- tor-relays - lists.torproject.org

metrics: add `IPv6 Exit Address` in addition to `Exit Address`
by s7r 09 Nov '21

09 Nov '21

Hello, Currently we have Exit Address for relays that use a different IPv4 address for `Exit` connections vs their ORPort IPv4 address. Similarly, one relay *could* listen on a certain IPv6 address ORPort but use a different IPv6 address for v6 exiting. Wouldn't it be useful to add this data too? This would tell us how many relays use one static IPv6 address for ORPort connections and temporary IPv6 addresses for exiting (using IPv6 privacy extensions). By looking at https://metrics.torproject.org/relays-ipv6.html one could assume that almost 50% of the IPv6 enabled relays (IPv6 ORPort) are exits.

1 0

Re: [tor-relays] Max number of bridge under the same IP
by gus 09 Nov '21

09 Nov '21

On Mon, Nov 08, 2021 at 07:02:13PM +0100, ML Tor wrote: > In data 8/11/2021, *gus* ha scritto: > > Hi, > > On Mon, Nov 08, 2021 at 03:24:13PM +0100, ML Tor wrote: > > Hi, > hi made a new Proxmox server for my home network. I still run a bare metal > Tor bridge, but now i would run more bridge in my home network. > > I have a public dynamic IP: what is the max number of bridge i can run > (obviously on different ORPort) under the same IP address > > > From the Tor Relay Guide: > > "Note: You can only run two Tor relays per public IPv4 address. If you > want to run more than two relays you will need more IPv4 addresses." > https://community.torproject.org/relay/relays-requirements/ > > > Too bad, so no more than two bridge on my singe ip. > > But... > > Maybe you want to run a standalone Snowflake > proxy?https://community.torproject.org/relay/setup/snowflake/ > > > Can i run my two bridge AND one Snowflake proxy? ;-) > Yes, it's fine! :) cheers, Gus > Thanks in advance, > > > -- > ML -- The Tor Project Community Team Lead

2 1

Max number of bridge under the same IP
by ML Tor 08 Nov '21

08 Nov '21

Hi, hi made a new Proxmox server for my home network. I still run a bare metal Tor bridge, but now i would run more bridge in my home network. I have a public dynamic IP: what is the max number of bridge i can run (obviously on different ORPort) under the same IP address Thanks in advance, -- ML

2 1

upgrade problem
by potlatch 06 Nov '21

06 Nov '21

Wondering if my tor.list has a typo since I can't upgrade Tor 0.4.5.9. I get error: Err:1 https://deb.torproject.org/torproject.org stretch/main amd64 tor-geoipdb all 0.4.5.10-1~d9.stretch+1 server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none I have debian 9 installed. Can someone turn on the light for me? Thanks, potlatch Sent with ProtonMail Secure Email.

2 1

known issues with deb.torproject.org repos?
by nusenu 02 Nov '21

02 Nov '21

Hi, are there known issues with the nightly master debian package builds? https://deb.torproject.org/torproject.org/dists/ and a related question: Will the stable packages remain on the 0.4.5.x LTS branch until the next LTS branch or will it at some point move to the latest stable again? (as it used to be) https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/CoreTorRele… kind regards, nusenu -- https://nusenu.github.io

2 3

Relay MIGHTYWANG consensus issues and loss of STABLE flag
by Mighty Wang 29 Oct '21

29 Oct '21

Hello fellow operators I have one pretty large relay, MIGHTYWANG which is an IP4/6 guard, dedicated hardware running on a 1Gb line uncontended. It is usually one of the top 5 relays by consensus weight but on the morning of 14th October it lost Guard status on account of losing the stable flag. I checked logs, connectivity and server health - nothing unusual, everything is generally pretty bullet proof in and around the relay and it had been running for well over a year without a reboot - just the very occasional Tor daemon restart following upgrades but no such activity prior to the 14th. So next I checked the consensus and I see that around half of the directory authorities seem to be not assigning the stable flag. See attached screenshot showing current consensus. The peering to each of those relays seems OK from what I can see (IP4 and IP6) so any idea what gives? I've got a MIGHTYWANG sitting here twiddling it's thumbs because have the directory authorities don't want to use it. Bit of a waste. I had similar things happen a few years ago with one of my old relays; again no obvious reason, just seemed to be the a random whim of the directory authorities. I've noticed a couple of other long term relays are in a similar position - is this some time of attack, deliberate action or just Tor magic? Wang -- MIGHTYWANG 9B2BC7EFD661072AFADC533BE8DCF1C19D8C2DCC

