NzBCMjgwRkFB RDk3MzY0RkMyMEJFQzgwAAoJEK2XNk/CC+yAc30H/itZHxdCndyXrynjhCI9N3Y/ jtdQ4V2UVWGe0YdsHBrSibexvZxj9EGtNHAuBNuf9ZPrTV5BXV4/Q0RXRZSp+AZ7 NVCp0/7wv/R/n+1qJqWfD2F0D27pyQoaHTMHSJKWXeVN71F5uM4+ScG5qyGsgsG7 Op9s3K5tYTr4m2WcPoAQke4Gj7Bn4nBIbJP8djPZeQ5ACKIDfBJjlgy6Q7fJE+E7 62GYvRknYVHjWAM6gsYSuHnoBCGPAcYkSWMOyPBf+rt8+J0HCMBja/yvzBMwMiNu jEGK/pFka6j+CKYZuEXIbfBV4MLnbZqaah5e58640rUvwqz5eFvf2pliONpVGY4= =aTsa -----END PGP SIGNATURE-----

3 2

how long till the axe falls on little guard relays?
by starlight.2014q3＠binnacle.cx 25 Aug '14

25 Aug '14

The guard status of the relay here is hanging on by a thread (consensus 5-in-favor 4-against) and this had me wondering until I read [tor-relays] don't worry (to much) if your relay is loosing the guard flag https://lists.torproject.org/pipermail/tor-relays/2014-July/005043.html Looking at the Consensus Health page it's clear that about 1000 other relays are also separated from Guard Oblivion by a single vote. I'm curious if anyone knows roughly when the next authority will upgrade to a version with the new criteria and the little guards get the chop.

5 5

Relay "kingqueen" lost Named attribute
by kingqueen 22 Aug '14

22 Aug '14

hi, Does anybody know why my relay "kingqueen" has lost its Named attribute? https://atlas.torproject.org/#details/7B48192A59A903F914ECF73ADBC3711F3E8EA… Thank you KQ

3 3

Re: [tor-relays] OnionTip.com distributes Bitcoin donations to all BTC addresses set in ContactInfo
by Tim 21 Aug '14

21 Aug '14

On 14 Aug 2014, at 22:00, Alexander wrote: >> On 2014-08-14 10:25, Mike Cardwell wrote: >> >> On the other hand. It costs you nothing to stick a bitcoin >> address in a config file to find out. > > Not being a lawyer, does accepting money for running a Tor relay make it > a commercial operation (in some countries) and put you in a different > legal position? > > Best regards, > Alexander Also not being a lawyer, if BTC isn't legal tender in your country (if such a concept exists), are you really accepting "money"? Tim

