- tor-relays - lists.torproject.org

Re: [tor-relays] [tor-relay] Spam
by tor＠t-3.net 26 Jun '14

26 Jun '14

The spam to my own Tor relay operator email address (same one as in this list) isn't meaningful in volume. I haven't seen any amounts that a delete key couldn't easily handle. In my experience, you should be careful with spam filtering, as you could end up dumping abuse complaints that you wanted to see and maybe respond to, or have legitimate relay list email not come through. I ended up having to whitelist some stuff for this list to work right because of automatic spam behavior of this mail service. It's not like the sight of spam email in your tor relay box is toxic to your workstation. It's usually obvious from the subject what it is, and that it can be safely and immediately deleted.

2 1

Need help to get TorDNSEL compiled
by BlueStar88 26 Jun '14

26 Jun '14

Hi there, today I've read about the outage at "check.torproject.org". Since my torcheck-service "torcheck.xenobite.eu" needs the underlying TorDNSEL feature I'm trying to get this to work on my host. Like this I won't need to query the TorDNSEL-part of "check.torproject.org" anymore. I'm not into programming and do not know anything about haskell, c++ and such. So be patient with me on such matters. ;-) I've DL'ed the code from the internet website mirror [2]. I've prepp'ed all the dependencies using lucid binary packages: ghc6 6.12.1-12 libghc6-mtl-dev 1.1.0.2-10 libghc6-network-dev 2.2.1.7-1 libghc6-time-dev 1.1.2.4-2 libghc6-hunit-dev 1.2.2.1-2 libssl-dev 0.9.8k-7ubuntu8.15 libghc6-stm-prof 2.1.1.2-5 libghc6-binary-prof 0.5.0.2-1 First error I got on compile attempt was: src/TorDNSEL/Main.hs:81:21: parse error on input `#' That was quite easy thought: import GHC.Prim (Addr#) I deleted the '#' hopefully making it correct this way. Next error is some numbers too high for me now: src/TorDNSEL/DeepSeq.hs:20:7: Could not find module `Data.ByteString': It is a member of the hidden package `bytestring-0.9.1.5'. Perhaps you need to add `bytestring' to the build-depends in your .cabal file. Use -v to see a list of the files searched for. The libghc6-bytestring-dev-0.9.1.5-125af ist installed by it's main package ghc6 6.12.1-12. Any ideas? Or are there some binary packages for TorDNSEL around, to make this more easy for me? :-P Thanks, BlueStar88 [1] https://blog.torproject.org/blog/tor-check-outage-03-and-04-july-2013 [2] https://www.torproject.org/tordnsel/dist/tordnsel-0.0.6.tar.gz

3 7

My exit's traffic isn't rising, is this normal?
by Jesse Victors 24 Jun '14

24 Jun '14

Hello everyone, I run https://globe.torproject.org/#/relay/1946F5E4748B069D3B989B5AF50C7DDD3AC618… and from the graphs it's clear that the traffic has roughly leveled off, rather than continue to climb. I generated a new key after Heartbleed, so it's been up for nearly three months. The bandwidth cap is set at about 100 MB/sec, (gigabit connection) which it's not even close to reaching. There's plenty of CPU available, and by all rights its got enough resources. At this rate, I've no idea how it is supposed to grow and help Tor more. For comparison, when I look at https://globe.torproject.org/#/relay/D3BDECB920E0B7543AD2BA7BF573F7B0F37F7B…, one of the Top 10 relays, I see the traffic growing much at a much higher rate, and https://globe.torproject.org/#/relay/F3B57BB429B4CA82A844B713E42666DF4BF7B8… is another example. What are they doing that I'm not? Another of my exits, https://globe.torproject.org/#/relay/2FC06226AE152FBAB7620BB107CDEF0E70876A…, is on a downward trend, yet has the same configuration as my first one. What can I do to reverse it? Thanks, Jesse V. 0xC20BEC80

1 0

KVM based virtual machine showing 4 MB/s in atlas, others showing 8-9MB/s ?
by s7r＠sky-ip.org 23 Jun '14

