- tor-relays - lists.torproject.org

relayor v23.2.0 is released
by nusenu 28 Aug '23

28 Aug '23

Hi, relayor v23.2.0 is released. relayor is an ansible role that helps you with running tor relays with minimal effort (automate everything). https://github.com/nusenu/ansible-relayor#main-benefits-for-a-tor-relay-ope… This release includes new prometheus alert rules so you do not forget to renew your relay certificates before they expire. This feature requires tor version 0.4.8 though which is unfortunately not yet available on deb.torproject.org stable repos. It also includes rules that alert you if your exit relay has an unhealthy DNS timeout fraction or if your relay is dropping onionskins for at least 15 minutes. Changelog: https://github.com/nusenu/ansible-relayor/releases/tag/v23.2.0 kind regards, nusenu -- https://nusenu.github.io

1 0

Exit Relays: What is your DNS timeout rate?
by nusenu 26 Aug '23

26 Aug '23

Hi, the upcoming relayor release will contain new prometheus alert rules that should help operators detect/mitigate/prevent some common operational issues. One of these rules will alert on high DNS timeout rates [1] on exit relays that should be investigated and resolved to improve the Tor Browser experience for users. To define the default alert threshold it would be relevant to know current timeout rates by multiple exit operators. So if you feel up to it you can send me (off-list) your current timeout rates (30 day graph): If you run tor exits with relayor and MetricsPort enabled you can use these Prometheus queries: timeout percentage by server: (sum by (instance)(rate(tor_relay_exit_dns_error_total{reason="tor_timeout"}[15m])))/(sum by (instance)(rate(tor_relay_exit_dns_query_total[15m])))*100 DNS query rate: sum by (instance)(rate(tor_relay_exit_dns_query_total[15m])) If you run exits without relayor you can use these queries: (sum by (job)(rate(tor_relay_exit_dns_error_total{reason="tor_timeout"}[15m])))/(sum by (job)(rate(tor_relay_exit_dns_query_total[15m])))*100 sum(rate(tor_relay_exit_dns_query_total[15m])) kind regards, nusenu [1] https://github.com/nusenu/ansible-relayor/commit/9b6937563ec0b41e6abb0217ed… -- https://nusenu.github.io

1 0

Wrong "first seen" flag for bridges at metrics.torproject.org
by telekobold 23 Aug '23

23 Aug '23

Hi together, I have an issue regarding the "first seen" flag at metrics.torproject.org: It is definitely wrong for my two bridges - both dates are much too close in the past. For one of the bridges, it seems to correspond to the last signing key renewal, for the other bridge, it seems to correspond to the penultimate signing key renewal. Has anyone observed similar behavior for its relay? (I found it meaningful to first ask here before creating an issue at [*]). [*] https://gitlab.torproject.org/hiro/onionoo/-/issues Kind regards, telekobold

3 2

Tor-Bridge
by tor＠pqpera.xyz 19 Aug '23

19 Aug '23

Possible compression bomb; abandoning stream. <- Happened to my server for 2h straight. Should I take any measures against that? Bridge is obsf4 with fingerprint: 2EA91C1415C421424BB478A55790E655627DE366.