3 3

reaching out to relay ops that run outdated versions
by Nusenu 19 Aug '14

19 Aug '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 FYI: I just sent out the email bellow to ~160 relay operators - I hope this results in some actual improvements. It is a bit disappointing to see even torservers.net, DFRI, icetor, Frenn vun der Enn, Calyx, Cymru in the recipients list. The recipient list is based on the following output (limited to relays faster than 999KB/s): grep -v 0.2.5.6 Tor_query_EXPORT.csv |grep -v 0.2.4.23|grep -v 0.2.6.0|head -n 344 (csv is from torstatus.blutmagie.de) > Hello, > > you are receiving this email because you are using an outdated tor > version on your tor relay. (your email address was taken from your > relay's contact info field) > > Tor v0.2.4.23 has been released on 2014-07-28 [1] to address a > security issue that makes de-anonymization attacks easier [2] - > please update to Tor v0.2.4.23 or v0.2.5.6. > > To find out your current version run the following command on your > relay: tor --version > > If you are using Linux: Package managers can be used to > automatically update Tor without requiring manual admin > intervention. > > > It is recommended to use the official APT/YUM repos from > torproject.org to get timely updates: APT: > https://www.torproject.org/docs/debian.html.en YUM: > https://www.torproject.org/docs/rpms.html.en > > > thanks for running a relay and making the tor network safer! > > > [1] > https://lists.torproject.org/pipermail/tor-announce/2014-July/000093.html > > [2] > https://lists.torproject.org/pipermail/tor-announce/2014-July/000094.html > -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJT8IfkAAoJEDcK3SCCSvoecIMP/0NX+C4+h55BXaQt2RSwA472 PyEIjSRUwrlnc0navJ1pSHOusCWnrCiMFXQaQqcdCliODzEytPoaLynItiwAtKzp UhDja4Sp/Lag9m9CiNJ/0C9k9OeHQbKcEffLAnTVUOZmcBFwo2CsROruGgveOic6 gE13Yi9LuoHdtMfDDRgLoQyL5hqa1kogpj9maMjXZwEwXhZvNpd7GEUd79WjtVm+ eFoYTW4mgPXcU0fZOtuZxAAkrd/blEzr67o4aKiMeaNDo6zmXIBe1URsPkRf50dO kQ0m4/GSicdVyOnsId+f6RcpAD/LD7QiqIyxv/XZ9uEDqtI2RvxBxNeU9kXU8KK+ y4fsXKZ4pvXgj5Nqv7niNJlftegr1rrdRB7wAtZ/2ETpEL3dqC+aBo0bL+ctk1zZ RlXZkPTOTmGEh5pDxXr8P1rxukgivOsPw3tWmeCjb2+HeiRi117LNeccvwW3SZYE pDLVSJIhxpkFKxtJ8N4vTyqoQzX/N+g1gkOZ/yuF4aCIpfLFTxjUUkMt8wyEI+v2 HMiAXyeHBFh541b9ScTrLao21sxPDsQHq1mNf3RHRKESgiejWLZz74wojUU/drIP coZVoJ7U3aFqb6xgIlJzv8u+IcPld6Xsy3U8MUtD+4q2v7t9y6u6QBrj454YCQrQ Ms0g2ocOvRCTKWUgtbdx =BK/o -----END PGP SIGNATURE-----

9 17

Protecting your domain's reputation
by JusticeRage 19 Aug '14

19 Aug '14

Hello everyone! I am the operator of a somewhat recent exit node with SMTP allowed, and I have found out something worth sharing. Let me know if this is already known. As suggested by the Tor documentation, I set a reverse DNS which makes clear that my exit node belongs to the Tor network (tor-exit-readme.manalyzer.org) This week-end, I started to recieve weird e-mail delivery failure notifications, and even a line from a guy kindly asking me to stop sending him mail. The thing is, I was actually lucky to recieve all those, and I wouldn't have if I didn't have a catch-all address set for the whole domain. Looking at the source of the rejected e-mails, I found out that someone was forging e-mails which look like they come from my domain: Received: from tor-exit-readme.manalyzer.org (tor-exit-readme.manalyzer.org [95.130.11.147]) by smtp.craigslist.org (Haraka/2.5.0) with ESMTP id 66DDCADC-FEA4-4D62-8F08-2630AC1E0299.1 envelope-from <best_pharmacy5(a)manalyzer.org>; Mon, 18 Aug 2014 13:25:12 -0700 From: Levitra-Shop <best_pharmacy5(a)manalyzer.org> To: <rkdq8-4339052657(a)hous.craigslist.org> Subject: When It Comes Healthcare, Nothing Beats a Hometown Advantage, Rkdq8-4339052657 . (I got tons of these, all procedurally generated e-mail addresses.) The thing is, these e-mails don't just seem like they're coming from my domain: they ARE coming from my domain, since the machine sending them has a rDNS which belongs to it. From a mail server's perspective, they're actually very legitimate and probably won't be flagged as spam. I believe that someone is listing all the exit nodes which have a reverse DNS set up, and uses the domain to send out unwanted e-mail. This is a problem for operators for the following reasons: - The reputation of your domain is damaged, and legitimate e-mails sent from it may end up discarded - It strenghtens the idea that mail servers blindly reject everything that comes out of a Tor exit node The good news is, there is something you can do about it. This is exactly what Sender Policy Framework [1] was created for. Long story short, this is some information you can put in your DNS to indicate which machines are allowed to send e-mails for the domains, and which are not (hint: the exit node should not be listed in there). Here is a sample policy which says that only servers registered as MX in your DNS should send e-mails for the domain : tor-exit.domain.com. IN TXT "v=spf1 mx -all" If you need something more specific, I have found a nice wizard [2] which will help greatly. If you run an exit node and have a reverse DNS set up, I highly recommend you take ten minutes to look into this. Please note that this will NOT prevent Tor users from sending e-mail or restrain their freedom in any way; it will only prevent ill-intentioned people from spoofing your domain. I also think that there should be a note in the Tor documentation about this issue (I couldn't find anything regarding this). I hope this helps! [1] https://en.wikipedia.org/wiki/Sender_Policy_Framework [2] http://www.spfwizard.net/ -- JusticeRage