4 5

Tor respority can't be updated from securly on debian
by Keifer Bly 28 Oct '21

28 Oct '21

Hi, so I am trying to update tor to the newest version on my debian vps, only to receive this error: Reading package lists... Done E: The repository 'https://deb.torproject.org/torproject.org st retch Release' no longer has a Release file. N: Updating from such a repository can't be done securely, and is therefore disabled by default. Here is my sources.list file, ## Note, this file is written by cloud-init on first boot of a$ ## modifications made here will not survive a re-bundle. ## if you wish to make changes you can: ## a.) add 'apt_preserve_sources_list: true' to /etc/cloud/clo$ ## or do the same in user-data ## b.) add sources in /etc/apt/sources.list.d ## c.) make changes to template file /etc/cloud/templates/sour$ ### # See http://www.debian.org/releases/stable/i386/release-notes$ # for how to upgrade to newer versions of the distribution. deb http://deb.debian.org/debian buster main deb-src http://deb.debian.org/debian buster main ## Major bug fix updates produced after the final release of t$ ## distribution. deb http://security.debian.org/ buster/updates main deb-src http://security.debian.org/ buster/updates main deb http://deb.debian.org/debian buster-updates main deb-src http://deb.debian.org/debian buster-updates main ## Uncomment the following two lines to add software from the $ ## repository. ## I am wondering what needs to be added here to allow tor to update? Thank you.

3 2

bridge question
by potlatch 28 Oct '21

28 Oct '21

Should torrc for bridges list MyFamily? I run several of both. potlatch Sent with ProtonMail Secure Email.

2 1

Dropped off consensus (0.4.4.5)
by Felix 23 Oct '21

23 Oct '21

Hi everybody This is early. Yesterday I upgraded Ichotolot60 1AE039EE0B11DB79E4B4B29CBA9F752864A0259E from 4.2.7 to 4.4.5. Now I see in the consensus health: moria1 Fast Run Stab V2Dir Valid bw=566 tor26 Fast Guard Stab V2Dir Valid dizum Fast Guard Stab V2Dir Valid gabel. Fast Stab V2Dir Valid bw=1130 danne. Fast Guard Run Stab V2Dir Valid maatu. Fast Stab V2Dir Valid bw=1200 farav. Fast Guard Run Stab V2Dir Valid bw=2970 longc. Fast Stab V2Dir Valid bw=490 bastet Fast Guard Run Stab V2Dir Valid bw=3520 And _no_ Authority "owns" the relay. Old Apr 02 21:51:31.872 [notice] Tor 0.4.2.7 running on FreeBSD with Libevent 2.1.11-stable, OpenSSL LibreSSL 3.0.2, Zlib 1.2.11, Liblzma 5.2.4, and Libzstd 1.4.4. New Sep 18 21:00:22.384 [notice] Tor 0.4.4.5 running on FreeBSD with Libevent 2.1.12-stable, OpenSSL LibreSSL 3.2.1, Zlib 1.2.11, Liblzma 5.2.4, and Libzstd 1.4.5. (Yeah, some Lib stuff is new too, hehe) The "Guard !Run Stab" consensus looks quite interesting to me. How can it be? Other relays with that nice "Guard !Run Stab" dropped off consensus over night (or since days) and no authority "owns" them too: HORUS1 0.4.4.4-rc norisknofun 0.3.5.10 ULayerKiriakou 0.4.3.5 Stellvia 0.4.3.6 torexit42 (StaleDesc) 0.4.1.6 torpidsDEhetzner1 0.4.3.2-alpha (3 days) karen (StaleDesc) 0.4.2.7 Stephen304 0.4.2.7 (3 days) Rigel2020 (StaleDesc) 0.4.3.6 dgplug (FallbackDir, StaleDesc) 0.4.4.5 =?= May-be the operators updated and are now in the same floating position? May-be this is super normal and came to my attention by surprise? Anyways, I let everthing run for a day or so. Time can heal. -- Cheers, Felix

5 8

Tor Bridge Question
by Josh Lawson 19 Oct '21

19 Oct '21

I work for a bank and was informed that when I connect to my employer network, it shows I am coming from a Tor IP and sets off an alert that then leads to me being on a call with an investigative team for my employers. I was running a Tor relay, but had to shut it down because of these alerts. I am not thinking of running a bridge instead, but I have a question. Are the bridge IP addresses private enough to not likely trigger an alert by bank fraud detection software? Please let me know if I am not phrasing this well. I would like to donate some bandwidth and was thinking maybe running a bridge would be less likely to set off alerts.

