- tor-relays - lists.torproject.org

DigitalOcean starting Exit node crackdown
by Shawn Nock 15 May '14

15 May '14

Hello friends, As I recall, there are several exits running on DigitalOcean's infrastructure. This is presented FYI: Background: I've run an exit on DigitalOcean for about a year without issues (lost track of uptime duing heartbleed key regen). It wasn't hidden (the droplet name was 'tor-exit') and it had valid reverse DNS and the standard informational page was hosted there. At the time of droplet creation, tor exits were not prohibited by their ToS. I've mentioned to DigitalOcean staff during support tickets that it was a Tor exit. Today the exit was shutdown, the message received was this: >Hello > >We do see that you are running an exit node for the TOR network. > >Unfortunately we are unable to resume services to this droplet and ask >you that you please not run any other TOR exit nodes. > >Please get back to us as soon as possible so we can resolve this. > >Thanks >Support I sent the following response: >Hello, > >My droplet has been running for months (perhaps a year) with no >significant incidents. It is well managed, allows only a strict subset >of traffic to exit and the very few complaints that have been lodged >have been dealt with quickly and professionally (as said by your >support team). The droplet has been configured to limit the rate of >traffic below the droplet's monthly network transfer quota. > >It's well established that under US law ISPs are excluded from >liability under the safe-harbour provisions of the DCMA for any >copyright infringing traffic. More generally, the probability under US >law that an ISP would be held liable carrying user-generated traffic is >extremely low. Tor exits have been operated by Universities, Churches, >and corporations (large and small) for slightly more that 10 >years. During this time not a single criminal or civil complaint has >been brought against an operator's ISP (to my knowledge). > >While it is surely your right to operate your business in the manner of >your choosing; I politely request an explanation for your apparent >policy against Tor exit nodes. If there is some way I might change the >parameters of the exit to suit a policy against specific traffic (to >certain IP blocks, port ranges); I'd surely comply. > >Finally, in this time where repressive regimes are cracking down on >Internet traffic and persecuting their countrymen and where free access >to the internet is nearing the stature of 'human right': if your policy >is indeed a general one against all Tor exits, I urge you to reconsider >your policy. It would be a great service to tens-of-thousands of Tor >users (refugees, political activists, religious minority, abused >spouses, law enforcement, &c) to revise your policy to allow >well-maintained exits to remain on your network. > >I appreciate any attention you could give to this serious matter. -- nock(a)aphr.asia (OpenPGP: 0x6FDA11EE 3BC412E3)

5 7

Malicious or crappily configured exit node
by u 15 May '14

15 May '14

Hello! referring to https://trac.torproject.org/projects/tor/wiki/doc/badRelays, i sent this also to tor-assistances@tpo. Never got an answer though :( Now and then, I use Icedove with TorBirdy under Debian. While connecting to port 465 on my usual mailserver, using SSL, I sometimes get an SSL certificate alert. The certificate presented is not my usual certificate at all (which works without adding an exception), but one for cab.cabinethardwareparts.com, pretending to be my mailserver. [1] I've searched a bit for information on that exit node and found: http://torstatus.rueckgr.at/router_detail.php?FP=0cc9b8aa649881c39e948e70b6… This node has flags: fast, stable, guard... I tried it several times and the behaviour was repeatedly the same. Last time it happened was 10 days ago. Then again today. I'm not quite sure where to report this (that is how this e-mail ends up on tor-relays :) ), nor how to avoid this exit node. Is there a way to do that? Thanks, u. [1] http://pix.toile-libre.org/upload/original/1399232278.png screenshot of the certificate

5 6

Re: [tor-relays] How to handle an abuse report
by tor＠t-3.net 15 May '14

15 May '14

Does the user appear to be bypassing attempts to block/ban him from the site/chat in question? If not, depending upon what you are looking at, one possible response is along the lines of: This is 2-way participation in an internet chat forum by 2 users who are at odds with one another. The quoted content may be ugly, but it does not appear to qualify as site or network abuse. Ch'Gans wrote: >Everything went well so far, until today. Someone, let's call this >person/group "A", reported an abuse to Hetzner. A TOR User, "B", is >spamming chat/forums with vociferous insults and disrespectful messages, >I got a copy of few of them and the insults from B are as bad as the >ideas defended by A, but I'm not here to judge anyone...

