- tor-relays - lists.torproject.org

Re: [tor-relays] [Workshop] Sysadmin 101 for (new) relay operators - June 4th
by Isaac Grover, Aileron I.T. 07 Jun '22

07 Jun '22

Good morning Gus, For those of us with families and other weekend commitments, will an on-demand replay be made available afterwards? Make your day great, Isaac Grover

3 2

bridge issue
by potlatch 07 Jun '22

07 Jun '22

Hello, I have a bridge [1] that doesn't have any keys in /var/lib/tor/keys! How is that possible and how do I fix the problem? potlatch [1] FB45183DD82D572CA2B2641C1AB0EB0D8CE7B858 Sent with [Proton Mail](https://proton.me/) secure email.

3 2

EOL after changing operatin system
by Fred 03 Jun '22

03 Jun '22

Hey there, I had to change my operating system and started an new relay instead of using the old keys. The new one is runnig fine. Dead relay: 67D1278A974D61104F7273E6266DEF3A5C26F191 T heoor Sorry, Daniel -- Gesendet mit Vivaldi Mail. Laden Sie Vivaldi kostenlos von vivaldi.com herunter.

1 0

EOL 2 x relay
by Anders Burmeister 03 Jun '22

03 Jun '22

Hi Heroes I’m sorry to inform you, that my two relays will discontinue and no longer participating from 28 july 2022. Had a lot of fun here. Fingerprint: EFEACD781604EB80FBC025EDEDEA2D523AEAAA2F Fingerprint: 484A10BA2B8D48A5F0216674C8DD50EF27BC32F3 I wish you all the best Regards Anders

2 1

Relay migration: best practices?
by tor＠nullvoid.me 30 May '22

30 May '22

Hello, I operate a small family of relays, over the 5 years it's been very set and forget and easy to maintain. Over those 5 years the servers have been cluttered with other half completed projects and general mess. I plan on reinstalling the OS from scratch, and understand I must backup the "keys/ed25519_master_id_secret_key" and "keys/secret_id_key" in the DataDirectory. Then copy them over on the new server. The hostname will change but the IP will stay the same. The server I am working on is not listed as a fallback directory server, but has been in the past. Is there any other things I can do to disrupt the damage done to the tor network during this downtime? Especially to any clients using it as a bridge. Thanks,

2 1

Sanity check on NumCPUs
by Thoughts 29 May '22

29 May '22

For a non-exit relay, is "NumCPUs 2" still the recommended maximum? Running on a quad core and recently saw a message indicating I had insufficient CPU power to support the desired number of connections... Thanks, Kevin

6 7

Loss of Guard and HS Dir flags
by Eddie 29 May '22

29 May '22

I currently run 3 relays, across different servers and today I noticed that one has now lost it's Guard and HS Dir flags. What's surprising is that this particular relay has the highest Bandwidth and Consensus Weight of all 3 and has not been restarted for over a month. The stats for all 3 can be found with: OhNoAnotherRelay I know that just running the relay is the important part and caring about what flags it has is a side issue, but I'm just interested in seeing why this has happened. Cheers.

4 7

Bridge operators contact addresses online ;-)
by lists＠for-privacy.net 28 May '22

28 May '22

I happened to see that Bridge operators contact addresses can now be displayed. https://gitlab.torproject.org/tpo/network-health/metrics/relay-search/-/iss… Demo on Tor Metrics for all 'bauruine' and 'ForPrivacyNET' bridges. Thanks to the torproject team. -- ╰_╯ Ciao Marco! Debian GNU/Linux It's free software and it gives you freedom!

1 0

Question about new log messages after 0.4.7.7 upgrade
by wardz 28 May '22

28 May '22

Been getting these syslog messages occasionally *after* the 0.4.7.7 upgrade on my bridge: -- May 26 21:00:58 torbridge Tor[ ]: Unexpected path length 4 for exit circuit 66 5, purpose 5 [3 similar message(s) suppressed in last 5400 seconds] May 26 16:26:17 torbridge kernel: [ ] TCP: eth0: Driver has suspect GRO implementation, TCP performance may be compromised. -- Anyone know what they mean and if it's something I should be worried about? Calculated advertised bandwidth seems to be about the same. For reference, im running latest Raspbian 64-bit Lite on a Raspberry 4 with latest firmware aswell. driver: bcmgenetversion: 5.15.41-v8+ Sent with [Proton Mail](https://proton.me/) secure email.

