- tor-relays - lists.torproject.org

APPCRASH on Windows Server Core 2019
by Saswat Padhi 23 Jul '21

23 Jul '21

Hello, I recently switched to a Windows Server Core 2019 machine for running my (exit) relay. Previously I was able to run the relay without any issues on Windows Server 2019, but it crashes without any errors or warnings on Core 2019. Has anyone tried running a Tor relay on Windows Server Core? I have attached my notice.log file and the error report from Windows events log, but none of them have anything informative at all. What I see is very similar to what's described on this thread: https://lists.torproject.org/pipermail/tor-relays/2021-April/019597.html. OP was finally able to resolve it, but they didn't post their solution ... Thanks and regards.

1 0

OVH killed me
by gerard＠bulger.co.uk 17 Jul '21

17 Jul '21

I have had no reports of abuse with my partial exit for a couple of years, then suddenly OVH kills the server (Reinstalling is a pain and IPV6 not autoloaded and they and Ubuntu keep changing networking) Anyway “Abnormal activity has been detected on your VPS vps585081.ovh.net. As your VPS poses too greater threat to our infrastructure, we had no choice but to put it in FTP rescue mode. This mode enables you to access the data on your VPS. An email containing information on FTP rescue mode has been sent to you. Actions can no longer be carried out on your VPS via your Manager/API. Only the following actions are possible: - Reinstallation of your VPS. Please do not hesitate to contact our technical support team so that this situation does not become critical. You will find the logs brought up by our system below, which led to this alert. - START OF ADDITIONAL INFORMATION - Attack detail : 7Kpps/3Mbps dateTime srcIp:srcPort dstIp:dstPort protocol flags bytes reason 2021.07.17 15:44:37 CEST 51.38.64.xxx:39859 192.124.249.xx:443 TCP SYN 60 ATTACK:TCP_SYN 2021.07.17 15:44:37 CEST 51.38.64.xxx:38510 67.222.30.xx:443 TCP SYN 60 ATTACK:TCP_SYN 2021.07.17 15:44:37 CEST 51.38.64.xxx :43014 67.222.30.xx:443 TCP SYN 60 ATTACK:TCP_SYN When I fire it up how to mitigate against this? My new server with the original IPV4 address is under attack already but tor is not running yet Gerry

1 0

Nodes on dynamic IPs don't survive an IP change any more
by Marco Predicatori 12 Jul '21

12 Jul '21

Hi, whenever my IP changes, my node stops relaying traffic, and after a few hours I see in the logs [notice] Heartbeat: It seems like we are not in the cached consensus. In past versions I remember seeing in the logs something like "...your ip seems to have changed...", followed by a new "...publishing server descriptor...", as far as I remember. Now I have to monitor my ip, and restart Tor whenever it changes. Wouldn't it be nice to go back to the previous behaviour? Bye, Marco -- https://metrics.torproject.org/rs.html#details/A4E74410D83705EEFF24BC265DE2…

1 1

(no subject)
by W H 12 Jul '21

12 Jul '21

Hello dear people I have an OBSF4 bridge to support the free internet. If I look at my bridge via https://metrics.torproject.org/ then the bridge distribution mechanism is set to HTTPS. But I would like to activate Moat. How does it work? Thank you very much

1 0

significant decrease in onionoo AS data coverage after switch to ipfire geoip db?
by nusenu 10 Jul '21

10 Jul '21

Hi, the following table shows how many relays in onionoo data have no as_name data. Since a long time the underlying DB has not been updated and there is a plan to improve things https://gitlab.torproject.org/tpo/metrics/relay-search/-/issues/40004 Now I'm wondering if this improvement made things worse? +------------+----------+ | 2021-06-10 | 419 | | 2021-06-11 | 422 | | 2021-06-12 | 422 | | 2021-06-13 | 424 | | 2021-06-14 | 421 | | 2021-06-15 | 422 | | 2021-06-16 | 420 | | 2021-06-17 | 414 | | 2021-06-18 | 1748 | kind regards, nusenu -- https://nusenu.github.io

