- tor-relays - lists.torproject.org

M1 anyone?
by niftybunny 29 Dec '20

29 Dec '20

With one of my servers down and giving me brain cancer … anyone tried to run relays on the new M1 chip? Is it even officially supported right now? Anyone any idea how much it could push? cheers, nifty

2 1

SSH
by Андрей Гвоздев 29 Dec '20

29 Dec '20

Hello I'm running a TOR relay, every time I SSH to my server I see a message that there were thousands of failed login attempts Do you see this message too?

10 12

Bridge acting strange
by enrollado 29 Dec '20

29 Dec '20

I have noticed some bizarre behavior on one of my relays. I logged into the server hosting particlefive (bridge) on November 15 and noticed that the tor process had crashed (not a clean exit). I had accounting set up, so it had hibernated from 11/07 00:00 UTC to 11/07 00:44 UTC. After that, it appeared to be running normally, but it crashed sometime after 11/07 06:25 UTC. I don't have crash dumps enabled, so I don't have any information on the crash. I restarted it and it appeared to have been working normally. I checked on it again on the 16th and all was well. On December 2nd, it suddenly stopped receiving client connections. According to the metrics page, it hasn't passed any traffic since then, though the logs show 20 - 60 GB per heartbeat interval. The log rotation has gone strange as well. As of today: notices.log - 12/29 06:25 to 12/29 12:20 notices.log.1 - 12/28 06:25 to 12/29 06:20 notices.log.2 - 11/06 06:25 to 11/07 06:25 notices.log.3 - 12/26 06:25 to 12/27 06:25 notices.log.4 - 12/25 06:25 to 12/26 06:25 notices.log.5 - 12/23 06:25 to 12/24 06:25 So, the log from the day before the crash is still hanging around with no unusual activity shown, and I'm missing the log file for 12/24. At this point, it seems to be running normally, but it is not receiving any new connections. Yesterday, I changed the configuration from accounting to bandwidth limiting, so notices.log.1 has the hup I sent to reload the configuration. However, notices.log.3 also shows a hup signal at 06:25 UTC that I did not send. I should probably report this on the tor-dev list, but moderation on that list appears to be pretty slow, and this list is more active. I was wondering if anyone else has seen this kind of odd activity on a bridge before. My paranoia alarm is in yellow status, so I'm about to dump this relay, get a new IP, and start over. Any advice is appreciated. No me preguntas nada, no te digo una mentira. Enrollado Sent with ProtonMail Secure Email.

1 0

Tor Traffic De-prioritization Script
by tontu 29 Dec '20

29 Dec '20

Hello all, I recently acquired a server with "unlimited" (not unmetered) bandwidth on a non-Hetzner/OVH/Scaleway network, but the pipe is just 100mbit (and will be saturated at some points by personal traffic bursts). That being said, I expect the 100mbit pipe to be idle 90% of the time, so it doesn't seem ideal to just set a low BandwidthRate. The documentation [1] for relay bandwidth shaping options points to a script to de-prioritize Tor traffic to ensure that personal traffic takes precedence. However, the script no longer exists within Tor source code. [2] Is this script now deprecated? If not, where can I find it? If so, what alternative methods might exist to de-prioritize Tor traffic during bursts from personal traffic pipes on Linux or BSD systems? Thanks all! -- Links [1] https://support.torproject.org/operators/bandwidth-shaping/ [2] https://gitweb.torproject.org/tor.git/tree/contrib/operator-tools/linux-tor…

3 2

new installation of an established TOR relay
by RJ Hofmann 28 Dec '20

28 Dec '20

Hello there, caused by a temporary failure of the raspberry I had to completely renew installation of my TOR relay nicknamed mosaik. The new installtion is already up and running, but since I had no copies of keys and fingerprints the new relay is completely new in terms of consensus weight etc.. I wonder if it is helpful in any way to inform you about this change as to accelerate the relay’s „reputation“ to make it fully functional for the community on the fast track. Anyway the relay will work its way up to its former capabilities. The old relay named „mosaik“ (see screenshot) is no longer existing, the new one is now called „kitchenaid“ (see screenshot) and active at its former speed. with best wishes RJH ______________________________ ______________________________

