- tor-relays - lists.torproject.org

(no subject)
by bbzxrmy wowman 09 Nov '13

09 Nov '13

high, i recently set my relay and also mailing list, however my screen name "BBZzXArmy does not show on the tor world map, can anyone confirm or help me with this im pissed at it zigzagarmy }{}{}{}{}{}{}{}{ BbZzXArmy PrajectoRkiDD ****MASS CHAIN MESSAGE read and spread to all your friendlists (. http://zeja11.blogspot.com/ .) 22eterniA .xex

3 2

Re: [tor-relays] exit and skype
by Jan Hendrik den Besten 09 Nov '13

09 Nov '13

> Date: Wed, 6 Nov 2013 17:12:37 +0000 > From: Thomas Hand <th6045(a)gmail.com> > To: tor-relays <tor-relays(a)lists.torproject.org> > Subject: Re: [tor-relays] exit and skype > Message-ID: > <CAKqc3T7u6mWC6CZLMoaEGkr2iUPe3rabgV-=fi=3LzP67w=oHA(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > If you want to continue using skype, you could invest in a VPN just to hide > it from your ISP and make microshaft think you are coming from a different, > non-tor related IP. > > Tom Thanks for the suggestion. Jitsi is working fine, in combination with running prosody on my server. Gf is happy too, fhew! One down, one to go (her mother).

1 0

Gmail forcing a password reset with tor birdy
by Zack Becker 08 Nov '13

08 Nov '13

I use Gmail for my junk email because of its storage. I would like to use Tor Birdy for thunder bird, but Google forces me to reset the password because of a "suspicious sign in prevented".

2 1

How to install Tor on Ubunt 12.10?
by The Maker 06 Nov '13

06 Nov '13

I want to run a relay that starts every time I login to my machine. I went to the page that discusses how to add the correct PPA to Ubuntu but it stops at 11.10. Is this also the PPA I should use for 12.04 or is there another one? Many Thanks, The Maker

3 2

Re: [tor-relays] exit and skype
by Jan Hendrik den Besten 05 Nov '13

05 Nov '13

> On Tue, Nov 5, 2013 at 2:54 PM, Lars Nood?n <lars.nooden(a)gmail.com> wrote: > > > On 11/05/2013 09:00 PM, Jan Hendrik den Besten wrote: > > > Boy, now I am in trouble... > > > > > > I run an exit node from my home address for a few weeks now, but my gf > > > starts complaining she cannot use Skype anymore to chat with her mum. > > > > > > I understand Microsoft blocks all tor exits from accessing Skype. Is > > there > > > anything I can do except converting the exit into a relay? > > > > You could try Jitsi or Blink. They're not the same as Skype but they > > are freer and the sound is better. > > > > /Lars Thanks for the suggestions. I would need something cross-platform (Linux, Windows, ipad). I'll try Jitsi.

1 0

Re: [tor-relays] Amazon abuse report
by tor＠tafb.xxx 04 Nov '13

04 Nov '13

I'm new to running a relay. There are lots of exit policies when I look at my atlas details: https://atlas.torproject.org/#details/DDB401F4CA108C6F6AF4E0DCE2DFC3407F577… Is this a pretty good exit policy list to prevent harassment from my ISP? Thanks! -Jamie M. > Putting the extensive exit restriction policy in the responses to take-down demands seems like a good idea. > > Robert