3 2

Overloaded state indicator on relay-search
by Silvia/Hiro 19 Oct '21

19 Oct '21

Hello all, One of our goals with our current performance work is to reduce the overload of relays in the network. The implementation of proposal 328[1] a while back made different overload indicators available to relay operators and since a couple of weeks ago those can be tracked via Onionoo[2] as well. As we know that a lot of our relay operators use relay search to check for the health of their relays, we have launched a new feature there, too, to help them know when their relays are overloaded. When a relay is in the overloaded state we show an amber dot next to the relay nickname. Currently we are counting between 50 and 80 overloaded relays and between 10 and 20 overloaded bridges. The overloaded state is reached when one or many of the possible load metrics have been triggered. When this happens we show it for 72 hours after the relay has recovered [3]. Note, though, that not all of the exposed overload metrics are triggering the overload indicator on relay search yet. If you noticed your relay is overloaded, please check the following support article to find out how you can recover to a "normal" state: https://support.torproject.org/relay-operators/relay-bridge-overloaded/ Let us known how you find this new feature. Cheers, -hiro [1] https://gitweb.torproject.org/torspec.git/tree/proposals/328-relay-overload… [2] https://lists.torproject.org/pipermail/tor-project/2021-August/003168.html [3] https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt#n637

13 51

What is: Channel padding timeout scheduled
by Eddie 18 Oct '21

18 Oct '21

Noticed that one of my relays (OhNoAnotherRelay02) is showing as off-line. Looking at the logs, I see a bunch of these messages: Oct 18 08:39:16.000 [notice] Channel padding timeout scheduled 143041ms in the past. Oct 18 08:39:21.000 [notice] Channel padding timeout scheduled 156925ms in the past. Oct 18 08:39:24.000 [notice] Channel padding timeout scheduled 168712ms in the past. Oct 18 08:39:25.000 [notice] Channel padding timeout scheduled 166895ms in the past. . . . Oct 18 10:18:48.000 [notice] Channel padding timeout scheduled 194581ms in the past. Oct 18 10:35:22.000 [notice] Channel padding timeout scheduled 216311ms in the past. Oct 18 10:35:30.000 [notice] Channel padding timeout scheduled 224267ms in the past. What's the cause of this. I used this downtime as an excuse to do a bunch of upgrades and a re-boot. Cheers.

1 0

help with exit
by Bass Down Low 17 Oct '21

17 Oct '21

Hi all, I am somewhat new to the project and trying to run a couple exits to help out. I noticed my relay amazinglizard F80494CE5B2441B67431FFA9CCA571D26BC4F6D8 has bee up for 4 days and not turned into an exit yet. I noticed the overload flag is present, does this prefent my relay from becoming an exit? If not, I would appreciate any help you can give. thank you very much

2 1

Tor automatic restart
by Keifer Bly 11 Oct '21

11 Oct '21

7 8

Updating from Ubuntu 20.04 using apt-secure
by John Csuti 11 Oct '21

11 Oct '21

Hello all, I recently went to update and upgrade my system and found that the certificate for deb.torproject.org is expired and no longer trusted? Is anyone else having this issue and is there a way to fix this. I also added the repo to a fresh install of ubuntu 20.04 and got the same error. Error Err:5 https://deb.torproject.org/torproject.org focal Release Certificate verification failed: The certificate is NOT trusted. The certificate chain uses expired certificate. Could not handshake: Error in the certificate verification. [IP: 95.216.163.36 443] Thanks, John Csuti +1 (216) 633-1279

2 2

Restarting Tor
by sysmanager7 10 Oct '21

10 Oct '21

Greetings All, I have three relays that are in need of an upgrade and reboot. What is the best way to restart these relays without loosing flags or time? Secondly how long can a relay be down before flags are dropped? Thank you for any help! Sysop Sent with [ProtonMail](https://protonmail.com/) Secure Email.

4 3

relayor v21.1.0 is released
by nusenu 10 Oct '21

10 Oct '21

Hi, relayor v21.1.0 is released. relayor is an ansible role that helps you with running tor relays with minimal effort (automate everything). https://github.com/nusenu/ansible-relayor Changes since relayor v21.0.1 https://github.com/nusenu/ansible-relayor/releases/tag/v21.1.0 - generate ContactInfo v2 proof files for easy publishing (if enabled) - update apt cache if it is older than one day before installing dependencies (patch by @tsekityam) #219 #220 - increase min. ansible version 2.9.13 -> 2.9.23 - increase min. tor version 0.3.5 -> 0.4.5 - Debian 11, FreeBSD 13 and OpenBSD 6.9 are supported kind regards, nusenu -- https://nusenu.github.io

1 0

Connection Reset and IO Timeout errors on 0.4.6.7 with libnss
by theintern 09 Oct '21

09 Oct '21

Has anyone else on this list had issues with compiled versions of 0.4.6.7 in which the --enable-libnss is enabled?