3 2

Re: [tor-relays] new installation of an established TOR relay (RJ Hofmann)
by Wilton Gorske 28 Dec '20

28 Dec '20

Hey RJH, Yep. This has happened to me with my Raspberry Pi too (nickname: mutualaid). Be sure you make a copy somewhere safe of kitchenaid's keys found in /var/lib/tor/keys to pick up where you left off next time. Given the network's extra capacity, I doubt core developers and the community will focus on finding a way to fasttrack a relay's reputation, let alone backing up the private keys in a secure way. It's up to relay operators to create copies of their keys. Alternatively, you can also just do period backups of the entire SD card for the Raspberry Pi relay. Either way, thanks for running one. In solidarity, Wilton tor-relays-request(a)lists.torproject.org: > Message: 2 > Date: Sun, 27 Dec 2020 13:50:03 +0100 > From: RJ Hofmann<cepa(a)weltzustand.de> > To:tor-relays@lists.torproject.org > Subject: [tor-relays] new installation of an established TOR relay > Message-ID:<04381F44-8483-4ACE-8928-6E008FB885B5(a)weltzustand.de> > Content-Type: text/plain; charset="utf-8" > > Hello there, > > caused by a temporary failure of the raspberry I had to completely renew installation of my TOR relay nicknamed mosaik. > > The new installtion is already up and running, but since I had no copies of keys and fingerprints the new relay is completely new in terms of consensus weight etc.. > > I wonder if it is helpful in any way to inform you about this change as to accelerate the relay?s ?reputation? to make it fully functional for the community on the fast track. > > Anyway the relay will work its way up to its former capabilities. > > The old relay named ?mosaik? (see screenshot) is no longer existing, the new one is now called ?kitchenaid? (see screenshot) and active at its former speed. > > with best wishes > RJH > >

1 0

Re: [tor-relays] Help with new relay
by lists＠for-privacy.net 22 Dec '20

22 Dec '20

On 21.12.2020 08:31, Thomas wrote: > It works fine when I run it as sudo, but according to its output, it > "isn't a good idea, nor should it be necessary." So my first question > is: How do I go about getting Nyx to connect to Tor's control socket > as a standard, non-sudo process? That will be FAQ in this list ;-) You have to add yourself to the Tor user 'debian-tor' group. (_tor-00, _tor-01,... if you set up several instances. see below) adduser user_name group_name or usermod -aG user_name group_name usermod -aG debian-tor user > My second question revolves around running the Tor daemon as a > service. It seems as if, again, I need to run it as root to make it > work, otherwise it gives me permission denied errors. What I want is > to be able to run 2 consecutive nodes on different accounts; that way > I can be more safe and secure while running my relay. If that's able > to happen, how would I go about configuring my relay daemons to be > separate, i.e. where would I put my torrc? Create 2 or more Tor instances: ~$ apt install tor-instances installs a helper script on a Debian or Ubuntu system. On other distributions you have to do all of this by hand what this script does! ~$ systemctl stop tor ~$ tor-instance-create 00 ~$ tor-instance-create 01 ~$ ... ~$ systemctl enable tor@00 ~$ systemctl enable tor@01 ~$ ... ~$ systemctl mask tor@default ~$ nano /etc/tor/instances/00/torrc ~$ nano /etc/tor/instances/01/torrc ~$ ... ~$ systemctl start tor@00 ~$ systemctl start tor@01 ... To see if the tor daemon is running: systemctl status _tor@00 systemctl status _tor@01 or '~$ journalctl -xe' to see if everything is ok I wrote it a little more in detail in the PIVX forum. Ignore the PIVX stuff: https://forum.pivx.org/threads/howto-setup-masternode-or-staker-wallet-behi… -- ╰_╯ Ciao Marco! Debian GNU/Linux It's free software and it gives you freedom!

