- tor-relays - lists.torproject.org

Relay
by Jonathan W 15 Sep '13

15 Sep '13

I am about to run a relay, but I don't want it using more than 1000GB a month. I prefer to manage this using the *BandwidthRate** *but I don't know the math* *to constrain it over a 1000GB a month. * * I also want to relay the directory. Is there a way to also use vidalia to interface? I'll be relaying on a linux (ubuntu) server remotly, and I'm using a windows system to set it all up. I'll be using SSH to shell in, but I'd love to use vidalia. Thanks, Jon

4 7

How to add the MyFamily line.
by Ignoramus Americanus 14 Sep '13

14 Sep '13

Would someone spell out how to include the MyFamily comment in the torrc file, please? What is needed more? Exits, bridges, non-exit relays or hidden bridges? -- Ignoramus Americanus ignoramus(a)operamail.com -- http://www.fastmail.fm - Or how I learned to stop worrying and love email again

4 4

Re: [tor-relays] tor-relays Digest, Vol 32, Issue 29
by rotpoison throngnet 14 Sep '13

14 Sep '13

Hey guys - I have been tracking the clickfraud botnet that is hitting exposed Privoxy service on Tor exit nodes since early this year. I call it Rotpoi$on, and recently I have been working with at least one of the security teams for the advertisement networks being leveraged for the clickfraud, as my time allows. You can read more about some collective findings on Rotpoi$on here: https://b.kentbackman.com/tag/rotpoion FYI, LUDICROUS2U is my Tor exit node. I started purposely running Tinyproxy on port 8118, configured such that it will forward directly to the advertiser networks with a specific markup indicating fraud as well as the original client IP in the X-header. Now, if every exit relay operator that has a Tor-injecting Privoxy service open instead replaced it with a similar "tainted" proxy on port 8118, it might quickly reduce the attractiveness of exit relays for "fraud service" by the Rotpoi$on throngnet. Recently I changed my exit relay IP address and for a week now Rotpoi$on hasn't hit. I have changed my IP address at least a dozen times over the last year. The time that it takes for my exit relay to again be hit on port 8118 (at times additionally 3128--Squid port) has varied considerably. This makes me think that the perpetrators are more or less manually adding the list of exit relays into their click fraud operation (script?). For a while I was under the presumption that the massive uptick of Tor clients as recently announced by the Tor Project was sign that the Rotpoi$on perpetrators were starting to inject their fraudulent clicks into Tor the "legitimate" way, meaning with a Tor client. This corresponded with a reduction in port 8118 hits to my exit relay. But alas, communication with one of the advertisement network security reps does not suggest a massive corresponding increase in click fraud originating from Tor exit relays in general. So I am at a loss how to explain exactly what is going on, other than the fact that the perpetrators are still paying for a lot of leased Windows servers whose actual effectiveness at generating a significant clickfraud revenue streams seems limited and even silly, according to some other researcher's comments. On Sat, Sep 14, 2013 at 2:00 AM, <tor-relays-request(a)lists.torproject.org>wrote: > Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > > > Today's Topics: > > 1. Tor 0.2.4.17-rc on arch armv6 (Lukas Erlacher) > 2. Re: Sent open privoxy port warning (Luther Blissett) > 3. Re: Sent open privoxy port warning (Luther Blissett) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 13 Sep 2013 15:13:18 +0200 > From: Lukas Erlacher <l.erlacher(a)gmail.com> > To: tor-relays(a)lists.torproject.org > Subject: [tor-relays] Tor 0.2.4.17-rc on arch armv6 > Message-ID: > <CAJWOhv-pxwHnqy6-bLojr66cGWg=0ee=HhO_WuNb9N= > PAw5mtw(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Hello to everyone with arm hardware and arch linux, > > I just set up Tor 0.2.4.17-rc on a raspberry pi and I want to share > what I did just to create a piece of documentation that might be > helpful for others. > I got tor-git from the AUR[1], modified it to fetch 0.2.4.17-release > instead of master, and built it according to the aur[2] and > pkgbuild[3] instructions. > > Here is what I did: > > 1) Backup torrc, fingerprint, and private key of my tor node > 2) Read up on AUR and PKGBUILD > 3) pacman -R tor tor-socks > 4) pacman -s base-devel > 5) Download and extract the AUR > 6) Carefully inspect the AUR package, especially PKGBUILD and tor.install > 7) Modify the PKGBUILD file with _branch=release-0.2.4 and > pkgver=0.2.4.17.rc.0 > 8) makepkg -s > 9) pacman -U tor-git-0.2.4.17.rc.0-1-armv6h.pkg.tar.xz > 10) mv /etc/tor/torrc /etc/tor/torrc.tor-git.sample > 11) mv /etc/tor/torrc.pacsave /etc/tor/torrc > 12) systemctl tor start > > That's it. Run "tor --version" and it should tell you that it's a git > build of 0.2.4.17-rc. > > You will have to rebuild the package for every update you want to get! > > As per The Arch Way, Please familiarize yourself with pacman, the AUR, > and PKGBUILD before attempting this! > > Absolutely no warranties given. The AUR can seriously damage your system! > > Best Regards, > Luke > > [1] https://aur.archlinux.org/packages/tor-git/ > [2] https://wiki.archlinux.org/index.php/AUR > [3] https://wiki.archlinux.org/index.php/PKGBUILD > > > ------------------------------ > > Message: 2 > Date: Fri, 13 Sep 2013 12:52:35 -0300 > From: Luther Blissett <lblissett(a)paranoici.org> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Sent open privoxy port warning > Message-ID: <1379087555.555.10.camel@tagesuhu-pc> > Content-Type: text/plain; charset="utf-8" > > On Wed, 2013-09-11 at 12:35 -0700, Aaron Hopkins wrote: > > I sent the following warning to the listed e-mail address of 14 of the 19 > > Tor nodes I found that accepted connections on port 8118, some of which > > bounced. > > > > If any of you run or know how to get in touch with the operators of the > > nodes DaJoker, FawkesSwissBlade, LUDICROUS2U, RaspberryPI, pangu, > > mouseHouse, tornonym, or 75.137.122.118, I'd appreciate if you could pass > > this along. > > > > Thanks! > > > > -- Aaron > > > > --- > > > > I noticed your Tor node _ with an IP of _ is one of 19 nodes that accepts > > connections publicly on TCP port 8118, which is the default port for > > Privoxy. I suspect this might be a configuration mistake. > > > > I'm investigating this because my tor node "tordienet" has received > millions > > of HTTP proxy requests to port 8118 per day for months. The requests > appear > > to come from a botnet running on roughly 1500 IPs, and seem to be > > advertising click-fraud related. From the discussion in July on the > > tor-relays(a)lists.torproject.org mailing list (archive at > > https://lists.torproject.org/pipermail/tor-relays/) this appears to be > true > > of many nodes. > > > > Port 8118 is the default port for Privoxy, which comes bundled with Tor > but > > is meant to provide an HTTP proxy for you and your local users to browse > > through and is not designed to be offered as a public service. If you > don't > > use Privoxy, would you mind shutting it down? Or if you do, can you > move it > > to a different port and/or only allow your own IPs to connect to it? > > > > I'd be happy to provide more information or help you with the > configuration > > changes if I can. > > _______________________________________________ > > tor-relays mailing list > > tor-relays(a)lists.torproject.org > > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > Hello Aron, > > Sometime ago I noticed similar behavior from a series of IP numbers > which mostly were inside limestonenetworks IP range and searched for > polipo (port 8123). I sent an email alert to its admins, but received no > answer whatsoever. I also sent to this malling list and some others, but > since my mail wasn't registered I think it bounced. I'm copying it > bellow. In case this is of any help. > > Also, wouldn't this be the case for a "routine security alert" on tor > blogs? > > ************************** > > Hello dear companions, > > Two days ago one of my tor exit nodes experienced something I'm now > calling "limestonenetworks DDoS on polipo" ( $WAN_IP:8123 ), since all > packets in the storm were flowing from a range of 514 different IP > addresses, all of them inside limestonenetworks IP range and targeting > port 8123 on my tor exit node WAN IP. > > Before the packet storm, I could observe a huge increase on attempts to > access my WAN domain through tor. I couldn't relate IP addresses from > this first raise to those responsible for the actual packet storm nor > could I identify some useful pattern there, but they were all coming > from port 9001 and increased just some hours before the storm, so I'm > guessing they are related somehow. > > Also, throughout the storm, one of my log files got corrupted with some > unreadable bin garbage. I do not know if it was intended/targeted > exploit, but I'm reworking secrets and trying to figure out what is this > binary. > > Here is a sample line of a WAN attempt: > > Aug 13 16:50:22 $USER user.warn kernel: [DROP INVALID WAN] : IN=vlan2 > OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx > SRC=77.56.151.190 DST=xxx.xxx.xxx.xxx LEN=52 TOS=0x00 PREC=0x00 TTL=43 > ID=38787 DF PROTO=TCP SPT=40888 DPT=9001 SEQ=289854459 ACK=41163 > > Here is a sample line of packet storm: > > Aug 13 20:39:14 $USER user.warn kernel: [hammer] : IN=vlan2 OUT= > MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx > SRC=74.63.216.60 DST=xxx.xxx.xxx.xxx LEN=52 TOS=0x00 PREC=0x00 TTL=48 > ID=20269 DF PROTO=TCP SPT=1757 DPT=8123 WINDOW=65535 RES=0x00 SYN URGP=0 > OP > > The attack persisted for at least three hours and left this binary (hex > represented): > > 0000000 0000 0000 0000 0000 0000 0000 0000 0000 > * > 0000b90 0000 0000 0000 0000 0000 0000 2067 3331 > 0000ba0 3220 3a30 3135 303a 2034 6174 6567 7573 > 0000bb0 7568 7520 6573 2e72 6177 6e72 6b20 7265 > 0000bc0 656e 3a6c 5b20 6168 6d6d 7265 205d 203a > 0000bd0 4e49 763d 616c 326e 4f20 5455 203d 414d > 0000be0 3d43 3030 323a 3a31 3732 663a 3a61 6464 > 0000bf0 343a 3a34 3030 313a 3a35 3966 323a 3a61 > 0000c00 6639 643a 3a39 3830 303a 3a30 3534 303a > 0000c10 3a30 3030 333a 2034 5253 3d43 3132 2e36 > 0000c20 3432 2e35 3232 2e31 3031 2037 5344 3d54 > 0000c30 3831 2e39 3833 322e 3533 322e 3035 4c20 > 0000c40 4e45 353d 2032 4f54 3d53 7830 3030 5020 > 0000c50 4552 3d43 7830 3030 5420 4c54 343d 2038 > 0000c60 4449 313d 3335 3431 4420 2046 5250 544f > 0000c70 3d4f 4354 2050 5053 3d54 3932 3635 4420 > 0000c80 5450 383d 3231 2033 4957 444e 574f 363d > 0000c90 3535 3533 5220 5345 303d 3078 2030 5953 > 0000ca0 204e 5255 5047 303d 000a > 0000ca9 > > Attached is the list of participating IP addresses, line by line, with > the count of packets received. The attacker started sending something > like 4 packets per second and increased to over than 9000!!! - just > kidding, over 30 per second. > > JSYK, I welcome any comments. >