2 1

Tor Relay in Kubernetes cluster
by Daniel Nikoloski 18 Aug '23

18 Aug '23

Hi all, Is anyone running Tor relay in k8s cluster? I am trying for a few days but It does not come alive. My servers are not behind a firewall, should be and are accessible, I run two bare-metal servers in Contabo. 1 master 1 node. Docker image and helm chart that use; https://gitlab.com/nikoloskid/tor-server The logs I get; > Aug 05 21:04:55.000 [notice] Now checking whether IPv4 ORPort 38.242.233.101:32150 is reachable... (this may take up to 20 minutes -- look for log messages indicating success) > Aug 05 21:24:45.000 [warn] Your server has not managed to confirm reachability for its ORPort(s) at 38.242.233.101:32150. Relays do not publish descriptors until their ORPort and DirPort are reachable. Please check your firewalls, ports > > , address, /etc/hosts file, etc. When i try telnet it is open to the internet > telnet 38.242.233.101 32150 > Trying 38.242.233.101... > Connected to 38.242.233.101. > Escape character is '^]'. You can see the service here; https://gitlab.com/nikoloskid/tor-server/-/raw/helm-chart-tor-relay/tor-ser… /etc/tor/torrc; > Nickname icebergk8s > Address 38.242.233.101 > ContactInfo nikoloskid(a)pm.me > RelayBandwidthRate 3.5MB > RelayBandwidthBurst 5MB > MaxAdvertisedBandwidth 5MB > ORPort 9001 NoAdvertise IPv4Only > ORPort 32150 NoListen IPv4Only > SocksPort 0 > ExitPolicy reject *:* > User debian-tor > DataDirectory /var/lib/tor Lep pozdrav / Best Regards, Daniel Nikoloski

2 1

Tor Relay Operator meetup @ CCCamp 2023 - Saturday 19th @ 7pm
by gus 17 Aug '23

17 Aug '23

Hello, The Tor Relay Operator Meetup - Chaos Communication Camp-2023[1] will happen at Bornhack (Cold North Village)[2] on Saturday, August 19th at 7pm (local time). After the meetup, we invite everyone to stay and have beer and drinks at Bornhack. Please spread the message. We have Tor stickers for you! :) Gus [1] https://events.ccc.de/camp/2023/infos/ [2] Coordinates: 53.0314175, 13.3065457 https://map.events.ccc.de/camp/2023/map/#20/53.03143/13.3066 -- The Tor Project Community Team Lead

2 4

WebTunnel: What ASNs/networks work best?
by tor-home at encryptfirst.com 17 Aug '23

17 Aug '23

When running a WebTunnel bridge, what types of IPs are better for serving requests? My background is with self-hosted home-lab type of setups. There are a number of different ways for homelabs to accept inbound https connections. A few examples: - Forward a port on a home router. - Rent a cloud VM/VPS and tunnel a port from the VPS's IP. - Have a CDN tunnel/forward requests. - VPN hybrid solutions like Tailscale Funnel. Are any of these better than others for hosting a WebTunnel bridge? Should cloud provider IPs be preferred over residential IPs, for example, considering that is where most web servers are hosted? Are large CDNs preferred over individual cloud VMs? Is it better to use a different IP for WebTunnel than the IP that runs the OR port (i.e. host OR port on home IP and WebTunnel from a cloud-based IP)? I'm mainly asking to determine which way helps the broadest number of Tor users. And which is less likely to be blocked in the future. What are the best practices? PS: Thanks for the webtunnel-bridge Docker image and the documentation on how to run it. It was very helpful and made setup easy.

4 4

Running an exit relay in Italy
by Eldalië 17 Aug '23

17 Aug '23

Hello there and thanks everyone for your answers to my message about middle relay blocking. Reading them I feel trying to solve the blacklisting of my IP would be overkilling. Since I have a chance to get a cheap VPS, I will try to migrate the relay on it. And since the relay would be on a dedicated IP, I'm thinking about making it an exit. Of course I must consider the law, and I'd like to read some references and listen about experiences from other operators before seeking professional (expensive, I guess) legal advice. My concerns are the following, but I would appreciate any other thoughts as well. The relay would be in Italy so Italian and EU laws apply. 1. Would I bear any responsibility for the use of the relay? I'm aware of the "mere conduit" concept (that is applied in the EU too) but Italy may have some crappy additional law I'm not aware of. 2. Would I be subject to any data retention or data monitoring obligation? 3. Would I be subject to any user identification obligation? 4. Would I risk the police knocking on my door even if the relay runs on a datacenter and not on my home network? Thanks, Eldalië -- Eldalië My private key is attached. Please, use it and provide me yours!