7 11

max TCP interruption before Tor circuit teardown?
by Gordon Morehouse 03 Nov '13

03 Nov '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello, I'm working on building support scaffolding[1] for Tor on Raspberry Pi and other small ARM single-board computers (SBCs). With the slower computers, sometimes too many attempts to connect to the ORPort (I am almost positive as part of TAP circuit building, but not *really* sure) can eventually cause Tor to consume more physmem than available and cause the oom-killer to kill Tor. Also, depending on the crappiness of the user's router, it's effectively a SYN flood, and can crash or impair consumer routers. My solution, so far, is to define (through trial and error on a per-machine basis, since [1] is only officially supporting 3 SBCs right now) limits on how many SYNs may be sent to the ORPort and the DirPort per second. This is done with iptables. I experimented, tuned the parameters and watched traffic for weeks and came up with a pretty good set of limits for a 950MHz Raspberry Pi: 4 SYNs/sec burst 10. (For those about to say the Pi is thus too slow to be used as a relay, it's quite capable of relaying *at least* 2.5Mbps, but *not* when it's getting SYN flooded.) So, sometimes hosts exceed this limit. Once the limit is exceeded, my current strategy is to use iptables REJECT to send an ICMP Service Unavailable (or whatever it's called, sorry no coffee yet) back to the hosts that triggered the filter. This is on a per-SYN basis. After watching the data, I noticed that some hosts just try to connect once or twice, or try to connect (during overload conditions) at reasonable intervals of tens of seconds to a few minutes. Other hosts will quadruple-tap the ORPort with SYNs, four in a row, and otherwise be much more aggressive with sending SYNs. I'm currently testing fail2ban[2] as a way to ban aggressive peers by changing that iptables REJECT to a DROP for a short period, in order to accomplish two things: 1. Encourage them to knock off their bad behavior (i.e., go away for a little while). 2. Free up CPU time, RAM and bandwidth because we don't have to construct and send ICMP packets to banned peers. Currently, if a peer violates the 4/sec burst 10 SYN limit more than 5 times in 60 seconds, that peer will be banned for 90 seconds. I'm trying to trim this down to the minimum that will protect the relay, and 90 seconds is a guess given some of my fears, read on... During an overload condition, my primary priority is to protect the relay, but of course I wish to do so with as little disruption to the Tor network as possible. So, here is a potential problem with my approach that I can think of, which could degrade service (mildly, for a few end users) on the Tor network. First, during a SYN flood type overload, some peers which have *existing* circuits built through the relay and are sending SYNs as normal traffic, will stochastically get "caught" in the filter and banned for a short time. If these hosts already have circuits open through the relay which is overloaded, I would prefer to preserve those circuits rather than break them. My defensive strategy versus overload here is to throttle new circuit creation requests, *not* to break existing circuits. So here's the $64,000 question: If a tor relay has a circuit built through a peer, and the peer starts dropping 100% of packets, how long will it take before the relay with the circuit "gives up" on the circuit and tears it down? I want to set my temp ban time *below* this timeout. Thus, unlucky peers that were caught in the filter and have circuits already built through the relay they will experience a brief performance degradation, but they won't lose their active circuits through the overloaded relay, and in the meantime hopefully the overload condition is becoming resolved. Is there such a timeout? There must be. Can someone tell me what it is? Or, is there a better way to protect low-resource machines (slow CPU, 512MB RAM) against the SYN flood "circuit creation storm" conditions which occasionally arise on the Tor network? Again, I must reiterate, machines with specs like these can be very good relays for home broadband users. The true goal of my project[1] is to build a set of software which enables a "plug and forget" relay for home broadband users that costs well under $100. [1] https://github.com/gordon-morehouse/cipollini [2] http://www.fail2ban.org/wiki/index.php/Main_Page Best, - -Gordon M. -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJSZAfXAAoJED/jpRoe7/ujGQ4H/jUUjdufoWw1qthjsqdf4ICO ejJXBuZ60O8TpuiT07EtZq9tSDsb5hLqjJMORNJWPJe3ffD7/BHv/6St0y0fkjFh svEFBwVMmkNfaDd65z2JaFBRnSQTsgtiOeOnQFQt1evWQMeVmFsvoMvVIbqGSkf6 NipJnfFeoAtt/6cCMl7+yIxmGGb1Udl0ZEmlVacIYtFr8MjgIo59vT94k7SuzV1N 4Na9PNeQ9WIBlZf9vyesHgnuzJA8hEkFyoP5Fc3bPT/e3WYdAIifswE6rhZVT+AQ 9rHRvBUVoYpMNyy0fqMY34rLYegelIYstsy26dmW+robJKDxGVC3zBeGbOtcEOE= =mSYu -----END PGP SIGNATURE-----

5 29

Re: [tor-relays] dynamically adjusting bandwidth
by starlight.2013q4＠binnacle.cx 03 Nov '13

03 Nov '13

>The question is, should I put in an adjustment for >'MaxAdvertisedBandwidth' during the backup window >or make any other change to advise remote relays to >de-prioritize the node for the duration? Another unanswered question now understood: As a consequence of a simple parameter tweak, Vidalia buggily zapped (for the second time) the relay configuration and turned off relaying. Quickly restored 'torrc' and restarted the relay, but noticed that the getinfo dir/server/authority observed bandwidth value (third of three) was zapped to a low value for about an hour. This had the effect of causing four out of nine authorities to remove the Guard flag and almost resulted in a consensus "not Guard" state. So the answer here is definitely DO NOT lower 'MaxAdvertisedBandwidth' during intervals when 'RelayBandwidthRate' is reduced for events like offsite backups. Doing so will probably cause the Guard flag to be removed when it is present. The only possible exception would be if one has insane amounts of bandwidth and the lowered value is still quite high. Seems unlikely that 'MaxAdvertisedBandwidth' has any immediate effect on the selection algorithm is only averaged into consensus bandwidth gradually, so probably it's best to not make temporary reductions.

2 1

connecting to obfsproxy bridge from OSX10.9 and TorBrowser-Pluggable-Transports-2.4.17-beta-2-pt3-osx-i386
by Paul Garrett Hugel 03 Nov '13

03 Nov '13

Please steer me to the correct list if off topic here Remote machine is Ubuntu obfsproxy bridge on amazon ec2 using ARM My local machine running 10.9 Mavericks with TorBrowser-Pluggable-Transports-2.4.17-beta-2-pt3-osx-i386 I read the trouble ticket #10030 https://trac.torproject.org/projects/tor/ticket/10030 changed the torrc file entries as indicated below ClientTransportPlugin flashproxy exec ./flashproxy-client --register :0 :9000 ClientTransportPlugin obfs2,obfs3 exec ./obfsproxy.bin managed Still cannot get the Browser to use the proxy Nov 01 22:55:58.740 [Warning] Could not launch managed proxy executable at './flashproxy-client' ('No such file or directory’). Nov 01 22:55:58.764 [Warning] Could not launch managed proxy executable at './obfsproxy.bin' ('No such file or directory’). Ok If I want to get serious and access my Ubuntu obfsproxy bridge on amazon ec2 what Tor components on local machine do I use and configuration Tor builds the circuits but browser can’t connect to proxy so Its non-functional for web browsing Thank you D922 B7B1 3A4D 9BF9 0927 DCA1 7A14 4B7D A3F4 8305

