- tor-relays - lists.torproject.org

Refuse Guard flag
by Eldalië 11 Aug '22

11 Aug '22

Hello there. I have been running my (non-exit) relay without issues for some months. Recently I noticed that my ISP started to reset my IP a few hours after the node gets the Guard flag, thus making it lose such a flag (as well as Stable and HSDir). I am not sure if the Guard flag is the real cause, but it is the only condition that is verified always and only right before I get a new IP. Is there a way I can keep my node running with the same settings but preventing it from becoming a guard, to investigate if the flag is the real cause? Thanks, Eldalië -- Eldalië My private key is attached. Please, use it and provide me yours!

3 2

How useful are bridges on ports other than 80 and 443
by Eddie 10 Aug '22

10 Aug '22

Unfortunately I've had to shut down my home based tor relay because my wife's employer is mis-categorising it as an exit node, instead of the middle/guard that it really is. So, until she retires, in a few months, that relay will now be silent after about 5-years running (all of which her having the same employer. Go figure). So, I thought in the meantime I'd run a couple of tor bridges, as my IP should now be clear of any published tor node lists. But I do need to leave ports 80 and 443 open for "normal" HTTP(S) traffic, which I know are the recommended bridge ports as they raise the least suspicion. Are there any other ports that folks might suggest I use that would get enough traffic and not be blocked by a simple firewall. I also run an internal mail server, so all those ports are off limits as well. Cheers.

1 0

Setting a bridge to automatically change IP adresses
by Keifer Bly 10 Aug '22

10 Aug '22

3 3

Overload (dropped ntor) due to DDoS??
by Richard Menedetter 06 Aug '22

06 Aug '22

Hi All I have a non exit relay running on a root server (4 AMD Epyc cores, 8 GB RAM, 2.5 GBit/s Ethernet) I have limited tor to numcpus 2, relaybandwidthburst 15 MB, hardwareaccel 1, maxadvertisedbandwidth 10 MB, maxmeminqueues 3GB Usually it takes less than 1 CPU core, and like 1 GB of RAM. But recently my relay is foten shown as obverloaded. I have these LOG entries: Tor[814]: General overload -> Ntor dropped (290376) fraction 5.3451% is above threshold of 0.5000% Is this due to DDoS attacks or a misconfigration on my side? Is there something that I can do to aleviate this issue? CU, Ricsi

4 5

OT: cheap bar metal machines
by lists＠for-privacy.net 05 Aug '22

05 Aug '22

HiHo, because I switched to my own servers in colocation, I canceled some rented ones. These were all Supermicro blades 8c Opteron, 2 hd's and BMC (IPMI). https://www.supermicro.com/Aplus/system/3U/3012/AS-3012MA-H12TRF.cfm SSD: Samsung (840,850,860) EVO, SATA: WD Enterprice (WDC_WD1003FBYX) They're relatively cheap. 16 EUR + 8 EUR per 16GB RAM. So server with 16GB RAM = 24 EUR/month or 32GB = 32 EUR/month. The 16GB are more than enough for 2 Tor instances! I still operated Monero mining on 4 CPU cores. Currently there is a 10% discount (permanent) and all servers with unmetered unlimited traffic (1000 Mbit). All with no setup fee. https://servdiscount.com/ The same applies to the new servers https://www.webtropia.com/ You can rent the servers prepaid or with a term of 1,3,6,... months/notice period. Hints: If you set up a customer account beforehand, you can upload your SSH keys for server setup. When setting up, select Raid1 (mdraid on Linux) directly. If you have any questions, please write to me personally. German or English. -- ╰_╯ Ciao Marco! Debian GNU/Linux It's free software and it gives you freedom!