2 1

(EVENT) Tor Relay Operator Meetup - June 24, 2023 @ 18.00 UTC
by gus 10 Aug '23

10 Aug '23

Hello, The next Tor Relay Operator Meetup will happen on June 24, 2023, at 18.00 UTC. We're working on the agenda here: https://pad.riseup.net/p/tor-relay-op-meetup-june-keep onionsite: http://kfahv6wfkbezjyg4r6mlhpmieydbebr5vkok5r34ya464gqz6c44bnyd.onion/p/tor… Feel free to add other topics to the agenda. WHERE Room link: https://tor.meet.coop/gus-og0-x74-dzn Registration No need for a registration or anything else, just use the room-link above. We will open the room 10 minutes before so you can test your mic setup. Please share with your friends, social media and other mailing lists! cheers, Gus -- The Tor Project Community Team Lead

5 7

short conntrack DDoS attack
by Toralf Förster 09 Aug '23

09 Aug '23

Few days ago the throughput of my Tor relay went down to nearly zero for about 3 minutes. It turned out that the reason (maybe) was a change here in my iptables rules. Especially I switched these 2 lines: iptables -A INPUT -m conntrack --ctstate INVALID -j DROP iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT and run then few hours later into problems. And switched back ofc. An explanation for the dropdown was given in [1]. Given that the explanation is right: How is the Tor application harmed if an attacker mangles packets so that the state of them are INVALID for the conntrack module but they do pass the RELATED,ESTABLISHED rule ? [1] https://forums.gentoo.org/viewtopic-p-8798034.html -- Toralf

2 1

Re: [tor-relays] Middle relay IP blocking
by torserver 08 Aug '23

08 Aug '23

Roger, I had the same problem with 3 financial websites blocking my IP address while running a middle relay. Exactly 5 days after stopping the relay these sites can be reached again. They probably use the same mechanism, visible in the TPRB Firefox plug-in. I run my home relay on a low energy consuming Raspberry Pi. Why is there no perfectly detailed instruction to install a relay on the Raspberry? With its built-in VNC it can be managed by SSH and remote desktop perfectly. Then there is no need for data congestion on a few cheap providers. One Watt power consumption only costs 3 Euros a year. Snowflake almost uses no data with a few occasional users. I 'd like to use my 100 Megabits more efficient. Regards, me. > Date: Tue, 8 Aug 2023 02:32:03 -0400 > From: Roger Dingledine <arma(a)torproject.org> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Middle relay IP blocking > Message-ID: <ZNHhY1rj8rQAId0y(a)nogrod.csail.mit.edu> > Content-Type: text/plain; charset=us-ascii > > On Mon, Aug 07, 2023 at 11:28:32PM +0300, s7r wrote: > > While all the above is true, a thing to remember is to make sure we don't > > end up all renting too many VPS'es or dedicated servers in the same places / > > same AS numbers - we need network diversity, it is a very important factor, > > more AS numbers, more providers, more physical locations, etc. So, running > > at home is super good and recommended from this perspective, provides us > > with the diversity we need, however not being to login to online banking to > > pay an electricity bill because of a middle relay is also way too annoying.. > > however who can afford the hassle should definitely run a middle relay or > > bridge at home > > Yes, exactly this. If you are interested in running a non-exit relay at > home, and you can tolerate the hassles from occasionally finding that > some service doesn't want to hear from you, then you are definitely > helping the diversity of the Tor network. > > Having the Tor traffic concentrated at a few cheapo providers like Hetzner > and OVH is not only scary in the sense that too much traffic goes through > too few cables, but it's also scary because it increases the appeal for > somebody to attack those few companies, either by breaking into their > infrastructure to watch traffic or through more traditional insider > threats like getting an employee there to help them monitor traffic. > > The internet already has uncomfortably many bottlenecks -- too few > undersea cables, too few Content Distribution Networks (CDNs), too few > app stores, etc. > > > (even Exit relay, I do run an Exit relay at my office place > > and I had one police visit in like 8 years or so). > > Follow this advice only with great caution. :) Many people happily > run their exit relay from their home, but it only takes one fresh new > cybercrime detective (trying to make a name for himself by kicking down > a door at 7am, and with no idea what Tor is) to ruin your day. > > --Roger > > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > ------------------------------ > > End of tor-relays Digest, Vol 151, Issue 9 > ******************************************