1 0

Fwd: [tor-talk] Fwd: Ops request: Deploy OpenVPN terminators
by grarpamp 15 May '14

15 May '14

to list, not me. ---------- Forwarded message ---------- From: Mirimir <mirimir(a)riseup.net> Date: Wed, May 14, 2014 at 11:58 PM Subject: Re: [tor-talk] Fwd: [tor-relays] Ops request: Deploy OpenVPN terminators On 05/14/2014 09:07 PM, grarpamp wrote: >> On Tue, May 13, 2014 at 5:48 PM, Jeroen Massar <jeroen(a)massar.ch> wrote: <SNIP> >> <user - ovpn - torcli> -- <exit torrelay or_ip - localhost - ovpn_ip> -- world > >> That "ovpn" part on the left is easily detected by any party in the >> middle doing > > No. Understand the diagram. It is not detectable by anyone > between torcli and torrelay, because that is just normal > tor. > >> Note that you are running IP over TCP over Tor (which is over TCP). > > Of course. Unless of course, as suggested before, some operators > choose the method of binding/routing their exit over an ip different > from their OR_IP, then it would just be native tor and native TCP. > >> The performance of that will be very bad. Tor network is already >> overloaded enough as it is. > > No it won't, I've tested it, it works just fine. The only issue is the > exit ip may change. So the exit operator is expected to block > access to ovpn_ip from anything other than their associated or_ip, > and the user is expected to config their client to use only the > associated exit per whatever 'world' usage session they have in > mind. It's not supposed to be point-click easy, only possible. That's a very cool idea :) Using $5/mo VPS, there could be a large pool of exit IPs for each Tor exit. <SNIP> ----------

1 0

Thinking about deploying a new node
by Lance Hathaway 15 May '14

15 May '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 So, every now and then, somebody asks what the best use of a node would be--bridge, relay, or exit. And yes, this is one of those requests. This would be a VPS from VPS Nodes. I checked the list of good and bad ISPs, and they don't seem to be listed. So I asked them directly how they felt about Tor, and this was the response: "While we don't specifically disallow Tor by name, it does come under the ToS as it is commonly used to launch large scale DDOS and SPAM campaigns and is therefore not allowed on our network for that reason. rDNS is provided as standard, you need to have a valid FQDN A record associated with the IP address that is assigned to your container. As far as SWIP, I would have to pass the request on to management as they are the only ones with that access." Seems pretty clear to me that they're not in favor of having an exit on their network. (I brought up the reduced exit policy and asked specifically about SWIP so that I could handle most of whatever abuse complaints come in, but they wouldn't provide anything further than this response.) That leaves bridge or standard relay. My question is, given 3TB of monthly bandwidth and a 100Mbps (shared) uplink, would it be better to run as an entry/middle node, or as an obfs3/scramblesuit bridge? (If there are other suggestions for trying to talk VPS Nodes into allowing an exit node, I'm all ears--though it may be better left with somebody with more experience talking to ISPs.) Thanks in advance, -Lance -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) iQIcBAEBCgAGBQJTdCUCAAoJEECmBqfoBgXnV2EQAKcP+K+b698oExGXuI3C5FLh YOGU6z1XQy6C/ERkcNxqTfSbqF/5Izm1ey+1qzr41keVUQ1CKkPgGWbgz/plnCbu ZJf3riJrYucg27RHCSioz3ZBt8NV7d8msRrJAVsUoZy90MyghxYTXH6faGBrLNdw tUnhT9IhSp2C46/JBlPa02FM3Aa4JXggnuhxmUNzpCsNun12D+U3AXefStOjo2GC a9CnXFxxmvHURm7CRlXm7VDMyXZYtWWvBny3ndXhAwdp1EXJ67cjcxdml7PNRYqD 6OOWbfc70i6f8f5YhFFvcsLBlxBaTFTLBWz3J7SQPbVk6W8x8Av3rSvfky7wGyW7 qdbB1UI2FvsIVVCzr8e5bZxjxxUIABMm3Dpg5P+d0y7m7Gts9QhfLtgDMDZHwTYO bbsaDjJO7hUlFFd029PPW6PkH1dSD6pIjkE78ZAX57+5ZBk6JeMhOl8uWeqvbkbz KlOJJ34w0dVLCYiSF+q/BT2tlRMYVjUnQpbWHoxIZNcqBF4bzHdh0O5p/Fg0LSwD GFMOeRpMIDe6oJhU9xo/rdEVjIUGA9rRCBalT2N9fD3XhMQRGm4z/4e41A+YOE61 00BqybYG3Cof87QGqvZEv7zg8w0iU1n2LT52MvpfnQC15QoDvq8GA8C4wAoNpdQv Te15KnmiIweVAXjZBzZ1 =PeIP -----END PGP SIGNATURE-----