1 0

Re: [tor-relays] tor 0.4.6 reached end of life
by torserver 03 Aug '22

03 Aug '22

Hi, on my Raspberry Pi 4 I can 't update from 0.4.5. The armhf architecture seems to be the problem. How do I have to upgrade to the newer versions? So far I haven 't found the ultimate way to setup a TOR relay on a Raspi 4 with auto updates. Greetz ghostbuster > Op 02-08-2022 14:00 schreef tor-relays-request(a)lists.torproject.org: > > Subject: [tor-relays] tor 0.4.6 reached end of life > > If you still run tor 0.4.6, now is a good time to upgrade your tor version. > > the list of largest operators still running end of life tor versions: > https://nusenu.github.io/OrNetStats/#end-of-life-relays-share > > https://nusenu.github.io

2 1

Please update your Snowflake proxy
by gus 03 Aug '22

03 Aug '22

Hi, If you're running Snowflake proxies, please read and share the message below. Thank you! Gus ------------------------------------------------------------------------ Please Update your Snowflake Proxy to help us rollout Distributed Snowflake Server Support https://forum.torproject.net/t/please-update-your-snowflake-proxy-to-help-u… At Tor, we are constantly trying to improve Snowflake to make it accessible to more people. This means we are currently working on enabling horizontal scaling of Snowflake to distribute the traffic to more than one server. After this update is roll outed, users will be able to choose one of the secondary snowflake servers as the connection target and reduce the traffic load on the default server. However, this change requires an updated version of the snowflake to be rolled out. This means this change is not live until enough proxies are updated to the most recent version and after we start to reject the previous version of snowflake proxies. For this reason, we would like to request you to update the version of your snowflake proxy, if you haven’t done that yet. Here are some guides on how to check the version and/or update the most recent version of snowflake: ### WebExtension on Firefox To check the version: go to about:addons. Click the 3 dot symbol on the right of Snowflake, and then select manage. you will be able to check the version of Snowflake. It should be 0.6.1. To update: Click the gear symbol on the top of the page, and then select check for updates. ### WebExtension on Chrome To check the version: go to chrome://extensions/?id=mafpmfcccpbjnhfhjnllmmalhifmlcie, and you will see the option to update the snowflake WebExtension. It should be 0.6.1. To update: go to chrome://extensions/ turn on developer mode and then select update. ### Standalone with Docker To check the version: docker run thetorproject/snowflake-proxy -v should include “-allowed-relay-hostname-pattern” in the output. To update: docker pull thetorproject/snowflake-proxy ### Standalone with Go Toolchain To check the version: proxy -v should include “-allowed-relay-hostname-pattern” in the output. To update: go install git.torproject.org/pluggable-transports/snowflake.git/v2/proxy@latest -- The Tor Project Community Team Lead

1 0

When will relays disappear form tor metrics
by Anders Burmeister 01 Aug '22

01 Aug '22

Hi heroes Ended and deleted my two relays Aerodynamik02 and Aerodynamik03. When can I expect they will disappear from tor metrics?https://metrics.torproject.org/rs.html#details/EFEACD781604EB80FBC0… Best regards Anders

2 1

tor 0.4.6 reached end of life
by nusenu 01 Aug '22

01 Aug '22

If you still run tor 0.4.6, now is a good time to upgrade your tor version. the list of largest operators still running end of life tor versions: https://nusenu.github.io/OrNetStats/#end-of-life-relays-share -- https://nusenu.github.io

1 0

An attempt to block spam ip addresses
by Toralf Förster 01 Aug '22

01 Aug '22

Issue 40636 and others deal with DDoS / concurrent connections. Here're few numbers from my attempt [1] of the last days to block such ip addresses. The stats are from 2 relays running at the same ip. Currently there're 700 ip addresses (15 IPv6) caught in the denylist. Those either opened >4 connections to the same orport and/or produced >12 new connection attemps within 5 minutes to the orport. Those system do re-appear quickly if the denylist is flushed. Within one hour over 500K packets, mainly TCP connection attempts, are dropped. Furthermore the number of used sockets at the system is reduced from >35K to about 21K. Nevertheless both relays spew the warnings "Your computer is too slow" and "General overload" from time to time. I do assume that this is a layer 7 problem and therefore can't be fixed at layer 3. The filter is build up from iptables. Scripts for IPv4 and IPv6 can be found under [2] and [3] respectively. [1] https://gitlab.torproject.org/tpo/core/tor/-/issues/40636#note_2821683 [2] https://github.com/toralf/torutils/blob/main/ipv4-rules.sh [3] https://github.com/toralf/torutils/blob/main/ipv6-rules.sh -- Toralf