3 2

Re: [tor-relays] significance of different bandwidth values
by starlight.2013q4＠binnacle.cx 01 Nov '13

01 Nov '13

At 16:19 10/15/2013 -0400, starlight(a)binnacle.cx wrote: >Question: > >What the difference between the bandwidth >value given by > getinfo ns/name/xxxxx > >>> w Bandwidth=297 >and > getinfo dir/server/authority > >>> bandwidth 300000 375000 335872 Since no one answered the question and I now have an idea about it, I'll attempt an answer for future web-searchers. . . getinfo ns/name/<node-name> This appears to be a consensus bandwidth calculation generated by five of the nine Tor authority nodes. These nodes run a special relay control client that accumulates and analyzes bandwidth reporting by other Tor nodes via "signal" updates from a daemon control channel. Think they are called 'bwauth's. The value can swing wildly, but appears that the pattern is sinusoidal with an average close to the true bandwidth available from a relay. After a few days the swings in the value seem to dampen somewhat. This "consensus bandwidth" value appears to be what is used by the client nodes' relay path selection algorithm. getinfo dir/server/authority This appears to the observed bandwidth calculation derived from local node statistics. Is much more stable and accurate, but is "informational" and is not used in the path selection algorithms.

1 0

Cisco ASA
by starlight.2013q4＠binnacle.cx 31 Oct '13

31 Oct '13

For anyone running a Cisco ASA between their 'tor' relay and the Internet, some potentially useful info: The default ASA connection timeout is short and often results in 'telnet' sessions through VPN tunnels getting whacked. So one might add timeout conn 48:00:00 to a config to mitigate that issue. However a busy 'tor' relay instance will rapidly accumulate large numbers of dead connection table entries due to loss of FIN packets from flaky corners of Internet. I'm not 100% sure about this, but it seems these dead connection table entries can impair the formation of new connections, not to mention the obvious potential for excessive memory consumption on the ASA. The solution is: access-list tor-class extended permit tcp any host X.X.X.X access-list tor-class extended permit tcp host X.X.X.X any where X.X.X.X is the 'inside' server running 'tor' class-map tor match access-list tor-class policy-map outside class tor set connection timeout idle 0:06:00 As 'tor' sockets have a default KeepalivePeriod 300 any connection with an idle time of more than five minutes is a dead duck and can safely be removed. Checked this out carefully. The comment above was inspired by a seeming performance boost and increase in connections observed after the change was made, not by direct traffic analysis. Could be coincidental. The way to verify it's working is with the show conn addr X.X.X.X long command, which includes the idle timeout associated with each connection. If one has other services running on the same box as 'tor', it might be necessary to adjust the 'access-list' to take them into account.

1 0

Re: [tor-relays] Advice on dealing with ISP's response toDMCAtakedownnotice.
by tor＠t-3.net 30 Oct '13

30 Oct '13

Yeah. Not saying I see a good way to do it. Not really asking for it. Whiny, IDS-noticed, almost nuisance-type complaints are the only ones we've gotten. The complaints aren't even describing successful intrusions. Sucks if these whinebucket type of complaints are making it harder in real world terms for people to host exit nodes. On Wednesday 30/10/2013 at 8:56 am, Linus Nordberg wrote: > Hi, > > Sounds like you risk ending up with a censorship tool controlled by > those who control the list of attack signatures. > > I'd prefer if we educate service providers about this dangerous place > called the internet with the goal of making them turn down the volume > on > their sirens a notch. > > > tor(a)t-3.net wrote > Wed, 30 Oct 2013 07:56:28 -0400: > > | What he said. > | > | No DMCA so far but, one thing I keep getting is complaints about > "SQL > | injection attacks". Apparently snort or other IDS picks this stuff > up > | and emails the abuse box. Some but not all of the complaints are > | automated. > | > | It would be nice if something could detect these attack signatures > on > | the internet-bound packets from our exit node and drop them. With > | trends as they are, we'd see zero abuse complaints, if there were a > | good way to do that. > | > | > | > | > | On Wednesday 30/10/2013 at 6:41 am, Moritz Bartl wrote: > | > On 25.10.2013 19:13, krishna e bera wrote: > | >> > | >>> > | >>> ExitPolicy accept *:1723 # PPTP > | >> How are you getting PPTP to work over Tor? The ISP-supplied > modems > | >> i've > | >> seen won't pass IP protocol 47 (GRE) packets without putting the > | >> target > | >> machine in a DMZ. > | > > | > > https://trac.torproject.org/projects/tor/wiki/doc/ReducedExitPolicy> > contains it. > | > > | > It's more of a "catch all" exit policy, but gets rid of most DMCA > | > complaints. > | > _______________________________________________ > | > tor-relays mailing list > | > tor-relays(a)lists.torproject.org > | > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > | > | _______________________________________________ > | tor-relays mailing list > | tor-relays(a)lists.torproject.org > | https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

Re: [tor-relays] Advice on dealing with ISP's response to DMCAtakedownnotice.
by tor＠t-3.net 30 Oct '13

