- tor-relays - lists.torproject.org

Re: [tor-relays] tor-relays Digest, Vol 118, Issue 16
by Mark Murray 14 Nov '20

14 Nov '20

I've been getting emails from OVH about "Detection of an attack" on my relays, it happened very occasionally but has been a bit more frequent recently. Anything I could/should do? Also is my first time replying to a mailing list ever, hopefully I replied to the right address? On 13/11/2020 12:00, tor-relays-request(a)lists.torproject.org wrote: > Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > > > Today's Topics: > > 1. Re: So my relay is apparently being attacked (Will Shackleton) > 2. Re: So my relay is apparently being attacked (Keifer Bly) > 3. Re: So my relay is apparently being attacked (Anders Burmeister) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 12 Nov 2020 19:16:25 +0000 > From: "Will Shackleton" <w.shackleton(a)gmail.com> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] So my relay is apparently being attacked > Message-ID: <3c5ee106-6233-4086-bd35-a445e8e6383e(a)www.fastmail.com> > Content-Type: text/plain > > My non-exit relays are being DDoS'ed too - I've received similar emails from my hosting provider. > > https://metrics.torproject.org/rs.html#search/family:B42C797CC8CD63C60FB643… > > -Will > > On Thu, 12 Nov 2020, at 7:09 PM, Roman Mamedov wrote: >> On Thu, 12 Nov 2020 10:52:47 -0800 >> Keifer Bly <keifer.bly(a)gmail.com> wrote: >> >>> I am wondering, are relays being ddosed a normal thing? Thank you. >>> --Keifer >> DDoS'ing opponents in an argument is common on some IRC networks, so it could >> have to do with the IRC exiting that you allow. >> >> I don't remember relays on their own getting DDoS'ed in years, but could >> remember a couple of cases of DDoS which could be correlated to IRC >> discussions I participated in right prior to that. >> >> -- >> With respect, >> Roman >> _______________________________________________ >> tor-relays mailing list >> tor-relays(a)lists.torproject.org >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >> > > ------------------------------ > > Message: 2 > Date: Thu, 12 Nov 2020 17:26:49 -0800 > From: Keifer Bly <keifer.bly(a)gmail.com> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] So my relay is apparently being attacked > Message-ID: > <CADqUGAO5udgNs6TF=McZemdRBLYVCXodcsi5RW0-PpbjZhXXnw(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Thanks all. > --Keifer > > > On Thu, Nov 12, 2020 at 11:56 AM Will Shackleton <w.shackleton(a)gmail.com> > wrote: > >> My non-exit relays are being DDoS'ed too - I've received similar emails >> from my hosting provider. >> >> >> https://metrics.torproject.org/rs.html#search/family:B42C797CC8CD63C60FB643… >> >> -Will >> >> On Thu, 12 Nov 2020, at 7:09 PM, Roman Mamedov wrote: >>> On Thu, 12 Nov 2020 10:52:47 -0800 >>> Keifer Bly <keifer.bly(a)gmail.com> wrote: >>> >>>> I am wondering, are relays being ddosed a normal thing? Thank you. >>>> --Keifer >>> DDoS'ing opponents in an argument is common on some IRC networks, so it >> could >>> have to do with the IRC exiting that you allow. >>> >>> I don't remember relays on their own getting DDoS'ed in years, but could >>> remember a couple of cases of DDoS which could be correlated to IRC >>> discussions I participated in right prior to that. >>> >>> -- >>> With respect, >>> Roman >>> _______________________________________________ >>> tor-relays mailing list >>> tor-relays(a)lists.torproject.org >>> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >>> >> _______________________________________________ >> tor-relays mailing list >> tor-relays(a)lists.torproject.org >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >> >

1 0

So my relay is apparently being attacked
by Keifer Bly 13 Nov '20

13 Nov '20

Hi, So twice this week I've gotten this email from OVH: Dear Customer, We have just detected an attack on IP address 51.68.197.220. In order to protect your infrastructure, we vacuumed up your traffic onto our mitigation infrastructure. The entire attack will thus be filtered by our infrastructure, and only legitimate traffic will reach your servers. At the end of the attack, your infrastructure will be immediately withdrawn from the mitigation. For more information on the OVH mitigation infrastructure: http://www.ovh.com/world/anti-ddos/ Regarding the relay at https://metrics.torproject.org/rs.html#details/79E3B585803DE805CCBC00C1EF36… I am wondering, are relays being ddosed a normal thing? Thank you. --Keifer