2 1

Any Tor/Linux coaches in Sydney?
by I 14 May '14

14 May '14

5 6

How to handle an abuse report
by Ch'Gans 14 May '14

14 May '14

Hi all, Since 3 weeks, I'm running a TOR exit node [1] on a server I rent from Hetzner (A German hosting company), after reading about using Hetzner to run a TOR node, I decided to go for the "restricted" mode to avoid any stupid copywrong issue (That is, I allowed only a limited set of ports, which sadly excludes p2p). Everything went well so far, until today. Someone, let's call this person/group "A", reported an abuse to Hetzner. A TOR User, "B", is spamming chat/forums with vociferous insults and disrespectful messages, I got a copy of few of them and the insults from B are as bad as the ideas defended by A, but I'm not here to judge anyone... From A's timezone, it happened from the 9th of May, 8:20PM to the 10th of May, 2:30 AM. Given the nature of the TOR network, I assumed that it is very unlikely that stupid-B will use my server's IP to insult stupid-A any time soon... or is it? Now, I have to report to Hetzner, I will tell them that I'm running a TOR exit node in "restricted" mode, but how can I defend myself, I am not sure that my "restricted node" and "given the nature of the TOR network" arguments will convinced them the Hetzner dudes. Could anyone gives advice, feedback or stories on how to deal with this situation? Best regards, Chris [1] https://atlas.torproject.org/#details/18B6EBAF10814335242ECA5705A04AAD29774… -- QtCreator/qmakeparser.cpp:42 ////////// Parser /////////// #define fL1S(s) QString::fromLatin1(s) namespace { // MSVC2010 doesn't seem to know the semantics of "static" ...

6 9

Linux CVE-2014-0196
by zwiebel＠quantentunnel.de 13 May '14

13 May '14

Hi I received a notice from a server provider to immediatly update/upgrade/reboot if I would use Debian. It's the CVE-2014-0196 issue. I did and it came up with Wheezy 3.2.57-3+deb7u1 which should be fine. How relevant is this issue? Felix ==========---------- - - - - - - - - - - ----------========== -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v2.0.22 (MingW32) mQENBFL/5VoBCAC8l2gGmuy2hZf866dDkwzOvMkyJlfnFZU6T5LWe4uPIx0a8R1U cmj/Vut2yUCaJgvFpdOVA3mmXC58zoDeiW7Um6q6otD6BR2hXdgyBTAgqkQ0BsYx epb4UXBz/u3TJmv655fBnXeDgCB8L5BIkcsmX6EoBNUs6a3TPMhX3UXOtEKLXJeZ 2QtoDxwXqHNSmW7jLq+qkpriVDqxDTFv+muZRE+Zn/6PZpEASvpSdVdT/1giEMUL QQFIP6cBPY2GYIaNCO1dYRj9ebM7ewWjCiOiOw6/eylxan8vfFntgaPU3J7W2wJp RiRtUIjT+TDycVyNk7gy4wV2Rj8+58+Krk1tABEBAAG0IEZlbGl4IDx6d2llYmVs QHF1YW50ZW50dW5uZWwuZGU+iQE5BBMBAgAjBQJS/+VaAhsPBwsJCAcDAgEGFQgC CQoLBBYCAwECHgECF4AACgkQC2jb92rYqyMGxQf/d9oJf0qpgXZaUmcqujQ3DVsc uvYOnK2MJCpDIvvZYdQTcnG2jz8/na1ZyfAGeKhYZ18ypONwSQYthC17L5GHQ2H3 Pg/H0GARtx4aJR5TtIKnhPR8yYdlikCuTBb5QSFJUUtEz91SqDW7EXNbMC4RRSEd BWWirADCJWitoR3JCC13r+CF6TCFDluClAht/t56f7prBzARVYWmlbgYD2yx4Uzs FOl0vvhW2o9dpVaLZ6mSHAyNzefCFcNumRUxqa+V6nY94dd8BV8xH0lOd1xaMtZW HuxIU9Sbh13OlJyBAvVffVBL+4sEOpc8XB6Yl/pmyjEjUSvC7lP3T+Ix9Mnk/A== =kfXw -----END PGP PUBLIC KEY BLOCK-----