1 0

Sent open privoxy port warning
by Aaron Hopkins 13 Sep '13

13 Sep '13

I sent the following warning to the listed e-mail address of 14 of the 19 Tor nodes I found that accepted connections on port 8118, some of which bounced. If any of you run or know how to get in touch with the operators of the nodes DaJoker, FawkesSwissBlade, LUDICROUS2U, RaspberryPI, pangu, mouseHouse, tornonym, or 75.137.122.118, I'd appreciate if you could pass this along. Thanks! -- Aaron --- I noticed your Tor node _ with an IP of _ is one of 19 nodes that accepts connections publicly on TCP port 8118, which is the default port for Privoxy. I suspect this might be a configuration mistake. I'm investigating this because my tor node "tordienet" has received millions of HTTP proxy requests to port 8118 per day for months. The requests appear to come from a botnet running on roughly 1500 IPs, and seem to be advertising click-fraud related. From the discussion in July on the tor-relays(a)lists.torproject.org mailing list (archive at https://lists.torproject.org/pipermail/tor-relays/) this appears to be true of many nodes. Port 8118 is the default port for Privoxy, which comes bundled with Tor but is meant to provide an HTTP proxy for you and your local users to browse through and is not designed to be offered as a public service. If you don't use Privoxy, would you mind shutting it down? Or if you do, can you move it to a different port and/or only allow your own IPs to connect to it? I'd be happy to provide more information or help you with the configuration changes if I can.

2 2

Tor 0.2.4.17-rc on arch armv6
by Lukas Erlacher 13 Sep '13

13 Sep '13

Hello to everyone with arm hardware and arch linux, I just set up Tor 0.2.4.17-rc on a raspberry pi and I want to share what I did just to create a piece of documentation that might be helpful for others. I got tor-git from the AUR[1], modified it to fetch 0.2.4.17-release instead of master, and built it according to the aur[2] and pkgbuild[3] instructions. Here is what I did: 1) Backup torrc, fingerprint, and private key of my tor node 2) Read up on AUR and PKGBUILD 3) pacman -R tor tor-socks 4) pacman -s base-devel 5) Download and extract the AUR 6) Carefully inspect the AUR package, especially PKGBUILD and tor.install 7) Modify the PKGBUILD file with _branch=release-0.2.4 and pkgver=0.2.4.17.rc.0 8) makepkg -s 9) pacman -U tor-git-0.2.4.17.rc.0-1-armv6h.pkg.tar.xz 10) mv /etc/tor/torrc /etc/tor/torrc.tor-git.sample 11) mv /etc/tor/torrc.pacsave /etc/tor/torrc 12) systemctl tor start That's it. Run "tor --version" and it should tell you that it's a git build of 0.2.4.17-rc. You will have to rebuild the package for every update you want to get! As per The Arch Way, Please familiarize yourself with pacman, the AUR, and PKGBUILD before attempting this! Absolutely no warranties given. The AUR can seriously damage your system! Best Regards, Luke [1] https://aur.archlinux.org/packages/tor-git/ [2] https://wiki.archlinux.org/index.php/AUR [3] https://wiki.archlinux.org/index.php/PKGBUILD

1 0

Re: [tor-relays] Getting max bandwidth out of a relay
by Jesse Victors 12 Sep '13