2 1

Ext Relay Operators: Please Upgrade to 0.4.7.7!
by Mike Perry 27 May '22

27 May '22

Tor 0.4.7.7-stable contains a very important performance improvement, called Congestion Control. You can read more about this improvement here: https://blog.torproject.org/congestion-contrl-047/ The TL;DR is that users of Tor 0.4.7 will experience faster performance when using Exits or Onion Services that have upgraded to 0.4.7. We have packages in available for Debian, Ubuntu, Fedora, CentOS, and BSD: - Debian: https://support.torproject.org/apt/tor-deb-repo/ - Ubuntu: https://support.torproject.org/relay-operators/operators-4/ - Fedora/CentOS: https://support.torproject.org/rpm/tor-rpm-install/ - BSD: https://lists.torproject.org/pipermail/tor-relays/2022-May/020528.html We would like to have a large fraction of Exit relays upgraded before our next Tor Browser Stable Release, on May 31st. Please let us know if you have any problems upgrading to this release. Additionally, while non-Exit relays do not need to upgrade, they will notice the effects of congestion control. All relay operators who pay for bandwidth by the gigabyte may want to consider enabling hibernation, to avoid surprise cost increases: https://support.torproject.org/relay-operators/limit-total-bandwidth/ All relays may also experience higher CPU usage. If this is a problem, rate limiting relay bandwidth will also help: https://support.torproject.org/relay-operators/bandwidth-shaping/ We also recently fixed an issue with overload reporting in 0.4.6.10 and 0.4.7.7: https://gitlab.torproject.org/tpo/core/tor/-/issues/40560 This should mean that there are far fewer false positives in the overload reporting on https://metrics.torproject.org/rs.html. If after upgrading to either of those versions, you still see overload, please see: https://support.torproject.org/relay-operators/relay-bridge-overloaded/ P.S. There is a known warn bug with vanguards-lite on first startup. It is harmless: https://gitlab.torproject.org/tpo/core/tor/-/issues/40603 -- Mike Perry

5 7

Revisit issue on incorrect time stamps on metrics
by a tor op 22 May '22

22 May '22

Hi I wrote about incorrect date stamps for relays/bridges on atlas/metrics site in December 2021. This has reappeared since some time (dont know for how long). First seen fullt incorrect by years and all times unlogic, first seen later than last restarted etc. Is this a common problem or just some relays? TIA, A tor op

2 1

Introduction
by roelquerimi 18 May '22

18 May '22

Hello the Tor relay operators. Nice to meet you. I'm Roel Querimi, I operate 9 exit relays: 0B1120660999AD1022D08664BE1AD08A77F55E50, 05757E11F488C50E3425F5F7E9319411B4270365, 5D2871217ABD67C2569C49919B46F3DFC6281D63, 983548730C7F3F52170BF2195C85D1423C33253B, 72152AE84ECF44727A9506237A93D63EAFB22B07, 7AE15D809ED86C1F2998B45985A40E7F07F078B6, 5C1B834B2E8D982B82B23D05773C78CC23BB0EB9, 3075E246EE9AAE3EECABF92A9B40A598EC77608E, 92A9547A61E21357CBA0A6E64340BCD5DF29D94F Sent with [ProtonMail](https://protonmail.com/) secure email.

1 0

Tor exit Spain
by potlatch 18 May '22

18 May '22

Hello Paul, I've run exit relays for 15-years. I put the first relay into Albania and followed with the first exit relay in Albania. I lost my two Albanian relays when the Ukraine conflict started. I currently have relays in Moldova (2), Romania, Finland (2), Chile, Estonia, Latvia, Bulgaria. Most are smaller than your server w/Consensus Weight around 8000. Further, I operate bridges in Kazahkstan (3), Finland and Albania. I would like to know a bit more before offering to take your server. Do you have good relationship with IONOS SE? What is physical machine compliment? etc.? I operate out of Seattle Washington and have good communications with the Tor office here. I am retired electrical engineer with time to help Tor and Electronic Frontier Foundation. Hope you find a good operator for your primo relay. I can be contacted directly at potlatch(a)proton.me Stay safe always,potlatch The imagination of nature is far, far greater than the imagination of man. --Richard Feynman Sent with [ProtonMail](https://protonmail.com/) secure email.

