- tor-relays - lists.torproject.org

Running relays at consortia networks [was: JANET/edu]
by grarpamp 10 Jun '14

10 Jun '14

On Thu, Jun 5, 2014 at 3:50 PM, Iain R. Learmonth <irl(a)fsfe.org> wrote: > I'm wondering if anyone knows anything about JANET's (the UK academic ISP) > views on running a Tor relay? > > It's probably not worth putting together a proposal for running one in a UK > University if the ISP is going to have problems with it. Has anyone tried approaching these networks themselves to see about running relays there? Their bandwidth for sponsored things is often free. In the US you might try internet2.edu and all its various connecting regional networks. On a second further approach, once all the risks and pro-reasons have been discussed and accepted, the consortia backing of many Uni's within would be bulletproof.

3 3

suspicious exit?
by JB 08 Jun '14

08 Jun '14

Hi All, FP! :) I just setup my relay node today, and am keeping a hawkish(ish) eye on traffic.... And noticed a flurry of activity from SSH port (22) at 5.104.224.5 - which is listed as an exit. But it's also listed on http://cbl.abuseat.org/lookup.cgi?ip=5.104.224.5 as infected (or NATting for a computer that is infected) with the Conficker botnet. I've black-holed it in the meantime, but am wondering if I'm being overly cautious... Any advice/response/input appreciated. TIA Jeff.

2 2

Unblocking blacklisted exits [was: suspicious]
by grarpamp 07 Jun '14

07 Jun '14

> But it's also listed on http://cbl.abuseat.org/lookup.cgi?ip=5.104.224.5 as If you find exits on blacklists, you could try to contact the operator via their descriptor contact, exit http banner, etc so that they can try to have it removed. Usually a few clicks on an assertion of ownership/cleanliness and an email ack is all that's needed for removal. Since ownership of IP's is always in flux from perspective of BL's such that any 'real' owner could always do it too, absent exit contact info, many users could probably submit removal for them without issues. There's a project covering this on the wiki: https://trac.torproject.org/projects/tor/wiki/org/projects/DontBlockMe

1 0

Tor bridges with AWS
by CD 06 Jun '14

06 Jun '14

I've signed up to AWS with Tor's instructions for bridges. I've intalled Tor on my PC. Wondering how to proceed. Am obviously an illiterate newbie, so any links for a basic knowledge-base would be greatly appreciated. Thanks in advance.

3 3

Re: [tor-relays] Update your OpenSSL, several high-risk CVEs
by Jesse Victors 06 Jun '14

06 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Thanks. I saw the OpenSSL update, but thanks for explaining what it was about. Is it necessary to restart Tor to apply the update? Jesse V. On 06/06/2014 04:00 AM, tor-relays-request(a)lists.torproject.org wrote: > Message: 1 > Date: Thu, 05 Jun 2014 16:36:06 +0200 > From: Jeroen Massar <jeroen(a)massar.ch> > To: tor-relays(a)lists.torproject.org > Subject: [tor-relays] Update your OpenSSL, several high-risk CVEs > Message-ID: <53908056.50209(a)massar.ch> > Content-Type: text/plain; charset=ISO-8859-1 > > See for the details: > > https://www.openssl.org/news/secadv_20140605.txt > > Debian etc all have packages available. > > Greets, > Jeroen -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQF8BAEBCgBmBQJTkdiSXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQxMjgyMjhENjEyODQ1OTU1NzBCMjgwRkFB RDk3MzY0RkMyMEJFQzgwAAoJEK2XNk/CC+yABpUIAJ9ZSohmGuH3r4UEg//FrYRF 3IJc6UPJx22FU0pdplN09I5L0LRzH7SehJly62niid6XNS/8bKByzjkvrnik0qRP Hjo8Rq4C/2wbRJU0w8MHvpCRLFhTRdCHdGI2+HkUaYbp7abwIZVWbTMdXB0T5lGx KvSgMeQfmlWzkwEb3WqDUqcc2NJG5D3K5WFV4WOsAi+KerBUiNyJKUqwGRd21PgS VV6S4JLQy0PVKdCAIbeEeOy2xclRfwKjBfe8RVD9b8fOmBY6ty7v1k6Org54PceA hLtJXDQXg9XQfe1u2T+peEYxf1bYIZMu+DI/7DJ0xFDr6naxJ4ttQabE2WmN6lE= =FOEn -----END PGP SIGNATURE-----