12 Sep '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 > As I am trying to avoid using too many IPs (IPv4 is constrainted, IPv6 > is not, but the latter won't get much traffic), I'll try if I can get my > tcp-balancer idea setup in the run of next week (low on spare cycles at > the moment) and then forcing each Tor instance to use a specific core. Right, you can only get two Tor instances per IP, at least on IPv4. The third won't get any significant bandwidth. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQF8BAEBCgBmBQJSMcSWXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQxMjgyMjhENjEyODQ1OTU1NzBCMjgwRkFB RDk3MzY0RkMyMEJFQzgwAAoJEK2XNk/CC+yA0psH/35+GsdqKtZxG1bC9pjaFeGr mySy8AQ4DTj/FPhQhCtSwlh35ZFrTnagTuK49XChLcepMV830qFon56A29aL3QI/ 9Je5PX5sILxNlMN4ubR5578PfZLTtkWm2j7l58VALFFTkozMVMbkmVsQp63+3AQN MLt6VKb7p1Oob/PGaZsk+9c9gqxDl4LnT6awzcn1caRyUcchsP98BUURtNNdiIqg 7Yb03t3toVDZnkESyqo5n10dxG5OE7EN+ldrJ5jYrZoWmcHlHG6Ln/5pdLL6u/93 4yAxO6DYijzBIXbzzG2TU1Z1t+8s5WGa5ov0s6EdssxqszfK23KgZmBWIESnP9A= =ctNz -----END PGP SIGNATURE-----

1 0

Getting max bandwidth out of a relay
by Jeroen Massar 12 Sep '13

12 Sep '13

TLDR: what do people to do get the max throughput through their boxes? Hi, This might be more tor-dev related (due to the Tor internals, eg why it does not use multiple CPU cores effectively etc), but is likely a bit more appropriate here as there are people who are able to get a lot of performance out of their boxes. I've been playing a bit with setting up a few relays and letting them push as much traffic as possible following amongst others the items at: https://www.torservers.net/wiki/setup/server Thus making sure it is using AES-NI (which turned off and then on made a bit of a difference but primarily in CPU load), and doing some TCP stack and other kernel tweaks. I am running the current-git Tor on them, thus self-compiled and except for the install path no special configure options (any tips there?). The boxes are 2-cpu 6-core E5645 @ 2.40Ghz, with HT thus 24 cores visible. Tor is using about 170% CPU (thus effectively 2 cores) on average along with 3G of mem, the box has 70G of mem thus that is not a problem. A little snapshot from 'arm' from one of the boxes: Bandwidth (limit: 3.9 Gb/s, burst: 3.9 Gb/s, measured: 353.9 Kb/s) Download (45.7 Mb/sec - avg: 27.2 Mb/sec, total: 302.2 GB) Upload (52.5 Mb/sec - avg: 27.9 Mb/sec, total: 308.4 GB): Down/Up varies upto 70mbit, the box has full GE and between them can push easily a single-stream 900mbit flow (tested with iperf/wgets/scp) next to the running Tor process. Thus there seem to be some significant issue in the Tor portion of things (though tuning might affect it as there are more flows etc). There is no connection tracking on the box, as that would just slow things down See also the munged torrc below, in case there are options to be set there. What else is there to tune except for maybe running multiple Tor nodes on the same box? Which would require it to use multiple IPs right as one can only run 2 nodes on the same IP I understand. Would there maybe be a way to run multiple Tor processes with the same key/identity but with a TCP load-balancer in front of it which distributes the incoming connections to the processes? The only thing then is that only one of them should report their details to the authorities and the others should not publish; would that be possible or would it mess up for instance performance stats? Greets, Jeroen -- torrc used: ----- NickName <nick> ContactInfo <contact> MyFamily $<othernode> ControlPort 9051 HashedControlPassword 16:<pass> CookieAuthentication 1 DirPort <ip>:<port> DirPortFrontPage /usr/local/tor/etc/tor/tordirport.html ORPort <ip>:<port> RelayBandwidthRate 600 MB RelayBandwidthBurst 606 MB SocksListenAddress 127.0.0.1 SocksPort 1080 ExitPolicy reject *:* #Log debug file /usr/local/tor/var/log/tor/debug.log Log notice file /usr/local/tor/var/log/tor/notices.log DataDirectory /usr/local/tor/var/lib/tor RunAsDaemon 1 DisableDebuggerAttachment 0 CellStatistics 1 DirReqStatistics 1 EntryStatistics 1 ExitPortStatistics 1 ExtraInfoStatistics 1 ----- /etc/sysctl.d/tor.conf net.ipv4.tcp_syncookies=1 net.ipv4.tcp_synack_retries=2 net.ipv4.tcp_syn_retries=2 net.core.rmem_max=33554432 net.core.wmem_max=33554432 net.ipv4.tcp_rmem=4096 87380 33554432 net.ipv4.tcp_wmem=4096 65536 33554432 net.core.netdev_max_backlog=262144 net.ipv4.tcp_no_metrics_save=1 net.ipv4.tcp_moderate_rcvbuf=1 net.ipv4.tcp_tw_recycle=1 net.ipv4.tcp_max_orphans=262144 net.ipv4.tcp_max_syn_backlog=262144 net.ipv4.tcp_fin_timeout=4 vm.min_free_kbytes=65536 net.ipv4.tcp_keepalive_time=60 net.ipv4.tcp_keepalive_intvl=10 net.ipv4.tcp_keepalive_probes=3 net.ipv4.ip_local_port_range=1025 65530 net.core.somaxconn=20480 net.ipv4.tcp_max_tw_buckets=2000000 net.ipv4.tcp_timestamps=0