2 2

Tor bridges on borrowed ports
by kzhm＠mailtor.net 09 May '14

09 May '14

Hello, assuming I have a friend, Bob. He has two IP addresses and wants to contribute to the tor network. He doesn't want to operate an exit, relay or bridge himself, though. I offer him to operate the bridges on my hardware and he's magically forwarding the required ports from his machines IPs to my machine so I do the relaying part of the bridging game. Bridge users benefit from the additional IP addresses that have to be blacklisted. I'm looking for a way to implement this. I could only think of *) inetd + nc *) dark iptables nat magic *) some sort of ip-over-ip tunnels which would all be kind of hacky, require installation of addition software and would probably have sideeffects on tors bridge stats. Can I announce an address that isn't directly mine? Can I use my address for outbound traffic to the next relay or do I need to use the "bridge address" for that? Is there a flaw in there? Is somebody already doing that? I'm putting this up for discussion. If I can get this working for Bob I could probably get access to some subnets from Charlie and Dave.. Waiting for input. Truly yours, Alice.

2 3

About running an Exit node
by Pika ohc 08 May '14

08 May '14

Hi there, I was considering to run an Exit node with my own pc, however, i have some questions about exit node. 1. How can I know if there is a client specifying me as an exit node and the traffic is sent from the client to me directly(where my exit node is the first node and also the last node for the client.)? 2. If i found some clients trying to do something bad by using the method mentiond in 1., how can I stop him? Is iptables or anything else can help me to block such clients? Hope there's someone can answer me. Thank you!

6 6

Mac OSX 10.6, re-installed, TBB downloaded, installed?, terminal window....what now?
by Robert Smith 08 May '14

08 May '14

I am NOT a Unix user. Decades ago, I was very skilled on an Amiga computer (I heard Amiga DOS was basically Linux). I have almost no experience on Macs. I hate them. My first attempt at installing Vidalia gave me a message saying: "You can't run Tor Browser with FireFox running". All programs that appeared in the "startup list" were unchecked (FireFox was not among them). Then after a cold boot, I got the same message. So I wiped the F##@$ Mac and re-installed only the OS (Snow Leopard) then updated it to the latest, 10.6 17. Then I download TBB again. Again I got just a terminal window. I tried to download and install the GUI version so I could get a simple bridge or relay running, but it looks the the terminal window is all I am going to get. If someone could post a link where I could download and install software for running a Tor relay or bridge, I'd appreciate it. Most computer users of my age are not nearly as experienced as I am. All lot younger than me, and they may not have the resources or interest to run a Tor relay. If it's hard to run relay or bridge on the most dumbed down OS (Macs seem very stable, but frustrating in anything I have attempted), who is going to be running relays? The 0.1% of the people out there. Mostly Linux experts and no one else. I'd run in on one of my PC's for now, but life is not allowing me the time, to make that an option at this time. Thanks for any advice.