1 0

Impact on running a tor relay on other internet services?
by Thoughts 28 Jul '22

28 Jul '22

Hi all - I've been running a TOR non-exit relay for several months now. Its rare, but I'm seeing what I believe is the occasional connection attack, with my relay complaining about the number of connections and suggesting I reduce capacity. Those are rare, and most of the time my server is running at about 20% CPU. During attacks, which seem unrelated to my Tor Upload/Download rate, CPU jumps to well over 100% (quad core, so 400% is max). I'd normally just ignore this, but it seems to be impacting other aspects of my network experience: Messenger Rooms will unexpected close, NetFlix gets "unable to stream this title", family complains about slow and dropped connections, etc. Just had it happen a few minutes ago with a Messenger Room and sure enough, CPU is at 130%, even though I'm only pumping about 15MB/Sec (37.5MB/S limit, 56.2 burst, 40.3 observered) over my gigabit ISP connection. Speedtest shows the performing within acceptable parameters. So contemplating what I can do, since this is bothersome. I've come up with a few alternatives, and curious about your thoughts: 1) Do some type of connection limiting at my PFSense Plus firewall. Perhaps limiting things to, say, 30 connections per IP address? Not even sure that is possible, but figure it might lighten the load on the TOR server. 2) Drop being a TOR non-exit relay and convert to a bridge. Not sure how long, if ever, it would take for my IP address, which is now public, to fade off of block lists... Not ideal, but at least as a bridge I'd still be servicing the environment. 3) Try connection limiting via iptables on the TOR host. Just seems like doing that at the firewall would be better. Thoughts? Kevin

1 1

relay memory leak?
by Fran 26 Jul '22

26 Jul '22

Hey, new non-exit relay, Debian 11, tor 0.4.7.8-1~d11.bullseye+1, ~ 1 week old (-> no guard) KVM VM with atm 4 cores, host passthrough AMD EPYC (-> AES HW accel.). As can be seen at the attached screenshots memory consumption is irritating as well as the quite high CPU load. All was fine when it had ~100 Mbit/s but then onion skins exploded (110 per second -> up to 4k per second) as well as CPU and memory. Tor complains: > Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. And from time to time memory killer takes action torrc is pretty basic: Nickname 123 ContactInfo 123 RunAsDaemon 1 Log notice syslog RelayBandwidthRate 2X MBytes RelayBandwidthBurst 2X MBytes SocksPort 0 ControlSocket 0 CookieAuthentication 0 AvoidDiskWrites 1 Address xxxx OutboundBindAddress yyyy ORPort xxxx:yyy Address [zzzz] OutboundBindAddress [zzz] ORPort [zzz]:xxx MetricsPort hhhh:sss MetricsPortPolicy accept fffffff DirPort yy Sandbox 1 NoExec 1 CellStatistics 1 ExtraInfoStatistics 1 ConnDirectionStatistics 1 EntryStatistics 1 ExitPortStatistics 1 HiddenServiceStatistics 1 Ideas/suggestions (apart from limiting BW) to fix this? Thanks fran

3 5

Next Tor Relay operator meetup + MCH activities
by gus 26 Jul '22

26 Jul '22

Hi everyone, This month we won't have our monthly online check-in as many of us are traveling or on vacation mode. But, don't feel sad, we will have two activities this weekend! 1. (livestream): Modernizing the Tor Ecosystem for the Future, 2022-07-24, 15:00-15:50 with Alexander Færøy (ahf), Network Team Lead. Read more: https://program.mch2022.org/mch2021-2020/talk/MUP7MX/ 2. Relay Operator Meetup @ May Contain Hackers (MCH2022) ahf, Artikel10 and many others Tor contributors are at MCH and they are organizing a relay operator meetup! If you are at MCH2022, please get in touch with them!! https://blog.torproject.org/event/mch2022/ The next meetup will be at the end of August. I'll send the invitation at the beginning of August. :) cheers, Gus -- The Tor Project Community Team Lead