1 0

Re: [tor-relays] (No Subject) (allforprivacy)
by Isaac Grover, Aileron I.T. 13 May '22

13 May '22

Good afternoon, The Library Freedom Project is what you're seeking, for libraries: https://libraryfreedom.org/ Also, I found this response on Slashdot for hosting at a university: https://yro.slashdot.org/comments.pl?sid=7773441&cid=50227785 Make your day great, Isaac Grover

1 0

(No Subject)
by allforprivacy 13 May '22

13 May '22

Good evening, I'd like to ask: How would one go about encouraging an organization (such as a college, university or library), that they are affiliated with to some extent, to operate a Tor Exit Relay? I currently operate a Non-Exit relay at home, but I would like to also see if me and some others in my organization could start an exit relay as well (Our jurisdiction is the United Kingdom). Thank you for reading, allforprivacy operator.

1 0

OpenBSD -stable net/tor and 0.4.7.7
by George 11 May '22

11 May '22

The OpenBSD net/tor -current port is correctly on 0.4.7.7, but the -stable port is still on 0.4.6.10. I submitted a diff to update -stable port to 0.4.7.7 last week, but it has not been committed yet. https://marc.info/?l=openbsd-ports&m=165179875418235&w=2 It's attached and should work fine. In order to update the OpenBSD -stable port you need an updated -stable 7.1 ports tree, then you apply the patch within the /usr/ports/net/tor port, and build from there. I can provide more guidance if necessary, but in order to not bore everyone else, maybe the Tor-BSD list is more appropriate? https://lists.nycbug.org:8443/mailman/listinfo/tor-bsd I can send out an amd64 -stable package, but then you'd have to trust me. g

1 0

Bridge not used
by Arnim Wiezer 11 May '22

11 May '22

Hi Tor-Operators, I have installed a bridge according to the official how-to. The config is as follows: Log notice file /var/log/tor/notices.log DataDirectory /var/lib/tor Address bridge.xxx.de BridgeRelay 1 ORPort 1044 ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy ServerTransportListenAddr obfs4 0.0.0.0:9043 ExtORPort auto ContactInfo arnimw(a)mailbox.org Nickname lunabridge PublishServerDescriptor 1 BridgeDistribution any Under https://metrics.torproject.org/rs.html#details/4DD98FB1959065309FD4A183530B… I see basically no usage, the logs are fine - as far as I can tell. Any help appreciated! Best, Arnim

3 4

Tor 0.4.7.7 Segmentation fault on Ubuntu 22.04 caused by "rseq"
by Xiaoqi Chen (Danny) 07 May '22

07 May '22

Dear relay operators, I recently upgraded one of my relays to Ubuntu 22.04 and now tor keeps crashing. I debugged a little bit and saw the following error in the log. It appears that it's due to seccomp not allowing "rseq" syscall, and possibly related to the latest version of Glibc. I temporarily mitigated the issue by turning off sandbox mode (remove "Sandbox 1" in torrc). Does anyone know how to properly resolve the crashing issue? Cheers, Danny Chen -- $ sudo tor -f /etc/tor/torrc May 07 02:10:46.831 [notice] Tor 0.4.7.7 running on Linux with Libevent 2.1.12-stable, OpenSSL 3.0.2, Zlib 1.2.11, Liblzma 5.2.5, Libzstd 1.4.8 and Glibc 2.35 as libc. ...... May 07 02:10:46.833 [notice] Opening Directory listener on 0.0.0.0:8080 May 07 02:10:46.833 [notice] Opened Directory listener connection (ready) on 0.0.0.0:8080 Fatal glibc error: rseq registration failed ============================================================ T=Fatal glibc error: rseq registration failed 1651889448 Tor 0.4.7.7 died: Caught signal 11 Fatal glibc error: rseq registration failed Fatal glibc error: rseq registration failed tor(+0xee525)[0x55c6431d6525] /lib/x86_64-linux-gnu/libc.so.6(abort+0x178)[0x7fe6da9ee898] /lib/x86_64-linux-gnu/libc.so.6(abort+0x178)[0x7fe6da9ee898] /lib/x86_64-linux-gnu/libc.so.6(+0x8945c)[0x7fe6daa4f45c] /lib/x86_64-linux-gnu/libc.so.6(+0x89770)[0x7fe6daa4f770] /lib/x86_64-linux-gnu/libc.so.6(+0x94b31)[0x7fe6daa5ab31] /lib/x86_64-linux-gnu/libc.so.6(+0x126a00)[0x7fe6daaeca00] Fatal glibc error: rseq registration failed

4 3

Relay Throttling
by sysmanager7 07 May '22

07 May '22

Hi Is there a tutorial on how to limit a relay's throughput?? There has to be! I did a search and came up empty. I'm trying to avoid shutting down my relay's due to financial burden Any help would be appreciated. Thank you! Sent with [ProtonMail](https://protonmail.com/) secure email.