1 0

Re: [tor-relays] Question: RAM requirement for an exit relay
by BRBfGWMz 21 Dec '20

21 Dec '20

Olaf is right Get a $ 5 per month VPS On Wed, Dec 16, 2020 at 08:28 AM, Olaf Grimm <jeep665(a)posteo.de> wrote: > Hello Amadeus! > > When you talk about a RasPi, I assume you mean a home location. > Please read the recommendations. Never operate an Exit Relay at home! > It will be expensive if the wrong people knock on the door. > > By the way, for an Exit Relay the bandwidth should already be 10MBit/s > or better. > > Olaf > > Am 15.12.20 um 01:44 schrieb Amadeus Ramazotti: > > hey, > > partly related to original question: > > I'm planning to set up a new exit. My very first relay. I'm planning to > use a small SoC with 2GB ram. Something running on ARM like a raspberry pi. > > > > Is this feasible or even a good idea? > > > > Regards > > > > > > On 14 Dec 2020, at 15:10, torix(a)protonmail.com wrote: > > > > I have several 1 G RAM exits running unbound without a problem. They never > seem to hit swap, either. On FreeBSD: > > last pid: 83973; load averages: 0.86, 0.71, 0.62 up 130+15:44:28 16:02:04 > > 23 processes: 2 running, 21 sleeping > > CPU: 43.1% user, 0.0% nice, 2.7% system, 5.5% interrupt, 48.6% idle > > Mem: 101M Active, 734M Inact, 444M Wired, 151M Buf, 210M Free > > Swap: 512M Total, 512M Free > > > > Go for it, > > > > \--Torix > > > > > > Original Message > >> On Monday, December 14, 2020 1:11 PM, <lists(a)for-privacy.net> wrote: > >> > >>> On 14.12.2020 13:58, lists(a)for-privacy.net wrote: > >>> > >>> grep VmPeak/proc/$PID/status = 181836 kB > >> A non exit has less: > >> grep VmPeak/proc/$PID/status = 57336 kB > >> tor-proxy-02.for-privacy.net ^^ > >> > >> > \----------------------------------------------------------------------------------------------- > >> > >> p_o Ciao Marco! > >> > >> Debian GNU/Linux > >> > >> It's free software and it gives you freedom! > >> > >> tor-relays mailing list > >> tor-relays(a)lists.torproject.org > >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > > _______________________________________________ > > tor-relays mailing list > > tor-relays(a)lists.torproject.org > > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > _______________________________________________ > > tor-relays mailing list > > tor-relays(a)lists.torproject.org > > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > \-- Sent using MsgSafe.io's Free Plan Private, encrypted, online communication For everyone. https://www.msgsafe.io

4 4

Help with new relay
by Thomas 21 Dec '20

21 Dec '20

Hi all! I'm a fairly new relay operator and I have a few questions regarding some of the nitty-gritty setup on Debian. I've set it up a couple times before, but I can't seem to be able to run my relay as non-root. Every time I boot up Nyx without using sudo, it says We were unable to read tor's authentication cookie... Path: /run/tor/control.authcookie Issue: Authentication failed: unable to read '/run/tor/control.authcookie' ([Errno 13] Permission denied: '/run/tor/control.authcookie') It works fine when I run it as sudo, but according to its output, it "isn't a good idea, nor should it be necessary." So my first question is: How do I go about getting Nyx to connect to Tor's control socket as a standard, non-sudo process? My second question revolves around running the Tor daemon as a service. It seems as if, again, I need to run it as root to make it work, otherwise it gives me permission denied errors. What I want is to be able to run 2 consecutive nodes on different accounts; that way I can be more safe and secure while running my relay. If that's able to happen, how would I go about configuring my relay daemons to be separate, i.e. where would I put my torrc? Any help would be much appreciated. Thanks! Thomas

1 0

Well, that escalated quickly
by enrollado 17 Dec '20

17 Dec '20

Hello all. I started an exit relay on Saturday. Last night I took a look at the log and I saw something like 30 active circuits at the heartbeat and the relay had passed a few tens of megabytes. I just logged in and saw 8,000 active circuits at the heartbeat and > 2 GB passed. Is it normal for an exit relay to suddenly ramp up like that? Just curious. Sent with ProtonMail Secure Email.