6 7

Re: [tor-relays] Bridges under DDoS
by rush23＠gmx.net 13 Nov '20

13 Nov '20

1 0

Cheap Servers? There MUST be a catch
by Dr Gerard Bulger 11 Nov '20

11 Nov '20

Worried about dominance of OVH for relays and exits? How about Google! Setting up a fast server is SO cheap on their https://cloud.google.com/ platform, it is tempting to set up relays, if not exits there. Looking at their T&Cs they do not seem to mention TOR or banning running a proxy, but a generic list of don't do bad things. I have two ubuntu servers doing running other programmes on there now, and so far cost me $0.78 with fixed IP4 addresses. I have not worked out how to attach IPv6 yet. Of course set DNS of the machines not to be Google's So tell me why this is such a bad idea. Gerry

6 5

A way to reduce spam and brute attacks...
by rush23＠gmx.net 10 Nov '20

10 Nov '20

Hello guys, is there any way to stop or if not reduce the spam, brute force attacks that are leaving my exit? Well port blocking or destination IP blocking is one way but without any relevant information except this hard, right? => https://cleantalk.org/blacklists/51.15.80.14 Stopped my exit for about 2-3 weeks awaiting lower number of complaints but nothing changed. In the end I have to migrate from exit to relay unfortunately. Regards Torproxy

2 1

Re: [tor-relays] Cheap Servers? There MUST be a catch
by BRBfGWMz 10 Nov '20

10 Nov '20

They allow you to do that with the free credits? On Mon, Nov 9, 2020 at 07:37 PM, niftybunny <abuse-contact@to-surf-and- protect.net> wrote: > I cant find any prices on the website. What do you get for under a dollar?On 8. Nov 2020, at 23:21, Dr Gerard Bulger &lt;gerard(a)bulger.co.uk&gt; wrote:Worried about dominance of OVH for relays and exits? How about Google! Setting up a fast server is SO cheap on their https://cloud.google.com/ platform, it is tempting to set up relays, if not exits there. Looking at their T&amp;Cs they do not seem to mention TOR or banning running a proxy, but a generic list of don’t do bad things. I have two ubuntu servers doing running other programmes on there now, and so far cost me $0.78 with fixed IP4 addresses. I have not worked out how to attach IPv6 yet. Of course set DNS of the machines not to be Google’s So tell me why this is such a bad idea… Gerry _______________________________________________tor-relays mailing listtor- relays@lists.torproject.orghttps://lists.torproject.org/cgi- bin/mailman/listinfo/tor-relays \-- Sent using MsgSafe.io's Free Plan Private, encrypted, online communication For everyone. https://www.msgsafe.io

1 0

Possible compression bomb, abandoning stream message received
by Keifer Bly 08 Nov '20

08 Nov '20

3 3

Abuse received for middle node (part of the curent problem)
by Olaf Grimm 08 Nov '20

08 Nov '20

I have just received two abuse messages from ISP Scaleway Elements for two of my middle nodes. Until now I thought this was not possible. No problem for me. Only here for your information. Olaf

5 4

Can't update tor relay on Debian, and notice about tor log file
by Keifer Bly 04 Nov '20

04 Nov '20

2 2

Questions About The Traffic Of My Tor Relay
by h.c2233 04 Nov '20

04 Nov '20

I am wandering why my middle relay download much more trafic than upload. It downloads 8 times more than upload, which is quite unreasonable. What's more, the net work speed is always lower than 1KB/s, while my bandwidth is 1GB/s. I just can't find out what's going wrong.

2 1

Log warning : possible (zlib) compression bomb on middle relays
by Guinness 04 Nov '20

04 Nov '20

Hi all, We are at least 3 users running middle relays from 0.4.4.5 and after having some logs like those : ``` Nov 02 05:30:55.000 [warn] Possible compression bomb; abandoning stream. Nov 02 05:30:55.000 [warn] Possible zlib bomb; abandoning stream. Nov 02 05:30:56.000 [warn] Possible compression bomb; abandoning stream. Nov 02 05:31:00.000 [warn] Possible compression bomb; abandoning stream. Nov 02 05:31:00.000 [warn] Possible compression bomb; abandoning stream. Nov 02 05:31:00.000 [warn] Possible compression bomb; abandoning stream. Nov 02 05:31:55.000 [warn] Possible compression bomb; abandoning stream. Nov 02 05:31:56.000 [warn] Possible compression bomb; abandoning stream. ``` I'm wondering if this is an attack or a new feature (haven't checked yet) but I'd like to know how many users are impacted. The interesting informations are : * Number of warnings * What kind of relay it is (middle, exit, entry) After your answers, I'll complete the issue I have opened on the bug tracker. Cheers, -- Guinness