3 3

Sign up for the Tor Challenge
by Adam Brenner 05 Jun '14

05 Jun '14

If you have not already, you should consider signing up for EFF's tor challenge https://www.eff.org/torchallenge/ Today also marks the Reset the Net event https://www.resetthenet.org/ -- Adam Brenner <adam(a)aeb.io>

1 0

Update your OpenSSL, several high-risk CVEs
by Jeroen Massar 05 Jun '14

05 Jun '14

See for the details: https://www.openssl.org/news/secadv_20140605.txt Debian etc all have packages available. Greets, Jeroen

1 0

Best way for normal OS X users to run a relay?
by Roger Dingledine 05 Jun '14

05 Jun '14

What is the best way to run a relay on OS X currently? Now that the Vidalia bundles are deprecated and hard to find, I believe we have no packages or bundles for OS X other than TBB 3.x? So either "install from source, write your own init script, hope you know what ulimit -n is, good luck with that" or "install tbb3 and edit the torrc, still hope you know what ulimit -n is" are the current options? Compare with https://www.torproject.org/docs/tor-relay-debian for the Debian/Ubuntu users, where our deb takes care of a lot of these things for them. Assuming my summary is accurate, what are some good ways to move forward here? Thanks! --Roger

7 7

VPS for tor exit nodes
by Contra Band 04 Jun '14

04 Jun '14

Dear exit node operators, Could you please recommend vps providers allowing to run tor exit nodes? I checked many vps operators but most of them allow relays but not exit nodes according to AUP or ToS. thanks.

9 13

Re: [tor-relays] "as well as block BitTorrent after repeated offenses..."
by Tor Admin 04 Jun '14

04 Jun '14

Hi, I'll happily block BitTorrent it before any offenses start. Just tell me how. Regards, =-John-= <snip snip> Spencer Neitzke <spencer(a)neitzke.me> spake thusly: > as well as block BitTorrent after repeated offenses -- Using Opera's mail client: http://www.opera.com/mail/

2 1

Re: [tor-relays] VPS for tor exit nodes
by Mike Patton 03 Jun '14

03 Jun '14

I have an exit with exigent here in Australia. They advised by email that they don't have an issue with Tor. M. On 4 Jun 2014 08:56, I <beatthebastards(a)inbox.com> wrote: > > > So can you post some provider names? > > Comsitec.de is one which is ok with exits but I have a lot of trouble getting their attention when it stops. > It is in Germany which is much better than being in USA because the mentality is better. > Two I have which now say exits are not accepted are Lunanode and Bluevm. One which was expensive but good is DrServer/AbusiveCores. The guy set up Tor when I had a problem with Linux!. > > Since some have said yes to exits when I paid but a week later 'introduced a new policy' I wonder if it is worth being open. If you know what can be done with fifteen VPSs for the next nine months which can't have Tor please tell me. > > Lowendbox.com is good for scavenging addresses and sudden bargains but it may be better in the long run to pay a little more and get more cooperation. > > It may be more useful to Tor at the moment to provide bridges and for that, I believe, the very cheapest VPSs would do the job e.g. $AUD15/year. > > Robert > > > So can you post some provider names? > > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

Usefulness of very limited exit policy nodes?
by Phil 31 May '14

31 May '14

Hi, Opinions please - is it worthwhile running an exit node on a home DSL connection with limited bandwidth and exit policies? I'm talking 150Mb per day, 20Kb/s, and only allowing ports 80, 443 and 53 out. I'm concerned about potential abuse from exit traffic more so than limited bandwidth. I've only had it up for a few days and the bandwidth is being used. Is such an exit policy useful for the network? Or would I be better off just running as a relay? Are there other ports that I could allow to exit that would make this node more useful, while not greatly increasing the risk of abuse reports coming my way? Phil