2 2

Middle relay IP blocking
by Eldalië 08 Aug '23

08 Aug '23

Hello there! I've been running for over 1.5 year a middle relay on an IP address I also use to browse, withous issues. However it's now some weeks since many websites that always refused tor traffic started to also refuse normal traffic from my IP. I suppose this is related to the relay, because I don't run any other "suspect" service on this IP and when I change it the problem is gone for a few hours. My guess is that some widely used black list started including middle relay IPs, but I have no proofs. Has anyone had similar experiences? Any thoughts on this? Thanks, Eldalië -- Eldalië My private key is attached. Please, use it and provide me yours!

12 15

Help Turkmens to bypass Internet censorship: run an obfs4 bridge!
by gus 02 Aug '23

02 Aug '23

Dear Relay operators community, The parliamentary elections in Turkmenistan are coming up very soon on March 26th[1], and the Turkmen government has tightened internet censorship and restrictions even more. In the last few months, the Anti-censorship community has learned that different pluggable transports, like Snowflake, and entire IP ranges, have been blocked in the country. Therefore, running a bridge on popular hosting providers like Hetzner, Digital Ocean, Linode, and AWS won't help as these providers' IP ranges are completely blocked in Turkmenistan. Recently, we learned from the Anti-censorship community[2] and via Tor user support channels that Tor bridges running on residential connections were working fine. Although they were blocked after some days or a week, these bridges received a lot of users and were very important to keep Turkmens connected. How to help Turkmens to access the Internet =========================================== You can help Turkmens to access the free and open internet by running an obfs4 Tor bridge! But here's the trick: you need to run it on a residential connection -- you won't need a static IPv4 --, and it would ideally be run on more robust hardware than just a Raspberry Pi (although that can help, we have found they can get overloaded). You can set up an obfs4 bridge by following our official guide: https://community.torproject.org/relay/setup/bridge/ After you setup a new bridge, you can share your bridge line with the Tor support team at frontdesk(a)torproject.org, and we will share it with users. A complete bridge line is composed of: IP:OBFS4_PORT FINGERPRINT cert=obfs4-certificate iat-mode=0 Check this documentation to learn how to share your bridge line: https://community.torproject.org/relay/setup/bridge/post-install/ Just sharing your bridge fingerprint is not the best, but it's fine. You can read more about censorship against Tor in Turkmenistan here: - https://gitlab.torproject.org/tpo/anti-censorship/censorship-analysis/-/iss… - Snowflake blocked: https://gitlab.torproject.org/tpo/anti-censorship/censorship-analysis/-/iss… Thank you for your support in helping to keep the internet free and open for everyone. Gus [1] https://en.wikipedia.org/wiki/2023_Turkmen_parliamentary_election [2] https://ntc.party/c/internet-censorship-all-around-the-world/turkmenistan/17 https://github.com/net4people/bbs/issues/80 -- The Tor Project Community Team Lead

7 24

How do I set up a conjure Bridge?
by Poojith Bestha 01 Aug '23

01 Aug '23

I have a question. How do I set up a conjure bridge? Is the process hard? What hardware do I need to use? Regards, Poojith

2 1

Receiving abuse reports for Non-Exit Relay
by admin＠prsv.ch 01 Aug '23

01 Aug '23

Hello all, In the past 24 hrs, I have been receiving complaints from my hosting provider that they're receiving hundreds of abuse reports related to port scanning. I have no clue why I'm all of the sudden receiving abuse reports when this non-exit relay has been online for months without issues. In addition, I have other non-exit relays hosted by the same provider with no issues and more across other providers. I proceeded to reinstall the OS and reconfigure Tor. I was then quickly notified by my hosting provider again of more abuse reports all showing port 22 as target port. I have not changed my torrc at all and it's still setup as a non-exit relay. No other applications/services were installed alongside Tor. Tor Metrics does not show the relay as Exit either. It feels like Tor Exit Traffic is leaking through my non-exit relay? Has anyone else experienced any behavior similar to this? Any ideas on how to fix or prevent this? prsv admin