2 1

Re: [tor-relays] Trying Trusted Tor Traceroutes
by starlight.2014q2＠binnacle.cx 08 May '14

08 May '14

At 22:35 5/7/2014 -0500, Anupam Das wrote: >Those are not our machines and moreover, we have not received any measurement (i.e., traceroute data) from those IPs. One more thing our traceroutes use UDP packets, not TCP packets. Thank you for your reply. I blocked the IPs.

1 0

Re: [tor-relays] Trying Trusted Tor Traceroutes
by starlight.2014q2＠binnacle.cx 08 May '14

08 May '14

forgot log entries

2 1

Re: [tor-relays] Trying Trusted Tor Traceroutes
by starlight.2014q2＠binnacle.cx 08 May '14

08 May '14

>Dear list members, > >Just a quick update regarding the TTTT >project. There are multiple GB's of data to >analyse and it is still being worked on. We are >also working on the public script(s) as well. > >Sebastian Urbach Have been seeing some dubious traffic warnings the last few days on the firewall from 50.116.9.77, 74.207.228.161 and 109.74.204.217. Are these IPs performing traceroutes for your project and can you vouch for them? If so will it improve your results if the ICMP TTL-expired packets are permitted? You should avoid the duplicate TCP SYNs if you don't want to annoy people. Maybe explain exactly (and tersely) how this works. If they're not yours they go on the black-hole ACL never to be seen again.

1 0

(no subject)
by I 07 May '14

07 May '14

4 4

SSH scans from Tor exit
by I 02 May '14

02 May '14

12 21

Relay down, "rejected", help
by kbesig 30 Apr '14

30 Apr '14

My relay became one of the "rejected" since the heartbleed vulnerability surfaced so I reformatted my XP relay and did a fresh Ubuntu 14.04 LTS install. Built vidalia-0.2.21 from source using: deb http://deb.torproject.org/torproject.org trusty main deb-src http://deb.torproject.org/torproject.org trusty main apt-get install build-essential fakeroot devscripts qt4-dev-tools qt4-designer libqt4-dev g++ cmake apt-get build-dep vidalia mkdir ~/debian-packages; cd ~/debian-packages apt-get source vidalia cd vidalia-* debuild -rfakeroot -uc -us cd .. sudo dpkg -i vidalia_*.deb Edited /etc/tor/torrc allowing connection ports. I'm unable to open vidalia with these error messages: 1. As non-admin: /usr/bin/vidalia (process:540): GConf-WARNING **: Client failed to connect to the D-BUS daemon: An AppArmor policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender="(null)" (inactive) interface="org.freedesktop.DBus" member="Hello" error name="(unset)" requested_reply="0" destination="org.freedesktop.DBus" (bus) (<unknown>:540): GLib-GIO-ERROR **: No GSettings schemas are installed on the system Trace/breakpoint trap (core dumped) 2. As root: /usr/bin/vidalia No protocol specified vidalia: cannot connect to X server :0 3. As root: /usr/bin/X11/vidalia No protocol specified vidalia: cannot connect to X server :0 I've seen similar errors searching for a fix, but none that seemed "resolved". Any suggestions would be appreciated as I'd like to get back up and running ASAP Thanks ------------------------------------------------------------------------

15 23

MaxAdvertiseBandwith
by jchase 30 Apr '14

30 Apr '14

Hi, I have a non-exit relay running Tor 0.2.25 on a Pi. Consensus weight 37. exit-policy: reject *:* Now Iḿ back from vacation and my relay has 1600 incoming conncts and arm warns me that my bandwidth is too small to support so many incomers. Would I kindly restrict my reject policy or limit my MaxAdvertiseBandwidth. Which I believe is no longer supported(?). Can anyone help me cut down on the traffic and the notices? J. Chase

4 3

can the old compromised keys be invalidated, "named" be recovered
by starlight.2014q2＠binnacle.cx 29 Apr '14

29 Apr '14

I just read that the relay can't get its old name back for six months now that the keys have been changed due to Heartbleed. Does any way exist to invalidate the old keys and transfer the name to the new relay? I realize that naming a relay is strictly an exercise in vanity, but hey, who is entirely immune?