4 5

A bit more evidence on circuit creation storms
by Dan Staples 12 Sep '13

12 Sep '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Just to add my experiences to the mix: I started running a RPi relay back in January. It ran fine for several months, until I started to get these circuit creation storms periodically. It would come at random times, maybe once a week, and would sometimes last for enough hours that it would knock down the Pi and I'd have to reboot it. While it was clearly CPU bound during the storms (90%+ shown by top), my bandwidth was also completely saturated. I was seeing 3 Mb/s traffic, as shown by ntop (great for monitoring bandwidth over time). Shutting down Tor during the storms would reduce the traffic to < 100kb/s...so clearly the circuit storms eat bandwidth too. Gordon, perhaps you had an upstream router that was preventing the traffic flood during the circuit storms? I asked Roger Dingledine about it at PETS a couple months ago, and he suggested it might be a case where there is a nearby popular hidden service that picked my relay as a guard node, and all of a sudden I get flooded by requests for the hidden service. No idea how to test the accuracy of this hypothesis. Finally, I noticed that bandwidth-related config options had no effect on the 3 Mb/s traffic flood during the circuit creation storms. I had: RelayBandwidthRate 200 KB RelayBandwidthBurst 200 KB MaxAdvertisedBandwidth 200KB ...yet, still 3 Mb/s traffic floods. Even MaxOnionsPending 250, NumCPU 1, and AvoidDiskWrites 1 made no difference in my RPi's ability to weather the storms. I eventually had to use QoS on my DD-WRT router to set limits on the traffic it would pass to the Pi. I will try your builds of 0.2.4 to see if that makes a difference. cheers, Dan > Since I originally started keeping an eye on these on my Raspberry > Pi relay (read: slow, resource-limited), I've got to wonder if the > circuit creation storms I was seeing months ago weren't normal > network phenomena but some kind of test run. > > We are talking going from 50-250 circuits to thousands of requests > per *second* out of nowhere, and then if the machine survived it, > the storm disappearing as suddenly as it came. This was happening > months ago, but less frequently and only on lower-end hardware. > Now it's happening everywhere. > > Even if the previous case *were* "normal" Tor network operation, > I'd say it's a bug, but I'm suspicious that it was whatever is > going on now in its test phase. > > tor at t-3.net: >> Also see a repeat of the odd log message with the 154.x net >> address someone else described with the huge hexidecimal string >> (40 hex chars, + sign, 40 more, on and on). > > Here as well. I believe this is the sign of an overloaded Tor > directory server. > >>> Over roughly the same time frame I received an incredibly high >>> number of spam e-mails in one e-mail account that normally >>> gets 20 or so a day on quiet days. Perhaps this is another >>> example of mal-ware in action. > > Funny, one of the dropped connections during my storm last night > was to port 993... :P > > Best, - -Gordon M. - -- http://disman.tl OpenPGP key: http://disman.tl/pgp.asc Fingerprint: 2480 095D 4B16 436F 35AB 7305 F670 74ED BD86 43A9 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBCAAGBQJSKInBAAoJEPZwdO29hkOpDZ4QAIjZqi9kXrcubZUg6v0nH6mP V9LT4j2Md0MqE74JcyEIgIBYKMWbun+n417LMMkb9uLu2mld6Lf/YIU9iO57JqQJ 8dM1uX0LJb51MbOj6ZTZEwMgHI8pX/ZeLj4zQscAz2C2oBwapnOpxqKTbg76CM1G DrP39iai9TpN+YfUY0FkxwdYTM46ADUvk/hbu/34CLXklOvrqWkK/Ta/nZ9zTebt HkB/KJn1P0I5L87x2VmIhIH5JKK6lszDlZg+k96PRC8oK9a1icECCGsnFJpqwVrv UyIsutezQHjT7HT4zJCNBxacHuK8VKbwayX6P/MSPpAGaobqEzSvWJmHdYRrIv2h glM5qIIzB3RmJxvHW8hCF47T8n9B6fo+J5PZly3xtwLGzCATjehnnhGTzigIw8ro WkQwMQr/3F5yQ0YS2YKh+KsQDhe2d1fYbrGtSPAG/z1RMuk2i5tmgyhAFJ8HvIfw GozzAaxcy1dCdEvQIyv/j1LCtUUpCrPVGd51grDI+GB9b5HuIEsPoQCvisshVEpu 1vLKyP7VLv+fOnvVb7MCwiWnU1Q5uw3yC3kdig9tTuAWGiMgbGoWpkGiy5MNVVQA Z2Q7uLnd7j6scTbpWgaa0Fx0HQ2euAXMwC+zS8g0PQXOEslGnnPs2Kqz5YTimtuh LWLcZ3WMZvlShurfNLse =mqNB -----END PGP SIGNATURE-----