1 0

Unreachable DirPorts
by Arlen Yaroslav 08 Oct '21

08 Oct '21

Hi to all relay operators! I run two Tor relays: 77D08850C1EE8587451F838D3F49874F75B0B1AC 09A70E396DE93F54D4541BBB0EC8E2B23761F34F They both have DirPorts configured on port 80. I can connect to this port on both hosts externally. However, Relay Search is showing the ports as either unreachable or unconfigured and is not showing the 'Latest server descriptor' and 'Latest extra-info descriptor' buttons at the bottom of the page. Would anyone be able help me troubleshoot this? Many thanks and regards, Arlen

2 1

Re: [tor-relays] Overloaded state indicator on relay-search
by Gary C. New 05 Oct '21

05 Oct '21

David Goulet: Will you confirm whether the Advertised Bandwidth metric is also client initiated (I'm assuming to the Directory Authority)? I have a 250Mb pipe and have seen a maximum Advertised Bandwidth rate of 4MB/s with my Tor relay. I know resource constraint must be factored in, but I would expect better than 4MB/s. I believe I remember reading it was based on an average 10 second burst rate, but in what direction is the connection initiated? Thanks, again. Gary

2 2

Re: [tor-relays] Overloaded state indicator on relay-search
by Bleedangel Tor Admin 29 Sep '21

29 Sep '21

1 0

New round of measuring the accuracy of Tor relays' advertised bandwidth
by Georg Koppen 23 Sep '21

23 Sep '21

Hello! You might recall we ran two "speed tests" so far for investigating the accuracy of a relay's advertised bandwidth, one in 2021[1] and another one earlier this year[2]. We gonna pick this test up again this week. However, this time it won't be just a single run but we are rather scheduling the experiment to be on for two weeks and then off for two weeks for the upcoming weeks/months (see: the third item in our network experiments strategy[3] for some rationale). More exactly: we'll run our measurement script for roughly one week, then wait about a week for flooded values leaving the relay descriptors, then 2 weeks off, then starting again... The experiment itself has not changed: we are planning to download several large data streams for a period of about 20 seconds with the goal to get a better estimation of the relay's true capacity. There are more details related to this experiment in particular in an older mailing list thread[1], in case anyone is interested and has not seen those yet. As in previous instances of this "speed test" there is the option for an opt-out. Let us know if any of you doesn't want to participate and we remove your relay(s) from the list to scan. Finally, an up-to-date status about the flooding being on/off (and other experiments scheduled) can be found on our status page[4]. Thanks, Georg [1] https://lists.torproject.org/pipermail/tor-relays/2019-July/017535.htmlff. [2] https://lists.torproject.org/pipermail/tor-relays/2021-May/019649.html [3] https://gitlab.torproject.org/tpo/network-health/team/-/wikis/Network-exper… [4] https://status.torproject.org/affected/network-experiments/

2 6

tor version question
by torix 22 Sep '21

22 Sep '21

Dear All, I can see in OrNetStats that I have several relays marked as having a vulnerable Tor version. But when I checked and tried to update them, I was told that everything was up to date. In 2 cases relays rented at the same time on the same host have different versions. AlexHost running FreeBSD release 12.1 and 12.2 respectively: 0.4.6.7 and 0.4.5.8 CoolComputers both running Centos8.4.2105: 0.4.6.6 and 0.4.5.10 I'm not sure why the same package repo would cough up different tor versions for different servers - is the answer to sit tight and wait for the older versions to catch up, or is there a way to force the older ones to update to a newer tor version? (My oldest version is 0.4.5.8). TIA, --Torix

2 2

Need help with Dir Address and Exit Address
by Bleedangel Tor Admin 21 Sep '21

21 Sep '21

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi all I have an exit relay running, and all is working well. I am a stickler though, and i notice when i search my relay on the metrics page, the following two items are listed as 'none': Dir Address Exit Address Can anyone help me to get these reporting properly? I have a V2 Directory flag and my dir port is 9030. I am allowing ipv4 exits. Metric page for reference: https://metrics.torproject.org/rs.html#details/5161B1C501805A0D3E9F87AFCAC9… Thanks for any help you can give! -----BEGIN PGP SIGNATURE----- Version: ProtonMail wnUEARYKAAYFAmFJOgQAIQkQ07hp34FMyg4WIQSgEMifmnN5ohFWvfnTuGnf gUzKDs8DAP4hSvlEPrlDkIY5vlLULhJHuNVbq/UT3r5mfBg/cg+p0wEAltfV bPlU/3wfg7j0b31h6R4g+Ik+96fkoq9VTqiydQg= =6AAW -----END PGP SIGNATURE-----

2 1

Ripped off relay name
by xplato 20 Sep '21

20 Sep '21

Just curious a relay appeared with a nearly identical name to a relay I have run for a while. Is this just a lack of creativity or something that I should be concerned about? The name is fairly unique and the new relay is almost identical in name. Sent from ProtonMail for iOS

4 3