5 4

Re: [tor-relays] Relay Throttling
by me＠mirandaniel.com 06 May '22

06 May '22

Hey, check your torrc, there is a RelayBandwidthRate setting (to limit speed) and also an AccountingMax setting to limit max traffic per month. -- MiranDaniel "---------- Původní zpráva ---------- Od: sysmanager7 via tor-relays <tor-relays(a)lists.torproject.org> Datum: 06.05.2022 14:16:35 Předmět: [tor-relays] Relay Throttling Hi Is there a tutorial on how to limit a relay's throughput?? There has to be! I did a search and came up empty. I'm trying to avoid shutting down my relay's due to financial burden Any help would be appreciated. Thank you! Sent with ProtonMail(https://protonmail.com/) secure email. "

1 0

Tor Exit: Complaints of IP being used for "spam" despite exit policy
by Neel Chauhan 06 May '22

06 May '22

Hi, A day or two ago, my Tor exit host, Psychz Networks, has sent me complaints about my IPs being used to send "spam" despite me having blocked Port 25 (and 465/587) in the exit policy. Psychz threatened to block Port 25 even when my exit policy explicitly blocks 25/465/587. The URLs I got were from Cisco Talos: * https://talosintelligence.com/reputation_center/lookup?search=104.149.136.2… * https://talosintelligence.com/reputation_center/lookup?search=104.149.133.5… Sometimes I think "is my FreeBSD exploited and being used to send spam", but then I also see Linux relays on other ISPs also on the blocklists. Yes, I am aware Tor exit relays will land on blacklists. But getting complaints from spam is new, especially when my relays are blocking SMTP. I am worried I would have to find a new host if they continue complaining. Darn, Psychz has been one of the more reliable exit hosts (on-and-off) for many years, although they are more vigilant on abuse than say BuyVM. BuyVM is similarly priced (although my Psychz is an special offer) and solid but has too many exits. OVH and TerraHost only allow exits on much more expensive dedicated servers. Prgmr and HostMaze allow exits but has so-so peering. I just hope Psychz doesn't continue to complain. -Neel

5 7

comments, hints and tipps for an ansible role to deploy Tor bridges
by Toralf Förster 05 May '22

05 May '22

I do appreciate those for my attempt here: https://github.com/toralf/tor-relays TIA -- Toralf

2 1

BSD tor ports/packages and impending 0.4.7.7 release
by George 04 May '22

04 May '22

BSD relay operators, like everyone else, should be aware that upgrading tor to 0.4.7.7 is critical for exit relays. The source is available now at: https://dist.torproject.org/tor-0.4.7.7.tar.gz Specifically for the BSD ports, here is the current status and workings. Any corrections appreciated. * DragonflyBSD https://github.com/DragonFlyBSD/DPorts/tree/master/security/tor Downstreams from FreeBSD quarterly updates, so may not have a 0.4.7.7 package or port for security/tor until July. * FreeBSD https://www.freshports.org/security/tor https://cgit.freebsd.org/ports/tree/security/tor https://svnweb.freebsd.org/ports/head/security/tor/ Updated to 0.4.7.7 already, and can be installed from security/tor now. Working fine at this point. For pkg(8) users, ensure that /etc/pkg/FreeBSD.conf line 11 is set to "latest", as opposed to "quarterly", which should be the case regardless of this security/tor release: url: "pkg+http://pkg.FreeBSD.org/${ABI}/latest", * NetBSD https://pkgsrc.se/net/tor pkgsrc's current port of net/tor was updated to 0.4.7.7. The stable port is still on 0.4.6.10 at https://cdn.netbsd.org/pub/pkgsrc/stable/pkgsrc/net/tor/Makefile * OpenBSD https://cvsweb.openbsd.org/cgi-bin/cvsweb/ports/net/tor/ The -current net/tor has been updated to 0.4.7.7 and the package is available. For users running 7.1-stable, net/tor 0.4.7.7 will hopefully be officially backported. Users can also update net/tor from ports on -stable themselves easily enough. If you're not on 7.1-stable, consider upgrading immediately. Thanks. g