2 1

Upgrade your relay to 0.2.4.17-rc?
by Roger Dingledine 12 Sep '13

12 Sep '13

Hi folks, I just released 0.2.4.17-rc. Hopefully there will be debs of it soon. It comes with a new feature: - Relays now process the new "NTor" circuit-level handshake requests with higher priority than the old "TAP" circuit-level handshake requests. We still process some TAP requests to not totally starve 0.2.3 clients when NTor becomes popular. A new consensus parameter "NumNTorsPerTAP" lets us tune the balance later if we need to. Implements ticket 9574. So the more relays that upgrade to 0.2.4.17-rc, the more stable and fast Tor will be for 0.2.4 users, despite the huge circuit overload that the network is seeing. Please consider upgrading. If you do, though, please also keep an eye on it -- it's possible we introduced some new bugs and the network will start dissolving once more relays move to the new version. In my spare time I'm also working on a blog post to explain what's going on and what measures we're taking to keep things afloat. Aren't distributed systems fun, --Roger

13 24

Why is my fast relay so slow to gain popularity?
by Jesse Victors 12 Sep '13

12 Sep '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello everyone, newcomer here. I'm behind very fast connection (11.5 MB/sec down, 7.5 MB/sec up) and I thought that the Tor network could benefit from my connection, especially since it's apparently been under high load recently. Per the latest blog posts, I downloaded the beta TBB and configured it as a relay under Linux. It's been up for almost two days now, yet it's still being utilized at a very, very small fraction of it's potential. In the network map, I see that my relay has an advertised speed which is again much slower than it actually can be. To my knowledge, a web server can be put under full load right away, and distributing computing projects use the most of your computer right off the bat. Why doesn't Tor run computational and/or bandwidth tests and advertise my relay at a much more actual speed? I don't see why a fast relay has to start at the very bottom of the barrel to begin with. I can see the logic in slowly ramping up connections in testing for stability and scalability, but the progress is slow because it's continually fighting against that existing average. I can set my requested average and burst bandwidth, but AFAIK I can't affect my advertised bandwidth. Why are things this way, and is there anything I can do to speed up the utilization growth? Thanks in advance for any help you can provide, Jesse V. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQF8BAEBCgBmBQJSMJg3XxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQxMjgyMjhENjEyODQ1OTU1NzBCMjgwRkFB RDk3MzY0RkMyMEJFQzgwAAoJEK2XNk/CC+yAAekH/i2rHzwbGZMiL4g31d2JEkQR ZjOaDCe6aNkK/ORf5MhxW7B6L772BczjPkjuO0H1Oe41bSkglO78gCbLC+YQ1r68 0nc45dcztNDkQPhZVrkj7RconNrmfLXFozFLKY1Nr2mLy6RTg0a1yQ/WhpFa/qah cUmVnGtvIoDnDAhuCPIEu7SuGba0I4TkBph1atKAC/gQYyOSp9CpCqxy0J3Qaa3Y pcCkGC7oWW2I9g8UJOx0UKg1auiYMZ1QrwpJ6HdHhvhFSWnhWeggkvaOCDewC2pZ dQg7Odk/ISfkpdeCgd8hg2IQBh3kpI1kRVUvX0sJgbYCbizT45bwKCLf/XzMQHE= =gfnB -----END PGP SIGNATURE-----

4 4

Exit flag given to nodes with nearly-all-reject?
by Jeroen Massar 11 Sep '13

11 Sep '13

Hi, Is the 'exit' flag given to a Tor node which only allows exit to a certain prefix? If yes, what kind of effect does that have on path selection, will it only be chosen for exit'ing to that prefix and not be used as a relay? Greets, Jeroen