30 Oct '13

What he said. No DMCA so far but, one thing I keep getting is complaints about "SQL injection attacks". Apparently snort or other IDS picks this stuff up and emails the abuse box. Some but not all of the complaints are automated. It would be nice if something could detect these attack signatures on the internet-bound packets from our exit node and drop them. With trends as they are, we'd see zero abuse complaints, if there were a good way to do that. On Wednesday 30/10/2013 at 6:41 am, Moritz Bartl wrote: > On 25.10.2013 19:13, krishna e bera wrote: >> >>> >>> ExitPolicy accept *:1723 # PPTP >> How are you getting PPTP to work over Tor? The ISP-supplied modems >> i've >> seen won't pass IP protocol 47 (GRE) packets without putting the >> target >> machine in a DMZ. > > https://trac.torproject.org/projects/tor/wiki/doc/ReducedExitPolicy > contains it. > > It's more of a "catch all" exit policy, but gets rid of most DMCA > complaints. > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

2 1

Re: [tor-relays] Advice on dealing with ISP's response to DMCA takedownnotice.
by tor＠t-3.net 30 Oct '13

30 Oct '13

Reply to the email, say that you found a misconfiguration in your Tor daemon which could have accounted for this problem and you've repaired it, and hopefully this problem is resolved for the future. Put the below as your exit policy in torrc, and I'd stop/start the service to be sure it grabbed it. Using the below exit policy, we've had our exit node running for a couple months or so doing pretty good bandwidth, and not had a single warez-related complaint. Seen some complaints about SQL injection attacks but perhaps those will annoy your ISP less. ExitPolicy accept *:20-23 # FTP, SSH, telnet ExitPolicy accept *:43 # WHOIS ExitPolicy accept *:53 # DNS ExitPolicy accept *:79-81 # finger, HTTP ExitPolicy accept *:88 # kerberos ExitPolicy accept *:110 # POP3 ExitPolicy accept *:143 # IMAP ExitPolicy accept *:194 # IRC ExitPolicy accept *:220 # IMAP3 ExitPolicy accept *:389 # LDAP ExitPolicy accept *:443 # HTTPS ExitPolicy accept *:464 # kpasswd ExitPolicy accept *:531 # IRC/AIM ExitPolicy accept *:543-544 # Kerberos ExitPolicy accept *:554 # RTSP ExitPolicy accept *:563 # NNTP over SSL ExitPolicy accept *:636 # LDAP over SSL ExitPolicy accept *:706 # SILC ExitPolicy accept *:749 # kerberos ExitPolicy accept *:873 # rsync ExitPolicy accept *:902-904 # VMware ExitPolicy accept *:981 # Remote HTTPS management for firewall ExitPolicy accept *:989-995 # FTP over SSL, Netnews etc ExitPolicy accept *:1194 # OpenVPN ExitPolicy accept *:1220 # QT Server Admin ExitPolicy accept *:1293 # PKT-KRB-IPSec ExitPolicy accept *:1500 # VLSI License Manager ExitPolicy accept *:1533 # Sametime ExitPolicy accept *:1677 # GroupWise ExitPolicy accept *:1723 # PPTP ExitPolicy accept *:1755 # RTSP ExitPolicy accept *:1863 # MSNP ExitPolicy accept *:2082 # Infowave Mobility Server ExitPolicy accept *:2083 # Secure Radius Service (radsec) ExitPolicy accept *:2086-2087 # GNUnet, ELI ExitPolicy accept *:2095-2096 # NBX ExitPolicy accept *:2102-2104 # Zephyr ExitPolicy accept *:3128 # SQUID ExitPolicy accept *:3389 # MS WBT ExitPolicy accept *:3690 # SVN ExitPolicy accept *:4321 # RWHOIS ExitPolicy accept *:4643 # Virtuozzo ExitPolicy accept *:5050 # MMCC ExitPolicy accept *:5190 # ICQ ExitPolicy accept *:5222-5223 # XMPP, XMPP over SSL ExitPolicy accept *:5228 # Android Market ExitPolicy accept *:5900 # VNC ExitPolicy accept *:6660-6669 # IRC ExitPolicy accept *:6679 # IRC SSL ExitPolicy accept *:6697 # IRC SSL ExitPolicy accept *:8000 # iRDMI ExitPolicy accept *:8008 # HTTP alternate ExitPolicy accept *:8074 # Gadu-Gadu ExitPolicy accept *:8080 # HTTP Proxies ExitPolicy accept *:8087-8088 # Simplify Media SPP Protocol, Radan HTTP ExitPolicy accept *:8332-8333 # BitCoin ExitPolicy accept *:8443 # PCsync HTTPS ExitPolicy accept *:8888 # HTTP Proxies, NewsEDGE ExitPolicy accept *:9418 # git ExitPolicy accept *:9999 # distinct ExitPolicy accept *:10000 # Network Data Management Protocol ExitPolicy accept *:11371 # OpenPGP hkp (http keyserver protocol) ExitPolicy accept *:12350 # Skype ExitPolicy accept *:19294 # Google Voice TCP ExitPolicy accept *:19638 # Ensim control panel ExitPolicy accept *:23456 # Skype ExitPolicy accept *:33033 # Skype ExitPolicy reject *:* On Thursday 24/10/2013 at 9:11 pm, Christopher Jones wrote: > > I’ve been running an exit relay for about 3 days and, sure enough, > some BitTorrent bugger caused sh3lls.net to send me a DMCA nastygram: > >> >> We have got the following complain, please remove all illegal torrents >> immediately from your server: >> >> Evidentiary Information >> Title: Suits (TV) >> Infringement Source: BitTorrent >> Initial Infringement Timestamp: 17 Oct 2013 22:06:17 GMT Recent >> Infringement Timestamp: 17 Oct 2013 22:06:17 GMT Infringing Filename: >> Suits Season 3 Episode 6 (The Other Time) (HDTV x264)-ASAP (1GBps >> SeedBox).mp4 URL if applicable: >> Infringing File size: 364405400 >> Infringers IP Address: 64.32.14.34 >> Bay ID: 7fbb4256bfca558d5a809b9f6536b5fd5e4e782d|364405400 >> Port ID: 33788 > > I followed through with the templates provided by the Tor Project as a > response to the DMCA takedown notification. A day later, the ISP sent > me this: > >> >> Dear Christopher >> Whether you run Tor or not, we even told you in past, it's your >> responsibility to stop all abuse >> If Tor is causing it, stop the program Tor on your server, if we get >> another complain we will have to suspend/terminate your services >> >> tor always always gets lots and lots of abuse and complains >> >> Update us within 24 hours >> >> Thanks > > I was never provided with the full text of the original DMCA > complaint, so I was unable to respond. Furthermore, I was never > “even told…in the past” that I had to stop all abuse caused by > Tor. Tor is not singled out in the ToS or AUP. And I was certainly > never told anything in the past about abuse and Tor specifically. As I > said, first warning. Then there’s the “tor always always gets lots > and lots of abuse and complains [sic]”. Which is kind of bizarre, > because their position on tor seems a bit cagey. Does the claim about > lots of abuse mean they won’t allow exit nodes? Or is that just a > “hint” that I’d be better off not trying to run it? > > And this is an ISP I picked from the good list. > > Suggestions are welcome. I’m running with the default exit node > policy, which should block most of the abuse-laden ports. > BitTorrent’s a little harder to deal with. I’ve no qualms working > with the ISP to mitigate their concerns, but I’m not sensing their > returning the same spirit of cooperation. > > .cpj_______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >

3 2

Filtering TOR Non-exit Relay - Just Curious
by Nelson 29 Oct '13

29 Oct '13

Tor Exit Relay have the ability to filter traffic by allowing the operator make choices based on personal preferences for personal, legal (ex: country of origin) and for other reasons. Non-exit Relays do not have the ability to set "Relay Policies" (torcc??), and why would they, considering that all this traffic is encrypted anyway, as I understand it, and one would not ever know what type of traffic it is, or its origin, based on the bandwidth graph. I checked my smoothwall firewall logs it does not seem to show the traffic flowing on my relay, I guess this would be obvious because it's Tor traffic; unless I'm not filtering the logs correctly. Running a Tor relay seems straightforward and one could just fire-it-up and easily contribute to the network. But my curiosity gets the best of me. I was looking to add additional URL Filter rules for my smoothwall as a more centralized way of controlling what gets to the LAN for my users. While checking for additional blocklists I came upon P2P rules and I started to compare the new blocklists with my old ones and then I stumbled upon PeerBlock which has been around for a while. On Windows 7, PeerBlock seemed to provide two things I was looking to test on a TOR Relay: 1. Real Time Traffic Logging (ip's and ports logged) 2. The ability to filter traffic. Apparently I am able to do both with PeerBlock, although I'm sure there are more suitable and capable tools available out there that do this, but I'm not aware of or have used any of these tools. In peerblock I can create new custom lists and completely block specific ip ranges (ex: warez, torrents etc.), and I am able to see what traffic is allowed or blocked based on policies created. 1. What problems, if any, arise from using peerblock and Tor together? 2. Why do we not have the ability to at least set our own policy for the type of traffic on a relay just like an Exit Relay?

6 9

"stable" flag voting differences
by starlight.2013q4＠binnacle.cx 28 Oct '13

28 Oct '13

I observed an interesting behavior in the authority votes regarding relay stability and am curious if anyone can comment. Have a new relay, about ten days old. Relay is marked Fast Guard Running Stable Valid One 10 minute network outage three days ago and then a 68 minute outage one day ago for repair. Overall about 4680 seconds down over the last week, and if one uses a 646220 second timeframe per this post https://lists.torproject.org/pipermail/tor-relays/2013-July/002255.html It works out to about 99.27% uptime, which seems within the 98% threshold quoted in the posting. What was interesting was that Faravahar gabelmoo maatuska tor26 urras all immediately removed the "stable" flag when the relay came back online after maintenance, while dannenberg moria1 left the stable flag in place. The two remaining authorities dizum turtles have never set the stable flag due to heavy link congestion between AS286/AS3265 for 'dizum' and congestion within AS6461 for 'turtles'. Then exactly 24-hours after the end of the outage the five naysayers turned the stable flag back on. Mainly a point of curiosity, but I'd guess from this that the first five authorities listed above are using a much shorter window for evaluating stability while the second two are using the seven-day window. I couldn't find per-authority logging of this category of information so it's hard to know. Perhaps it's relevant that the node was removed from the consensus directory briefly immediately after the outage ended. Finally it is interesting that 'dizum' and 'turtles' have set the "guard" flag even though they consider the relay unstable. This is a recent development. Earlier the two impaired-path authorities had the guard flag set off.