23 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, The same virtualization technique at different providers gives me different advertised bandwidth for relays in atlas: one provider 8-9MB/s other 3-4 MB/s The relays are all exit, having the same RAM and CPU configuration, as well as 100mbit port and unmetered traffic, they use the same Tor version, none of them are capped in any way via torrc or other means, same operating system and same virtualization technique. Why could be this difference in advertised bandwidth? Suggestions? - -- s7r PGP Fingerprint: 7C36 9232 5ABD FB0B 3021 03F1 837F A52C 8126 5B11 PGP Pubkey: http://www.sky-ip.org/s7r@sky-ip.org.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.17 (MingW32) iQEcBAEBAgAGBQJTqIMAAAoJEIN/pSyBJlsRTg0IAKGweB8grMmx18rB33/xBrBC 6UAbpnUxj3tDlD+7J9SwK1jkPSvxpKEkKuwblFifJ2J1o4xoUKCvQQWLVfwP4qRI 0R6cn/Zx9pShzZ6MRRIOmuxaZjiavddqeM0/qcnwhsvGVH/6sTw80000VrLV2TMH vExzu7ofEjV1205CZ1CBAj0sOW2s+3nld7iulvttWbBoeHs2+CbRpEfQu1QPoZYu NtJ6f0vBBkenCWD/yv9Xaiwo/Ywej6jH97LIdksr9msRcDmJnbmY3VSmrlnm8n7z YFJSCFlOi3LJIB0y8QmZuowHAQcGe0Q1LmGCWU4uGgB4OHU7QRgC/jM7qffp+eQ= =+FWS -----END PGP SIGNATURE-----

1 0

Shutting down middle relays (off-topic)
by Tora Tora Tora 23 Jun '14

23 Jun '14

Regretfully, I have to shutdown my two middle relays (not too big, you won't even notice it :-D), since I am unable to resolve issues with the latest OpenSSL bug. I was able to find upgraded packages for Centos and Fedora that are supposed to address CVE-2014-0224 vulnerability (the change log claims so). However, the Tripwire )SSL_CCS_InjectTest and Qualys onlien tests both disagree. If someone can suggest a resolution that works, I might be able to keep them running, otherwise I see no point in running vulnerable relays until I figure things out. Thanks ...

7 15

CLI tool like Atlast
by Kali Tor 23 Jun '14

23 Jun '14

Hi all, Is there a CLI client/tool that does what https://atlas.torproject.org/ does? Basically provide an output based on a node's fingerprint? e.g. https://atlas.torproject.org/#details/7EDE11A41D1C7DF4F9103ABAA4F0A31E42CB0… Thanks, KaliTor

5 14

Lost hsdir flag
by kingqueen 21 Jun '14

21 Jun '14

hello, I don't know why, my relay nicknamed kingqueenbtnftw used to have the hsdir flag but now doesn't. I think from what I can gather, hsdir is based purely on the time since last boot / restart Tor service, rather than how long the relay has been up in total? That would explain it. Thanks kingqueen --- This email is free from viruses and malware because avast! Antivirus protection is active. http://www.avast.com

2 2

Traffic limitation
by johhher 20 Jun '14

20 Jun '14

Hi, I'm running a Tor relay on a cheap Linux vserver with high bandwidth. I have a traffic limitation of 500Gb per month and was just wondering what would be the best configuration for the network. Currently I've limited the traffic to a daily maximum to prevent it from hibernating a long time at the end of the month. Is this the right way to do it? Or would be better to limit it on a monthly basis. Thanks for an answer! Johhher

6 5

Yahoo and AOL emails removed from tor-relays due to bounces
by Andrew Lewman 20 Jun '14

20 Jun '14

It seems Yahoo and AOL email servers have decided to refuse all messages from this tor-relays list. Other lists aren't affected, yet. We're seeing this message from Yahoo and AOL servers: "Status: 5.2.1 Remote-MTA: dns; mailin-04.mx.aol.com Diagnostic-Code: smtp; 521 5.2.1 : (DMARC) This message failed DMARC Evaluation and is being refused due to provided DMARC Policy" There is no fix for this yet as it breaks mailing list software globally. This bug explains the situation, https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=752084 If you use yahoo or aol for email, unfortunately you can't join nor receive email from our lists. I suspect this will become true for all of our email lists soon. -- Andrew pgp 0x6B4D6475 https://www.torproject.org/ +1-781-948-1982

3 2

CentOS of the air
by I 19 Jun '14

19 Jun '14

"At about 02:00 UTC June 18th 2014, changes at the domain registrar caused the CentOS.org domain to get marked as Inactive. This caused widespread outages, with all services in centos.org including: - - Mirror Network ( internal centos.org as well as external ) - - All mirrorlist - - All isolist - - Website ( including bugs.centos.org and wiki.centos.org - - All internal support infrastructure Services were restored at the registrar just before 9:00 AM UTC June 18th, however depending on dns path some users might still see issues for upto 6 to 8 hrs from that point.