2 1

Tor crashes frequently on fast relay
by Random Tor Node Operator 11 Sep '13

11 Sep '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello everybody, since this botnet started flooding Tor, my Tor relay Bazinga ($196832C61F30E9D6D179393C9AED4E47FD29796B) has been experiencing some issues. Previously, it was relaying 100 Mbit/s for a few months without problem. When the botnet came along, at first the throughput dropped to about 30 Mbit/s and Tor kept spamming "Your CPU is too slow" and crashed every hour or so. I set RelayBandwidthRate to 20 Mbit/s which reduced the crash frequency. Then, 0.2.4.17-rc was released and I lifted RelayBandwidthRate back to 100 Mbit/s. At first it was running fine, but then the crashes came back. This is from yesterday and the day before: $ sudo grep -i interrupt /var/log/tor/log.1 Sep 10 08:59:40.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 10 10:01:45.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 10 11:04:50.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 10 12:49:56.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 10 13:51:01.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 10 15:22:18.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 10 16:07:27.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 10 18:56:03.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. $ sudo zcat /var/log/tor/log.2.gz|grep -i interrupt Sep 09 06:51:20.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 07:54:30.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 08:48:36.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 09:51:56.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 10:20:01.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 10:49:06.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 13:03:26.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 13:26:40.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 13:50:47.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 14:02:54.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 14:26:06.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 14:42:11.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 14:52:17.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 15:08:31.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 15:21:37.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 15:31:27.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 15:44:32.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 15:53:38.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 16:02:45.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 16:08:50.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 16:16:56.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 16:24:04.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 16:34:10.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 16:48:20.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 16:55:25.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 17:02:30.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 17:21:39.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 17:35:45.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 18:51:51.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 19:14:02.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 19:30:10.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 19:50:16.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 20:06:23.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 20:49:52.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 21:13:00.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 21:51:06.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 09 22:54:22.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. It is a VPS on a Xen hypervisor with 3x Intel(R) Xeon(R) CPU L5630 @ 2.13GHz and 2 GB RAM According to htop, tor currently uses about 105% CPU and 350 MB RAM. It was around the same CPU and RAM consumption while it was happily relaying 100 Mbit/s. At first I was suspecting the hoster to have reduced CPU resources or so, but they said they didn't change anything, including no virtualization parameters. Any help would be appreciated. - --RTNO -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJSMCRbAAoJEJe61A/xrcOQmfcP/Rq2XmtQk8e4orMWe1rPHnKX 6CMMmrI5TIAW/XQ+Qulr2ElEKh0M85XSagF8ZeziQVL348z3FoI36HwUMbzLnkI3 uELx8kq1xTGlLOmtSEdyD9xH2dwCxarlogexVb3uHUVEUQM99GMQd/A4bSzLPgTW 6fnwvDWNNZ4x1PKXxElejGhoHiq2oW5f5JoSijw4LUWJBI2SrXx4aWFHm4SofVti Cncaf+UVM2f4loBn9gUh5LWmbeWviDXsk9p5DeNAAaJ8BwK8dp4MyAoH731dcbpw svJ2b1R0TtmgyO6g/WLJcJX3s9u6iKq2QzQgLavynsAaazn6Rr4nRqPD02TFM7rw nyP9H6r08P/7gumOF3G4JSXe3Px6GMipdcGNl0fBjr6R67sB7ZeMwT00O53m0f5l InUbCCghG/ukcEtbly0CZfu7qOISlz9cxUFShmYWOLv3EpMboh9lyMNC3DbyAYH2 3kMfffyVLS21HgNA57l0N+aZl++jz+EIwFK8r+L9xZEOUBQKcXrfm0jXneV6j8uA J9NuXYyKHWltxU+EO2ccyN2Zco/3KA044dwSnTo1BXCHnt95DjyylLcQj5+7+KYW QIsviYsONp4FSz0aQUFOnLk5KAhZtieQ28Iav1S4Gb3QiL4pY2rR9r27dBZ/E1wg +C9uvwcJz4ei14ZR9A19 =BoPn -----END PGP SIGNATURE-----

3 6

Re: [tor-relays] Running Bind locally
by tor＠t-3.net 11 Sep '13

11 Sep '13

For linux bind named.conf: Within "options {" put: allow-query { any; }; allow-recursion { trusted; }; allow-query-cache { trusted; }; Then, add this new section somewhere after the options closing bracket: acl "trusted" { localhost; localnets; //netblocks/IPs you want, examples below: 123.23.23.23/24; 12.123.123.123; }; On Tuesday 10/09/2013 at 4:23 am, Eugen Leitl wrote: > On Tue, Sep 10, 2013 at 12:45:03AM -0700, Bry8 Star wrote: >> >> If you run your own BIND/named as Authoritative DNS-Server, for some >> domain-name that you own, and if it is also configured to function >> as a Recursive DNS-Server for local software (in that computer), and >> if you have enabled DNSSEC (for recursive side), then that would be >> better, imho. > > Speaking about recursive DNS for BIND, does anyone have > a working set of options which limit recursive DNS queries > to just the local subnet, and another couple IPs, maybe? > > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >

2 1

The lifecycle of a new Tor relay
by Roger Dingledine 11 Sep '13

11 Sep '13

Many people set up new fast relays and then wonder why their bandwidth is not fully loaded instantly. In this post I'll walk you through the lifecycle of a new fast non-exit relay, since Tor's bandwidth estimation and load balancing has gotten much more complicated in recent years. https://blog.torproject.org/blog/lifecycle-of-a-new-relay --Roger

1 0

Is this suspicious?
by I 10 Sep '13

10 Sep '13

1 0

Running Bind locally
by Yoriz 10 Sep '13

10 Sep '13

My VPS hoster has configured DNS as follows: $ cat /etc/resolv.conf nameserver 8.8.8.8 nameserver 8.8.4.4 I believe these are Google's DNS servers. Unfortunately, they are somehow unreliable (possible rate-limited by Google). My tor logs are filled with: Sep 07 16:37:24.000 [warn] eventdns: All nameservers have failed Sep 07 16:37:25.000 [notice] eventdns: Nameserver 8.8.8.8:53 is back up Sep 07 16:37:35.000 [warn] eventdns: All nameservers have failed Sep 07 16:37:35.000 [notice] eventdns: Nameserver 8.8.4.4:53 is back up Are there other free, open DNS services that might be more reliable/less rate-limited? Does Tor use the system DNS configuration? In other words, if I would run a local Bind daemon, would my tor exit use it? Is that bad for the safety of the tor user, as the Bind daemon effectively becomes an audit log of all domains visited by tor users? // Yoriz

7 8

Exit relay operators: a call for packets on port 8118
by rotpoison throngnet 09 Sep '13