2 1

Compiling tor-0.2.5.3-alpha on Raspberry Pi
by Lance Hathaway 29 Apr '14

29 Apr '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Apologies if this would be better addressed in a different list... I know there are a couple of people here who are working on making the Raspberry Pi a good option for running Tor--and the work is appreciated! Gordon Morehouse has built binary pickages for the Pi, but I wanted to try compiling it myself (for good practice, mostly). I followed the directions for compiling from source on a Debian-based system, but the compile fails with the following: config/parse_bridge_line: FAIL ../src/test/test_config.c:373: a.b.c.d was supposed to fail, but it didn't. FAIL ../src/test/test_config.c:374: assert(!bridge_line) [parse_bridge_line FAILED] ...some log lines skipped for brevity... 1/201 TESTS FAILED. (1 skipped) make[1]: *** [test] Error 1 make[1]: Leaving directory `/home/pi/debian-packages/tor-0.2.5.3-alpha/build' dh_auto_test: make -j1 test returned exit code 2 make: *** [build] Error 29 dpkg-buildpackage: error: debian/rules build gave error exit status 2 debuild: fatal error at line 1357: dpkg-buildpackage -rfakeroot -D -us -uc failed I confess, I haven't the slightest clue what to do with this. Have I overlooked something stupid? I don't want to open a "bug" unless it's an honest-to-goodness bug (developers have better things to do with their time than chase down "bugs" which are actually "user errors"), but I don't have the knowledge to say whether this is a bug or not... Any thoughts? -Lance -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) iQIcBAEBCgAGBQJTWW95AAoJEECmBqfoBgXnbVcQALl69M5KuGTfpUH/nsl6hxCu RwB+u5kothwRIPoJblHdEa7m00sWJxUc8HlHfczgjIYkC1gob+vgIDiMR6skAc2t RdSaCYuKWTh6RVTXUAb4UNd3GdvTu/QW/5NsUYDFlTT4QIxg7W2OEOirC4x9bNei gspV+TyOBdJbrTWmVoBFh8YPbpVeY1R5rwARjv7BOhkDCAle3N4vh+S3LvUNr3hk bUimllKSK7fht7bFyesiCrPB1wUxEazAwD7iIDCj6XmVRM57Wu9TV48RO+LLWEB5 qdKuTvN4MyqFbCiuBQXWU5Ps+IEOwoLSVzkQDvtdXhA1WvQmt8gVavXlRlZ+vWIi bEnJFxLMTqcwmC7RRk5blKr73/fBllaEumTpV4TfO3wRDwCKvtKLum9Z6wyV6g8n iY1WoJIThAiN6UM/nohKiecwM/L5e0gwEbkIxYLiCDGwzR3/QAvU84dv4a3EvWcy ptVZgcSQ3B4g55FOlTSJTasBG/rkCIm0Kdi6D7qXAUdm+ylSn/9eMcealSBwk38F Cfm/5P0bMAaKyGugY9VvoMPku8rsQgcimuUY8jH+8WgUxlUcZoL0fYSZ9hiVZ+m4 zW+MiA8Ct2MSzx5GNDDjdBYs7TqOE/MywkSIoxzgy/h0fhAaC3Vm5+NpkI8Z7MUD /1MdDUHCawEZk8KHt7ev =GIPd -----END PGP SIGNATURE-----

3 3

Help setting up an exit relay on CentOS linux
by Chuck Bevitt 28 Apr '14

28 Apr '14

Hello all, I've run an exit node from my home in the past using my consumer ISP service (Time Warner) and Windows 8, I'm pretty much of a Windows guy (I make my living building business applications with Microsoft tools) but now I have an opportunity to run an exit node on a hosted server running CentOS linux. I've loaded CentOS at home to test it out and the problem I'm having is that I can't get the Vidalia control to run. The browser bundle works OK - I can open FireFox and make a Tor connection. As far as I know I've downloaded the correct files for CentOS linux and I have the Vidalia start icon. However nothing happened when I try to open the Vidalia icon. Since I'm not familiar with linux, I don't know where to start looking. I had assumed that I would just open Vidalia and set up my exit relay the same way I did on Windows 8. I greatly appreciate help with this especially from someone who's configured a relay on CentOS. Thanks, Chuck Bevitt