3 3

Web status page
by IceFish ThreeTwo 19 Aug '14

19 Aug '14

Is there a -- Sent from my iPhone

2 2

Include Tor Weather Link
by Spencer Rhodes 18 Aug '14

18 Aug '14

If another email goes out to operators of outdated Tor relays, I would suggest including some information and a link to the Tor Weather service, which has an option to notify via email if the software version is outdated. -- Sent from my phone.

2 1

Dynamic IP
by Tim 18 Aug '14

18 Aug '14

Tim Wilson-Brown E: twilsonb(a)mac.com > Date: Mon, 18 Aug 2014 05:04:31 +0200 > From: Sebastian Hahn <mail(a)sebastianhahn.net> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Dynamic IP > Message-ID: <CD0E96E4-2BFA-4FAA-BC19-C3320AC46F08(a)sebastianhahn.net> > Content-Type: text/plain; charset=us-ascii > > Hi Tim, > >> Sebastien, I run a relay on a machine that has an internal private IP, behind a NAT router with a public IP. >> >> In my experience, I need to specify the NAT router's public IP in the torrc, otherwise tor doesn't include it in the router descriptor it submits to the consensus. > > This shouldn't happen typically, Tor tries to learn its IP address by > looking at the traffic it receives. > >> If that process isn't working for me, is this a bug I should report? > > Likely. Can you try again, noting the kind of log messages Tor might > emit? > I apologise, Sebastien, it appears I was not waiting long enough for the router to connect to a directory, then use the headers to find its IP. I had always assumed that the first series of failures to find an IP (before any directories were contacted) was permanent. This is the debug log output from a secondary test router that I configured on the same IP: Aug 18 17:47:20.558 [info] {CONFIG} int resolve_my_address(int, const or_options_t *, uint32_t *, const char **, char **)(): Guessed local hostname 'REDACTED.local' resolves to a private IP address (192.168.REDACTED.REDACTED). Trying something else. Aug 18 17:47:20.558 [info] {CONFIG} int resolve_my_address(int, const or_options_t *, uint32_t *, const char **, char **)(): Interface IP address '192.168.REDACTED.REDACTED' is a private address too. Ignoring. Aug 18 17:47:20.558 [info] {CONFIG} int resolve_my_address(int, const or_options_t *, uint32_t *, const char **, char **)(): Address 'REDACTED.local' resolves to private IP address '192.168.REDACTED.REDACTED'. Tor servers that use the default DirAuthorities must have public IP addresses. Aug 18 17:47:20.558 [info] {CONFIG} int router_pick_published_address(const or_options_t *, uint32_t *)(): Could not determine our address locally. Checking if directory headers provide any hints. Aug 18 17:47:20.558 [info] {CONFIG} int router_pick_published_address(const or_options_t *, uint32_t *)(): Success: chose address '121.REDACTED.REDACTED.REDACTED'. Once the test router appears in the consensus, I'll make similar changes to the primary router (and it will pick them up on the next restart!) Tim

1 0

Close friend
by IceFish ThreeTwo 18 Aug '14

18 Aug '14

Hello. I'm not going to use the term "Framily", Sprint can...nsfw. Anyways, my close friend just set up a Tor node. I'm pretty sure I read somewhere that the Family option in torrc is used so that nodes administrated by the same person never make a circuit with each other, which somehow protects anonymity. Should my friend and I put each other's fingerprints in the Family field? Seems logical since we know each other and if the point of theFamily field is to protect anonymity. Thanks! Ice Fish -- Sent from my iPhone