2 2

Dotsrc.org is looking for IPv4 address space for exit nodes
by Anders Trier Olesen 07 Jul '21

07 Jul '21

Hi All! A while back, I sent an email to the tor-relays-universities mailing list, announcing that we (dotsrc.org) are attempting to run fast exit nodes on the Danish national research network: https://lists.torproject.org/pipermail/tor-relays-universities/2020-Decembe… Since then, our ISP has told us that they still don't like the idea of running an exit node on a Danish research network IP, so they'll register an AS number and request separate IPv6 addresses to dotsrc. As far as I know, it is still not possible to run IPv6 only exit nodes, which is why we're currently looking for a Provider Independent (PI) IPv4 address space that we can announce. IPv4 addresses have become a scarce resource, and are too expensive for dotsrc.org to buy on the open market. If you happen to have an unused IPv4 block (or know someone who might) that you're willing to donate or let dotsrc.org announce, please contact us at staff(a)dotsrc.org. https://dotsrc.org/news/2021-07-06_searching_for_ipv4_address_space/ Best regards Anders Trier Olesen staff(a)dotsrc.org

1 0

end of life: tor 0.4.4 (2021-06-15)
by nusenu 06 Jul '21

06 Jul '21

Reminder: tor 0.4.4 reached it's end of life on 2021-06-15. Over 1000 relays and about 20% of the network capacity runs an unsupported version of tor. https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/CoreTorRele… Consider upgrading if you are one of the affected operators https://nusenu.github.io/OrNetStats/#end-of-life-relays-share -- https://nusenu.github.io

2 1

Publishing rejected fingerprints
by Trofim Maslow 03 Jul '21

03 Jul '21

Hi everyone. I think it’s a good idea to publish a list of rejected relay fingerprints and reason why they are rejected once a month. This should make Tor more transparent.

3 2

Re: [tor-relays] "Verify My Relay"
by S1l3nt Hash 29 Jun '21

29 Jun '21

Thank you for everyone's helpful input. Ive managed to get it up and running. This is the updated config I used for everyones interest. Main change was: ORPort xxx.xxx.xxx:9001 No Listen (static public ip) ------> This was removed After this, ORPort could reach external, and form connections. Address xxx.xxx.xxx.xxx (static public ip) -------> Removed AddressDisableIPv6 1 -------> Added as I'm not using IPv6 at this stage There was low performance for a few days, however i've read https://blog.torproject.org/lifecycle-new-relay and can see a steady increase in speed over the last few days. @Zakwan Kalb: My relay hasn't been marked as bad, just initial misconfig due to lack of understanding, should be all sorted now. @Georg Koppen: Not sure, but seems to be all sorted now @Toralf: Yeah i've noticed just habit i gues :D @John: Thx for the head up with ports, it helped with the fault finding!

1 0

Relay consensus weight drop
by mikefloyd2 26 Jun '21

26 Jun '21

Hi, I've noticed that my relay's bandwidth has been continuously dropping during the last couple of weeks. My bandwidth has been stable during that time, and I haven't changed anything in terms of configuration. I've also noticed that bastet, longclaw and maatuska are showing lower weights for my relay. Have been any changes recently in the network that could cause this? My relay - https://metrics.torproject.org/rs.html#details/671A68ABADA1402FB00676055F48… Thanks in advance, Mike Sent with [ProtonMail](https://protonmail.com/) Secure Email.

6 11

Log message
by Zakwan Kalb 24 Jun '21

24 Jun '21

Hi, I have an issue: a day after I start my relay I get a bunch of error messages from Tor. Here is an example: http status 400 ("Fingerprint and/or ed25519 identity is marked rejected -- if you think this is a mistake please set a valid email address in ContactInfo and send an email to bad-relays(a)lists.torproject.org mentioning your fingerprint(s)?") response from dirserver 204.13.164.118:80. Please correct. Did anyone have the same issue?

