- tor-relays - lists.torproject.org

tor relay recommended upgrade procedure?
by Zenaan Harkness 30 Mar '14

30 Mar '14

Currently running Debian's stable/wheezy version of tor which 0.2.3.25 on my first relay, gracemissionstor. I discovered the torproject deb repository here (of course): https://www.torproject.org/docs/debian The following google search: debian upgrade site:torproject.org didn't give much. But the following search: "tor relay" upgrade site:torproject.org gave: https://blog.torproject.org/blog/lifecycle-of-a-new-relay and the FAQ which includes: https://www.torproject.org/docs/faq.html.en#UpgradeOrMove which relates how to keep the same relay id when upgrading. Is there a recommended procedure for upgrading tor relay? Should I upgrade asap now that I've realised torproject has more recent (0.2.4) stable version of tor? Or should I just wait until I have to reboot the server (don't know when that could be) or until a security alert comes around from tor developers? Perhaps I should just rely on the debian package to do the right thing regardless (which for most services is to restart the service, but I guess could be 'do nothing until next reboot' if the packager decided that was wise). Seeking some guidance on this issue thanks, Zenaan

4 7

Mikrotik implementation
by Wolle Brandstätter 29 Mar '14

29 Mar '14

*Dear list members,* *I was thinking about implementing a node on a Mikrotik Router which is located in one of my companies datacenters with an 1Gig Uplink. * *Do you already have some experience in deploying TOR on this kind of routers?I found an interesting tutorial on how to get TOR running on those kind of devices.http://wiki.mikrotik.com/wiki/Use_Metarouter_to_Implement_Tor_Anony… <http://wiki.mikrotik.com/wiki/Use_Metarouter_to_Implement_Tor_Anonymity_Sof…> * *Await your answer.* *Cheers,Wolle*

1 0

2.5.3-alpha packages
by Delton Barnes 28 Mar '14

28 Mar '14

Is the nightly repository currently the Debian repository to use for 2.5.3-alpha packages? I ask because I am looking to move off of nightlies and onto more stable packages once they are available. Am running scramblesuit so need 2.5.x. Thanks, Delton

1 0

TTTT scoreboard
by Sebastian Urbach 28 Mar '14

28 Mar '14

Dear list members, The TTTT scoreboard and the involved systems are in need for some adjustments. Anupam is working on it and we expect that the issues are resolved on this weekend. Sorry for the interruption. -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ---------------------------------------------- Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. ---------------------------------------------- Benjamin Franklin (1706 - 1790), Inventor, journalist, printer, diplomat and statesman

1 0

Re: [tor-relays] TTTT
by Sebastian Urbach 28 Mar '14

28 Mar '14

Hi Renke, Thanks, we are looking into it asap. On March 28, 2014 2:13:42 PM renke(a)mobtm.com wrote: > Sebastian, > > > http://datarepo.cs.illinois.edu/relay_scoreboard.html > > I believe your updater script for the scoreboard is broken - the values are > unchanged since 2014-03-17 :) > > Renke > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

Metrics for assessing EFF's Tor relay challenge?
by Roger Dingledine 28 Mar '14

28 Mar '14

Hi Christian, other tor relay fans, I'm looking for some volunteers, hopefully including Christian, to work on metrics and visualization of impact from new relays. We're working with EFF to do another "Tor relay challenge" [*], to both help raise awareness of the value of Tor, and encourage many people to run relays -- probably non-exit relays for the most part, since that's the easiest for normal volunteers to step up and do. You can read about the first round from several years ago here: https://www.eff.org/torchallenge To make it succeed, the challenge for us here is to figure out what to measure to track progress, and then measure it and graph it for everybody. I'm figuring that like last time, EFF will collect a list of fingerprints of relays that signed up "because of the challenge". One of the main pushes we're aiming for this year is longevity: it's easy to sign up a relay for two weeks and then stop. We want to emphasize consistency and encourage having the relays up for many months. So what are the things we'd want to track? - Number of relays signed up that are Running, over time. - Total bandwidth history of these running relays, over time. - Maybe a graph showing the total number of bytes ever contributed by these relays? That would impress people perhaps. - Total consensus weight of these running relays, over time. - Something emphasizing duration -- e.g. the total consensus weight of the subset of the relays that have been in the consensus for 90% of the past month, 2 months, 6 months, etc. Are there better ideas here I hope? We'll want to be cognizant that if we're in the first week of the challenge, the 2 month graph will be empty and thus look sad. - Something comparing the above numbers to the total numbers. Given how huge some of the relays are lately, it would be easily to visualize the new contribution as a tiny irrelevant fraction, which could be disheartening to new relay operators even if their relays will actually become a big deal with some patience. What are some strategies for making this work right? E.g. a layer graph showing y layered on top of x where y is the new contribution, rather than a percentage-of-total graph that shows approximately 0%. We could also imagine more niche categories. For example, if we're hoping to get people to sign up relays at universities, we could imagine that the folks running the challenge give us a list of fingerprints of relays that self-identify as being at universities, and then we do up the same set of graphs with that subset of relays. So, Christian, others, how much of this is possible as-is or with some limited tweaking, with Globe and related scripts? I am hoping the answer is most of it. :) I also cc Karsten because a lot of this overlaps with the metrics scripts, but I am expecting Karsten to push back against the idea of integrating these measurements more with the metrics project. Any other ideas for what to measure to help people know whether their contribution is being worthwhile? [*] Please don't take this mail as any official announcement, or timeline, or any of that. At this point we need to collect people to help make this happen, not collect news stories. Thanks! --Roger

