- tor-relays - lists.torproject.org

Re: [tor-relays] Running Bind locally
by tor＠t-3.net 11 Sep '13

11 Sep '13

For linux bind named.conf: Within "options {" put: allow-query { any; }; allow-recursion { trusted; }; allow-query-cache { trusted; }; Then, add this new section somewhere after the options closing bracket: acl "trusted" { localhost; localnets; //netblocks/IPs you want, examples below: 123.23.23.23/24; 12.123.123.123; }; On Tuesday 10/09/2013 at 4:23 am, Eugen Leitl wrote: > On Tue, Sep 10, 2013 at 12:45:03AM -0700, Bry8 Star wrote: >> >> If you run your own BIND/named as Authoritative DNS-Server, for some >> domain-name that you own, and if it is also configured to function >> as a Recursive DNS-Server for local software (in that computer), and >> if you have enabled DNSSEC (for recursive side), then that would be >> better, imho. > > Speaking about recursive DNS for BIND, does anyone have > a working set of options which limit recursive DNS queries > to just the local subnet, and another couple IPs, maybe? > > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >

2 1

The lifecycle of a new Tor relay
by Roger Dingledine 11 Sep '13

11 Sep '13

Many people set up new fast relays and then wonder why their bandwidth is not fully loaded instantly. In this post I'll walk you through the lifecycle of a new fast non-exit relay, since Tor's bandwidth estimation and load balancing has gotten much more complicated in recent years. https://blog.torproject.org/blog/lifecycle-of-a-new-relay --Roger

1 0

Is this suspicious?
by I 10 Sep '13

10 Sep '13

1 0

Running Bind locally
by Yoriz 10 Sep '13

10 Sep '13

My VPS hoster has configured DNS as follows: $ cat /etc/resolv.conf nameserver 8.8.8.8 nameserver 8.8.4.4 I believe these are Google's DNS servers. Unfortunately, they are somehow unreliable (possible rate-limited by Google). My tor logs are filled with: Sep 07 16:37:24.000 [warn] eventdns: All nameservers have failed Sep 07 16:37:25.000 [notice] eventdns: Nameserver 8.8.8.8:53 is back up Sep 07 16:37:35.000 [warn] eventdns: All nameservers have failed Sep 07 16:37:35.000 [notice] eventdns: Nameserver 8.8.4.4:53 is back up Are there other free, open DNS services that might be more reliable/less rate-limited? Does Tor use the system DNS configuration? In other words, if I would run a local Bind daemon, would my tor exit use it? Is that bad for the safety of the tor user, as the Bind daemon effectively becomes an audit log of all domains visited by tor users? // Yoriz

7 8

Exit relay operators: a call for packets on port 8118
by rotpoison throngnet 09 Sep '13

09 Sep '13

I am an exit relay operator in Honolulu that has posted to this list before, on the same subject. I am hoping that some other exit relay operators can sniff for packets to destination port 8118 (usually used for Privoxy) to confirm that they are seeing the same thing I am on all exit relays that I have set up in the last half year. Depending on your network configuration, you might have to instead record firewall logs for that port. Don’t worry, unless you have your Privoxy service open to the world, you won’t be intercepting or eavesdropping on any legitimate traffic. You should just be seeing SYN packets from a few hundred-strong net of Windows servers now hosted at Gorilla Servers, Ubiquity/Nobistech, and Limestone Networks, with a handful at Psychz. I am calling this malicious (?) net of Windows servers Rotpoi$on. I have more details in the most recent blog post at https://b.kentbackman.com Thanks for your help. - Kent

5 5

Fwd: New tor node not acting as an exit server?
by Niles Rogoff 08 Sep '13

08 Sep '13

I scrapped my previous exit node and set up a new one on a different machine. It's been running for 6 and a half hours, but does not have the exit flag. The logs say both my ORPort and DirPort are reachable from the outside, and using arm from a different machine shows two circuits open. >From the config file: ExitPolicy reject 192.168.0.0/16:*,accept *:80,accept *:443,reject *:* Anyone know why my new node isn't being used or recognized as an exit node? Did I forget a config option? Fingerprint: 1e598cdb9bbc751d753146d880b326952886d73b

2 2

Re: [tor-relays] Tor node was doing more traffic than its bandwidthis configured for
by tor＠t-3.net 08 Sep '13