3 5

Verify my Relay
by S1l3nt Hash 24 Jun '21

24 Jun '21

Hello, I wanted to do my part in helping the TOR network grow, so I've started a tor relay on a debian system. After running for a while and monitoring on Nyx, and checking Relay Search I've notice my link says "Offline". Just wanted to know if there is a way to confirm working status, apologies in advance as I'm quite new to this. Torrc Nickname **** SocksPort 0 RunAsDaemon 1 Address xxx.xxx.xxx.xxx (static public ip) DirPort 9030 NoAdvertise DirPort xxx.xxx.xxx.xxx:9030 NoListen (static public ip) ORPort 9001 NoAdvertise ORPort xxx.xxx.xxx.xxx:9001 NoListen (static public ip) ContactInfo (my email) Log notice file /var/log/tor/notices.log ExitPolicy reject6 *:*, reject *:* RelayBandwidthRate 16777216 RelayBandwidthBurst 16777216 DisableDebuggerAttachment 0 ControlPort 9051 CookieAuthentication 1 CookieAuthFile /var/lib/tor/control_auth_cookie CookieAuthFileGroupReadable 1 DataDirectoryGroupReadable 1 HashedControlPassword *** Also configured Port Forwarding on my router for 9001 and 9030 to the private IPv4 address on the tor relay. Confirmed with my ISP no ports are being blocked. When I first started I had the confirmation MSG that DirPort could be reached, and have active incoming and outing connections. Now currently only have several outgoing connections. Was at one stage appearing "Online" on Relay Search, now "Offline" Currently have: [NOTICE] No circuits are opened. Relaxed timeout for circuit *** (a Testing circuit 3-hop circuit in state doing handshakes with channel state open) to 60000ms. However, it appears the circuit has timed out anyway. [1 similar message(s) suppressed in last 7740 seconds] Have not configured 9001 and 9030 to open in linux, are they by default? Thanks in advance for any help and knowledge, looking forward to helping. Hash.

4 3

Bad relay mark
by Zakwan Kalb 24 Jun '21

24 Jun '21

Please email me (kalbzakwan(a)gmail.com) if your relay was marked as bad relay. There is something suspicious happening, I would like to discuss it.

1 0

Torweather is still alive or back ;-)
by lists＠for-privacy.net 21 Jun '21

21 Jun '21

Damn cool, I was surprised when I got mail from torweather.org. (Some IPv6 addresses were down and I didn't notice.) And you can adjust your delivery frequency. Relay down since 3, 12, 24, 48 Hours or 1 Week. https://github.com/thingless/torweather Hint: You must have a working mail address in torrc contact info for it. -- ╰_╯ Ciao Marco! Debian GNU/Linux It's free software and it gives you freedom!