3 4

TTTT
by Sebastian Urbach 28 Mar '14

28 Mar '14

Dear list members, The next big data review regarding the "Trying Trusted Tor Traceroutes" project was initiated this week. It will probably take a while (weeks) before we have solid conclusions. We are very close to 100 complete runs from different IP's, in fact 99 right now. I hope that we will reach this goal very soon :-) We are not sure yet if we gathered enough data, but time will tell. We want to thank you for your support and if you want to make sure that we have more data in case the amount we collected turns out to be insufficient, then join us or keep running multiple rounds. Project: http://web.engr.illinois.edu/~das17/tor-traceroute_v1.html Results: http://datarepo.cs.illinois.edu/relay_scoreboard.html I make sure that this list is getting the results from the data review before anyone else. -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ---------------------------------------------- Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. ---------------------------------------------- Benjamin Franklin (1706 - 1790), Inventor, journalist, printer, diplomat and statesman

4 5

Avoiding sinkholes
by ramo＠goodvikings.com 28 Mar '14

28 Mar '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Heya List I currently run a VPS which hosts both my mailserver and my tor relay / exit. Recently I sent an email from this mailserver and had it bounce back. It seems the receiving mailserver subscribes to the spambot list CBL (http://cbl.abuseat.org) and denied it because my IP address was on that list. It's on that list since at some point a botnet talking through tor to its C&C server used my exit node to do so - The C&C server has since been replaced with a sinkhole. That was logged, my server was deemed infected and bam, I'm blacklisted. The site that did the blacklisting kindly has a good description of what happended (including the sinkhole IP address) and allowed an automatic delisting. I'm able to update my exit policy so it doesn't happen again, however I'd like a somewhat more proactive approach. So my question is - Does anyone know of a publicly available list of sinkholes created for botnets? If such a list exists I can dynamically update either my exit policy or firewall appropriately. Has anyone implemented such a system already? (obviosuly this only works for sinkholed botnets - but if anyone knows how to stop all botnets I'm all ears....) Cheers Ramo -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.14 (GNU/Linux) iQEcBAEBAgAGBQJTNQpGAAoJEAXQWoW8lug/mdkH/jqK5ndFWbVrRnNV7a8IqgYl 4iiR6TUYLjGEdcz8VDZ+cOkW0uCQkOvD6RWl/kWHKmA4iy7alFgbKE4Lkcg4QgBB 7EgNYww3zBbj1NX5rtRN7POge2n4ns7Y7whw0qbvHXE0ur74iLyy5H3hHZeWoosU g6t9mCsMpEpGAvbkzkDxo+idAdxYe+JiB3iaAAEUDtzeStOG5RJ/qrg8JM+U7ofA bWPehBV8+V8E//4G/XLsePCciBN0071ylg+YoGcxDpM97WHvmQKbi5VU3KfQJFTB AFaQ+7ib1BNhe7KEC7V0Iha6Yu/BTNhDRA/0i1C3pad32HQsfGvep261yq+KBjc= =Wemh -----END PGP SIGNATURE-----

3 3

the obfsproxy bundle, and decrease in number of users to my bridges
by Viking God 27 Mar '14