3 3

Tor bridges limit
by Me 25 Jul '22

25 Jul '22

Good day all. I am currently running two middle relays on my home network and was wondering if I can add any bridges to my existing set up. I am aware of the limit of two middle relays per ip address but do not see anything stating whether there was any such limit for bridges. I am also not clear on whether the bridges are recognized by the tor network in the same manner as Middle relays and whether the two unit limit applies to the total of devices connected. Thank you in advance for any guidance and always remember.... They are watching

2 1

Relay Overloaded and Dropping Onionskins
by bidulock_ringrose＠aleeas.com 21 Jul '22

21 Jul '22

Greetings! I hope this is the right list to be asking this, if it is not please forgive me. I am purposefully omitting some identifying information for privacy sake. I run 2 non-exit relays both with an advertised bandwidth of around 8 MiB/s each. I have noticed that they have been overloaded a lot lately. These relays have been bottlenecked at the 3-4 MiB/s mark ever since I put them online. Upon further investigation, when I curled the MetricsPort according to https://support.torproject.org/relay-operators/relay-bridge-overloaded/, the following metrics stood out to me. Both relays run on the same machine with the same IP address. I hope the obfuscation makes sense. Side note: I am using Toralf's ddos-inbound script, which has not dropped any connections at all for me when using the -b then -s switch. CPU utilization is high (80%) on one core but low on the rest (5-30%) In the syslog, I also get spammed with "Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [28xxx similar message(s) suppressed in last 34200 seconds]" Relay 1: tor_relay_load_onionskins_total{type="ntor_v3",action="processed"} 750xxxx tor_relay_load_onionskins_total{type="ntor_v3",action="dropped"} 17 tor_relay_load_global_rate_limit_reached_total{side="read"} 6xxxx tor_relay_load_global_rate_limit_reached_total{side="write"} 17xxxx Relay 2: tor_relay_load_onionskins_total{type="ntor_v3",action="processed"} 10xxxxxx tor_relay_load_onionskins_total{type="ntor_v3",action="dropped"} 28xxxx tor_relay_load_global_rate_limit_reached_total{side="read"} 20xxxxx tor_relay_load_global_rate_limit_reached_total{side="write"} 19xxxx All other metrics are normal according to the article on overloaded relays. This runs in a Debian Proxmox VM using the host cpu, so no CPU virtualization. 4 cores, 8GB memory, and AES is supported. It's 2x Xeon 2628v3s with NUMA enabled in the VM (2 sockets, 2 cores per socket). Enabling NUMA and de-virtualizing the CPU has helped increase my top bandwidth by around .7 to .9 mbytes/s, but still not great. Thank you in advance.

2 1

Bridges and Hs_vanguards
by dmz21 12 Jul '22

12 Jul '22

Dear readers, During the last week the bytes/second of my bridge dropped to 20% of its common usage over the past months, while the average number of connected clients stayed the same (according to metrics.torproject.org) I'm also seeing a dozen circuit connections with purpose Hs_vanguards in nyx recently, which are not familiar to me. Under-utilization of my bridge is not a problem to me, but maybe someone can tell me whether the two are related? Maybe it's an issue at my end or my hoster or maybe a generic issue of the tor network currently? Or maybe it's all normal? Thanks and best regards