1 0

tor fails on start-up after yum update
by Eddie 21 Jun '21

21 Jun '21

Running a CentOS 7.9 system, pulling tor updates from https://rpm.torproject.org/centos/$releasever/$basearch The last 2 times that tor has been yum updated, the restart of the service has just stopped, at exactly the same point: Jun 18 06:46:50.000 [notice] Tor 0.4.6.5 opening log file. Jun 18 06:46:50.830 [notice] We compiled with OpenSSL 100020bf: OpenSSL 1.0.2k 26 Jan 2017 and we are running with OpenSSL 100020bf: 1.0.2k-fips. These two versions should be binary compatible. Jun 18 06:46:50.831 [notice] Tor 0.4.6.5 running on Linux with Libevent 2.0.21-stable, OpenSSL 1.0.2k-fips, Zlib 1.2.7, Liblzma 5.2.2, Libzstd 1.5.0 and Glibc 2.17 as libc. Jun 18 06:46:50.831 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning Jun 18 06:46:50.831 [notice] Read configuration file "/usr/share/tor/defaults-torrc". Jun 18 06:46:50.831 [notice] Read configuration file "/etc/tor/torrc". Jun 18 06:46:50.833 [notice] Based on detected system memory, MaxMemInQueues is set to 6342 MB. You can override this by setting MaxMemInQueues by hand. Jun 18 06:46:50.833 [notice] You configured a non-loopback address '192.168.0.254:9100' for SocksPort. This allows everybody on your local network to use your machine as a proxy. Make sure this is what you wanted. Jun 18 06:46:50.833 [notice] Opening Socks listener on 192.168.0.254:9100 Jun 18 06:46:50.833 [notice] Opened Socks listener connection (ready) on 192.168.0.254:9100 Jun 18 06:46:50.833 [notice] Opening Control listener on 127.0.0.1:9051 Jun 18 06:46:50.833 [notice] Opened Control listener connection (ready) on 127.0.0.1:9051 Jun 18 06:46:50.833 [notice] Opening OR listener on 0.0.0.0:9001 Jun 18 06:46:50.834 [notice] Opened OR listener connection (ready) on 0.0.0.0:9001 Jun 18 06:46:50.834 [notice] Opening Directory listener on 0.0.0.0:9030 Jun 18 06:46:50.834 [notice] Opened Directory listener connection (ready) on 0.0.0.0:9030 Jun 18 06:46:51.000 [notice] Parsing GEOIP IPv4 file /usr/share/tor/geoip. Starting the service then it starts correctly. I also couldn't see anything out of the ordinary in the main system logs, other than it echoing the above. Any ideas on what's going on here. Also, what is the correct setting for systemctl enable/disable tor/tor-master (I don't have any tor@ services), because I get inconsistent results using tor-master. Issuing "systemctl stop tor-master" will stop the accompanying tor instance, but "systemctl start tor-master" doesn't start it, but a "systemctl restart tor-master" does do a stop/start. I haven't had time to experiment with what happens on a re-boot (yet). Cheers.

2 1

Can't compile 0.4.6.5 on Ubuntu 18.04
by William Denton 15 Jun '21

15 Jun '21

I went to upgrade a relay running on Ubuntu 18.04 to the new release (0.4.6.5) and to my surprise it didn't compile. Every other version has built without any trouble. Wading into the Gitlab site was rather confusing, so I thought I'd send this here, in the hopes it reaches the right people and someone else might be interested. I ran ./configure, then make, and pretty soon this happened: CC src/feature/dirclient/dirclient.o In file included from ./src/core/or/or.h:50:0, from src/feature/dirclient/dirclient.c:13: src/feature/dirclient/dirclient.c: In function ‘dir_client_decompress_response_body’: ./src/lib/log/ratelim.h:55:27: error: initializer element is not constant #define RATELIM_INIT(r) { (r), 0, 0, 0 } ^ src/feature/dirclient/dirclient.c:1877:38: note: in expansion of macro ‘RATELIM_INIT’ static ratelim_t warning_limit = RATELIM_INIT(LOG_INTERVAL); ^~~~~~~~~~~~ ./src/lib/log/ratelim.h:55:27: note: (near initialization for ‘warning_limit.rate’) #define RATELIM_INIT(r) { (r), 0, 0, 0 } ^ src/feature/dirclient/dirclient.c:1877:38: note: in expansion of macro ‘RATELIM_INIT’ static ratelim_t warning_limit = RATELIM_INIT(LOG_INTERVAL); ^~~~~~~~~~~~ Makefile:12141: recipe for target 'src/feature/dirclient/dirclient.o' failed make[1]: *** [src/feature/dirclient/dirclient.o] Error 1 make[1]: Leaving directory '/usr/local/src/tor/tor-0.4.6.5' Thanks, Bill -- William Denton https://www.miskatonic.org/ Librarian, artist and licensed private investigator.