1 0

tor-arm question
by Adam Griffin 19 Jun '14

19 Jun '14

Hi, Just started a new tor relay on my raspberry pi yesterday and I'm monitoring with tor-arm over ssh. I'm currently listed on atlas.torproject.org with flags 'Fast', 'Running', 'V2Dir', and 'Valid' with > 17hrs uptime. However, tor-arm is showing a blank for uptime and about once a minute, the CLI goes blank and then flickers back. (the flickering happens at the same rate for local and remote SSH) Also, about once every couple hours I get a 'Relay unresponsive' and then 10 seconds later 'Relay resumed'. Anything to do to remedy these issues?

3 5

Help keeping Tor relay up
by Evelyne Fong 19 Jun '14

19 Jun '14

I've managed to get my relay running long enough to run the bandwidth check and have it succeed. I'll check Atlus and it'll say my relay's up and running. However when I check again about an hour later, it's saying that "Running: false". I've set up the relay recently, so I'm not expecting a lot of traffic. However, I'm confused as to if my relay is suddenly failing for no reason or is Atlus saying my relay is no longer running because there's no traffic on it. Any help would be appreciated. Thanks.

3 3

Debian relay Puppet module
by Alexander Fortin 19 Jun '14

19 Jun '14

Hi folks, I’ve recently joined the Tor Project and I have been running a non exit relay for a few days. I’m also a Puppet user and, more in general, I try to make deploying applications on the servers I administer as easy as possibile, Tor included. I think Tor documentation to install on a Debian server is quite good, but I still prefer to have Puppet doing that for me, and I’m quite sure every Puppet user out there would think the same. This is the work-in-progress version of the module I’m currently using to manage my relay: https://github.com/shaftoe/puppet-tor/tree/fixes I’m open to any feedback on how to improve it and eventually publish it to the Puppet forge (make it easier for other Puppet users to use it); maybe adding some decent disclaimer on top of the README? I can also drop the whole idea if someone convince me is a bad one... -- Alexander Fortin http://about.me/alexanderfortin

9 22

Tor-relay - IP
by Rui Branco 18 Jun '14

18 Jun '14

hello, I'm a new user of the Tor-relay and I have many doubts. Sorry about that. In the atlas project why the tor-relays ip are discovered? isn't it dangerous? -- Best Regards, Rui Branco

4 3

normal for a new relay node to be under-utilized?
by Kali Tor 18 Jun '14

18 Jun '14

Is it normal for a new relay node to carry almost no traffic even after 24 hrs? From Atlast Uptime: 1 day 8 hours 30 minutes and 28 seconds Advertised Bandwidth: 59.71 KB/s From arm Bandwidth (limit: 16 Mb/s, burst: 32 Mb/s, measured: 160.0 b/s) Upload (0.0 b/sec - avg: 738.8 b/sec, total: 10.8 MB) Download (0.0 b/sec - avg: 3.6 Kb/sec, total: 52.2 MB) torrcRelayBandwidthRate 2048 KB RelayBandwidthBurst 4096 KB AccountingMax 100 GB AccountingStart month 1 03:00 DirPort 9030

3 2

Advertised Bandwidth increasing
by kingqueen 18 Jun '14

18 Jun '14

Hi I'm running the new, imaginatively-nicknamed kingqueenbtnftw relay. I have read around a lot but something I don't get. I thought advertised bandwidth was what I'd put in torrc whereas consensus weight was what some uber-machines tested my relay at, with the idea that this can foil disruption attacks by false relays pretending to give high bandwidth. SO I expected consensus weight to gradually increase. What I didn't expect was for the advertised bandwidth to increase by step changes (as shown on atlas and globe). Evidently I've got something wrong. Could somebody please enlighten this poor nub? By the way, I appreciate that consensus weight is a dimensions number but I understand that it originated as being based on kibibytes per second? If this is still the case, it's currently significantly more than my advertised bandwidth (which is less than that set in TORRC) but appears below it in the graphs? Thanks to anyone who educates me. I have full intent on both the T-shirts on offer - the standard Tor one for uptime and bandwidth, and the EFF one for still being online in a year with over 1MBps transfer :-) Hi to all who know me Kingqueen

2 2

Operating system diversity?
by Jonathan D. Proulx 18 Jun '14

18 Jun '14

Hi All, In the recent thread relating to Debian relay Puppet modules it was suggested that a greater diversity of operating systems in tor nodes wooudl be preferable. I'm not sure if this was meant as a technical or aesthetic preference, but I am curious. Is there any technical benefit to rounning a more diverse set of opensource oprating systems for tor nodes? I discount closed source as we don't know what's going on in there. Would that present significantly different attack surfaces? I can imagine a vulnerability in the TCP stack or other kernel functionality in Linux would not be the saem in FreeBSD or vice versa... My nodes are currently Ubuntu but if there's a reason to do so I coould possibly switch OS to FreeBSD (or hurd does tor run on hurd :)) -Jon