08 Sep '13

Yeah, this must be wrong, then. I put this in the torrc: RelayBandwidthRate 35 MB RelayBandwidthBurst 40 MB and I was looking to limit it to 35-40 "M" as shown in Cacti, which would be MBits. On Sunday 08/09/2013 at 5:38 am, grarpamp wrote: > On 9/8/13, Roger Dingledine <arma(a)mit.edu> wrote: >> >> Are you sure you didn't confuse bits and bytes? Tor counts in bytes. >> >> (The arm monitor, if that's what you're using, counts in bits by >> default.) > > As with real networks and operators, if this is so, then big thank > you to arm people for correctly counting network bandwidth in bps. > No thanks on webhosters and isp's who convert their upstrream > bandwidth contracts into transfer bytes and pass that on to their > customers for their apache logs, thereby spoofing hosted network > *bandwidth* apps like Tor into feeling some silly need to count bytes. > Do wish Tor would speak properly in bits by default. > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

3 2

Guard failing large amount of circuits
by I 08 Sep '13

08 Sep '13

3 2

Tor node was doing more traffic than its bandwidth is configured for
by tor＠t-3.net 08 Sep '13

08 Sep '13

I updated our node to the RC version some days ago. Earlier today, it started to do a traffic amount that was higher than it had been configured to do in torrc. Torrc was configured for 35M use and 40M burst, but today it went to 50M and stayed there for an hour. Killing it HUP didn't help. I did a service restart on it to bring it back down.

3 2

User report with TBB 2.4.17rc
by David Carlson 08 Sep '13

08 Sep '13

As of the time-stamp on this e-mail it is extremely slow using TBB 2.4.17 rc to access such places as gmail.com. It took me about 10 minutes since I first fired it up to sent this email. David C

3 2

ExitPolicy reject *:* ships commented out?
by gordon＠thisblueroom.net 07 Sep '13

07 Sep '13

I convinced a friend to run a Tor relay (he was happy to do so) but he claims he just upgraded and that this line: ExitPolicy reject *:* # no exits allowed is commented out by default. So his VPS got shut down over a bunch of complaints and he got banned from Freenode on it. Is that true? I could've sworn 0.2.4.x shipped with that as the *default* exit policy - as it should, given the potentially catastrophic legal consequences in some countries for those setting up a relay who unwittingly set up an exit relay rather than a middle node. Best, -Gordon M.

9 9

[ARM] Connecting to another host's control port with ARM: Connection refused.
by Robert Charlton 07 Sep '13

07 Sep '13

Hello, Tor community. Quick, possibly noobish question. I'd like to use my desktop and connect ARM (running on the desktop) to the control port of a server running Tor on the same LAN, but it's refusing the connection. I'm running /sudo -u tor arm -i 10.0.0.3:9051/, and it outputs: robert@CPC-Arch:~$ sudo -u tor arm -i 10.0.0.3:9051 [sudo] password for robert: Connection refused. Is the ControlPort enabled? I can connect to the control port from the same host fine, but when I try to do it from another host it fails. There must be something I'm missing. Hope you guys can help me. Thanks. -Robert

3 3

The Tor flood
by David Carlson 07 Sep '13

07 Sep '13

I think that it may be somewhat ego-centric to accept the argument that this apparent flood is actually directed at the Tor network. It may be that the real goal is to find efficient weapons to attack the Internet as a whole, or major segments of it. It may be measuring the response time of the Tor network as well as that of various defenders who are trying to disarm bot-nets. David C

2 1

Raspberry Pi / Raspbian tor 0.2.4.17-rc binary .deb packages
by Gordon Morehouse 07 Sep '13

07 Sep '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello folks, I've built binary .deb packages for Raspbian, the Raspberry Pi flavor of armhf Debian built for the Pi's ARMv6 chip. You can get them here, or find instructions on how to build your own from source if you don't trust my build. https://github.com/gordon-morehouse/cipollini I haven't made any changes to the source itself - no Pi-specific optimizations - just built it on a Pi to get ARMv6 compatible executables; Debian wheezy armhf is targeted at ARMv7 and up, for those not familiar. Best, - -Gordon M. -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJSKm1tAAoJED/jpRoe7/ujjO4H/RfvL2PbUV48lbzLyyD4vuxH FmQdGNSGLyI2u6E2rbugpr5Y2OUVLZDXdPmbypen5rGEgKy73vOSjaoOLLiSu3+w VhOtoKZl4NvHIXFlU+wGddK51gZneUIpiARUqBry9vjglYoMaRHvOEaHrQrUb00f ioBxCgNyP4bLESGECPwIgT5X6PaISATin9fghGTQHQ84F1Zh2Kt7aViMK2RGxJRS WJdZ/PxURHC30uaN5R+KBNgcKHoZHIYTRqAhuD0bfcJbhgEAxDAyxBHB2bSzQOsi fW8IyXLrBshsHAllJZdt6wgcDarRUsMX6G6Y7SuvvNEwG4zXSU+2RnZaWWDygfY= =qxGc -----END PGP SIGNATURE-----