4 5

Running exits from home, posting exit-notice
by grarpamp 31 May '14

31 May '14

In some threads people are running exits from home for principle, economy, management, etc. Some threads question risk. Just as you put exit-relay-notice on your IP to obtain advantage of chance of reading it first before interacting with you, you may consider literally posting it on your doors. Also, even paid hosting location could have advantage from this. https://gitweb.torproject.org/tor.git/blob_plain/HEAD:/contrib/operator-too… Btw, the link to that at the bottom of here is 404: https://www.torproject.org/docs/tor-doc-relay.html.en

2 1

Confirm IPv6 Setup as Exit Node
by Adam Brenner 30 May '14

30 May '14

Howdy, I have setup a Tor exit node and IPv4 appears to work (will get a real test in the next 48 hours). I would like to confirm my IPv6 setup as I have found the documentation on this subject lacking (or my googling skills suffering!) Added the following to my torrc file: ORPort 9001 ORPort [2606:2e00:0:19::4]:9050 # first line works with IPv4 while second line is supposed to be IPv6 IPv6Exit 1 ExitPolicy accept6 *:* # Allow all IPv6 Requests I did not specify anything for DirPort as I believe this is not working under IPv6? Is this correct? For reference my fingerprint is 6269EC22B7970ACDE4AF09F6ADE67CEB0C7F7964 -- Adam Brenner <adam(a)aeb.io>

7 9

Exit node little traffic after Named flag?
by Mike Patton 29 May '14

29 May '14

Hi all, I started running an exit node as a test, about a month ago. Initially everything was fine and traffic was good up to my throttled limit. However since my relay got given the Named flag, my traffic has been very very low. Any idea why that would be? Relay nick is NetFreedomTest2 Regards, M.

2 1

Please help profile Tor 0.2.5.4
by Moritz Bartl 28 May '14

28 May '14

Nick could use your help identifying potential bottlenecks in the 0.2.5.4-alpha release by profiling your relay. This is especially useful on high bandwidth relays (> ~50 Mbit/s). https://trac.torproject.org/projects/tor/ticket/11332 Ideally, attach your report(s) to the ticket (you can use cypherpunks/writecode as login if you don't want to create a user). Thanks! -- Moritz Bartl https://www.torservers.net/

1 0

hardening a tor relay
by Contra Band 27 May '14

27 May '14

Hi all, I'm impressed by Tor and its contribution to freedom of speech and started to run some tor relays. The first one is https://atlas.torproject.org/#details/DBE3CE33BA8BF1CB98091EE2A72690DF8218C… and I have applied tight iptables to that as below. Can somebody advise what should be add/remove to make it more efficient to tor network? =========iptables-rules.sh========== # Flushing all rules iptables -F iptables -X # Setting default filter policy iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP #ipv4 udp drop all iptables -A INPUT -p udp -j DROP iptables -A OUTPUT -p udp -j DROP #ipv6 udp drop all ip6tables -A INPUT -p udp -j DROP ip6tables -A OUTPUT -p udp -j DROP # Allow unlimited traffic on loopback iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT ip6tables -A INPUT -i lo -j ACCEPT ip6tables -A OUTPUT -o lo -j ACCEPT # Allow incoming SSH iptables -A INPUT -p tcp --dport xxx -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp --sport xxx -m state --state ESTABLISHED -j ACCEPT # Allow incoming 443 iptables -A INPUT -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT # Allow outgoing 443 iptables -A OUTPUT -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT # Allow incoming 9050 iptables -A INPUT -p tcp --dport 9050 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp --sport 9050 -m state --state ESTABLISHED -j ACCEPT # Allow outgoing 9050 iptables -A OUTPUT -p tcp --dport 9050 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -p tcp --sport 9050 -m state --state ESTABLISHED -j ACCEPT # Allow incoming 9051 iptables -A INPUT -p tcp --dport 9051 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp --sport 9051 -m state --state ESTABLISHED -j ACCEPT # Allow outgoing 9051 iptables -A OUTPUT -p tcp --dport 9051 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -p tcp --sport 9051 -m state --state ESTABLISHED -j ACCEPT # Allow incoming 9001 iptables -A INPUT -p tcp --dport 9001 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp --sport 9001 -m state --state ESTABLISHED -j ACCEPT # Allow outgoing 9001 iptables -A OUTPUT -p tcp --dport 9001 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -p tcp --sport 9001 -m state --state ESTABLISHED -j ACCEPT Thanks Simon