4 3

Authorithy clock skew in consensus health page
by torjoy 16 Dec '20

16 Dec '20

Hi all, Its just a curiosity question... What is the reference source used in comparsions of authorities clock skew in consensus health? Are they synced throught NTP daemons (like chrony or opentpd for example)? TOR can take advange of very accurate timing in the authorities and relays? I know that just few seconds (or miliseconds?) are fine of clock offset. And if the relay's clock has some fluctuation of hundreds of miliseconds? For example going from -100mS of offset to +300mS offset and them to -200 mS offset... I mean, too much clock noise can be a problem for TOR? Best regards, Luiz Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 2

Re: [tor-relays] I created a way of running tor relays on Windows easier
by Keifer Bly 16 Dec '20

16 Dec '20

Here it is, thank you. https://github.com/thecomputermaster/TorWrapperWindows/blob/main/WindowsTor… --Keifer On Wed, Dec 16, 2020 at 8:39 AM Gisle Vanem <gisle.vanem(a)gmail.com> wrote: > > This is a project I have been working on which allows users to run > relays on Windows with ease. Made this for > > volunteers who want to run relays, but only have Windows. See here > > > > https://www.youtube.com/watch?v=Vpk6yvUWQqU > > The link to GoogleDrive cannot be accessed; > " ... in violation of Google's blah-blah .." > > Do you have a Release on Github instead? > > -- > --gv >

1 0

I created a way of running tor relays on Windows easier
by Keifer Bly 16 Dec '20

16 Dec '20

1 0

Question: RAM requirement for an exit relay
by Olaf Grimm 15 Dec '20

15 Dec '20

Hello! I would like to activate a local DNS resolver with unbound at the exit relays, but I am concerned about the RAM size with 1GB. On an example machine I have 2GB RAM and the exit relay occupies 400MB at 22.9 MiB/s according to the metrics. Does anyone have experience with such values? My smaller exit relays only have 1GB of RAM. Well, there is still the problem that simply trying it out is not possible. If I overrun the RAM and it comes to SWAP activities, then already on a local machine almost no access was possible. With a VPS this is a no-go. Kind regards! Olaf

8 11

No port IPv4 80 so not an called exit even when 443 open wide.
by Dr Gerard Bulger 14 Dec '20

14 Dec '20

It is now out of date that Tor servers are required to have port 80 IPv4 open, even if limited to a single Class A network in order that the relay can be labelled as an exit. Port 443 should be enough. For reasons I do not understand, if I open port IPv4 80 to a wider range I get abuse notices within a day, usually DMCA, as if some man in the middle is scanning the html! So far, wide open IPv6 port 80 attracts zero attention from those alleging abuse. http://example.com called as an IPv4 address cannot be reached by my tor exits as port 80 IPv4 too limited. Port 443 IPv4 and IPv6 on my exits are wide open to all, and we should all be on https anyway. https://example.com can be reached from my exits. Example.com does have an IPv6 address so in theory can be reached from my exits on port 80 as IPv6 port 80 is wide open I assume not used as the DNS requested for example.com gives IPv4 address. Can an Exits now be defined as an exit with port 443 open IPv4? And then tested that is an exit with https requests not http. Gerry Bulger

2 2

Re: [tor-relays] reporting Abusive exit nodes
by BRBfGWMz 13 Dec '20

13 Dec '20

It's great. Great content here too: https://wiki.archlinux.org/index.php/Tor Where do you put the configuration file when running a network from real-time distro (tails) that does not allow /etc/tor/torrc modification? On Wed, Dec 9, 2020 at 07:56 PM, lists(a)for-privacy.net <lists(a)for-privacy.net> wrote: > On 04.12.2020 05:21, BRBfGWMz wrote: > > I frequently find abusive exit nodes. Is there any way to report these > > to the > > tor consensus system, so it deprioritizes them? > You can also post here or in tor talk. bad-relays is a closed list. :-( > > > Or can I build a configuration file or list of exit nodes that I don't > > want in > > my chain? > > Of course: > > ## A list of identity fingerprints and country codes of nodes to use for the > first hop in your normal circuits. (nuts, NO address patterns!? > EntryNodes $fingerprint,{cc} > ## A list of identity fingerprints, country codes, and address patterns of > nodes to use as exit node. > ExitNodes $fingerprint,{cc},203.0.113.0/24,[2001:DB8::] > ## A list of identity fingerprints, country codes, and address patterns of > nodes to avoid when building a circuit. > ExcludeNodes $fingerprint,{cc},203.0.113.0/24,[2001:DB8::] > ## A list of identity fingerprints, country codes, and address patterns of > nodes to never use when picking an exit node. Nodes listed in ExcludeNodes > are automatically in this list. > ExcludeExitNodes $fingerprint,{cc},203.0.113.0/24,[2001:DB8::] > > ## A list of identity fingerprints, nicknames, country codes, and address > patterns of nodes that are allowed to be used as the second hop in all > client or service-side Onion Service circuits. > HSLayer2Nodes > ## A list of identity fingerprints, nicknames, country codes, and address > patterns of nodes that are allowed to be used as the third hop in all client > and service-side Onion Service circuits. > HSLayer3Nodes > > I don't have set StrictNodes 1. Please read the man page beforehand! > > Ncknames are unfortunately no longer allowed everywhere. I do not use > country codes the database has some errors. > > Soon you can use multiple lines: > > https://github.com/torproject/tor/pull/2066/commits/bb9707420e87a1efc016aea… > > \-- > p_o Ciao Marco! > > Debian GNU/Linux > > It's free software and it gives you freedom! > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > \-- Sent using MsgSafe.io's Free Plan Private, encrypted, online communication For everyone. https://www.msgsafe.io