3 3

tor relay + sslh
by Casper 14 Jun '21

14 Jun '21

Hello, I recently discovered an SSL multiplexer called "sslh": """ sslh accepts connections on specified ports, and forwards them further based on tests performed on the first data packet sent by the remote client. Probes for HTTP, SSL, SSH, OpenVPN, tinc, XMPP are implemented, and any other protocol that can be tested using a regular expression, can be recognized. A typical use case is to allow serving several services on port 443 (e.g. to connect to ssh from inside a corporate firewall, which almost never block port 443) while still serving HTTPS on that port. Hence sslh acts as a protocol multiplexer, or a switchboard. Its name comes from its original function to serve SSH and HTTPS on the same port. """ Since many of my network services claims to listen on 433 (to bypass mobile network limitations), I'm thinking to configure and deploy sslh on large scale. If tor handshake can be handled by sslh, could the process (of the tor relay) be listening on 127.0.0.1:12345 and publish good relay descriptor as well ? Currently, in my relay config, I have the following: """ ORPort 26719 ORPort [{{ ansible_default_ipv6.address }}]:26719 DirPort 26720 and Address <my_public_ipv4_here> """ Tor will accept to be listening on the localhost interface only? """ ORPort 127.0.0.1:26719 Address <my_public_ipv4_here> """ Best regards, -- GnuPG: AE157E0B29F0BEF2 at keys.openpgp.org CA Cert: https://dl.casperlefantom.net/pub/ssl/root.der

3 2

Problem moving my Tor Bridge Relay
by Cor.ling 12 Jun '21

12 Jun '21

Hello, I have a Tor Bridge and it worked well (thanks also for your kind support) but it doesn't work anymore after I tried to move it. Basically I copied the 'Keys' folder (at /var/lib/tor/keys) on a USB flash drive. After that I put the folder into the /var/lib/tor folder of the new device (deleting the pre-existing "Keys" folder). But I receive these errors on syslog (/var/log/syslog): > "Jun 12 15:13:59 PC systemd[1]: Stopped Anonymizing overlay network for TCP. > Jun 12 15:13:59 PC systemd[1]: Starting Anonymizing overlay network for TCP... > Jun 12 15:13:59 PC tor[38309]: Jun 12 15:13:59.472 [notice] Tor 0.4.5.6 running on Linux with Libevent 2.1.12-stable, OpenSSL 1.1.1j, Zlib 1.2.11, Liblzma 5.2.5, Libzstd 1.4.8 and Glibc 2.33 as libc. > Jun 12 15:13:59 PC tor[38309]: Jun 12 15:13:59.472 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning > Jun 12 15:13:59 PC tor[38309]: Jun 12 15:13:59.472 [notice] Read configuration file "/usr/share/tor/tor-service-defaults-torrc". > Jun 12 15:13:59 PC tor[38309]: Jun 12 15:13:59.472 [notice] Read configuration file "/etc/tor/torrc". > Jun 12 15:13:59 PC tor[38309]: Jun 12 15:13:59.474 [notice] Based on detected system memory, MaxMemInQueues is set to 2875 MB. You can override this by setting MaxMemInQueues by hand. > Jun 12 15:13:59 PC tor[38309]: Jun 12 15:13:59.476 [warn] /var/lib/tor/keys is not owned by this user (debian-tor, 124) but by root (0). Perhaps you are running Tor as the wrong user? > Jun 12 15:13:59 PC tor[38309]: Jun 12 15:13:59.476 [warn] Failed to parse/validate config: Couldn't access private data directory "/var/lib/tor/keys" > Jun 12 15:13:59 PC tor[38309]: Jun 12 15:13:59.476 [err] Reading config failed--see warnings above. > Jun 12 15:13:59 PC systemd[1]: tor(a)default.service: Control process exited, code=exited, status=1/FAILURE > Jun 12 15:13:59 PC systemd[1]: tor(a)default.service: Failed with result 'exit-code'. > Jun 12 15:13:59 PC systemd[1]: Failed to start Anonymizing overlay network for TCP. > Jun 12 15:13:59 PC systemd[1]: tor(a)default.service: Scheduled restart job, restart counter is at 4. > Jun 12 15:13:59 PC systemd[1]: Stopped Anonymizing overlay network for TCP. > Jun 12 15:13:59 PC systemd[1]: Starting Anonymizing overlay network for TCP... > Jun 12 15:13:59 PC tor[38314]: Jun 12 15:13:59.721 [notice] Tor 0.4.5.6 running on Linux with Libevent 2.1.12-stable, OpenSSL 1.1.1j, Zlib 1.2.11, Liblzma 5.2.5, Libzstd 1.4.8 and Glibc 2.33 as libc. > Jun 12 15:13:59 PC tor[38314]: Jun 12 15:13:59.721 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning > Jun 12 15:13:59 PC tor[38314]: Jun 12 15:13:59.721 [notice] Read configuration file "/usr/share/tor/tor-service-defaults-torrc". > Jun 12 15:13:59 PC tor[38314]: Jun 12 15:13:59.721 [notice] Read configuration file "/etc/tor/torrc". > Jun 12 15:13:59 PC tor[38314]: Jun 12 15:13:59.723 [notice] Based on detected system memory, MaxMemInQueues is set to 2875 MB. You can override this by setting MaxMemInQueues by hand. > Jun 12 15:13:59 PC tor[38314]: Jun 12 15:13:59.726 [warn] /var/lib/tor/keys is not owned by this user (debian-tor, 124) but by root (0). Perhaps you are running Tor as the wrong user? > Jun 12 15:13:59 PC tor[38314]: Jun 12 15:13:59.726 [warn] Failed to parse/validate config: Couldn't access private data directory "/var/lib/tor/keys" > Jun 12 15:13:59 PC tor[38314]: Jun 12 15:13:59.726 [err] Reading config failed--see warnings above. > Jun 12 15:13:59 PC systemd[1]: tor(a)default.service: Control process exited, code=exited, status=1/FAILURE > Jun 12 15:13:59 PC systemd[1]: tor(a)default.service: Failed with result 'exit-code'. > Jun 12 15:13:59 PC systemd[1]: Failed to start Anonymizing overlay network for TCP. > Jun 12 15:13:59 PC systemd[1]: tor(a)default.service: Scheduled restart job, restart counter is at 5. > Jun 12 15:13:59 PC systemd[1]: Stopped Anonymizing overlay network for TCP. > Jun 12 15:13:59 PC systemd[1]: tor(a)default.service: Start request repeated too quickly. > Jun 12 15:13:59 PC systemd[1]: tor(a)default.service: Failed with result 'exit-code'. > Jun 12 15:13:59 PC systemd[1]: Failed to start Anonymizing overlay network for TCP." (i'm using a PC with Kubuntu 21.04 and I followed this guide for the setting up: https://community.torproject.org/relay/setup/bridge/debian-ubuntu/) What can I do to solve these errors?