27 Mar '14

A repost, as I didn't get any answers when I posted in another thread: Where can I download an obfsproxy bridge bundle nowadays? It seams to have disappeared. I use both win and linux(but not debian/ubuntu). I have found dual information pages about setting up obfsproxy+tor in Debian/Ubuntu Here: https://www.torproject.org/projects/obfsproxy-instructions.html.en And here: https://www.torproject.org/projects/obfsproxy-debian-instructions.html.en Why dual instructions for Debian/Ubuntu? But no instructions for other OS:es, and no direct download links with compiled packages/programs here: https://www.torproject.org/dist/ How do you suppose that people will be able to help setting up obfsproxy bridges, when there isn't any way to get instructions or packages/programs? Previously I ran an obfsproxy bridge and saw the amount of traffic get lower and lower, at the end it was only about 2-10 MB of traffic per week and with very few users. Some weeks I go no users so I stopped wasting my electricity and stopped running the obfs-bridge. But now I would like to try again after a couple of months pause. I'm interested to see if the Internet-blocking in Turkey might have caused some more traffic. I also used to run a normal bridge up until a couple of weeks ago but saw the traffic get as low as around 50MB per week, while normally I used to get around 1-2GB per week so I shut it down too. I asked myself: "What's the point of wasting energy and at the same time making it easier to hack into my network, when I'm not even helping the world?". So I shut it down too. Perhaps some changes in the tor network after the release of Tor 0.2.4 has reduced the number of bridge and obfsproxy users globally? Due to the constant flow of bugs in the different tor-related software and bundles, my first guess is that the problem is with changes in Tor plus related software. A look at the bug tracker makes me wonder if there are more things in the Tor related software that do work or don't work??? But perhaps more bridges are blocked nowadays by the filters that various countries apply to the Internet? Or perhaps less countries block their Internet users so less people need to use bridges? Or perhaps a lot of new bridge operators have arisen, making every bridge receive less traffic? My ISP isn't known for blocking anything and I've never heard of any government blocking of Tor in the EU, so the problem is probably not with my ISP nor the EU. I have always been running the latest stable release of the bundles, so It doesn't have anything to do with old versions. So my questions: Where can I find a obfsproxy bridge bundle for rpm-linux and for windows? Is there any good explanation to why the traffic to my normal bridge and my obfsproxy bridge got lower and lower after the release of tor 0.2.4 as stable?

2 1

Tor-Plugin for munin
by Martin Weinelt 27 Mar '14

27 Mar '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Everybody likes graphs, right? I tried some of the available munin plugins, but none of those were really working anymore. So I sat down and began writing my own, using stem, which is really awesome. These are really early stages, but it already supports autoconf determination and suggestions. If you want to take a look, it is hosted on github[1]. At the moment it supports a connection graph, getting its data from orconn-status. More graphs are possible, but not yet implemented. Ideas are welcome. Regards, Martin Weinelt [1] https://github.com/mweinelt/munin-tor -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJTMhmTAAoJEL1KoFKPY/F+Hs0H/2X3RwoyIMJrAximYeqMTDbN 5w5nOwi+iv0Klr2Pe4bkSIR+OHoTp7lUHFlEGHk7WC/Z6LE0luCHEmQbRS0S9a6o e0gcTczRFfxW/BNLUMeiD0SbKLromdDBJtGFM94Eqr9da/CpiicLG4sBkOwO0k8p 2NF8cBSrwqpLlg+FdA+wIomFUAl4Ph/qKRNN6NALeQqxkLFI1vQxmJarC+y9bV6Q z+g8ccn5jqhaJm4rX0j9/MzSspwtf5yQ+2pD6+QCroXynbMq5AQjU3BTb9VCk9jW eofy3LlP0LnVw9nFBKpGWWNFyYfG/cptrORLwMBfuaHqscYrbAAdcwlu0D4nxwc= =H5tI -----END PGP SIGNATURE-----

2 2

log: Error binding network socket to 203.217.31.172: Cannot assign requested address
by Zenaan Harkness 27 Mar '14

27 Mar '14

>From here: Mar 27 16:50:35.000 [warn] Error binding network socket to 203.217.31.172: Cannot assign requested address to here: Mar 27 23:56:46.000 [warn] Error binding network socket to 203.217.31.172: Cannot assign requested address I got 828 of those messages. Why no socket number, or more information in the logs to debug this? Although it only happened in that time frame above - not happening any more. TIA Zenaan

1 0

Tor relay setup
by eugene zhukovsky 26 Mar '14

26 Mar '14

Hi, I am trying to setup Tor relaying, but it doesn't work so far. Windows 8, private vpn. I opened ports 80,443,9001 and 9030 (both TCP and UDP) on my Comcast router to be forwarded to the box I'm trying to configure. I added inbound and outbound rules in the firewall setup for ports 80,443,9001 and 9030 (both TCP and UDP) but I'm still getting Mar 15 15:30:58.654 [Warning] Your server (62.210.167.197:443) has not managed to confirm that its ORPort is reachable. Please check your firewalls, ports, address, /etc/hosts file, etc. Mar 15 15:30:58.658 [Warning] Your server (62.210.167.197:9030) has not managed to confirm that its DirPort is reachable. Please check your firewalls, ports, address, /etc/hosts file, etc. Please advise, ----------- Best wishes, Gene