8 14

Non-exit abuse reports
by dope457 24 May '14

24 May '14

Hello, I have been running middle relay on my VPS since it was too much trouble to operate an exit. But ever since I have received two abuse reports regarding same issue. 1) Source: 31.31.78.141 Event type: DNSANOMALY Detail: High amount of TCP DNS traffic, whole transfer: 12 503 B Timestamp: 2014-05-14 20:20:35 NetFlow source: localhost Targets: 178.238.223.67 2) Source: 31.31.78.141 Event type: DNSANOMALY Detail: High amount of TCP DNS traffic, whole transfer: 667 644 B Timestamp: 2014-04-28 19:45:00 NetFlow source: localhost Targets: 178.238.223.67 relay - https://atlas.torproject.org/#details/F12AFDB3FEC184E76944579579F762F1142C7… ISP is pushing me to do something about it and that is why I am asking you to help me because I am not sure what to do. Thank you and have a nice weekend! dope457

3 2

Fwd: [rt.torproject.org #26011] Unknown connections
by eva 21 May '14

21 May '14

Hi all, so I'm forwading my message to your mailing list - see below. And yes, I read https://blog.torproject.org/blog/lifecycle-of-a-new-relay though. The consensus weight of my relay was 27 before, and dropped to 15. Now it's getting up again, so it might be ok. But my main question is about unknown connections. Is this a normal behaviour? Apologies, if this is already answered on another page I didn't read, unfortunately. Thank you all for developing Tor. Eva -------- Original-Nachricht -------- Betreff: [rt.torproject.org #26011] Unknown connections Datum: Tue, 20 May 2014 20:36:19 +0000 Von: Matt Pagan via RT <help(a)rt.torproject.org> Antwort an: help(a)rt.torproject.org An: unnamedabc(a)posteo.de Hi: I think you would get a better response to this question by emailing the tor-relays mailing list at tor-relays(a)lists.torproject.org. To subscribe to this mailing list, visit this page: https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays You first may want to have a read over https://blog.torproject.org/blog/lifecycle-of-a-new-relay though. On Mon May 19 18:44:00 2014, unnamedabc(a)posteo.de wrote: > Hi, > > first, thanks for your incredible work on Tor. > > I'm running a middle relay on Linux for about two months and everything > seems to be quite ok. But I'm new to Linux and to configuring a network. > So if you experts have some time to spare to help a newbie, it would be > very nice. > > For the last few days the relay traffic is only a third of it's normal > traffic. And I wonder if I should worry about some inbound and > outbound connections called 'unknown'. Arm shows something like this > > outbound > address: 0.0.0.0 > locale: ?? > No consensus data found > > inbound > address: 166.84.7.148 > locale: ?? > No consensus data found > > Could that be a problem? > > The relay fingerprint is 12AAE898482C1B7CB9ED91A3D7F6EF81D2149178 > > Thanks, > Eva -- - - - - - - - - - - - - - - - - - - - - - - - Help make more Tor-- Support the Tor Project! https://www.torproject.org/donate/donate.html

1 0

Sorry for my molestation
by zwiebel＠quantentunnel.de 19 May '14

19 May '14

I will keep calm next days ... > Gesendet: Montag, 19. Mai 2014 um 18:19 Uhr > Von: "Peter Palfrader" <weasel(a)torproject.org> > An: zwiebel(a)quantentunnel.de > Cc: "Tor Assistants" <tor-assistants(a)lists.torproject.org> > Betreff: Your tor-relays postings (was: [tor-relays] relay not receiving very much traffic) > > Hey, > > you have been posting to tor-relays quite a bit recently. > > zwiebel(a)quantentunnel.de schrieb am Montag, dem 19. Mai 2014: > > > torrc looks good in my eyes. > [..] > > Please don't top-post, and please send text-only mail instead of HTML > mail. > > Thanks, > weasel > -- > | .''`. ** Debian ** > Peter Palfrader | : :' : The universal > http://www.palfrader.org/ | `. `' Operating System > | `- http://www.debian.org/ >