7 7

Re: [tor-relays] tor-relays Digest, Vol 150, Issue 13
by amanyaz Amangeldiyew 31 Jul '23

31 Jul '23

Hi. Everybody. In Turkmenistan these IPs are open: 96.233.128.72 167.62.193.195 108.50.165.220 71.33.251.73 99.232.152.8 108.184.202.115 108.34.184.5 99.230.178.2 108.184.201.30 71.212.129.108 88.22.43.218 67.6.147.5 79.16.171.221 79.113.212.117 88.91.78.20 172.88.64.65 67.251.118.15 41.109.196.229 96.237.186.35 95.31.20.151 71.113.184.94 151.225.43.243 141.255.66.158 88.19.75.220 67.11.187.237 67.6.182.48 95.252.250.216 67.6.161.111 95.236.84.157 143.107.229.252 92.194.57.57 I think for now port 8080 is open too. Can anybody make obfs4 server with these ips and port 8080? On Mon, Jul 31, 2023 at 5:01 PM <tor-relays-request(a)lists.torproject.org> wrote: > Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > > > Today's Topics: > > 1. Re: Help Turkmens to bypass Internet censorship: run an obfs4 > bridge! (lists(a)for-privacy.net) > 2. Re: Help Turkmens to bypass Internet censorship: run an obfs4 > bridge! (Gary C. New) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 30 Jul 2023 23:30:26 +0200 > From: lists(a)for-privacy.net > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Help Turkmens to bypass Internet censorship: > run an obfs4 bridge! > Message-ID: <2156503.WeTp2EQoyn@t520> > Content-Type: text/plain; charset="us-ascii" > > On Freitag, 21. Juli 2023 18:07:35 CEST gus wrote: > > > New update: In the last few weeks, internal political conflicts and > > other events[1] in Turkmenistan have led to another wave of censorship > > on Tor and anti-censorship tools. Tor bridges have been one of the few > > free alternatives for people in Turkmenistan to connect with the world > > and access the open Internet. > > > > I stopped snowflake and now a bridge is running on my dynIP. > > > > > ## torrc example > > > > BridgeRelay 1 > > ORPort 127.0.0.1:auto > > AssumeReachable 1 > > ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy > > ServerTransportListenAddr obfs4 0.0.0.0:8080 > > ExtORPort auto > > Nickname helptm > > ContactInfo <please-add-your-email-here> > > Log notice file /var/log/tor/notices.log > > # If you set BridgeDistribution none, please remember to email > > # your bridge line to us: frontdesk(a)torproject.org > > BridgeDistribution none > > But I have that in the log :-( > Jul 30 16:48:29 t520 Tor-01[93466]: The IPv4 ORPort address 127.0.0.1 does > not match the descriptor address 203.0.113.18. If you have a static public > IPv4 address, use 'Address <IPv4>' and 'OutboundBindAddress <IPv4>'. If you > are behind a NAT, use two ORPort lines: 'ORPort <PublicPort> NoListen' and > 'ORPort <InternalPort> NoAdvertise'. > Jul 30 16:48:29 t520 Tor-01[93466]: The IPv6 ORPort address ::1 does not > match the descriptor address 2001:db8:1234:1:bbbb:eeee:eeee:ffff. If you > have a static public IPv4 address, use 'Address <IPv6>' and > 'OutboundBindAddress <IPv6>'. If you are behind a NAT, use two ORPort > lines: 'ORPort <PublicPort> NoListen' and 'ORPort <InternalPort> > NoAdvertise'. > > I don't know if I should ignore that or better configure it that way: > ORPort 127.0.0.1:8443 NoListen > ORPort 8443 NoAdvertise > ORPort [::1]:8443 NoListen > ORPort 8443 NoAdvertise > > I'm aware of > https://gitlab.torproject.org/tpo/core/tor/-/issues/40208 > I hope to get it done with scipting on my Mikrotik, or switch to ipv4 only. > > frontdesk(a)torproject.org has no PGP key, can I send you or meskio the > bridgeline? > > Bridgeline must be: > Bridge obfs4 <IP ADDRESS>:<PORT> <FINGERPRINT> cert=abra+kadabra iat-mode=0 > But DynIP changes every few days. Do you also give the bridge users > myrouter.example.net? > > Because of your post in the forum: > https://forum.torproject.org/t/orport-127-0-0-1-auto/8470 > should we do this with all running bridges, or only the hidden ones? > > -- > Ciao Marco! >