4 4

Dynamic IP
by Tim 18 Aug '14

18 Aug '14

> On Sun, 17 Aug 2014 00:42:13 +0200, Sebastian Hahn <mail(a)sebastianhahn.net> wrote: > > Date: Sun, 17 Aug 2014 00:42:13 +0200 > From: Sebastian Hahn <mail(a)sebastianhahn.net> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Dynamic IP > Message-ID: <90ABDCE9-CC09-4892-9935-F7B7C78832E9(a)sebastianhahn.net> > Content-Type: text/plain; charset=us-ascii > > Hi Tim, > >> On 16 Aug 2014, at 23:53, Tim <t_ebay(a)icloud.com> wrote: >> I'm running a relay on a similarly "dynamic" IP. >> If the line goes down, I'm reallocated a new one. But otherwise the IP is stable. >> If I don't notice the change, I notice the traffic drop, then I update the torrc, and everything works again. > > I think you're a little confused. It's not necessary to specify your own > IP address in Tor's configuration file. The various "address" options are > purely optional. Or I am confused, and you mean something completely > different? > Sebastien, I run a relay on a machine that has an internal private IP, behind a NAT router with a public IP. In my experience, I need to specify the NAT router's public IP in the torrc, otherwise tor doesn't include it in the router descriptor it submits to the consensus. How does tor autodetect its public IP, when it is running on a separate machine with a private network IP, behind a NAT router with a public IP? If that process isn't working for me, is this a bug I should report? If tor doesn't currently autodetect public IPs on middleboxes (as opposed to the tor relay machine itself), is this a feature that could be implemented? Or do we wish to discourage this use case? (It would involve trusting an external server to report tor's public IP correctly - and making other assumptions like the middlebox having a single public IP.) Tim

2 1

Number of relays by version
by Jesse Victors 17 Aug '14

17 Aug '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA384 Hey guys, Today on Reddit I saw a post on /r/Tor that listed the number of relays by version, which was pretty cool. While OP apparently loaded the information into SQLite and selected the count, there's another way to do it: sudo cat /var/lib/tor/cached-microdesc-consensus | grep '^v ' | awk '{print $3}' | sort | uniq -c Which currently gives: 2 0.2.3.20-rc 5 0.2.3.22-rc 3 0.2.3.24-rc 579 0.2.3.25 1 0.2.4.10-alpha 2 0.2.4.11-alpha 5 0.2.4.15-rc 15 0.2.4.16-rc 23 0.2.4.17-rc 4 0.2.4.18-rc 12 0.2.4.19 271 0.2.4.20 351 0.2.4.21 998 0.2.4.22 3 0.2.4.22-dev 3209 0.2.4.23 7 0.2.4.23-dev 3 0.2.5.1-alpha-dev 9 0.2.5.2-alpha 22 0.2.5.3-alpha 5 0.2.5.3-alpha-dev 28 0.2.5.4-alpha 4 0.2.5.4-alpha-dev 47 0.2.5.5-alpha 232 0.2.5.6-alpha 29 0.2.6.0-alpha-dev I find the distribution interesting. 0.2.3 is dwindling, but for those 589 that remain, please be aware 0.2.4 is available, so be sure to update or change to the official Tor repos. Looks like 0.2.6.0 is the tip of the spear now. - -- Jesse V. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQF8BAEBCQBmBQJT8FBhXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQxMjgyMjhENjEyODQ1OTU1NzBCMjgwRkFB RDk3MzY0RkMyMEJFQzgwAAoJEK2XNk/CC+yAFCMIAMBzJko9CDSqfEyiPFZzNVy8 ZNlr4ZBekm9aLG2cJEVD2zN2wLc0mWb/ETFrbVNbauWIEvuNjchE0xZRXMUJBrFT L9ErUmNeGWEr77XXYAawoOI4PDPXOF4SIMQUdAel8OVCZ5g0UYARDlfIBgwVeq+o LnvSrDdv/hcwIxsrLxX+J/XqwXOIDnxhjMu6MnHG7YDXGameACbMl4OfOCgXVNT9 VV9YLATJq1nHr5F5I8xmDU5RVUsVRccn8POBHgTfZwDtwMy3N6U/wQqFY0XzslLH wY2veoPcuIoL8x1Sz81vK9Buc9oD/F06HzrZRW2WHg2Tw8yJYFizVyWpOlQ/xKs= =NIsd -----END PGP SIGNATURE-----