3 2

My app which makes running tor relays on Windows Very Simple
by Keifer Bly 12 Dec '20

12 Dec '20

Hi all, So this is a software peice I have been developing which makes running tor relays on Windows very easy. All the user needs to do is write their torrc. The app installs tor, and configures all once the torrc is written by itself. Here is a video showing the app: Features Automatic Tor download and installation (via Choclatey) Type the torrc file, and the app configures and points tor there for you. Attempted automatic firewall configuration. Automatic creation of log file. Cons: Currently only directly support vanilla bridges. OBFS4 will have to be manually downloaded / configured. ATTEMPTED firewall auto configuration. It auto adds a rule to Windows Defender Firewall to allow the traffic, but can't configure router firewalls, etc. Let know what you think. I have successfully gotten tor up and running through this. If chocolatey changes their install scripts, this will need to be updated. I can send the source code if interested. Programming Language: C#/.Net Tor Windows App.mp4 <https://drive.google.com/file/d/1ZJ4EKXbu2Clyzc5WdNdxSWquswhdvSTJ/view?usp=…> --Keifer

1 0

reporting Abusive exit nodes
by BRBfGWMz 09 Dec '20

09 Dec '20

I frequently find abusive exit nodes. Is there any way to report these to the tor consensus system, so it deprioritizes them? Or can I build a configuration file or list of exit nodes that I don't want in my chain? \-- Sent using MsgSafe.io's Free Plan Private, encrypted, online communication For everyone. https://www.msgsafe.io

3 2

Shutdown of my exit relay
by Sarah Harvey 05 Dec '20

05 Dec '20

Hi folks, Through an error on my part, my exit relay got taken down (as12876.tor.shh.sh with fingerprint D7082DB97E7F0481CBF4B88CA5F5683399E196A3). I'm in the process of getting a replacement, but the fingerprint and IP will change as a result, and of course it will take time for it to regain consensus in the network. I believe I had also asked for it to be added to the fallback directory list since at the time it was high-traffic and stable. In this case I recommend removing it from this list until I can find a suitable replacement. Many apologies, -Sarah

1 0

Update on New Australian Law Against Domestic Hosts
by Christian Heinrich 03 Dec '20

03 Dec '20

https://www.smh.com.au/politics/federal/takeover-accounts-federal-police-to… -- Regards, Christian Heinrich http://cmlh.id.au/contact

1 0

Fwd: Thailand block
by BRBfGWMz 28 Nov '20

28 Nov '20

What provider do you use? How much does it cost? \---------- Forwarded message ---------- From: Dr Gerard Bulger <gerard(a)bulger.co.uk> Date: On Tue, Nov 24, 2020 at 08:29 AM Subject: [tor-relays] Thailand block To: BRBfGWMz <brbfgwmz(a)concealed.company> I have been running an exit (mythaicontribution) in Thailand for 3 Years (the exit has narrow port 80 range but full 443 and all other less risky ports open. It has never been that busy as an exit, unlike my other UK and USA exits of similar profile. I noticed it was off line last week. The ISP was slow to work out what was going on, to discover that the upstream ISP has blocked the IP “due to DOS attack” I think that is unlikely for such a long block, and assume the hand of MICT. I gather the do not give reasons. (https://en.wikipedia.org/wiki/Internet_censorship_in_Thailand) In some ways surprising it took them so long. Is there a way on Tor’s web pages and data base to look at historical data. I am curious to know when it off line and removed from Tor metrics. Gerry \-- Sent using MsgSafe.io's Free Plan Private, encrypted, online communication For everyone. https://www.msgsafe.io