2 2

Traceroute measurement from Tor relays
by Karsten Loesing 28 Oct '13

28 Oct '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello Tor relay operators, We could use your help in a pilot project to improve Tor security. As you may be aware, the anonymity of a connection over Tor is vulnerable to an adversary who can observe it in enough places along its route. For example, traffic that crosses the same country as it enters and leaves the Tor network can potentially be deanonymized by an authority in that country who can monitor all network communication. Researchers have been working to figure out how Tor traffic gets routed over the Internet [0-3], but determining routes with high confidence has been difficult. That's where you come in. To figure out where traffic travels from your relay, we'd like you to run a bunch of "traceroutes" - network measurements that show the paths traffic takes. This is a one-time experiment for now, but, depending on what we find out, regularly making such measurements may become a part of Tor itself. We have already gotten some results thanks to Linus Nordberg of DFRI and Moritz Bartl of torservers.net, and now it's time to ask all relay operators to help. We would like to start this right away. We have written some shell scripts to automate most of the process. The easiest way for you to get them is with git, using the following commands: git clone https://bitbucket.org/anupam_das/traceroute-from-tor-relays git checkout f253f768d14e3368e4fe4de9895acd2715a19412 You can also just download the files directly by visiting [4]. Detailed instructions for setting up and running the experiment are in the README. Basically the experiment does traceroutes to three groups: all "routable IP prefixes", all Tor relays, and then all /24 subnets. These kinds of measurements are not uncommon, and they will not be done at a high rate. By default the scripts will periodically move the results to our server [5] via SSH, although you can keep the results around and/or not send them automatically if you wish (see the README). The traceroute data recorded is not sensitive or private at all. We plan to make the code and data public, following Tor's practice of open cooperation with the research community [6]. The measurements will work best if you have the "scamper" tool from the Cooperative Association for Internet Data Analysis (CAIDA) installed (see the README for installation instructions). This is a standard and open-source tool that handles the many modern complexities of Internet routing measurement. If you are not able to run scamper, the script will also work with the more-common but less-accurate and slower "traceroute" utility. We do not currently have support for Windows relays. The output will take up around 500KB (110MB if you disable automatic removal after upload) disk space if you use scamper; on the other hand if you use "traceroute" utility each output will be around 4MB (1GB with automatic removal after upload disabled). * *Depending on whether you run scamper or traceroute the total time required varies but results for traceroutes to "routable IP prefixes" and all Tor relays should finish within one week (possibly earlier). We would like to request relay operators to upload those results once finished.* * This experiment is in collaboration with several researchers, but the leads are Anupam Das, a Ph.D. student at the University of Illinois at Urbana-Champaign, and his advisor Nikita Borisov. Based on a review of the scripts of commit f253f768d14e3368e4fe4de9895acd2715a19412, we believe that they operate as described above. Please do read through them yourself, and let us know if you have any questions or concerns. And also feel free to contact any of us for help or with suggestions. Because of you, Tor is the "king" of anonymous communication. With your help, we will keep improving to face the new challenges to privacy and freedom online. Thank you, Karsten Loesing <karsten(a)torproject.org> Anupam Das <das17(a)illinois.edu> Nikita Borisov <nikita(a)illinois.edu> [0] "Protecting anonymity in the presence of autonomous system and internet exchange level adversaries" by Joshua Juen. Master's Thesis, UIUC. 2012. <https://www.ideals.illinois.edu/handle/2142/34363> [1] "Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries" by Aaron Johnson, Chris Wacek, Rob Jansen, Micah Sherr, and Paul Syverson. ACM CCS 2013. <http://freehaven.net/anonbib/cache/ccs2013-usersrouted.pdf> [2] "AS-awareness in Tor path selection" by Matthew Edman and Paul F. Syverson. ACM CCS 2009. <http://freehaven.net/anonbib/cache/DBLP:conf/ccs/EdmanS09.pdf> [3] "Sampled Traffic Analysis by Internet-Exchange-Level Adversaries" by Steven J. Murdoch and Piotr Zieliński. PETS 2007. <http://freehaven.net/anonbib/cache/murdoch-pet2007.pdf> [4] https://bitbucket.org/anupam_das/traceroute-from-tor-relays/downloads [5] ttat-control.iti.illinois.edu [6] https://metrics.torproject.org/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJSZ+aXAAoJEMIuYwomKaxNouoH/AyS9oUXuilXH5Wat4l41OGy Zdx8I4VOIox4MPpEEvgulzxJUg5+XvEcMwECwe9/fiIw1M0RAALzicme8xGbG5c7 6OndBNqtTg2dN+4SXC90bMPHtaTS7KiNxkvq4h3z5EqFg38Nymwm2xA7dsEIE7Mh T/k7wch/uE++wWKFXpa8MNKUCC+RpIWUdx00F717F8av/fLlhFuwmjKiMqqNDH5D ntLn2i67Tqe17hOJxVNgPJuf7MDfsTgMTGVCClSWtn95EDrL6WMh2RIteUt+Gb94 3KxS7uIqzyXIN2BhcZ+kk55g7LAWmL+AMKGyGsa88+j8c782hVzRSoL9ii+EZ0U= =ygb9 -----END PGP SIGNATURE-----