2 1

Re: [tor-relays] Dynamic IP
by Tim 16 Aug '14

16 Aug '14

I'm running a relay on a similarly "dynamic" IP. If the line goes down, I'm reallocated a new one. But otherwise the IP is stable. If I don't notice the change, I notice the traffic drop, then I update the torrc, and everything works again. Wouldn't it be great if there was an option for tor to do this automatically? But this would involve trusting google or similar to correctly report the external IP (and not get MITMed). I tried running a bridge, but it made almost no use of the available bandwidth. But if the IP were more dynamic, a bridge would be an excellent choice, as long as I could keep the config synced with the external IP. This would be the core use case for a tor "use dynamic external IP" option. (And the current "guess my IP" option doesn't work for me, as it's the internet-visible external IP I need, not the relay's internal network IP.) > On 17 Aug 2014, at 6:45, IceFish ThreeTwo <threehundredthirtytwofishes(a)gmail.com> wrote: > > Date: Sat, 16 Aug 2014 13:09:08 -0700 > From: IceFish ThreeTwo <threehundredthirtytwofishes(a)gmail.com> > To: "tor-relays(a)lists.torproject.org" > <tor-relays(a)lists.torproject.org> > Subject: Re: [tor-relays] Dynamic IP > > Alright thanks. Yeah it's a "dynamic" IP. I bet they just say that in case > they have to change it for some reason. > >> On Saturday, August 16, 2014, justaguy <justaguy(a)riseup.net> wrote: >> >> That's not a big deal, if it's once every 8 months. >> But every day, that would be a problem. >> If you keep running your relay for 8 months, and then an ip change, i >> think it will be back at normal speeds in like 5 minutes >> On 08/16/2014 10:04 PM, IceFish ThreeTwo wrote: >> >> Unfortunately my ISP only provides static IPs for their business accounts, >> which, even if in my price range, I can't get at my home because of zoning. >> My IP hasn't changed once since I got the service and I think I've kinda >> locked it in with my router. But if it does switch say once every 8 months, >> how big of a deal is that? >> >> On Saturday, August 16, 2014, justaguy <justaguy(a)riseup.net >> <javascript:_e(%7B%7D,'cvml','justaguy(a)riseup.net');>> wrote: >> >>> Yes, other relays don't like your relay changing ip's all the time. >>> You should try to get a static ip somehow, ask your isp :) >>> On 08/16/2014 10:00 PM, IceFish ThreeTwo wrote: >>> >>> I have a dynamic IP from my ISP. Is that going to cause issues with my >>> relay? >>> >>> -- >>> Sent from my iPhone >>> >>> >>> _______________________________________________ >>> tor-relays mailing listtor-relays@lists.torproject.orghttps://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >> >> -- >> Sent from my iPhone >> >> >> _______________________________________________ >> tor-relays mailing listtor-relays(a)lists.torproject.org <javascript:_e(%7B%7D,'cvml','tor-relays(a)lists.torproject.org');>https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > -- > Sent from my iPhone >

2 1

Getting things right
by Graeme Briggs-White 16 Aug '14

16 Aug '14

I have a rooted Samsung S3 with CM 11 4.4.4 nightly build and would like to know exactly how to get the best for everyone involved on the network. My problem seems to be ram capacity and have tried every which way to improve that. Nothing seems to work as it has under 1 Gig of ram. How do I configure this for the best and not piss other users off. My binary skills are none too great but I'm willing to learn and am open to harsh comments to get me on my way. I'm quite a newbee at this and open to criticism.....

3 13