2 1

torrc
by Walenty Czerwinski 12 Jun '21

12 Jun '21

I wonder what's the difference between BandwidthRate, MaxAdvertisedBandwidth and RelayBandwidthRate?

1 0

Running Tor exit nodes on university networks
by Andreas Kempe 11 Jun '21

11 Jun '21

Hello everyone, I'm a member of Lysator ACS at Linköping university, Sweden. I'm currently investigating the possibility for our computer society to run Tor exit nodes. The IT department has made it clear that they will need some convincing that this is a good idea. One thing that they are wondering is whether there are other universites with experience running Tor nodes. If anyone is currently running Tor nodes on university networks, I'd love to hear about your experiences. A few questions that turned up are listed below. - Have you seen any good or bad press because of the node? - Are you receiving a lot of abuse complaints? - How are you handling abuse complaints? - How are you protecting the rest of your infrastructure from possibly malicious traffic? - Do you have any killer arguments as to why supporting Tor is a good idea that helped sway the people in charge at your university? Thank you in advance for any feedback! Cordially, Andreas Kempe

4 5

G-Core Labs and their humanoid robots
by Tor Relays 11 Jun '21

11 Jun '21

TL;DR: G-Core Labs does not understand their abuse detection software and their support agents are a bunch of humanoid robots. Dear customer, Due to suspicious activity SMTP ports have been blocked. Affected service ID: <id>. Destination port: 25, 465, 587. To unblock contact support. Me: hello, i guess you are referring to a recent spamhaus entry? i do not use ports 25, 465, 587 so it likely is a false positive. I don't need these ports open but i would prefer if you could unlock them in case i would like to use them in the future. otherwise i might wonder why they don't work without remembering that they got blocked on your end. Thanls Support agent 1: Hello, In terms of Acceptable Use Policy (AUP), clause 2(d), we reserve a right to block SMTP ports if your service is not located at our platform. Please, find the list of blockage cases and solutions. 1) Service belongs to third parties. Unfortunately, we have to deny your request of unblocking SMTP ports according to AUP. 2) Service belongs to our platform. Please, specify domain you send emails to. If domain is fine, we'll unblock ports accordingly. 3) You didn't send any emails. Please, check your server to find the reason of spamming. As soon you resolve the issue, we'll unblock ports. However if our automated system identifies spamming on your server again, we'll have to block SMTP ports permanently. We kindly ask you to send a reply in a detailed manner so we could analyze your case accordingly. Me: I will repeat myself: I do not send emails. Please unblock the SMTP ports or specify why you blocked the SMTP ports. Thanks. Support agent 1: Check your network settings, perhaps something could cause it. Tell us what you will found and we will figure it out. Me: I do not have a reason to believe the server got hacked and i do not use the server to send emails so it likely is a false positive. Why were the SMTP ports blocked? Support agent 1: It was blocked because automatic monitoring system find your activity suspicious. Now, trust level of your traffic for IP has been increased however the traffic is still automatically monitored. If the system of automatization identifies your traffic as illegitimate or if we receive an infringement report, we'll have to disable ports once again. Me: Please do not block any ports without my consent when you do not have any logfiles that prove any misbehavior. "Automatic monitoring system find your activity suspicious" does not help in debugging any possible misbehavior coming from my server. Do you have information about where i can read up about the function of your automatic monitoring system to prevent this problem? Support agent 1: We can't share information about algorithm. Four days later, different support agent: Dear customer, Due to suspicious activity SMTP ports have been blocked. Affected service ID: <id>. Destination port: 25, 465, 587. To unblock contact support. Me: hello, can you please give me more details about the suspicious activity? Support agent 1: Hello, In terms of Acceptable Use Policy (AUP), clause 2(d), we reserve a right to block SMTP ports if your service is not located at our platform. Please, find the list of blockage cases and solutions. 