1 1

(no subject)
by amanyaz Amangeldiyew 27 Jul '23

27 Jul '23

Hi. I am from. Turkmenistan. I have obtained obsf4 bridge from internet but only ip address is readable. If anybody knows fully obsf4 bridge please send me to my mail. Ip address is: obsf4 93.104.161.141

1 0

Final Call: Last Opportunity to Participate in the Tor Update Survey - Closes Tomorrow!
by Meitong Wang 22 Jul '23

22 Jul '23

Dear Tor Relay Operators, We hope this email finds you well. This is our final outreach regarding the Tor Update Survey, and we want to extend a sincere thank you to those who have already participated. Your valuable contributions have been invaluable to our research project at the University of Edinburgh. For those who haven't had the opportunity to take part yet, we wanted to remind you that the survey will be closing tomorrow, the 23rd of July. If you are interested in sharing your insights towards updates as a Tor relay operator, we kindly request you to participate now and make your voice heard. Your participation in this survey is crucial for understanding the challenges and developments within the Tor network. Your responses will be treated with the utmost confidentiality, and all data will be anonymized to ensure your privacy. Taking the survey will take approximately 10 minutes, and we genuinely appreciate the time and effort you invest in contributing to this research. To participate, please click on the following link: https://cryptpad.fr/form/#/2/form/view/dvbbDORTjeztLzosbOuGVaRheI-FBjFh6xPQ… Once again, we would like to express our gratitude for your interest and support in this project. Your input will contribute to the continued growth and improvement of the Tor network. If you have already participated or are unable to participate at this time, we sincerely thank you for considering our invitation. Should you have any questions or require further information, please do not hesitate to reach out to us. Thank you, and we truly appreciate your attention to this matter. Best regards, Meitong Wang & Tariq Elahi The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336. Is e buidheann carthannais a th' ann an Oilthigh Dh?n ?ideann, cl?raichte an Alba, ?ireamh cl?raidh SC005336.

1 0

Friendly Reminder: Tor Relay Operators' Survey Closes on 23rd July - Last Chance to Participate!
by Meitong Wang 19 Jul '23

19 Jul '23

Dear Tor Relay Operators, We hope this email finds you well. We are writing to provide a friendly reminder that our Tor Update Survey, conducted as part of the University of Edinburgh Research Project, will be closing on 23rd July. If you haven't already participated, this is your last chance to share your invaluable insights and experiences as a Tor relay operator. Your input is critical to our research and will play a significant role in understanding the challenges in the Tor network's update process. Your responses are entirely confidential, and all data will be anonymized to ensure your privacy. We truly appreciate your willingness to contribute to this research. The survey will take approximately 10 minutes to complete, and your input will shape the future improvements and enhancements of the Tor network update design. We understand how busy schedules can be, but taking the time to participate in this survey will be greatly beneficial to the entire Tor community. To access the survey, please click on the following link: https://cryptpad.fr/form/#/2/form/view/dvbbDORTjeztLzosbOuGVaRheI-FBjFh6xPQ…. The survey will close on 23rd July, so if you are interested in taking part, we kindly encourage you to do so now. Thank you once again for your participation and support. Should you have any questions or require further information, please don't hesitate to reach out to us. Please note that this study has been approved by the UoE Informatics Research Ethics Process, with the project reference number: 775342. Best regards, Meitong Wang & Tariq Elahi The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336. Is e buidheann carthannais a th' ann an Oilthigh Dh?n ?ideann, cl?raichte an Alba, ?ireamh cl?raidh SC005336.