5 8

ORPort is unavailable after a couple of minutes of successful self-testing
by Tachkov Sergey 25 Mar '14

25 Mar '14

Hello, We have previously set up and adjusted a non-exit node with the following key parameters: ORPort 443 NoListen ORPort 127.0.0.1:4443 NoAdvertise After upgrading tor up to the latest version (0.2.4.21) we started receiving in log the following: Mar 23 11:53:06.000 [notice] Now checking whether ORPort 1.2.3.4:443 and DirPort 1.2.3.4:9030 are reachable... (this may take up to 20 minutes -- look for log messages indicating success) Mar 23 11:53:07.000 [notice] Self-testing indicates your DirPort is reachable from the outside. Excellent. Mar 23 12:13:06.000 [warn] Your server (1.2.3.4:443) has not managed to confirm that its ORPort is reachable. Please check your firewalls, ports, address, /etc/hosts file, etc. Mar 23 12:33:06.000 [warn] Your server (1.2.3.4:443) has not managed to confirm that its ORPort is reachable. Please check your firewalls, ports, address, /etc/hosts file, etc. Firewall and the application which redirects traffic to the 4443 port haven't changed. What may be the cause of that?

2 2

Tor Relay Performance
by Sebastian Urbach 25 Mar '14

25 Mar '14

Hi, Everytime i speak with colleagues i wonder that the most performance related options for TOR relays are unknown. I just started to write down what i know and i would be happy if someone else could benefit from that. http://key-server.org -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ---------------------------------------------- Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. ---------------------------------------------- Benjamin Franklin (1706 - 1790), Inventor, journalist, printer, diplomat and statesman

5 4

Port 8118 Traffic?
by Dennis Crawford 25 Mar '14

25 Mar '14

Hello - I just recently installed a Tor Relay and now I'm seeing a TON of port 8118 denied requests in my log. Mar 21 17:24:51 kendra kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=c8:0a:a9:9e:2f:02:00:90:1a:a2:a0:7e:08:00 SRC=162.211.126.188 DST=72.90.68.179 LEN=48 TOS=0x00 PREC=0x00 TTL=122 ID=16300 DF PROTO=TCP SPT=4853 DPT=8118 WINDOW=65535 RES=0x00 SYN URGP=0 Mar 21 17:24:53 kendra kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=c8:0a:a9:9e:2f:02:00:90:1a:a2:a0:7e:08:00 SRC=162.211.126.227 DST=72.90.68.179 LEN=48 TOS=0x00 PREC=0x00 TTL=122 ID=19011 DF PROTO=TCP SPT=1146 DPT=8118 WINDOW=65535 RES=0x00 SYN URGP=0 Mar 21 17:24:55 kendra kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=c8:0a:a9:9e:2f:02:00:90:1a:a2:a0:7e:08:00 SRC=162.211.126.173 DST=72.90.68.179 LEN=48 TOS=0x00 PREC=0x00 TTL=122 ID=28405 DF PROTO=TCP SPT=3137 DPT=8118 WINDOW=65535 RES=0x00 SYN URGP=0 Mar 21 17:24:57 kendra kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=c8:0a:a9:9e:2f:02:00:90:1a:a2:a0:7e:08:00 SRC=216.245.222.105 DST=72.90.68.179 LEN=52 TOS=0x00 PREC=0x00 TTL=56 ID=24995 DF PROTO=TCP SPT=2998 DPT=8118 WINDOW=65535 RES=0x00 SYN URGP=0 Mar 21 17:24:59 kendra kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=c8:0a:a9:9e:2f:02:00:90:1a:a2:a0:7e:08:00 SRC=162.211.126.180 DST=72.90.68.179 LEN=48 TOS=0x00 PREC=0x00 TTL=122 ID=21683 DF PROTO=TCP SPT=3372 DPT=8118 WINDOW=65535 RES=0x00 SYN URGP=0 Mar 21 17:25:01 kendra kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=c8:0a:a9:9e:2f:02:00:90:1a:a2:a0:7e:08:00 SRC=173.234.116.173 DST=72.90.68.179 LEN=48 TOS=0x00 PREC=0x00 TTL=247 ID=9188 PROTO=TCP SPT=1976 DPT=8118 WINDOW=65535 RES=0x00 SYN URGP=0 I'm not configured at 8118. My config: SocksPort 72.90.68.179:9050 # Bind to this adddress:port too. SocksPolicy accept 72.90.68.176/29 ControlPort 9051 ORPort 9001 DirPort 9030 # what port to advertise for directory connections On my firewall, I'm allowing: TCP_IN: 9030,9001,9050,9051 and TCP_OUT: 9030,9001,9050,9051 Am I doing something wrong? Why am I getting all this 8118 traffic? Any help would be greatly appreciated. Dennis