4 3

Advertised Bandwidth increasing
by kingqueen 17 Jun '14

17 Jun '14

Hi I'm running the new, imaginatively-nicknamed kingqueenbtnftw relay. I have read around a lot but something I don't get. I thought advertised bandwidth was what I'd put in torrc whereas consensus weight was what some uber-machines tested my relay at, with the idea that this can foil disruption attacks by false relays pretending to give high bandwidth. SO I expected consensus weight to gradually increase. What I didn't expect was for the advertised bandwidth to increase by step changes (as shown on atlas and globe). Evidently I've got something wrong. Could somebody please enlighten this poor nub? By the way, I appreciate that consensus weight is a dimensions number but I understand that it originated as being based on kibibytes per second? If this is still the case, it's currently significantly more than my advertised bandwidth (which is less than that set in TORRC) but appears below it in the graphs? Thanks to anyone who educates me. I have full intent on both the T-shirts on offer - the standard Tor one for uptime and bandwidth, and the EFF one for still being online in a year with over 1MBps transfer :-) Hi to all who know me Kingqueen -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

1 0

Ops request: Deploy OpenVPN terminators
by grarpamp 17 Jun '14

17 Jun '14

Ops request: Deploy OpenVPN terminators We are ops because we want to allow people to avoid censorship and speak freely. But are we doing all we can? It is well known that all relays, exit or non-exit are added to a variety of blocklists. Primarily through scraping the consensus. And those blocklists are then used to indiscriminately deny legitimate users/people access to sites, regardless of their 'behaviour', which more often than not has simply not been determined yet. So we need to augment what we're doing in order to be effective in our mission. Here's how... We already run Tor on an IP, that IP is blackballed as noted above, so using another port on it as a vpn terminator is pointless. Yet our hosting packages often offer other IP's in the same range, or we already have them to use as part of the deal (or, failing that, we can forward the openvpn TCP port on our bad relay IP to another clean non-bulk-blocked IP we control). We obviously cannot publish this new openvpn 'exit/termination' IP anywhere, such as in the comment field of the consensus as it will be banned. *But we can bind to it and let users find it with their own openvpn scans close to (one up or down from) our OR IP.* Just use the standard openvpn TCP port on it. There is no bandwidth cost to us to do this because all the traffic is moved between the exit IP and the openvpn termination IP over localhost. (Well, unless you are forwarding openvpn port on OR IP to another termination real IP off your box.) At minimum we should allow TCP transport out from the vpn to the world, aka the usual nat, so as to make websurfing work for our users. Bonus for allowing nattable outbound UDP, ICMP, etc. Further bonus for allowing inbound binds on whatever port on the IP that is available to be bound to. Obviously sine the IP is scarce to us, we can't allow full unnatted use of the IP. The point is, we already own these extra IP's, and legitimate people are being blocked from services for no reason other than kneejerk or blind reactions to Tor via blocking services. Ahem, cloudflare, et al and other blocking 'services' well known to us. So to the extent we have other IP's available to us, we should set them up to be unpublished openvpn nodes and let users find us by trying to terminate their vpn connections on us at that IP and openvpn port. Yes, blocklists could try the 'one IP up/down' scan method and list this project of ours too, but it's more work for them and they're unlikely to do it in any sort of global fashion. Especially since they can't prove it's part of Tor (because we don't publish the IP's as such). If we wish to make an announcement that we are running such terminators, obviously it should not be made from addresses related to our OR IP's. [FWIW, there is another openvpn terminator project out there. Unlike ours would be, its nodes are public, and even with that detriment (though possibly only because it is lesser known) it obtains more freedom from blocklisting than Tor. However its termination points perform poorly/unreliably whereas ours would be both nonpublished and better managed.]

10 18

New SSL keys for new OpenSSL version?
by no.thing_to-hide＠cryptopathie.eu 16 Jun '14