1 0

Possible Connection Storm
by Eddie 26 Apr '22

26 Apr '22

Checking my relays after being away for a few days, noticed that one of them was showing as Overloaded, which I've never seen in over a year's running. Looking in the logs, it looks like there was a huge increase in connections, which has now settled down and I'm no longer showing as overloaded. Here's some relevant pieces: Apr 21 03:45:08.000 [notice] Heartbeat: Tor's uptime is 110 days 12:00 hours, wi th 6977 circuits open. I've sent 5236.04 GB and received 5121.19 GB. I've receiv ed 5232797 connections on IPv4 and 269395 on IPv6. I've made 2018765 connections with IPv4 and 580408 with IPv6. Apr 21 03:45:08.000 [notice] Circuit handshake stats since last time: 1901/1901 TAP, 244943/244943 NTor. Apr 21 07:04:49.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config opti on or choosing a more restricted exit policy. Apr 21 09:45:08.000 [notice] Heartbeat: Tor's uptime is 110 days 18:00 hours, wi th 47998 circuits open. I've sent 5263.73 GB and received 5148.85 GB. I've recei ved 5244063 connections on IPv4 and 270025 on IPv6. I've made 2021914 connection s with IPv4 and 581488 with IPv6. Apr 21 09:45:08.000 [notice] Circuit handshake stats since last time: 1609/1609 TAP, 6391488/6532508 NTor. Apr 21 15:45:08.000 [notice] Heartbeat: Tor's uptime is 111 days 0:00 hours, wit h 45439 circuits open. I've sent 5300.03 GB and received 5185.19 GB. I've receiv ed 5253283 connections on IPv4 and 270537 on IPv6. I've made 2024515 connections with IPv4 and 582464 with IPv6. Apr 21 15:45:08.000 [notice] Circuit handshake stats since last time: 467/467 TA P, 9937327/9984534 NTor. Is this anything I need to be concerned about, or is it just one of things that occasionally happens. Cheers.

2 1

Re: [tor-relays] Bridge Distribution Mechanism none
by Ross Camm 21 Apr '22

21 Apr '22

I have no error from Apparmor and I dont believe obfs4 proxy is the issue as I have obfs4 installed and confirmed running dpkg -l | grep obfs4 ii obfs4proxy 0.0.7-4 ps ax | grep obfs4 5501 ? Sl 0:01 /usr/bin/obfs4proxy netstat -nap | grep obfs4 tcp 0 0 X.X.X.X:12345 0.0.0.0:* LISTEN 5501/obfs4proxy Tor logs Apr 18 17:00:33 pi Tor[5497]: Registered server transport 'obfs4' at 'X.X.X.X:12345' torrc ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy ServerTransportListenAddr obfs4 X.X.X.X:12345 [ https://bridges.torproject.org/scan/ ]( https://bridges.torproject.org/scan/ ) also reports my ORPort is reachable via IPv4 and IPV6 Tor logs Apr 18 17:01:37 pi Tor[5497]: Self-testing indicates your ORPort [X:Y:Z::A]:993 is reachable from the outside. Excellent. Apr 18 17:01:37 pi Tor[5497]: Self-testing indicates your ORPort A.B.C.D:993 is reachable from the outside. Excellent. Publishing server descriptor. What am I missing ? Thanks again Ross > Probably because obfs4 is not installed or not running properly.> Check your logs for obfs4 errors, and for Apparmor error messages as well.> On Mon, Apr 18, 2022 at 09:07, Ross Camm <ross(a)whyza.net> wrote:> I have been up and running with my Tor Bridge for a number of months now, yet Tor Metrics reports that the Bridge Distribution Mechanism for my server is stuck on 'none'.>> Consequently I see no incoming connections to my Bridge.>> I have tried altering the following>> BridgeRelay 1>> PublishServerDescriptor bridge> BridgeDistribution moat>> with no success.>> The mechanism is always none....and I have left the changes for a week to see if Metrics updates to no avail.>> I have a static IPv4 address and functional IPv6 and have confirmed my ports are publicly accessible for both protocols>> Self-testing indicates your ORPort [XXXX:XXXX:XXXX::XXX]:993 is reachable from the outside. Excellent.> Self-testing indicates your ORPort XXX.XXX.XXX.XXX:993 is reachable from the outside. Excellent. Publishing server descriptor.>> I am running raspberry pi os buster which had an obsolete Tor version.>> I subsequently upgraded and stay up to date with the latest bullseye version via bullseye backports,>> Currently Tor 0.4.6.10-1~bpo10+1>> Any ideas of why my servers Bridge Distribution Mechanism is always reported and behaving as none ?>> Thanks in advance ;)>> Ross

2 1