8 9

minimum ram
by I 27 Oct '13

27 Oct '13

4 10

Thanks for the advice on handling DMCA complaints.
by Christopher Jones 26 Oct '13

26 Oct '13

Hey all, I just wanted to thank the list members for giving me some great advice on working with my ISP to deal with the DMCA nastygrams. I restricted my exit policy to allow most legitimate TCP services and block the rest, which should hopefully disincentivize those damn P2P users from picking my relay as an exit in most cases. Does the Tor project run a database to track abuse complaints? Could be useful in terms of uncovering who the largest pains in the ass are (mine was from Irdeto on behalf on NBC Universal), as well as organizing targeted campaigns to put pressure on companies like Irdeto to at least perform some due diligence and not send out DMCA originating from exit relays. If not, maybe I’ll start working on a project to do so if there isn’t something else like it elsewhere. On another note, I discovered I prefer running Tor on FreeBSD over Linux. Ran CentOS for a bit, but somehow encrypting /tmp blew it up and the NOC had to re-install the OS. I went with FreeBSD instead and dig it immensely. Pf is much less of a headache than IPTables — I actually got port forwarding from 80 to 9091 and 43 to 9090 working. Administration is more straightforward. I like the clear separation of the base system from additional software added from ports. Compiling ports, while more time consuming, is a delight compared to some of the binary package management issues I’ve had in the past with Linux. FreeBSD also appears to manage memory more efficiently. I run Linux as a desktop OS, but for a server OS, FreeBSD has won me over with its simplicity, less convoluted security (no SELinux — yes I know you can turn it off, but I’m the masochist who leaves it on), better support for chroot jails. Just my opinion. One more question and I’ll probably feel stupid after reading the answers, but does “RelayBandwidthRate” apply separately to rx and tx rates or the combined throughput of them both? The server I run has an unmetered 100Mb/s connection. I’ve got RelayBandwidthRate set to 5MB and RelayBandwidthBurst set to 10MB. 12.5MB/s being the theoretical max, if I bumped up my bandwidth rate to, say, 8, would my relay overload the NIC or would it continue to behave? My server specs are as follows: FreeBSD 9.2 Dual Core Atom D2500 4GB RAM 2TB SATA drive (encrypted swap and /tmp) 100Mbit unmetered traffic 5 usable IPv4 addresses At last check, I had 1140 TCP connections according to lsof and vnstat is showing throughputs of 13-18Mbit/s rx and 14-19Mbit/s tx. Tor CPU usage is about 22-27% according to top. Does this look reasonable or should I tweak some things like max connections? Thanks, Chris

4 3

TCP: drop open request
by mett 26 Oct '13

26 Oct '13

Hi! Since yesterday, the kern.log of the relay I'm running is flooded with "TCP: drop open request from". I first thought it was a kind of DDOS on our servers but it seems to be related to Tor (When I stop Tor, kernel doesn't complain anymore). Does somebody have an idea of why this is happening and what to do to mitigate it? Thanks a lot.

3 3

Re: [tor-relays] [tor-talk] A new check
by grarpamp 25 Oct '13

25 Oct '13

>> > > We're considering launching a new check, >> > > >> > > It'd be appreciated if you could take a moment to look for false negatives, >> > > and let us know. >> > >> > I found 15 relays where check2 told me that I'm not using Tor. >> >> Very good idea! :) Did you also run the same test against >> check.torproject.org? Keep in mind that while it may be frustrating to some users config tests to find that they are temporarily using a false negative exit... this 'multihoming' could, and should in fact, be considered a feature since it keeps some exits out of the reach of anti-tor blocklists that simply parse all the IP's out of the descriptor set. Similar to how obfs and other design features keep Tor out of the reach of anti-tor entities, making an anti to do a little work to be an anti is a good thing. Thus having a good number of false negatives around can allow you to reach places you couldn't otherwise reach due to that type of blocking. That may cause philosophical stress to some places that indiscriminantly [1] block Tor IP's by default, but also keep in mind that Tor is dual use and such a policy is rather blind to that by definition... as would be indiscriminantly blocking all coffee shop IP's by default. So if the point of 'looking for false negatives' is to do something, like attempt to convince the operators to not multihome... the better thing to do would be to add regular false negative tests to the backend of the check service so that these exits come up positive therein. [1] Within a day ago I posted a link to a slashdot discussion of one particular instance of this.

1 0

Advice on dealing with ISP's response to DMCA takedown notice.
by Christopher Jones 25 Oct '13