12 11

253 new exits - up and down
by Corl3ss 03 Nov '20

03 Nov '20

Hi, today 253 new exit nodes joined the network : https://onionoo.torproject.org/summary?search=apokaliz It was active for 12 hours and then down. It is enough odd to report it here. If you have any information about it, it will be a pleasure to read it. Corl3ss

3 2

Re: [tor-relays] Log warning : possible (zlib) compression bomb on middle relays
by trooned 03 Nov '20

03 Nov '20

I see the same warnings on my bridge (uptime since last restart about 3 days) as well. Nov 02 04:52:10.000 [warn] Possible compression bomb; abandoning stream. Nov 02 04:52:10.000 [warn] Possible compression bomb; abandoning stream. Nov 02 04:52:10.000 [warn] Possible zlib bomb; abandoning stream. Nov 02 04:53:10.000 [warn] Possible zlib bomb; abandoning stream. Nov 02 04:53:10.000 [warn] Possible zlib bomb; abandoning stream. Nov 02 04:54:10.000 [warn] Possible compression bomb; abandoning stream. Nov 02 04:54:10.000 [warn] Possible compression bomb; abandoning stream. Nov 02 04:55:10.000 [warn] Possible compression bomb; abandoning stream. Regards, TrooNed

1 0

Relays for 5G smartphones
by David Poulsen 01 Nov '20

01 Nov '20

Dear Sirs, I've been experiencing a lot of "weird" traffic to/from the Danish State's welfare and app for corona-virus testing answers! I am using 4G Orbot, RiseUp VPN and Tor Browser, Tor Browser (Alpha), but also with Proton VPN and ordinary browsers like Firefox & Chromium browsers are very unstable. I have gathered a lot of screendumps and logs, and I am sure somebody hat taken over their site, and Duckduckgo redirects all the traffic to these sites where NemID, has to confirm wh you are, when trying to get answers for the corona-test! These sites are: sundhed dot dk coronaprover dot dk There are no problems accessing these sites, with the correct setup of security settings for me! FYI the sundhed dot dk is owned by the Danish Welfare & Heakth system with an app called MinSundhed, which also have weird traffic redirections! Regards David Sent with ProtonMail Secure Email.

1 0

How long does it take for a relay IP to stop being displayed in metrics and web service?
by shsmbcfdfk 01 Nov '20

01 Nov '20

Hi, I setup a non-exit relay on my home network and I have been listed as relay. So now me and my family even if we don't use Tor we are excluded from some online services. Beyond the discussion of whether the owners of these services understand Tor or not, it's a problem that the address is added to public lists, especially for non-exit relays. I completely shut down the relay several hours ago but my IP is still listed. My question is how long does it take for a relay to disappear ? Thanks,

5 4

Re: [tor-relays] Snowflakes
by entensaison＠use.startmail.com 01 Nov '20

01 Nov '20

Hi Toralf and Gus, Thanks for your replies! On Wednesday, October 28, 2020 at 4:11 PM, Toralf Förster <toralf.foerster(a)gmx.de> wrote: > On 10/26/20 5:32 PM, entensaison(a)use.startmail.com wrote: >> Hi everybody, >> I'm not sure this is the right list to ask, but is it useful to run >> snowflake proxies? > I'd say yes. > > FWIW I do run it as a ordinary Linux service (git clone + go build) > instead as a plugin in my browser here under Gentoo Linux at my > desktop. > So the proxy runs even if I close the browser. > > FWIW the plugin tells me : > > Number of users your Snowflake has helped circumvent censorship in > the > last 24 hours: 5 > > :-) > > -- > Toralf > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

How to manually change overloaded Guard?
by petrarca＠protonmail.ch 31 Oct '20

31 Oct '20

Since tonight I can't get any usable Tor connections anymore; restarting Tor gives the following error message: Guard TOR2DFNrelB ($0ED0EA324C931CF41CB5272BFB1D015B3D5772A9) is failing more circuits than usual. Most likely this means the Tor network is overloaded. Success counts are 152/217. Use counts are 45/59. 167 circuits completed, 13 were unusable, 2 collapsed, and 51 timed out. For reference, your timeout cutoff is 60 seconds. Any idea how to change the Guard - just restarting Tor doesn't help?