1 0

Is there a way to update obfs4 using chocklatey?
by Keifer Bly 16 Jul '23

16 Jul '23

Hi, So on Windows, it is possible to install the tor relay software using Chocolatey https://chocolatey.org/. Once it is installed, tor can be installed by using choco install tor and updated using choco upgrade tor in Windows powershell. But I am wondering, is there a way to install and update obfs4 in Chocolatey? Thanks. --Keifer

1 0

Question regarding bandwidth ratio on bridges.torproject.org and a few further, small, (probably related) questions
by telekobold 06 Jul '23

06 Jul '23

Hello together, I'm operating two Tor bridges. When calling bridges.torproject.org, for one of the bridges (set up in March, 2023), there are three outputs: - obfs4: functional - a bandwidth ratio - a "last tested" entry. But for my second bridge (set up at the beginning of June 2023), bridges.torproject.org does not output a bandwidth ratio. What does this missing bandwidth ratio output mean, since everything else seems to be normal? When starting nyx on the relays, I see connections there (even more on the bridge with the missing bandwidth ratio output), I can connect to both bridges using the Bridge's IP addresses and ORPorts via Tor browser, and metrics.torproject.org also outputs an advertised bandwidth, which is even much higher (4.87 MiB/s at the moment) than for my other bridge (1.43MiB/s at the momemt) for which bridges.torproject.org outputs a bandwidth ratio. The bridges run on virtual servers at the same hoster, but in two different countries. Nothing else runs on these virtual servers. I am honestly not quite sure to what extent the fingerprint of the bridge is information worth protecting, or whether only the port and IP address need to be protected. By the way, I also don't understand why my two bridges don't have a higher advertised bandwidth - currently, it's 4.87MiB/s for one and 1.43MiB/s for the other relay. I never got the fast flag for either bridge yet, in contrast to my two "normal" relays. On both servers, at least 1.6GiB/s is available, and a monthly data throughput of several terabytes. As a further issue, nyx doesn't output (in constrast to my two other relays) - not sure if this is a known issue. And, as a last issue, I didn't specify a distribution mechanism for my bridge, in the hope that the most suitable mechanism will be selected automatically. Initially, for one of my bridges (the one for which bridges.torproject.org outputs a bandwidth ratio) the bridge was assigned distribution mechanism "Moat". But suddenly, "None" is displayed under distribution mechanisms at metrics.torproject.org, which means that apparently the bridge is no longer distributed. What could be the reason that the distribution mechanism suddenly changed? Kind regards telekobold

2 1

Invitation to Participate in Tor Update Survey - University of Edinburgh Research Project
by Meitong Wang 05 Jul '23

05 Jul '23

Dear Relay Operators, My name is Meitong, and I am a Master's student at the University of Edinburgh, currently being supervised by Tariq Elahi. I am working on a project to understand Tor Relay Operators and further improve Tor security. I am writing to invite you to participate in a survey as part of a research project conducted by the University of Edinburgh. The purpose of this survey is to gather valuable insights and feedback from relay operators regarding the Tor network's update process. The overall goal of this survey is to understand the experiences, challenges, and perspectives of relay operators when it comes to Tor relay updates. Your input will contribute to improving the update design and addressing any issues that may arise. I want to assure you that your participation in this survey is completely anonymous. Your responses will be treated with strict confidentiality and will only be used for research purposes. To access the survey, please click on the following link: https://cryptpad.fr/form/#/2/form/view/dvbbDORTjeztLzosbOuGVaRheI-FBjFh6xPQ… The survey will be open until July 23, 2023. Your participation is highly appreciated and will be valuable in shaping the future updates of Tor. Please note that this study has been approved by the UoE Informatics Research Ethics Process, with the project reference number: 775342. To provide you with more information about the survey and its purpose, I have attached the Participant Information Form. This document explains the study's background, procedures, and your rights as a participant. I kindly request that you review it before deciding whether to participate. If you have any questions or concerns about the survey or the research project, please feel free to reach out to me. I would be more than happy to provide further clarification. Thank you in advance for your time and valuable contribution. We eagerly await your response! Best regards, Meitong Wang & Tariq Elahi The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336. Is e buidheann carthannais a th' ann an Oilthigh Dh?n ?ideann, cl?raichte an Alba, ?ireamh cl?raidh SC005336.