25 Oct '13

I’ve been running an exit relay for about 3 days and, sure enough, some BitTorrent bugger caused sh3lls.net to send me a DMCA nastygram: > We have got the following complain, please remove all illegal torrents immediately from your server: > > Evidentiary Information > Title: Suits (TV) > Infringement Source: BitTorrent > Initial Infringement Timestamp: 17 Oct 2013 22:06:17 GMT Recent Infringement Timestamp: 17 Oct 2013 22:06:17 GMT Infringing Filename: Suits Season 3 Episode 6 (The Other Time) (HDTV x264)-ASAP (1GBps SeedBox).mp4 URL if applicable: > Infringing File size: 364405400 > Infringers IP Address: 64.32.14.34 > Bay ID: 7fbb4256bfca558d5a809b9f6536b5fd5e4e782d|364405400 > Port ID: 33788 I followed through with the templates provided by the Tor Project as a response to the DMCA takedown notification. A day later, the ISP sent me this: > Dear Christopher > Whether you run Tor or not, we even told you in past, it's your responsibility to stop all abuse > If Tor is causing it, stop the program Tor on your server, if we get another complain we will have to suspend/terminate your services > > tor always always gets lots and lots of abuse and complains > > Update us within 24 hours > > Thanks I was never provided with the full text of the original DMCA complaint, so I was unable to respond. Furthermore, I was never “even told…in the past” that I had to stop all abuse caused by Tor. Tor is not singled out in the ToS or AUP. And I was certainly never told anything in the past about abuse and Tor specifically. As I said, first warning. Then there’s the “tor always always gets lots and lots of abuse and complains [sic]”. Which is kind of bizarre, because their position on tor seems a bit cagey. Does the claim about lots of abuse mean they won’t allow exit nodes? Or is that just a “hint” that I’d be better off not trying to run it? And this is an ISP I picked from the good list. Suggestions are welcome. I’m running with the default exit node policy, which should block most of the abuse-laden ports. BitTorrent’s a little harder to deal with. I’ve no qualms working with the ISP to mitigate their concerns, but I’m not sensing their returning the same spirit of cooperation. .cpj

3 2

Re: [tor-relays] Traceroute measurement from Tor relays
by Jesse Victors 25 Oct '13

25 Oct '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 > That's where you come in. To figure out where traffic travels from > your relay, we'd like you to run a bunch of "traceroutes" - network > measurements that show the paths traffic takes. This is a one-time > experiment for now, but, depending on what we find out, regularly > making such measurements may become a part of Tor itself. We have > already gotten some results thanks to Linus Nordberg of DFRI and > Moritz Bartl of > torservers.net, and now it's time to ask all relay operators to help. > We would like to start this right away. How much bandwidth will this be taking up, and roughly how much will be uploaded/downloaded? I've cloned the repo, but I'm nervous about running this if it's going to be a significant bandwidth hog for a whole week. As Aaron said in Issue 39, it looks like it's going to be a lot of IPs and a large amount of packets. Also, ISPs may not take kindly to all these scans. What's the word on that? Has anyone run this tool, and what's their opinion? I'd be happy to help, but I'd like to know the full details of the various resources this tool will be consuming. Jesse V. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQF8BAEBCgBmBQJSacyDXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQxMjgyMjhENjEyODQ1OTU1NzBCMjgwRkFB RDk3MzY0RkMyMEJFQzgwAAoJEK2XNk/CC+yAhy4IAJ0OSiPjqFTq8bqyU+nXZX7R 6TgA1nmU3Q2tEc6CVBf+/eBpddyAmAG5SZ8/vXKGrUB2VtujaW/VMZ/9zaEMql2B KKGcPcYAy0wQUcJPFZEw0TMuRS5dVV+bEmUXEYh3DhfECVfsGMy8b1mP0UuxW9MN 8UQFiDbzT04lGo2vNOpFGk2DuH+WVHzDj1/Nqv249iobPQWqvebJtFbTnoWrt7m/ cAO3kJtSq43RJSQcImXqwOKDdnTLI5/7FSlP/0Mw5N7ROBMUVfA9/80mRY3VcxtX u6EHP8ZE0JPBOf6WAnwjJU1DBay9EUtHuPpYu1jO9pfuWDrPINyR7NgSg+wEWIQ= =yDvu -----END PGP SIGNATURE-----

1 0

Cheap non exit relay recommendation
by Christian Dietrich 24 Oct '13

24 Oct '13

I hope this is allowed, to due the fact that this is advertising. Currently i'm running two tor relays on a single dedicated server, pushing 404 mbit/s atm. (000000000000myTOR1 & 000000000000myTOR2) I will cancel it at beginning of november due to the fact that i miss tor relay multi core support and i plan to support other projects instead. Anyway, i can recommend my current hoster for non exit tor nodes, you will get: HP ML310e G8 Server (/w iLO4) Intel XEON E3-1230v2 (4x 3,3 GHz /w HT) 16 GB DDR3 ECC 2x 1 TB SATA RAID1 Disks 1000mbit unmetered traffic (pushed ~100 TB so far, no problems) 1 IPv4 Adress (5,-€ per additional) / /64 IPv6 for 69,99€ (currently ~96 USD) hXXp://goo.gl/pXkb78 Germany based. I think this is currently the best deal for non exit relays.

3 2

Port for obfsproxy
by GDR! 23 Oct '13

23 Oct '13

Hello, I'm new here, running a relay for the past year. I'm looking to implement obfsproxy running on port 80 and emulating HTTP traffic. The official manual says I should add this line to torrc: ServerTransportPlugin obfs2,obfs3 exec /usr/bin/obfsproxy managed However, it runs on a random port (30000+) which kind of defeats the whole purpose of running an obfuscated bridge. I also haven't seen a way to force faking HTTP traffic. The manual page is very terse and doesn't explain how to do any of this. How do I configure obfsproxy to look like a HTTP server? -- Zapisz moj nowy prywatny adres email: gdr(a)gdr.name Teraz na wlasnym serwerze. Zawsze czysto - zawsze sucho - zawsze pewnie. Klucz PGP to nadal 4ED3D2B7

7 13