09 Sep '13

I am an exit relay operator in Honolulu that has posted to this list before, on the same subject. I am hoping that some other exit relay operators can sniff for packets to destination port 8118 (usually used for Privoxy) to confirm that they are seeing the same thing I am on all exit relays that I have set up in the last half year. Depending on your network configuration, you might have to instead record firewall logs for that port. Don’t worry, unless you have your Privoxy service open to the world, you won’t be intercepting or eavesdropping on any legitimate traffic. You should just be seeing SYN packets from a few hundred-strong net of Windows servers now hosted at Gorilla Servers, Ubiquity/Nobistech, and Limestone Networks, with a handful at Psychz. I am calling this malicious (?) net of Windows servers Rotpoi$on. I have more details in the most recent blog post at https://b.kentbackman.com Thanks for your help. - Kent

5 5

Fwd: New tor node not acting as an exit server?
by Niles Rogoff 08 Sep '13

08 Sep '13

I scrapped my previous exit node and set up a new one on a different machine. It's been running for 6 and a half hours, but does not have the exit flag. The logs say both my ORPort and DirPort are reachable from the outside, and using arm from a different machine shows two circuits open. >From the config file: ExitPolicy reject 192.168.0.0/16:*,accept *:80,accept *:443,reject *:* Anyone know why my new node isn't being used or recognized as an exit node? Did I forget a config option? Fingerprint: 1e598cdb9bbc751d753146d880b326952886d73b

2 2

Re: [tor-relays] Tor node was doing more traffic than its bandwidthis configured for
by tor＠t-3.net 08 Sep '13

08 Sep '13

Yeah, this must be wrong, then. I put this in the torrc: RelayBandwidthRate 35 MB RelayBandwidthBurst 40 MB and I was looking to limit it to 35-40 "M" as shown in Cacti, which would be MBits. On Sunday 08/09/2013 at 5:38 am, grarpamp wrote: > On 9/8/13, Roger Dingledine <arma(a)mit.edu> wrote: >> >> Are you sure you didn't confuse bits and bytes? Tor counts in bytes. >> >> (The arm monitor, if that's what you're using, counts in bits by >> default.) > > As with real networks and operators, if this is so, then big thank > you to arm people for correctly counting network bandwidth in bps. > No thanks on webhosters and isp's who convert their upstrream > bandwidth contracts into transfer bytes and pass that on to their > customers for their apache logs, thereby spoofing hosted network > *bandwidth* apps like Tor into feeling some silly need to count bytes. > Do wish Tor would speak properly in bits by default. > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

3 2

Guard failing large amount of circuits
by I 08 Sep '13

08 Sep '13

3 2

Tor node was doing more traffic than its bandwidth is configured for
by tor＠t-3.net 08 Sep '13

08 Sep '13

I updated our node to the RC version some days ago. Earlier today, it started to do a traffic amount that was higher than it had been configured to do in torrc. Torrc was configured for 35M use and 40M burst, but today it went to 50M and stayed there for an hour. Killing it HUP didn't help. I did a service restart on it to bring it back down.

3 2

User report with TBB 2.4.17rc
by David Carlson 08 Sep '13

08 Sep '13

As of the time-stamp on this e-mail it is extremely slow using TBB 2.4.17 rc to access such places as gmail.com. It took me about 10 minutes since I first fired it up to sent this email. David C

3 2

ExitPolicy reject *:* ships commented out?
by gordon＠thisblueroom.net 07 Sep '13

07 Sep '13

I convinced a friend to run a Tor relay (he was happy to do so) but he claims he just upgraded and that this line: ExitPolicy reject *:* # no exits allowed is commented out by default. So his VPS got shut down over a bunch of complaints and he got banned from Freenode on it. Is that true? I could've sworn 0.2.4.x shipped with that as the *default* exit policy - as it should, given the potentially catastrophic legal consequences in some countries for those setting up a relay who unwittingly set up an exit relay rather than a middle node. Best, -Gordon M.

9 9

[ARM] Connecting to another host's control port with ARM: Connection refused.
by Robert Charlton 07 Sep '13

07 Sep '13

Hello, Tor community. Quick, possibly noobish question. I'd like to use my desktop and connect ARM (running on the desktop) to the control port of a server running Tor on the same LAN, but it's refusing the connection. I'm running /sudo -u tor arm -i 10.0.0.3:9051/, and it outputs: robert@CPC-Arch:~$ sudo -u tor arm -i 10.0.0.3:9051 [sudo] password for robert: Connection refused. Is the ControlPort enabled? I can connect to the control port from the same host fine, but when I try to do it from another host it fails. There must be something I'm missing. Hope you guys can help me. Thanks. -Robert

3 3

The Tor flood
by David Carlson 07 Sep '13

07 Sep '13

I think that it may be somewhat ego-centric to accept the argument that this apparent flood is actually directed at the Tor network. It may be that the real goal is to find efficient weapons to attack the Internet as a whole, or major segments of it. It may be measuring the response time of the Tor network as well as that of various defenders who are trying to disarm bot-nets. David C

2 1