2 1

Call for Testing - New Feature: Relay IPv6 Address Discovery
by David Goulet 28 Nov '20

28 Nov '20

Greetings everyone! We've very recently merged upstream (tor.git) full IPv6 supports which implies many many things. We are still finalizing the work but most of it is in at the moment. This is a call for help if anyone would like to test either git master[1] or nightly builds[2] (only Debian) to test for us a specific feature. The feature we would love for some of you to test is the IPv6 address discovery. In short, with this new feature, specifying an ORPort without an address will automatically bind tor to [::]:<port> and attempt to find the IPv6 address by looking at (in this order): 1. "Address" from torrc 2. "ORPort address:port" from torrc 3. Interface address. First public IPv6 is used. 4. Local hostname, DNS AAAA query. If all fails, the relay will simply never publish an IPv6 in the descriptor but it will work properly with the IPv4 (still mandatory). The other new thing is that now tor supports *two* "Address" statement which can be a hostname or IPv4 or IPv6 now. Thus this is now valid: Address 1.2.3.4 Address [4242::4242] ORPort 9001 Your Tor will bind to 0.0.0.0:9001 and [::]:9001 but will publish the 1.2.3.4 for the IPv4 address and [4242::4242] for IPv6 in the descriptor that is the address to use to reach your relay's ORPort. Now, if you happen to have this configuration which I believe might be common at the moment: ORPort 9001 ORPort [4242::4242]:9001 The second ORPort which specifies an IPv6 address will supersede the "ORPort 9001" which uses [::] and thus you will bind on 0.0.0.0:9001 and [4242::4242]:9001. You should get a notice log about this. Thus the recommended configuration to avoid that log notice would be to bind to specific addresses per family: ORPort <IPv4>:9001 ORPort <IPv6>:9001 And of course, if you want your relay to _not_ listen on IPv6: ORPort 9001 IPv4Only In your notice log, you will see which address is used to bind on the ORPort and then you will see the reachability test succeed or not on the address that tor either used from the configuration or auto discovered that is the address you are supposedly reachable from. Man page has NOT been updated yet, it will arrive once we stabilize the IPv6 feature and everything around it. Please, do report (on this thread) _anything_ even slightly annoying about this like logging or lack of logging and so on. This is a complex feature and errors can be made thus any testing you can offer is extremely appreciated. Thanks!! David [1] https://gitweb.torproject.org/tor.git/ [2] https://2019.www.torproject.org/docs/debian.html.en -- EeJVrrC/dHQXEXYB1ShOOZ4QuQ8PMnRY2XGq4BYsFq4=

8 12

Thailand block
by Dr Gerard Bulger 24 Nov '20

24 Nov '20

I have been running an exit (mythaicontribution) in Thailand for 3 Years (the exit has narrow port 80 range but full 443 and all other less risky ports open. It has never been that busy as an exit, unlike my other UK and USA exits of similar profile. I noticed it was off line last week. The ISP was slow to work out what was going on, to discover that the upstream ISP has blocked the IP "due to DOS attack" I think that is unlikely for such a long block, and assume the hand of MICT. I gather the do not give reasons. (https://en.wikipedia.org/wiki/Internet_censorship_in_Thailand) In some ways surprising it took them so long. Is there a way on Tor's web pages and data base to look at historical data. I am curious to know when it off line and removed from Tor metrics. Gerry