2 1

Snowflakes
by entensaison＠use.startmail.com 29 Oct '20

29 Oct '20

Hi everybody, I'm not sure this is the right list to ask, but is it useful to run snowflake proxies? I only recently realized they can be run by ordinary people. On the new website I don't see how you would find that out, there doesn't seem to be any link pointing to them. Metrics only shows a hundred snowflake users. What is the reason they are not advertised for? (towards humans) Have a nice day!

3 2

Re: [tor-relays] Fw: Can't update tor relay on Debian, and notice about tor log file
by Keifer Bly 28 Oct '20

28 Oct '20

Torix, I just tried your workaround, the issue still occurs. Thank you. --Keifer On Tue, Oct 27, 2020 at 1:58 PM <torix(a)protonmail.com> wrote: > Dear Keifer, > > Just guessing here, but have you tried reverting your sources.list to http? > > As for the notices and notices.1, this seems like normal linux log > rotation. See if you don't have an /etc/logrotate.d/tor file that gives > the structure of how the tor log is handled. Mine is set to rotate to a > new file daily, so notices.log is renamed to notices.log.1, and the new log > is notices.log. Notices.log.1 is zipped up to notices.2.tgz, and so on, and > the last 5 days of files are kept before being deleted. > > --Torix > > > Sent with ProtonMail <https://protonmail.com> Secure Email. > > ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ > On Tuesday, October 27, 2020 8:30 PM, Keifer Bly <keifer.bly(a)gmail.com> > wrote: > > Hi all, so for my bridge at > > > https://metrics.torproject.org/rs.html#details/EF36AE38C162E96E0645E1DF25EF… > > > > I am some reason unable to update tor and obfs4 to the newest version. Upon running sudo apt update && sudo apt install -y --only-upgrade tor > > > > I am getting an error saying that updating from such a resprrtory can’t be > done securely and is therefor disabled by default. I have the following > entered in Debian file /etc/apt/sources.list: > > > > > > deb https://deb.torproject.org/torproject.org focal main > deb-src https://deb.torproject.org/torproject.org focal main > > > > So am not sure why it thinks this is insecure. > > > > Another thing I noticed, it seems that for some reason, for the tor > traffic log file, it switches from writing to notices.log to notices.log.1 > automatically after a while, this happened on both my bridge and my relay > though I did not tell it to do this. > > > > I wonder why the update error is happening, thank you. > > >

1 0

recently saw 4 tor relays in row on tails. bug in tor?
by BRBfGWMz 26 Oct '20

26 Oct '20

I recently saw a series of 4 relays connected to each other: itomori, MediumSlesmn, hotbrownie, pellidos itomori, docto, Geheimschreiber, 420isGay Dont most relays in the network of length 3? Bug in tor? \-- Sent using MsgSafe.io's Free Plan Private, encrypted, online communication For everyone. https://www.msgsafe.io

3 3

relay got suspended
by Paul Geurts 26 Oct '20

26 Oct '20

hi y'all, one of my relays got suspended today, because of heavy ddos traffic. *Hello,* *Today your VPS IP address was heavily attacked by a large DDoS, so we were forced to suspend the VPS and null the IP for the time being, since it had overloaded our upstream provider. We are keeping an eye on the situation, however in the meantime you will want to get your site behind a DDoS filter such as CloudFlare.* *Let us know if you have any further questions.* *Thank you!* *Adam* has any of you see this behauvior? I think there is no use in putting a relay behind a ddos filter, or is there? In that case I'll just spin up another one. relay in question is this one, almost 7 months with no interuption what so ever, no indication in the (munin) monitoring for high or higher traffic... because the vps is suspended I don't have the latest syslog so I don't know for sure whether anything has shown up there, but I am quite sure that yesterday there were no abnormal logging entries on this server. https://metrics.torproject.org/rs.html#details/CDE4149F0DC65A7BE1AE440340BE… rgds,. Paul

4 3

FreeBSD and Libressl from the ports
by Felix 26 Oct '20

26 Oct '20

Hi everybody :: That post went as well to tor-bsd(a)lists.nycbug.org but is reposted here for a potential higher attendance :: This is for those who run FreeBSD and Libressl from the ports. Because of the issue [0] we can not compile from source. Maybe you can use Libressl from the base system or you overwrite the security/libressl or security/libressl-devel port with an older version like 3.2.0 and compile from there. (Uhh, you can go with Openssl until the fix is in place) Please find the ports files in [1]. Libressl 3.2.0 works with Tor 4.4.x like a charme. Libressl 3.2.1 and 3.2.2 cause an issue with some Tor auths. Libressl 3.2.2 is/was devel and sits as well in non-devel, so we can not switch back this time :( . [0] https://gitlab.torproject.org/tpo/core/tor/-/issues/40128 [1] https://svnweb.freebsd.org/ports/head/security/libressl/ -- Cheers, Felix