3 2

Raspberry Pi binary .debs - 0.2.4.21
by Gordon Morehouse 25 Mar '14

25 Mar '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello all, I've finally released[1] signed binary .debs for Tor 0.2.4.21 for Raspberry Pi. All the usual "random dude's binaries" apply, but at least these are signed with my PGP key and distributed with hashes. They're really for temporary Pi testing or convenience, be paranoid and build from source following the procedure alluded to in the project README. Check the Cipollini Project README[2] for more information about the (very nascent) project. Best, - -Gordon M. 1. https://github.com/gordon-morehouse/cipollini/tree/master/raspbian_packages… 2. https://github.com/gordon-morehouse/cipollini -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJTLg/MAAoJED/jpRoe7/ujO+8H/3c3RJzsYEtWq8/BJcwnW0nP awxBU3Lb0iAt9JNOw7zcdtA6WdC6eIHgKYZ0nH7Vwc4+bHn/RGyvLrD4n11pgB2I eKz2ikQXSWb5jqNQD7sCwQeh5drLxH0VMedOtirpMlqyUteKJOMQfbxmDRA5MBtN KXSSsbKxatnnVA/3/9GFO8oLDEfA0IXp5/RN4bjXDqzW9jHJfC7LVRxq8LK3RRif MYTuzNV3e8CQ9+q5fyqgCBPLA7OBIhH+wVKOVwU/RLlyQTRUqtV9b9Fe7CXXj5eZ YgUgZeNVQZ3gBtSuWWuVHGPu+ZKskSvVKu8Gcj71XCnu6LfI+3DyRWmhCXRU5i4= =yTek -----END PGP SIGNATURE-----

4 7

New obfsproxy release: obfsproxy-0.2.7 [bridge operators: please upgrade!]
by George Kadianakis 24 Mar '14

24 Mar '14

Hello, a few days after the release of obfsproxy-0.2.6, we spotted a bug where scramblesuit would basically reject clients if they try to connect a second time after a short amount of time has passed [0]. This is a serious correctness bug and bridge operators are advised to upgrade to obfsproxy-0.2.7 as soon as possible (we want to start suggesting scramblesuit to users and we need to make sure that most bridges have already upgraded by then). You can use git master or pip to upgrade to 0.2.7. We have also notified the obfsproxy Debian maintainers and we should soon have obfsproxy-0.2.7 packages ready (we will send an email to this list when they are ready). Furthermore, obfsproxy-0.2.7 clients now support SOCKS5 (thanks Yawning!) and the changes also include a few performance enhancements for obfs3 and scramblesuit. Please upgrade your bridges. Thanks! PS: We will do yet another obfsproxy release soon-ish (probably in the next 2 weeks) which will include some more scramblesuit improvements and other miscellaneous code changes. Again, we will inform you by sending an email to this list. [0]: https://trac.torproject.org/projects/tor/ticket/11100

8 9

External connections to port 9050
by Greg W 24 Mar '14

24 Mar '14

I turned on some logging on my firewall today to help troubleshoot and issue and noticed a load of connections from external addresses to port 9050 on my exit node. I don't think that should be publicly accessible. Am I wrong about it being publicly accessible and does anyone else see lots of connection attempts on that port? Thanks, Greg

4 7

Why would consensus weight would be declining like this?
by Tora Tora Tora 23 Mar '14

23 Mar '14

Declining dramatically https://atlas.torproject.org/#details/90743CFA1B93295B9334CC0C625D22990AABA… vs https://atlas.torproject.org/#details/CC2F7C6ED12B67CB3882B98213E02DEF2CB82… that is holding steady

2 3

Exiting only port 8333
by Mike Hearn 23 Mar '14

23 Mar '14

I would like to be an exit for port 8333 only. I have configured my relay to do this, but I am not being listed with the relay flag and do not see any traffic exiting my node (at least not using arm). I saw an FAQ that says this is because you have to exit web traffic to get marked as an exit. I do not wish to do this. Is there any way to exit just one port?