1 0

We're trying out guard-n-primary-guards-to-use=2
by Roger Dingledine 11 Jul '22

11 Jul '22

Hi folks, As part of the hackweek projects ( https://gitlab.torproject.org/tpo/community/hackweek/ ), some of us are thinking about simple tweaks we can do to tune the network to better handle this month's traffic overload. The long term answer is to try out proposal 327: https://gitweb.torproject.org/torspec.git/tree/proposals/327-pow-over-intro… because we think a lot of the overload has to do with people sending way too many intro cells to some onion services, and giving the onion services ways to defend themselves is the only real answer. But while we're thinking about implementing that proposal, one of our earlier steps is to set the guard-n-primary-guards-to-use consensus parameter from 1 to 2. Now that it's taken effect (you can watch the votes at https://consensus-health.torproject.org/#consensusparams ), this change means that clients will now choose between two guard relays by default (rather than just one) when building circuits. This is potentially a big deal, since it puts us into a different point in the performance vs safety tradeoff space. Here is some reading for why we originally moved down to 1 guard by default: https://blog.torproject.org/improving-tors-anonymity-changing-guard-paramet… https://www-users.cse.umn.edu/~hoppernj/single_guard.pdf But on the theory that some guards are way overloaded right now and some aren't, giving clients two bites at the apple might make a dramatic improvement in terms of reliable and consistent performance. There is also some argument in favor of using two guards anyway. One reason (explained more in proposal 291) is that there are already some edge cases where clients use their second guard. And also, in the glorious future, we will want to be using multiple guards because we have switched to the multi-path Conflux design (proposal 329) -- though we're not there yet. So: I am giving you all here some early warning, in case you see anything odd on the network when we make this change. Let us know if you do. :) --Roger

4 5

Is ExoneraTor still alive?
by Christian Pietsch 07 Jul '22

07 Jul '22

Dear all, ExoneraTor is/was useful for showing law enforcement authorities that a given IP address acted as a Tor exit relay at a given day. Unfortunately, ExoneraTor seems to be offline. This page does not work at all, returning an HTTP 503 error immediately: https://exonerator.torproject.org/ This page returns the following error whenever I submit an IP address: https://metrics.torproject.org/exonerator.html | Server problem | | Unable to connect to the database. Please try again later. If this problem persists, please let us know! Can it be revived? Can I help? Cheers, Christian -- Christian Pietsch volunteering for Digitalcourage e.V. https://digitalcourage.de/ – Swarm support: https://digitalcourage.de/swarm-support – German BigBrotherAwards: https://bigbrotherawards.de/

2 1

[Event] Tor relay operator meetup - June 25th @ 1900 UTC
by gus 27 Jun '22

27 Jun '22

Hello, The next Tor relay operator meetup will happen on Saturday, June 25 @ 1900 UTC. Where: BigBlueButton - https://tor.meet.coop/gus-og0-x74-dzn No need for a registration or anything else, just use the room-link above. We will open the room 10 minutes before so you can test your mic setup. Everyone is free to bring up additional questions or topics at the meeting itself. Please share with your friends, social media and other mailing lists! cheers, Gus -- The Tor Project Community Team Lead

1 2

Relay "unmeasured" after update to 0.4.7.8
by Martin 27 Jun '22

27 Jun '22

Hi all! After updatering to the latest version, my relay consensus went down to 20 and was marked unmeasured. However it still serves a couple of thousand connections (capped at 10 MB/s) and all flags are still there, but when I try to use it to build a circuit manually it won't let me... Cheers

2 1

Metrics shows my relay down. But it's not.
by Eddie 25 Jun '22

25 Jun '22

The metrics is showing one of my relays (40D13096BBD11AF198CE61DEE4EAECCE5472F2E7) as down for around the last 3 hours. Logging in to it, I see everything running normally. This server has also lost a bunch of flags for no apparent reason, so I'm not sure if they're connected. Cheers.

2 1

FreeBSD 13.1: clock_gettime(CLOCK_MONOTONIC_FAST) ~ 50 % performance gain
by Andreas Kempe 22 Jun '22