3 2

Bridge Operators - Heartbleed, Heartwarming, and Increased Help
by Matthew Finkel 26 Apr '14

26 Apr '14

Hi All, Below is an email we sent last week to almost all of the bridge operators who provided contact information for their bridge(s). For those operators we missed and for those we couldn't contact, this hopefully provides some useful information. All the best, Matt ----------------------------------------------------------------------- Hi Tor Bridge Relay Operator! Unfortunately this email must begin with bad news, but it gets better. Due to the recent Heartbleed OpenSSL vulnerability that was disclosed earlier this week, we are reaching out to you to ask that you install an updated version of OpenSSL. The vulnerability has the potential to decrease the security of your bridge as well as the anonymity of any user connecting to your bridge. As a result of this, we also ask that you generate a new identity key due to the possibility that your current one was leaked. The process to upgrade your version of OpenSSL depends greatly on your operating system. Please ensure you are using a version that was released within the past four days, see the Heartbleed website[0] for more details on the vulnerability and for which versions are affected. Please do this before you regenerate your identity key. When this is done, you will need to restart Tor. At this point you can ask us to retest your bridge to confirm that it is not vulnerable anymore. Next, to regenerate your identity key simply stop Tor and delete the current key. This is done by opening Tor's Data directory and removing the contents in the keys/ directory. Tor's Data directory is located at /var/lib/tor, by default. Let us know if you have trouble locating it. When this is complete, start Tor and it will automatically create a new identity for you. See the recent blog post for many more details: https://blog.torproject.org/blog/openssl-bug-cve-2014-0160 Now that the bad news was said, we want to take this opportunity to thank you, from the bottom of our hearts, for volunteering to run a bridge relay. We know we do not say it often, but it is really appreciated! Please let us know if you have any question, concerns, or suggestions, especially related to how we communicate with you and how bridge relay operators can be more involved. Lastly, if you are not already running the obfsproxy pluggable transport[1] (i.e. obfs3) on your bridge, please follow the Debian instructions[2] (for a Debian-based system) on the website and install it. Your bridge is a great contribution to the Tor network, however as censorship on the internet increases around the world users are forced to use a pluggable transport. Tor does not understand how to communicate with them by default, though. Therefore we are asking that all bridge operators install obfsproxy and help as many users as possible. In addition, also consider subscribing to the tor-relays mailing list[3], if you are not already; we will be posting instructions on how to maximize the contribution of your bridge on that list every now and then. [0] http://heartbleed.com [1] https://www.torproject.org/docs/pluggable-transports.html.en [2] https://www.torproject.org/projects/obfsproxy-debian-instructions.html.en#i… [3] https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays Again, thank you for running a bridge relay and sorry for the bad news. Let us know if you have any questions or if you have any suggestions. All the best, Matt The Tor Project

8 10

Relay reading more than it writes??
by Rupert Roe 26 Apr '14

26 Apr '14

Hi All, I recently started running these two relays on raspberry Pis in the UK: http://torstatus.blutmagie.de/router_detail.php?FP=515a9887a426c1dc2bb4b9b1… http://torstatus.blutmagie.de/router_detail.php?FP=e3e6a7de02caa12ac5712884… Both of my relays seem to consistently read more from the network than they write, and I can't figure out why. Are my relays dropping loads of packets? If so is that harming the speed or reliability of the network? Why are my relays doing this when other ones seem to have a perfect read / write balance?? If anyone has any ideas why this is happening or how I could troubleshoot the issue I'd be really grateful! Thanks, Rupert

1 0

Please need urgent help with the DNS resolver of a fast exit relay
by s7r＠sky-ip.org 25 Apr '14