1 0

relay not receiving very much traffic
by Markus Klock 19 May '14

19 May '14

Hello!I deployed a new tor-relay about 2 months ago. It runs on a server with 2 Quad-cores, 8GB RAM and 1Gbit connection.However, I have still not received very much traffic to it, it almost never goes above 10Mbit.This is the server traffic the last 2 months:http://best-practice.se/dump/tor-ralay.PNG Is this normal or may I have configured something wrong?Last time I had a relay running I received 100Mbit+ traffic... Markus

5 11

Advertised Bandwidth
by Spencer Neitzke 19 May '14

19 May '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hello, My advertised bandwidth is much slower than what it should actually be. I am running on a network that easily achieves 2gbps, although atlas is reporting 4.15mb/s. Have I misconfigured something? Nickname - ServerX5690 -----BEGIN PGP SIGNATURE----- Version: OpenPGP.js v0.5.1 Comment: http://openpgpjs.org wsBcBAEBCAAQBQJTeZXmCRAgZfyIs5JzlAAABhkH/0GeOwtqo1sE5aT7jQVT taaOKZmJiIgDfBA0KQZdq8WLAkT2V61wiOHcWf6PXIouvY/Tt3n+aWs85v4n cs5Rahj83MYZArKIm9wQ34hEkYu6Fku9HVIVZBWpPcFC6aZgKDk9xgKo4qO1 +OjxsoE8liY0WYVr9BabWKsN3+kiwWDQUk/Et48xPk6YyFJLj0Bjqa951SQf J7lTjitrfxYqPn6GHiz9njhO/szHOP24aLJR5jIagBbGJzlxeQ686C4ptDVM DuZjeTqmN6ZmVWZv5M44FdJknfUigRnUerWVBjfrVuHGU5pnSVf6owSduOX4 U+kK3PlbOrk+0zfQiyJBeuU= =A0nS -----END PGP SIGNATURE-----

3 4

Re: [tor-relays] relay not receiving very much traffic
by Markus Klock 18 May '14

18 May '14

Well, I *am* the network admin :) This server is directly connected to our backbone and is not being throttled in any way. AS1653 is our upstream and they like the Tor-project, no throttles there either :) How often does tor/atlas mesure bandwith? /Markus ________________________________ Från: zwiebel(a)quantentunnel.de<mailto:zwiebel@quantentunnel.de> Skickat: ‎2014-‎05-‎18 23:11 Till: tor-relays(a)lists.torproject.org<mailto:tor-relays@lists.torproject.org> Ämne: Re: [tor-relays] relay not receiving very much traffic _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

3 2

Re: [tor-relays] relay not receiving very much traffic
by Markus Klock 18 May '14

18 May '14

Yeah, I have no problem pushing 850Mbit and more via iperf and wget from speedtest-servers. /Markus ________________________________ Från: zwiebel(a)quantentunnel.de<mailto:zwiebel@quantentunnel.de> Skickat: ‎2014-‎05-‎18 22:11 Till: tor-relays(a)lists.torproject.org<mailto:tor-relays@lists.torproject.org> Ämne: Re: [tor-relays] relay not receiving very much traffic _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

One server, Two open tor connections
by Kurt Besig 18 May '14

18 May '14

Hi all, I'm currently running a Linux relay on one LAN machine. I recently set-up a dual boot win7/Ubuntu 14.04 LTS machine, also on the LAN. For now I'd just like to browse the tor network on the second machine and not run a relay on it for the present. I'm concerned my ISP might give me problems if my bandwidth gets too crazy. So, other than editing my /etc/tor/torrc to open a control port and forwarding the control port, is there anything else required to simply browse tor? When I installed tor on the second machine's Ubuntu install I added the tor repositories to my sources.list and updated, upgraded, and installed tor though apt-get.

3 2