22 Jun '22

Hello everyone, I was doing some profiling on my two relays running on FreeBSD 13.1 and noticed that they were spending a lot of time in clock_gettime() which prompted me to have a look at the implementation. Time implementation =================== The time implementation is abstracted in src/lib/time/compat_time.c where different mechanisms are used for different operating systems. On Linux CLOCK_MONOTONIC_COARSE is a clock that gives worse precision than CLOCK_MONOTONIC, but is faster and the abstraction layer checks for its presense and provides more performat less precise time where applicable. On FreeBSD, there is also a fast monotonic time source available called CLOCK_MONOTONIC_FAST. In the header file src/lib/time/compat_time.h, a comment references this clock, but it is not used. I thought it might be worth a shot seeing what difference it would make if I enable the use of CLOCK_MONOTONIC_FAST on FreeBSD and on the VM where I run my two FreeBSD relays, the difference was stunning. I made did a quick patch simply replacing CLOCK_MONOTONIC_COARSE with CLOCK_MONOTONIC_FAST, see patches attached, compiled and tested. Tracing system calls to make sure the correct call was being used, which it was. Results ======= This lead to reducing the CPU usage of the patched relay by about 50 % compared to the unpatched relay. I was a bit shocked so I wrote a small benchmark program and ran it on my VM giving the following results: CLOCK_MONOTONIC: 4.776675 s CLOCK_MONOTONIC_FAST: 0.260002 s Showing that on my VM the performance of CLOCK_MONOTONIC_FAST is about 20 times better than CLOCK_MONOTONIC. I have tested on a few different systems and I think that the performance increase of CLOCK_MONOTONIC_FAST is thanks to commit 60b0ad10dd0fc7ff6892ecc7ba3458482fcc064c - "vdso: lower precision of vdso implementation of CLOCK_MONOTONIC_FAST and CLOCK_UPTIME_FAST" that was cherry-picked to 13.1. Try it yourself and report your results ======================================= If you want to benchmark your server to see whether switching clock could benefit you, you can compile and run my attached test program by doing user>clang -o bench.c -o bench user>./bench In case the program terminates too quickly or slowly for your liking, adjust const unsigned long iterations = 1000000; up or down to change the execution time. My supplied patches appear to work fine on my system, but aren't really upstream appropriate since a solution that works for both FreeBSD and Linux is needed. If you want to test them and you're building Tor from the ports tree, drop them in /usr/ports/security/tor/files and build and install. I'm very interested in seeing some performance data from other people to see whether I think it worth either pestering some Tor devs to have a look at this or putting in some effort myself to write an upstreamable patch. Thank you for reading! Cordially, Andreas Kempe

3 4

From [tor-announce] Tor stable release 0.4.7.8 - Security Fix
by Felix 20 Jun '22

20 Jun '22

> We have released tor 0.4.7.8 earlier today, a new stable version for > the 0.4.7.x series containing an important High severity security > fix. The affected tor are only those of the 0.4.7.x series as in from > tor-0.4.7.1-alpha to tor-0.4.7.7. Jun 18 10:08:46.000 [notice] This version of Tor (0.4.7.8) is newer than any recommended version, according to the directory authorities. -- Cheers Felix

2 1

EXPKEYSIG when running 'apt update'
by Imre Jonk 17 Jun '22

17 Jun '22

Hi tor-relays, I'm getting this error when running 'apt update': Err:4 https://deb.torproject.org/torproject.org bullseye InRelease The following signatures were invalid: EXPKEYSIG 74A941BA219EC810 deb.torproject.org archive signing key The signing key in /etc/apt/trusted.gpg.d/deb.torproject.org-keyring.gpg does not appear to be expired, so I guess some repository metadata signature has expired. Does anyone else encounter this issue? Thanks, Imre

4 4

Identifying a relay
by Eddie 16 Jun '22

16 Jun '22

Have a question about how a server I connect to can tell I am running a guard/middle relay. All I can think of is that they check the published list of tor nodes against the IP. Or (maybe, but unlikely) portscan the IP and probe any open ports to determine the service. Are there any other methods that can be used. Background: The corp my wife works for blocked our IP. The excuse they gave was that it was due to a change made by a vendor they use to identify malicious IP addresses. I have been running the relay for almost 5 years without any previous flagging. They also state that running a middle relay is not in violation of any policy, but the vendor mis-identified our relay as an exit, hence blocking it. After changing the IP, the new IP was also blocked in less than 24 hours. My feeling is that the vendor is now just using the full list of tor nodes and indiscriminately blocking everything, despite what the corp security folks say. I'm looking for some sort of validation I can use to counter their claims.

5 5