25 Apr '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi, The servers from my ISP are not stable or good enough to handle the traffic for this Tor exit router. I get this in the log very often: Apr 24 15:14:07.000 [notice] Circuit handshake stats since last time: 91633/91636 TAP, 15962/15962 NTor. Apr 24 17:40:45.000 [warn] eventdns: All nameservers have failed Apr 24 17:40:45.000 [notice] eventdns: Nameserver <ip>:53 is back up Both nameservers fail and come back after 1 second, or less. I don't know what impact will this have on the exit node. Is it any problem at all? I have decided also to setup my own DNS resolver and not use the ones from ISP, so I have installed named. What I need help is, for your someone to tell me exactly how do i have to edit named.conf in order to: 1. Enable DNSSEC, for the clients who want to use it. Not make it a requirement, just enable it and prefer it over normal DNS if and when possible. 2. Be able to resolve all TLDs as described here: https://trac.torproject.org/projects/tor/wiki/doc/DnsResolver#DNSResolverSe… Now I can clearly understand the message from that post but there is no instruction anywhere about how to do it, those links for Alt Roots are broken. Is this a requirement? Who needs to resolve silly TLDs not supported by IANA / ICANN anyway? 3. Cache the records for as long as possible - my relay is already using a lot of traffic so I have to spare as much as I can. Please provide me with a good named.conf and description of settings so I can properly configure a good DNS resolver for my relay. Thank you in advance! -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.17 (MingW32) iQEcBAEBCAAGBQJTWTnUAAoJEIN/pSyBJlsRtN8IAJK8ndrb6IdW+PRpynTu5gzH /6ID3k3uO+EX1jKDSrSMzUlfaOZT0UIVXX/KKxqJSa4YQH4MMGcWfCYXkv+bdFC0 s3ABvAWOeklX5KxUwGWaEJJND+Zu4nstIcVTFpjKpbiFJ7mdzjlDVSCsZFXYBVoV tOY7amgAoQCxNsG0aBKUKeArRSJ03jcicD/92PkL8ro2IB6FItusp5Qywcp12Nhq mXEJdD8l/5jSS1epaaZJ6LzDFyyZsVKsxK8EkBxkYtblkk8WxUnkz4gXrP88cnMC rHb8gqLBvHqjLUn1fKtmJbxJ/J1qEa+2PyoJpzkh4hQxXSZ52TskWKSi0eR7j5E= =675a -----END PGP SIGNATURE-----

2 2

Exit node rejection of special IPv4 blocks
by Zack Weinberg 24 Apr '14

24 Apr '14

I'd like a sanity check on this list of special-purpose IPv4 blocks which I'm currently forbidding in the CMU exit node's policy. I'm most uncertain about denying access to multicast (224.0.0.0/4) and 6to4 router anycast (192.88.99.0/24) -- I *think* there are no scenarios where someone would actually need to get at either of those via Tor, but I could be wrong. # Reserved IPv4 addresses, sorted by RFC and then numerically reject 255.255.255.255/32:* # RFC 0919: "limited broadcast" reject 224.0.0.0/4:* # RFC 1112: multicast reject 240.0.0.0/4:* # RFC 1112: future addressing modes reject 0.0.0.0/8:* # RFC 1122: "This host" source address reject 127.0.0.0/8:* # RFC 1122: Loopback reject 10.0.0.0/8:* # RFC 1918: private use reject 172.16.0.0/12:* # " " " reject 192.168.0.0/16:* # " " " reject 198.18.0.0/15:* # RFC 2544: test environments reject 192.88.99.0/24:* # RFC 3068: 6to4 relay anycast (???) reject 169.254.0.0/16:* # RFC 3927: link-local reject 192.0.2.0/24:* # RFC 5737: documentation reject 198.51.100.0/24:* # " " " reject 203.0.113.0/24:* # " " " reject 100.64.0.0/10:* # RFC 6598: "shared space"/"carrier grade NAT" reject 192.0.0.0/24:* # RFC 6890: future special purposes TIA, zw

3 2