3 3

Fwd: Re: Bridges under DDoS
by William Kane 23 Nov '20

23 Nov '20

Forwarding to mailing list since OP has replied to my e-mail address, and not the list. ---------- Forwarded message ---------- From: William Kane <ttallink(a)googlemail.com> Date: Mon, 23 Nov 2020 16:07:39 +0000 Subject: Re: Re: [tor-relays] Bridges under DDoS To: BRBfGWMz <brbfgwmz(a)concealed.company> Dear BRBfGWMz, you can use this script I made a while ago - please read the entire message carefully or you risk locking yourself out of the system. Here you go: #!/bin/bash IPTABLES="/usr/sbin/iptables" # Flush all old rules and tables. $IPTABLES -F $IPTABLES -X $IPTABLES -t nat -F $IPTABLES -t nat -X # Establish default policies. $IPTABLES -P INPUT DROP $IPTABLES -P FORWARD DROP $IPTABLES -P OUTPUT ACCEPT # Unconditionally allow local traffic. $IPTABLES -A INPUT -i lo -j ACCEPT # Allow already established connections. $IPTABLES -A INPUT -i <NETWORK_INTERFACE> -m state --state ESTABLISHED -j ACCEPT # Allow Tor ORPort traffic. $IPTABLES -A INPUT -i <NETWORK_INTERFACE> -p tcp --dport <YOUR_ORPORT> -j ACCEPT Note that this is for a normal Tor relay, not a bridge - for a bridge, just opening the inbound obfs4proxy port is enough, though. You will have to make adjustments, namely specifying the name of your public network interface ("ip addr" or "ifconfig", either one will work on modern distributions). Make sure to also open the port sshd, your SSH daemon, bound to or you will be locked out from the system after executing the script (!). If you are on Arch Linux, you can save the script to /etc/iptables/iptables.rules (execute the script and then run "iptables-save > /etc/iptables/iptables.rules", after that the only thing left to do is to enable the according systemd service unit to automatically load the rules on boot ("systemctl enable iptables"). If on Debian, you can specify a script to run as soon as your public network interface reaches the "up" state, directly in your network configuration. Note that this will just drop unknown incoming connections (ICMP traffic as well, so you won't be able to ping your server anymore), usually the best measure, you could also configure it to reject unknown TCP packets but this will generate additional outbound traffic (which is what an attacker might want). Please also note that if you are running a IPv6 enabled relay, you will have to use ip6tables instead of iptables - you will also have to allow all incoming ICMPv6 traffic through ip6tables, with plain IPv4 you don't really need to allow ICMP packets, with IPv6, it's absolutely required. Hope I helped, never be afraid to ask questions, I am here to help. 2020-11-22 21:12 GMT, BRBfGWMz <brbfgwmz(a)concealed.company>: > Are the locations for the relays that are set up during the process of > setting > up relays for a single machine truely random (or pseudorandom), or is there > any dependence on the ip/location of my desktop? > > On Tue, Nov 17, 2020 at 08:48 AM, William Kane <ttallink(a)googlemail.com> > wrote: > >> If your server is not responding, no harm done (likely already done if > >> you have iptables set up to drop unknown (established flag not set) > >> incoming traffic.). > >> > >> If it's somehow maxing out your connection speed, then time to talk to > >> your upstream provider / hosting company - very likely they already > >> have anti dos equipment on their network, and many would just re-route > >> a customer through it until the attack stops, but it might cost you > >> some money. > >> > >> 2020-11-13 17:03 GMT, Jonas <jonasdietrich(a)ctemplar.com>: > >> > According to packetflow traces, roughly 26,000 unique IPv4 from 85 >> countries > >> > executing a SYN flood attack on TCP/9001. None of my bridges have 9001 >> open > >> > nor respond to this port. The attacks continue to this day. > >> > > >> > Danke. > >> > > >> > Jonas > >> > _______________________________________________ > >> > tor-relays mailing list > >> > tor-relays(a)lists.torproject.org > >> > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > >> > > >> _______________________________________________ > >> tor-relays mailing list > >> tor-relays(a)lists.torproject.org > >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > >> > > \-- Sent using MsgSafe.io's Free Plan Private, encrypted, online > communication > For everyone. https://www.msgsafe.io > > >

1 0

Bridges under DDoS
by Jonas 14 Nov '20

14 Nov '20

Grüezi, Over the past seven days, all of my bridges are under DDoS attack. Other servers hosted with adjacent IP addresses are not under attack. Any one else seeing such attacks lately? Curious that all of my bridges are under attack, meaning someone altogether knows they exist. Thanks.

4 4