4 7

Re: [tor-relays] tor-relays Digest, Vol 38, Issue 27
by Oliver Schönefeld 23 Mar '14

23 Mar '14

Am 22.03.2014 um 21:04 schrieb tor-relays-request(a)lists.torproject.org: > Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > Today's Topics: > > 1. new fingerprint after update (Oliver Sch?nefeld) > 2. Re: new fingerprint after update (Alexander Dietrich) > 3. Re: new fingerprint after update (I) > 4. Re: Relay configuration for FreedomBox (James Valleroy) > 5. Re: new fingerprint after update (Roger Dingledine) > 6. Re: Relay configuration for FreedomBox (Lunar) > 7. Re: Relay configuration for FreedomBox (Lance Hathaway) > > Von: Oliver Schönefeld <oliver.schoenefeld(a)me.com> > Betreff: [tor-relays] new fingerprint after update > Datum: 22 .März 2014 15:26:07 MEZ > An: tor-relays(a)lists.torproject.org > Antwort an: tor-relays(a)lists.torproject.org > > > Hi guys, > > i updated from Tor 0.2.3.25 (relay 266C0CADC79F802C554019887324A57332A1DA70) to Tor 0.2.4.21 yesterday and the relay fingerprint changed to 07E333A3B979C27739096C5B2EE10D7C8E3D8FFD. > > Is there any way to get the new version working with the old fingerprint? > I looked in the manual and tried adding a DirAuthority line in the torrc file, which looks as the following: > DirAuthority 123tor *:9030 FINGERPRINT > > But then Tor doesn't start. > > I also tried writing the old fingerprint in the fingerprint file, but it's changed to the new one everytime i start Tor. > > > So thanks for your help in advance and have a nice weekend everybody! > > Oli > > > > Von: Alexander Dietrich <alexander(a)dietrich.cx> > Betreff: Aw: [tor-relays] new fingerprint after update > Datum: 22 .März 2014 15:47:29 MEZ > An: tor-relays(a)lists.torproject.org > Antwort an: tor-relays(a)lists.torproject.org > > > Is it possible that either the "DataDirectory" setting changed due to the update or the directory content? > yes, because vidalia isn't part of the game anymore - yes i'm a little late with the update :( > Best regards, > Alexander > --- > PGP Key: 0xC55A356B | https://dietrich.cx/pgp > > On 2014-03-22 15:26, Oliver Schönefeld wrote: >> Hi guys, >> i updated from Tor 0.2.3.25 (relay >> 266C0CADC79F802C554019887324A57332A1DA70) to Tor 0.2.4.21 yesterday >> and the relay fingerprint changed to >> 07E333A3B979C27739096C5B2EE10D7C8E3D8FFD. >> Is there any way to get the new version working with the old >> fingerprint? >> I looked in the manual and tried adding a DirAuthority line in the >> torrc file, which looks as the following: >> DirAuthority 123tor *:9030 FINGERPRINT >> But then Tor doesn't start. >> I also tried writing the old fingerprint in the fingerprint file, but >> it's changed to the new one everytime i start Tor. >> So thanks for your help in advance and have a nice weekend everybody! >> Oli >> _______________________________________________ >> tor-relays mailing list >> tor-relays(a)lists.torproject.org >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > > > Von: I <beatthebastards(a)inbox.com> > Betreff: Aw: [tor-relays] new fingerprint after update > Datum: 22 .März 2014 17:58:58 MEZ > An: tor-relays(a)lists.torproject.org > Antwort an: tor-relays(a)lists.torproject.org > > > ...and the t-shirt counter at Atlas.torproject.org resets > there are worse things than that - but thanks for the reminder to claim it ;) > > Von: James Valleroy <james.valleroy(a)gmail.com> > Betreff: Aw: [tor-relays] Relay configuration for FreedomBox > Datum: 22 .März 2014 19:56:12 MEZ > An: tor-relays(a)lists.torproject.org > Antwort an: tor-relays(a)lists.torproject.org > > > On Wed, Mar 19, 2014 at 9:25 AM, Lance Hathaway <qhltx(a)yahoo.com> wrote: >> If you're going to be running these as bridges, it seems to make sense >> to include obfsproxy support, probably with obfs3 and scramblesuit [0] >> enabled right off the bat. > > Thanks for the information. Is it likely that obfs3 and scramblesuit > will be usable in the long-term? Or will they need to be deprecated at > some point like obfs2? > > Also, if obfs3 or scramblesuit were deprecated, but some FreedomBoxes > continued to run those transports, what would be the result? Would the > worst case be that the bridge is no longer usable by some, as in [0]? > > The reason that I'm asking is that FreedomBox is currently working > within Debian "testing" but our target is Debian "stable". Once our > packaged configuration is frozen for the next stable release, it will > be more difficult for us to push changes other than security fixes. > > [0] https://trac.torproject.org/projects/tor/ticket/10314 > > > > > Von: Roger Dingledine <arma(a)mit.edu> > Betreff: Aw: [tor-relays] new fingerprint after update > Datum: 22 .März 2014 19:57:50 MEZ > An: tor-relays(a)lists.torproject.org > Antwort an: tor-relays(a)lists.torproject.org > > > On Sat, Mar 22, 2014 at 03:26:07PM +0100, Oliver Schönefeld wrote: >> i updated from Tor 0.2.3.25 (relay 266C0CADC79F802C554019887324A57332A1DA70) to Tor 0.2.4.21 yesterday and the relay