2 1

RaspPi with -enable-ec_nistp_64_gcc_128
by Harold Naparst 06 Sep '13

06 Sep '13

Yesterday, Nick Mathewson wrote: One thing that you should try is seeing whether the latest 0.2.4.x release does any better for you. In particular, I'd recommend trying the just-released 0.2.4.16-rc, with openssl 1.0.1e, and make sure that openssl 1.0.1e was built with the -enable-ec_nistp_64_gcc_128 option if possible. (I see you're already using 1.0.1e, but it doesn't appear to have been built with that option.) When I try to build openssl with this option on my Raspian system, I get *ecp_nistp224.c:43:3: error: unknown type name ‘__uint128_t’ * It would be helpful for me to get some guidance from someone who has done this on Raspbian. Regards, Harold

3 2

how to start remote VPS gui
by I 06 Sep '13

06 Sep '13

2 1

Patch
by Niels Hesse 04 Sep '13

04 Sep '13

Hello. Please excuse my ignorance. I saw the mention of a patch in the recent tor blog post. https://blog.torproject.org/blog/tor-weekly-news-%E2%80%94-september-4th-20… How does one apply that? Thanks in advance.

3 3

MaxAdvertisedBandwidth, MaxOnionQueue and so on
by Thomas Themel 04 Sep '13

04 Sep '13

Hi, currently trying to set up a bog standard relay node that's supposed to generate about 20TB/month of outgoing traffic. I've thus set RelayBandwidthRate 7500 KB RelayBandwidthBurst 20000 KB but keep getting tons of these Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. Questions: - Is this log message still accurate? I've seen from e.g. ticket 9005 that apparently circuit creation is anyway already handled in parallel, and my machine is definitely not constantly overloaded on all 8 threads. - The node also crashes far too often, i.e. multiple times a week. Annoyingly, I can't seem to get core dumps for these crashes even though I've verified that the core ulimit is set to unlimited, but still the crashes themselves or a kill -SEGV $TORPID do not give me core files. Any ideas? I've also verified that the cwd is /var/lib/tor and that /var/lib/tor is writable :( - I've also set MaxOnionQueue 250, but that didn't change much. Any other suggestions? ciao, -- [*Thomas Themel*] I just want an EDitor!! Not a "viitor". Not a "emacsitor". [Albulastrasse 52] Those aren't even WORDS!!!! ED! ED! ED IS THE STANDARD!!! [ CH-8048 Zürich ] [*+41 78 9070988*] Paul J. LoPresti in <1991Jul11.031731.9260(a)athena.mit.edu>

4 4

obfsbridge operators: git master enables client statistics!
by George Kadianakis 04 Sep '13

04 Sep '13

Greetings obfsbridge operators, tl;dr, you might want to upgrade your tor to the latest git master. Trac tickets #4773 and #5040 have been merged to tor's git repository. This means that if you run the current git master, your obfsbridge will produce interesting statistics. Specifically, your bridge will count the number of its unique users like normal bridges do (but because of some complications it was not so easy for obfsbridges). It will also count the number of users per transport. Your bridge will then send these statistics to the bridge authority, and they will be published in metrics.torproject.org so that we can easily track the deployment of pluggable transports. You can experience the stats yourself by peaking at $DataDirectory/stats/bridge-stats. BTW, make sure that you are using the latest obfsproxy written in Python, and not the obsolete obfsproxy written in C. Cheers!

2 2

Status of UserspaceIOCPBuffers ??
by Gordon Morehouse 03 Sep '13

03 Sep '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 So in the documentation: UserspaceIOCPBuffers 0|1 If IOCP is enabled (see DisableIOCP above), setting this option to 1 will tell Tor to disable kernel-space TCP buffers, in order to avoid needless copy operations and try not to run out of non-paged RAM. This feature is experimental; don’t use it yet unless you’re eager to help tracking down bugs. (Default: 0) Is this description still accurate, or is it better debugged nowadays? Would this be useful to set on machines with limited memory resources, e.g. the Raspberry Pi? Thanks much for any insight. - -Gordon M. -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJSJMrDAAoJED/jpRoe7/ujZX8IALXnFOs6WEQsud4UChnjdDRC Cor6LScDdXjGBvRDodMxyrF6lX50SwIaBR+zu4I4Hw2ekit8UZdBdZafWSjQgq5W KdMW1XruYBEIN2OcWSjSoZ1K2DzuOr1O77JwBhCuRcJtqqIP5yfD2TcF6AmuxHWk 82is5XCppem1b3CVobduKIVvbC6vUu+3fau5jkwrRv0xVQGTEtSWRY9TDFP5hoxB cZN+N2yYAm0pZ9+X1fFOHteKOx9r8ENsHfSCeZfKJXbbeRmklxVnZ1k3AgU2BiET L2tVs/piMOkhOd/hGX59bRk/IyvxArmXxd5+Vq9ejLZa7nmKMuOfZYbKdGo+zlE= =b1Os -----END PGP SIGNATURE-----