1) Service belongs to third parties. Unfortunately, we have to deny your request of unblocking SMTP ports according to AUP. 2) Service belongs to our platform. Please, specify domain you send emails to. If domain is fine, we'll unblock ports accordingly. 3) You didn't send any emails. Please, check your server to find the reason of spamming. As soon you resolve the issue, we'll unblock ports. However if our automated system identifies spamming on your server again, we'll have to block SMTP ports permanently. We kindly ask you to send a reply in a detailed manner so we could analyze your case accordingly. Me: Thanks but i know the AUP. The server does not send any emails and i do not have a reason to believe the server got hacked so please tell me the timestamp and destination of the connection that triggered your automatic monitoring system. Support agent 1: Let us please discuss your issue with our colleagues. We will inform you on this ticket. Support agent 1: Hello! Thank you for waiting! Unfortunately, we have to decline your unblocking request. As we see there is a second block on the same server. We couldn't unblock ports if they were blocked once Me: My question was: What triggered the block? Support agent 1: We couldn't provide you detailed information about SMTP-blocking system, sorry. The block is triggered if your server has suspicious activity on SMTP ports. Me: i understood that. What does "suspicious activity" means? Support agent 1: Let us, please, clarify this information with our engineers Me: Thank you. I hope you understand that it's an unfortunate situation when i do not find any misbehavior on the server but your "automatic monitoring system" accuses me of misbehavior and the answer is "there was suspicious activity". I am awaiting the response. Support agent 1: We have received a reply from your colleagues. Sorry, but we couldn't announce how this technology works. It is confidential information! Me: Can you forward me to someone higher or is there an address where i can complain? Support agent 2: Hello, Let us please discuss this moment with colleagues. Please stay tuned! Support agent 3: Thank you for waiting. Unfortunately, we can't forward somebody higher to you or give you an email additional email address. All communications take place via the support team. If you want to complain, please send us your complaint and we will send it to our colleagues. Me: Hello <name>! Sure, i can summarize it for you: I would like to complain about a malfunction in your "automatic monitoring system". Four days ago i received a ticket that SMTP ports are blocked due to "suspicious activity". I answered the support agent that the server is not used for sending emails and there is no sign of a malfunction on the server so it very likely is a false positive and he unblocked the SMTP ports. Today i received such a ticket again and the server is still not used for sending emails and there still is no sign of malfunction. To help you understand the incident i would need some information from you: - the source/destination IP and port that triggered the automatic monitoring system - an exact timestamp What solution can you offer me? Support agent 3: I'll send your message to our colleagues and let you know about the result. Support agent 3: Unfortunately, we can't provide you with any information that you've been asking for and we have to decline your request for unblocking. Our decision is based on our Master Service Agreement. You can find it here: https://gcorelabs.com/legal/ Me: What is the reason that you can not provide me with the requested information? Support agent 3: We don't provide that kind of information. As we already said it's confidential information. Me: Punishing the user for something, then making the information about the cause of the punishment as confidental for him is interesting. Are you sure that you properly understand the function of your "automatic monitoring service" and what steps will you take to prevent false positive results in the future? Support agent 3: Our engineers are working to improve the technology of SMTP ports blocking, but I'm afraid I can't share with you any additional information about it. I gave up after that. This happens when you use A/I to detect abuse and degrade humans to communicate A/I decisions. A/I will abuse us all.