1 0

My Tor exit node not visible
by netaudit 21 Oct '20

21 Oct '20

Hi there, I've set up a new Tor exit node around 15 hours ago but despite it had been such a time and my exit is visible from outside world I still get little to no traffic at all. I also cannot see my servers IP on bulk tor exit node list. I checked the logs and everything seems alright too: [notice] Self-testing indicates your DirPort is reachable from the outside. Excellent. [notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor. Can you please tell me what I am missing here? Thank you Sent with [ProtonMail](https://protonmail.com) Secure Email.

6 6

ContactInfo Spec Version 2 is released
by nusenu 20 Oct '20

20 Oct '20

Hi, I'm happy to announce version 2 of the ContactInfo Information Sharing Specification. https://nusenu.github.io/ContactInfo-Information-Sharing-Specification/ It comes with an easy to use ContactInfo generator, which is maintained by Eran Sandler: https://torcontactinfogenerator.netlify.app/ Example ContactInfo string as defined by this specification: email:tor[]example.com url:https://example.com proof:uri-rsa uplinkbw:100 ciissversion:2 In words this ContactInfo string means: - the technical contact for this relay can be reached at tor(a)example.com - the entity responsible for this relay has a website at https://example.com - the proof file to verify the url can be fetched from https://example.com/.well-known/tor-relay/rsa-fingerprint.txt - this tor instance can provide a bandwidth up to 100 Mbit/s - this string implements version 2 of this specification The spec has many fields to choose from but I'd like to highlight these 3 fields, also used in the example above, as some of the most relevant: - email - url - proof The proof field allows operators to make their URL value verifyable (protected against spoofing) by placing their relay fingerprints in a text file located on their website. If no website is available DNS TXT records can be used instead. Now that version 2 is out, we will work on parsing to provide operators with an easy way to check their strings (and maybe also their proofs) interactively. I intend to use the data as input for OrNetStats as operators start to set their ContactInfo strings. I have operator-level graphs in mind, showing the operator how his set of relays evolved over time. See https://raw.githubusercontent.com/nusenu/tor-network-observations/master/pn… for an example. The timespan will likely be significantly smaller than the one used in this example. The release of version 2 marks the deprecation of version 1. I aim to support version 2 for at least 2 years and aim to make future releases backward compatible. I've no plans to significantly change or extend the amount of fields, with the exception of one potentially interesting use-case (see the bottom of this email). Many changes that went into version 2 are directly related to your comments after publishing version 1, thanks for that! We also got feedback for the generator and are tracking them here: https://github.com/erans/torcontactinfogenerator/issues Changelog ---------- Most notable changes since version 1: - 'operatorurl' got renamed to just "url" - "verifyurl" field simplified/replaced with "proof" (no longer requires a webserver) - email field is no longer mandatory - UTF-8 support - xmr (monero) field added - bitcoin field renamed to btc - zcash field renamed to zec - PGP keys should be on keys.openpgp.org (verifying keyserver) - removed fields: KIST, ricochet Future Idea Since some had concerns about spam: It would be trivial to add support for an encrypted email address when the operator has a webserver and a verified url field. If there is some demand for this and the Tor Project is willing to publish a GPG key that can be used for encryption I'll add support for it. That would mean only the persons at the torproject having access to that key could fetch the encrypted address and decrypt it with their private key, others would only see "encemail:y" or similar. kind regards, nusenu

3 2

Collaborative Bad-Abuse-Sender Blocklist
by Matt Corallo 20 Oct '20

20 Oct '20

Hi all, I run a few relatively-small exit nodes, and still get a decent flow of the usual Fail2Ban, blocklist.de, and such garbage to abuse PoCs. I tend to proactively find appropriate abuse/noc contacts to provide a response informing them of how they can appropriately block all Tor exits from their SSH ports if they wish, but often get either no or indignant responses about how sending a stream of garbage abuse reports is a useful service to the internet (nevermind that most large providers don't bother handling abuse reports anymore because of exactly this behavior). After a reply or two I usually add senders to a blocklist and bounce them at the mailserver with a notice about spam not being useful. Is there any interest in building up a shared blocklist of senders who feel its their right to send Fail2Ban emails in non-machine-parsable formats and not bother handling replies to their emails they expect others to handle, or does anyone already have such a list? Matt

4 6