fingerprint changed to 07E333A3B979C27739096C5B2EE10D7C8E3D8FFD. > > https://www.torproject.org/docs/faq#UpgradeOrMove > >> I looked in the manual and tried adding a DirAuthority line in the torrc file, which looks as the following: >> DirAuthority 123tor *:9030 FINGERPRINT >> >> But then Tor doesn't start. > > Yeah, that's not at all what DirAuthority is for. Can you help us > understand what made you think this was a good idea to try, so we can > fix it in the man page? :) > >> I also tried writing the old fingerprint in the fingerprint file, >> but it's changed to the new one everytime i start Tor. > > Hopefully the above faq entry helps. > > Thanks for running a relay! > --Roger > > thank you so much, roger! i copied the old /keys folder and it's working like a charm. i basically ctrl+f'ed "fingerprint" in the stable manual and the DirAuthority property was the only one that made sense, since i don't run a bridge. but i have to admit that i didn't read the NOTE section... shame on my head. thank y'all! > > > > Von: Lunar <lunar(a)torproject.org> > Betreff: Aw: [tor-relays] Relay configuration for FreedomBox > Datum: 22 .März 2014 20:23:49 MEZ > An: tor-relays(a)lists.torproject.org > Antwort an: tor-relays(a)lists.torproject.org > > > James Valleroy: >> The reason that I'm asking is that FreedomBox is currently working >> within Debian "testing" but our target is Debian "stable". Once our >> packaged configuration is frozen for the next stable release, it will >> be more difficult for us to push changes other than security fixes. > > (Debian hat on:) I try to keep Debian backports as up-to-date as possible. > Are official backports out of your set of allowed packages as well? > > -- > Lunar <lunar(a)torproject.org> > > > > Von: Lance Hathaway <qhltx(a)yahoo.com> > Betreff: Aw: [tor-relays] Relay configuration for FreedomBox > Datum: 22 .März 2014 21:03:43 MEZ > An: tor-relays(a)lists.torproject.org > Antwort an: tor-relays(a)lists.torproject.org > > > Signierter PGP Teil > On 22/03/2014 11:56 AM, James Valleroy wrote: > > Thanks for the information. Is it likely that obfs3 and > > scramblesuit will be usable in the long-term? Or will they need to > > be deprecated at some point like obfs2? > > > > Also, if obfs3 or scramblesuit were deprecated, but some > > FreedomBoxes continued to run those transports, what would be the > > result? Would the worst case be that the bridge is no longer usable > > by some, as in [0]? > > > > The reason that I'm asking is that FreedomBox is currently working > > within Debian "testing" but our target is Debian "stable". Once > > our packaged configuration is frozen for the next stable release, > > it will be more difficult for us to push changes other than > > security fixes. > > > > [0] https://trac.torproject.org/projects/tor/ticket/10314 > > I can't speak to whether more pluggable transports will be deprecated > in future, but I'll go out on a limb here and say "probably." The > nature of things ensures that the capabilities of censors continue to > advance. And as they do, new approaches will be found and deployed to > bypass those advancing attempts to block the network. > > When bridges were first deployed, the fact that they weren't all > openly listed in a public directory made them more difficult to block. > Now, most plain bridges are very easy to block. When obfs2 was first > deployed, it was a solid protocol (I have no doubt). These days, China > is actively hunting down and blocking obfs2. There is very little > point to deploying either a plain bridge or an obfs2 pluggable > transport these days, especially on a mass scale. > > On the plus side, obfs3 is still pretty strong, and it's one of the > common pluggable transports right now. Scramblesuit is not live in the > official bundles yet (AFAIK), but it just released and has some pretty > robust-looking defenses against active probing and other attacks. If > you're working on something new to deploy, these should be included, > without a doubt. They may indeed be deprecated in future, and in the > worst case may become unusable or make the bridge more susceptible to > being blocked. But if you go with a plain bridge or obfs2, you're > already in your worst-case scenario. You have nothing to lose and > everything to gain by enabling the newest pluggable transports. > > I would highly recommend adding the Tor package repository to the > FreedomBoxes. As explained in [0], this won't always give you the > latest version of tor, but it will provide security fixes. My hunch is > that it will almost always also be a little fresher than Debian > stable. And given that network censors and network developers are > always going to be in an escalating arms race, enabling new releases > of Tor (and obfsproxy) directly from the project is going to make the > FreedomBox much more useful in the long term. > > -Lance > > [0] https://www.torproject.org/docs/debian > > > > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