2 1

Re: [tor-relays] Someone is trying to overrun the Network
by tor＠t-3.net 03 Sep '13

03 Sep '13

Here is what Top on our Tor relay is doing today: PID USER PR NI VIRT RES SHR S %CPU %MEM TIME COMMAND 1163 _tor 20 0 628m 286m 34m R 106.3 15.3 4693:47 tor Logs filled with: Sep 03 04:12:20.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [5700 similar message(s) suppressed in last 60 seconds]

1 0

onionoo
by eliaz 03 Sep '13

03 Sep '13

Been having a devil fo a time keeping my bridge up this week. One question: With the bridge up & running, & the map showing it connecting to circuits, why is onionoo reporting "running":false, ? Should I worry about this discrepancy? Thanks, eliaz

4 10

Analysis of log file
by Carsten Larsen 02 Sep '13

02 Sep '13

Hi tor-relay list, I have been running a tor node for 133 days and Im starting to receive some weird messages in the log file. One of them look like this: Received http status code 504 ("Gateway Time-out") from server '154.35.32.5:80' while fetching "/tor/server/d/9169637E422C216BECD05C6CFE3AE..... I also have another one which appear regular: [warn] {NET} Failing because we have 991 connections already. Please raise your ulimit -n. First question is: any ideas how to get ride of these messages ? Second: Would it be possible to submit a log file for further analysis, and to whom should I send it ? The node is running on ARM debian box. I can of cause provide details if it necessary. Best regards Carsten Larsen Fingerprint: E1EE4FB010F28E55B7ACA2D046AB89F3B413F2A3

3 2

Re: [tor-relays] Pony C&C
by xorox 02 Sep '13

02 Sep '13

hi, xoroxDE2 176.9.122.78 *is listed * http://cbl.abuseat.org/lookup.cgi?ip=176.9.122.78&.pubmit=Lookup xoroxFR 5.135.167.214 *is listed * http://cbl.abuseat.org/lookup.cgi?ip=5.135.167.214&.pubmit=Lookup xoroxLU 94.242.252.225 *is listed * http://cbl.abuseat.org/lookup.cgi?ip=94.242.252.225&.pubmit=Lookup xoroxDE & xoroxLU2 are not listed ... :-) -- xorox5025(a)gmail.com +32/496.702.589

1 0

node list or moral discussion forum
by That Guy 02 Sep '13

02 Sep '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > > Other node operators, could you please try your IP address? Perhaps > this could explain the recent increase in connections? > within 2 days of setting up a node at a new IP it was added to the extortionists over at SORBS :-/ a suggestion: maybe a new tor-node-moralfag-mailinglist should be set-up as to remove this soap opera from a technical mailing list. _________________________________________________________________________ GnuPG Fingerprint: 7770 D186 A06E A329 2217 3161 63EB F269 37B8 8644 _________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iQIcBAEBAgAGBQJSJIVTAAoJEGPr8mk3uIZEJa0P/3nbn6UJyWCKPL1qi3KZ80fE T1OUYJVJKFAlN+u1Ur59CZWS2tsHJUhES4ovOj1gWF7TdrORS/knojQwM1JDyrWU 2b5Dw/jXnmf2BabliXKebk6BktEiN8I41UlVT/3MtZRnI3K1xCw0tvXy1Em3e1pJ V5EttYsylw6MXX00cO9L+LiQOHRATriTIYCUfdLmdamFkJyS27WZgEtVJ/zQGNpo dqUka2Wbns8gKPRr+4qdnA7JulM6P+gsS2hwOf+cSsTek0j9SU4UR3LLNJRXj6d/ ftCkBmp+9Bwc6FCfrT3msGDqIijei+yYjcD+ptoo9mdL/QI7GDCVbHpljowkBegS 0yvdub+WNHULjQ2bxumzi1m6DI91hAfTqwQTEUhhe8Co0/GLsjCelYdhDrTBdWIm ykH/2fqpkv2HsyK20qcUicJiijOjQODW5Ctxr7P3i9fMIi8vO/YCS7/kWwspQhXH fmdsbLzUnjpJuBU9OacuuVldOIw8Yit5URd8zLlF8Pai2a5eeedLKdG/84biKWsE 12iaJl1Ub+Wyg3FkG0/lXp1n2ANATfG3CZnAamnqwylk9N7a714LgK2jhFcRrMZE aHHIrzfEpYSceukFq8G8o6oL7zExC2i0xk8B+0pWCPkoRVw9pmXnRLvFs1HSV2f3 7b9fRFCfVB/EWq0fV9YC =d/kt -----END PGP SIGNATURE-----

4 3