1 0

Security implications of disabling onion key rotation?
by David Fifield 05 Jul '23

05 Jul '23

Linus Nordberg and I have had a paper accepted to FOCI 2023 on the special pluggable transports configuration used on the Snowflake bridges. That design was first hashed out on this mailing list last year. https://forum.torproject.net/t/tor-relays-how-to-reduce-tor-cpu-load-on-a-s… https://github.com/net4people/bbs/issues/103 https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/Survival%20G… There is a draft of the paper here: https://www.bamsoftware.com/papers/pt-bridge-hiperf/pt-bridge-hiperf.202303… https://www.bamsoftware.com/papers/pt-bridge-hiperf/pt-bridge-hiperf.202303… A question that more than one reviewer asked is, what are the security implications of disabling onion key rotation as we do? (Section 3.2 in the draft.) It's a good question and one we'd like to address in the final draft. What are the risks of not rotating onion keys? My understanding is that rotation is meant to enhance forward security; i.e., limit how far back in time past recorded connections can be attacked in the case of key compromise. https://spec.torproject.org/tor-design Section 4 says: Short-term keys are rotated periodically and independently, to limit the impact of key compromise. Do the considerations differ when using ntor keys versus TAP keys?

3 5

Instructions for setting up an Obfs4 bridge on windows
by tor 03 Jul '23

03 Jul '23

Hi, I'm attempting to follow the instructions for setting up a obfs4 bridge on Windows. In my instance, it is Windows 10. The instructions say to copy out the obfs4proxy.exe from: C:\Users\<user>\Desktop\Tor Browser\Browser\TorBrowser\Tor\PluggableTransports However, there is no obfs4 file in this location or anywhere else within the tor browser bundle. In this location, there are only a snowflake exe and a lyrebird exe. I also checked the tor expert bundle and there is no obfs4 exe there. Any suggestions as to where I may find the obfs4 exe for Windows? -matt

2 1

(Announcement) WebTunnel, a new pluggable transport for bridges, now available for deployment
by Shelikhoo 30 Jun '23

30 Jun '23

Dear Tor relay operators, We're excited to announce WebTunnel, a new bridge pluggable transport (PT) for the Tor ecosystem. It is a censor resistant proxy that try to imitate HTTPS traffic, based on HTTPT(https://www.usenix.org/conference/foci20/presentation/frolov) research. We are currently operating a trial soft launch for WebTunnel, and encouragebridge operators to setup WebTunnel bridges to discover issues within theimplementation of this newpluggable transport. How it works ------------ When connecting to a WebTunnel Bridge, the client send a http 1.1 upgrade request to the load balancer over an encrypted connection, like how WebSocket works. Thus, from an observator’s point of view, this process looks like a real websocket connection to the real website. If one ever try to connect to the fronting website, then what will be presented will be that fronting website. Without the full URL including the path, which the censor don’t know, it is very difficult to tell if a website hosts a WebTunnel by probing the HTTPS port. Technical requirements ---------------------- To set up a WebTunnel Bridge, you will need a self-hosted website,a domain under your control,a configurable load balancer, static IPv4, and environment to setup Tor Bridge to setup a WebTunnel Bridge. Docker or other container runtime is recommended to streamline setup process, but is not required. The setup guide is available here: _https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/web… <https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/webt…> How to test and report issues ----------------------------- You can test the WebTunnel bridge by using themost recent version of Tor Browser Alpha(https://www.torproject.org/download/alpha/). Currently, WebTunnel is only distributed over the HTTPSdistributor(torrc setting:'BridgeDistribution https'). You can report issues on the Tor Project GitLab Anti-censorship group: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/webt…. Given that this new PT is only available now on Tor Browser Alpha, relay operators should not expect significant usage or a large number of users at the moment. Please let us know if you encountered any difficulty with WebTunnel setup. Thanks for your contribution to the Tor ecosystem.

3 2