16 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello Tor! I run an internal Tor relay on Debian Wheezy. Today the OpenSSL version was updated to 1.0.1e-2+deb7u11 . Do I need to delete the old SSL keys like after the Heartbleed bug? Thanks and best regards Anton - -- no.thing_to-hide at cryptopathie dot eu 0x30C3CDF0, RSA 2048, 24 Mar 2014 0FF8 A811 8857 1B7E 195B 649E CC26 E1A5 30C3 CDF0 Bitmessage (no metadata): BM-2cXixKZaqzJmTfz6ojiyLzmKg2JbzDnApC -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQEcBAEBAgAGBQJTn1hxAAoJEMwm4aUww83weJAH/jYHtjrhrFrGnVdjrKPlN/TR w9NZcvRd0GrNDbZGGwemVam+OmFdHTDEeWZ73fgb/DvrGT8Iej8hD09/vD37xn9p GYhLabsKW06j8oRz7fiVDlWVOWND8QHW+UImnwKcIlvgp9a2EaSyBGVshIGppqMW wGgc8ZhoXvo5fAe/M630PHi6e/oGDJZIilSTIDmttV8M9cTEmsxah64oHZiJqVqc ierCAlAlsbkYH7fs7/QgJw0QolnhtcIZ5ALgijT+Z4EGH5oJBFnA20lvni1qLp1T O/RUTuF8qLAUWFBLgrF1Ng5zDlyPEaVUK5SO1pM6dzvDwvSWOlrapmfCd3b07DI= =OslV -----END PGP SIGNATURE-----

2 1

Ansible repo for setting up relays
by Sam Kottler 15 Jun '14

15 Jun '14

Alexander's email about the Puppet module he's putting together has reminded me to send a mail about an ansible repository I use to manage my relays. https://github.com/skottler/tor-ansible is where it lives. Unlike the puppet module, I'm working on getting a whole environment deployment put together. Ultimately (when I get some time) I'll have it stand up all the necessary pieces to securely run (i.e. ssh configuration, user setup, etc) a relay. For now it just installs Tor. Let me know if you've got any questions. Pull requests are all welcome, of course! -s

2 1

Hash of session info was not as expected
by Logforme 14 Jun '14

14 Jun '14

My tor log file is usually quite boring but today it looks like this: Jun 14 13:42:46.000 [warn] Hash of session info was not as expected. Jun 14 13:57:56.000 [warn] Hash of session info was not as expected. Jun 14 14:11:58.000 [warn] Hash of session info was not as expected. A new line about every 10 minutes since 04:14:53 (CET) Is it a user with problems, an attack on my relay or a sign that my relay have some kind of hardware/software issues?

1 0

Torservers herngaard issues
by grarpamp 12 Jun '14

12 Jun '14

Seems to be consistently delivering random length web pages (if they are artificially slowed such as https://berlin.craigslist.org/) and its bandwidth is tanking on globe.tpo. 3B486DEC5A22694C0960B4A97A3665C617C89B1C

2 1

Sinkhole IPs to block for Cryptolocker and Gameover Zeus
by Adam Brenner 11 Jun '14

11 Jun '14

As you know, the Tor network can be used for mischievous and in some countries illegal activity hurting the reputation of Tor. Two of these activities include Cryptolocker[1] and Gameover Zeus[2]. Recently my exit node was inserted into a few block lists due to this two issues mentioned above and I would guess this hinders 'good' traffic within the Tor network using an exit node. I have complied a list of Sinkholes from CBL for both Cryptolocker and Gameover Zeus. Consider adding these IPs to your ExitPolicy reject list. ExitPolicy reject 85.159.211.119 # Cryptolocker ExitPolicy reject 212.71.250.4 # Cryptolocker ExitPolicy reject 54.83.43.69 # Cryptolocker ExitPolicy reject 192.42.116.41 # Cryptolocker ExitPolicy reject 192.42.119.41 # Cryptolocker ExitPolicy reject 198.98.103.253 # Cryptolocker ExitPolicy reject 208.64.121.161 # Cryptolocker ExitPolicy reject 142.0.36.234 # Cryptolocker ExitPolicy reject 173.193.197.194 # Cryptolocker [1]: http://www.us-cert.gov/ncas/alerts/TA13-309A [2]: https://www.us-cert.gov/ncas/alerts/TA14-150A -- Adam Brenner <adam(a)aeb.io>

2 1

Exit policies pointing to IP blocks not appearing on Globe
by Mendelson Gusmão 10 Jun '14

10 Jun '14

Hi! I just setup a tor relay, encouraged by EFF's Tor Challenge. All I have is a domestic connection. I've read my TOS and my ISP seems to be very friendly to this case. Although I have a little suspicion about traffic shaping, my exit node seems to be running very well! I'm worried about one thing, though. I remember that a while ago, when I tried to access Facebook using a tor client, I saw a message telling that I was blocked for using the network. To avoid the other users of my network to be blocked due to the traffic in my exit node, I managed to add exit policies rejecting every IP block that belongs to Facebook. However, these exit policies don't appear in neither globe.torproject.com nor any site that provides information about nodes. Are these addresses being scrubbed? How do I make sure that these policies being applied? Thanks!

4 4