"Invalid length on ESTABLISH_RENDEZVOUS."
by Tora Tora Tora 23 Mar '14

23 Mar '14

I am testing 0.2.5.2-alpha for non-exit relay and seeing lots of "Invalid length on ESTABLISH_RENDEZVOUS" errors. Any cause for concern?

2 1

Best price/efficiency ratio
by Trigger Happy 23 Mar '14

23 Mar '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi list, I'm running tor-relay (middle) on VPS from statnet.pl (reseller form Hetzner) https://globe.torproject.org/#/relay/C528972A915EEADE37F5B11A7AB7B571C89F46… Now i'm in top 50 of all relays for only 8,3 euro/month i think it's a good deal . Do You know better options ? - -- Trigger Happy jabber: triggerhappy(a)jabber.ccc.de torchat: xruq34bnhbqlkjtn -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJTLfftAAoJEEtm9wC9fGLFFJsP/RADCmlr3/8aTUrdefsOEgk8 CeDCQGasCuQ/iPNdJRCpILkiz7s+SM2FBzMLQVpDUiM5A9VD8aLOfnvhNGjKo4eo uaJUc7t1GrDlhDBzd4C7kV5o48hMeqP/61iDFR0eEO3sH5EIheV3io1fEzQc3XmW hGpgRR0SnfS0VDeQp4FhKXtxfiw4Dp7UMgRS9wQbI7TbFhdETkFjn4YvDIi1AfXg 8xH1xMUhfpJo4wa4RY1+UG+aa7X90HbF278QWlUnMdHiOr1VK3dgbRiV5cvYRF1U XZ6Jr+hDBWScn0dxxKWnebCqRIdh2mmn3G2aF9MdZ9WEaNwoNMzd+NAhUQy43vFr M3w3HZ3NJbVHA2WwQRFfVlg675Z4/PI+Uh60SGMHZoTXRVM2AFYQwUk9r4Mwbfwi qU8jj7pa228gwk5HYBgnOQMRFX/mpqe/Ww82qf/c1YispX+6JvevlfOKe2BF5X0t 66XIMNPJ+639h70XOcFJJyoe/mvbw21N0FZoShrFjAnoIDXyZek5LY1rGkdm4g5j 6w4F6RMQkEuK61eSFTC1lPhpUrUwkkCrBoU+Gg0rAFiqSYytT/rvSgtdlfbhcOlu SoMPY8rR6sG6b6Ib1YumiMXNc+fpT+9QbBxoaVxbORyLtvvb78dH8PcpQdwj79KK 9M0CeGy7A6Ex6tvcDVOf =h07G -----END PGP SIGNATURE-----

5 4

Relay configuration for FreedomBox
by James Valleroy 23 Mar '14

23 Mar '14

Hello, The FreedomBox project [1] is planning to include Tor in the upcoming 0.2 release. FreedomBox is intended to be used as an always-on server, so its Tor node has been configured as a bridge relay. There is also a need for FreedomBoxes to be able to find each other regardless of location or restrictive firewall. This feature is not yet completely implemented for FreedomBox, but it will likely involve each box running a Tor hidden service, and making the initial connection to other boxes over the Tor network. Here is the configuration that we are currently using in /etc/tor/torrc: ORPort 4431 BridgeRelay 1 Exitpolicy reject *:* It is based on example configuration for bridge relays given in the Tor documentation [2] but modified to still allow SOCKS connections. Do you see any vulnerabilities, attacks, or risks with the current configuration, and are there any changes that you would recommend? [1] https://wiki.debian.org/FreedomBox [2] https://www.torproject.org/docs/bridges#RunningABridge Thanks

4 6

new fingerprint after update
by Oliver Schönefeld 22 Mar '14

22 Mar '14

Hi guys, i updated from Tor 0.2.3.25 (relay 266C0CADC79F802C554019887324A57332A1DA70) to Tor 0.2.4.21 yesterday and the relay fingerprint changed to 07E333A3B979C27739096C5B2EE10D7C8E3D8FFD. Is there any way to get the new version working with the old fingerprint? I looked in the manual and tried adding a DirAuthority line in the torrc file, which looks as the following: DirAuthority 123tor *:9030 FINGERPRINT But then Tor doesn't start. I also tried writing the old fingerprint in the fingerprint file, but it's changed to the new one everytime i start Tor. So thanks for your help in advance and have a nice weekend everybody! Oli

4 3