5 6

Exit
by Walenty Czerwinski 11 Jun '21

11 Jun '21

Is there a chance to get problems with law enforcement in Poland because of operating exit relays? I heard in some countries law enforcement arrested relay operators thinking they committed a crime with a server where relays are hosted.

2 1

IPv6 not showing up on tor exit node
by pimpnet 10 Jun '21

10 Jun '21

I run a tor exit node and have properly configured IPv6 but sometimes it does not appear on the tor relay list. This is fixed when I reboot the tor service but what could be the reason?

1 0

More Tor measurements next week [opt out]
by Zachary Newman 07 Jun '21

07 Jun '21

tl;dr: Low-load measurements coming; no action needed unless you would like to opt out. Hi all, Next week (week of 2021-05-31), we will be starting a wide-scale measurement of the latencies between relays on the Tor network for a research project; these measurements will last an estimated 1-2 months. We have the permission of the Tor Research Safety Board and this information will ultimately be used to improve the network. Further, the load at any one time on the Tor network from these measurements will be limited and negligible (approximately the same load as the start-up tests of a few new Tor clients). We are coordinating with the currently-running speed test[1], and will start our measurements after the conclusion of this speed test. If you operate a relay and would like to opt out of these measurements, please send us an email (shortor(a)csail.mit.edu) including the fingerprint of your relay(s). We will stop sending you traffic and, if the test has begun, delete past measurements involving your relay(s). Status updates will be posted publicly[2], and we will bump this thread before we start and if anything important changes. Please contact shortor(a)csail.mit.edu with any questions. Regards, Zack Newman (on behalf of the ShorTor team) [1] https://lists.torproject.org/pipermail/tor-relays/2021-May/019649.html [2] https://people.csail.mit.edu/zjn/tor.txt

1 1

New Test for Measuring the Accuracy of Tor Relays' Advertised Bandwidths
by Georg Koppen 07 Jun '21

07 Jun '21

Hello everyone! Some of you might remember the speed test Rob had been running during August 2019 to investigate the accuracy of the advertised bandwidth a relay is reporting in its server descriptor.[1] Back then this involved, for each relay, downloading several large data streams for a period of about 20 seconds to get a better estimation of the relay's true capacity (See: [1] and follow-up emails for the exact details of the experiment). We plan to do this speed test again in about 1 week and relay operators can opt-out of it (again) if they want to. We still believe that the overhead of this speed test is in line with regular usage, but if anyone doesn't want to participate that's fine. Let us know if so (by replying to this thread or off-list, if preferred) and we remove your relay(s) from the list to scan. Thanks, Georg [1] https://lists.torproject.org/pipermail/tor-relays/2019-July/017535.htmlff.

4 5