- tor-relays - lists.torproject.org

How long does it take for a relay IP to stop being displayed in metrics and web service?
by shsmbcfdfk 31 Oct '20

31 Oct '20

Hi, I setup a non-exit relay on my home network and I have been listed as relay. So now me and my family even if we don't use Tor we are excluded from some online services. Beyond the discussion of whether the owners of these services understand Tor or not, it's a problem that the address is added to public lists, especially for non-exit relays. I completely shut down the relay several hours ago but my IP is still listed. My question is how long does it take for a relay to disappear ? Thanks,

5 4

Re: [tor-relays] Snowflakes
by entensaison＠use.startmail.com 31 Oct '20

31 Oct '20

Hi Toralf and Gus, Thanks for your replies! On Wednesday, October 28, 2020 at 4:11 PM, Toralf Förster <toralf.foerster(a)gmx.de> wrote: > On 10/26/20 5:32 PM, entensaison(a)use.startmail.com wrote: >> Hi everybody, >> I'm not sure this is the right list to ask, but is it useful to run >> snowflake proxies? > I'd say yes. > > FWIW I do run it as a ordinary Linux service (git clone + go build) > instead as a plugin in my browser here under Gentoo Linux at my > desktop. > So the proxy runs even if I close the browser. > > FWIW the plugin tells me : > > Number of users your Snowflake has helped circumvent censorship in > the > last 24 hours: 5 > > :-) > > -- > Toralf > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

How to manually change overloaded Guard?
by petrarca＠protonmail.ch 31 Oct '20

31 Oct '20

Since tonight I can't get any usable Tor connections anymore; restarting Tor gives the following error message: Guard TOR2DFNrelB ($0ED0EA324C931CF41CB5272BFB1D015B3D5772A9) is failing more circuits than usual. Most likely this means the Tor network is overloaded. Success counts are 152/217. Use counts are 45/59. 167 circuits completed, 13 were unusable, 2 collapsed, and 51 timed out. For reference, your timeout cutoff is 60 seconds. Any idea how to change the Guard - just restarting Tor doesn't help?

2 1

Snowflakes
by entensaison＠use.startmail.com 28 Oct '20

28 Oct '20

Hi everybody, I'm not sure this is the right list to ask, but is it useful to run snowflake proxies? I only recently realized they can be run by ordinary people. On the new website I don't see how you would find that out, there doesn't seem to be any link pointing to them. Metrics only shows a hundred snowflake users. What is the reason they are not advertised for? (towards humans) Have a nice day!

3 2

Re: [tor-relays] Fw: Can't update tor relay on Debian, and notice about tor log file
by Keifer Bly 27 Oct '20

27 Oct '20

Torix, I just tried your workaround, the issue still occurs. Thank you. --Keifer On Tue, Oct 27, 2020 at 1:58 PM <torix(a)protonmail.com> wrote: > Dear Keifer, > > Just guessing here, but have you tried reverting your sources.list to http? > > As for the notices and notices.1, this seems like normal linux log > rotation. See if you don't have an /etc/logrotate.d/tor file that gives > the structure of how the tor log is handled. Mine is set to rotate to a > new file daily, so notices.log is renamed to notices.log.1, and the new log > is notices.log. Notices.log.1 is zipped up to notices.2.tgz, and so on, and > the last 5 days of files are kept before being deleted. > > --Torix > > > Sent with ProtonMail <https://protonmail.com> Secure Email. > > ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ > On Tuesday, October 27, 2020 8:30 PM, Keifer Bly <keifer.bly(a)gmail.com> > wrote: > > Hi all, so for my bridge at > > > https://metrics.torproject.org/rs.html#details/EF36AE38C162E96E0645E1DF25EF… > > > > I am some reason unable to update tor and obfs4 to the newest version. Upon running sudo apt update && sudo apt install -y --only-upgrade tor > > > > I am getting an error saying that updating from such a resprrtory can’t be > done securely and is therefor disabled by default. I have the following > entered in Debian file /etc/apt/sources.list: > > > > > > deb https://deb.torproject.org/torproject.org focal main > deb-src https://deb.torproject.org/torproject.org focal main > > > > So am not sure why it thinks this is insecure. > > > > Another thing I noticed, it seems that for some reason, for the tor > traffic log file, it switches from writing to notices.log to notices.log.1 > automatically after a while, this happened on both my bridge and my relay > though I did not tell it to do this. > > > > I wonder why the update error is happening, thank you. > > >

1 0

recently saw 4 tor relays in row on tails. bug in tor?
by BRBfGWMz 26 Oct '20

26 Oct '20

I recently saw a series of 4 relays connected to each other: itomori, MediumSlesmn, hotbrownie, pellidos itomori, docto, Geheimschreiber, 420isGay Dont most relays in the network of length 3? Bug in tor? \-- Sent using MsgSafe.io's Free Plan Private, encrypted, online communication For everyone. https://www.msgsafe.io

3 3

relay got suspended
by Paul Geurts 25 Oct '20

25 Oct '20

hi y'all, one of my relays got suspended today, because of heavy ddos traffic. *Hello,* *Today your VPS IP address was heavily attacked by a large DDoS, so we were forced to suspend the VPS and null the IP for the time being, since it had overloaded our upstream provider. We are keeping an eye on the situation, however in the meantime you will want to get your site behind a DDoS filter such as CloudFlare.* *Let us know if you have any further questions.* *Thank you!* *Adam* has any of you see this behauvior? I think there is no use in putting a relay behind a ddos filter, or is there? In that case I'll just spin up another one. relay in question is this one, almost 7 months with no interuption what so ever, no indication in the (munin) monitoring for high or higher traffic... because the vps is suspended I don't have the latest syslog so I don't know for sure whether anything has shown up there, but I am quite sure that yesterday there were no abnormal logging entries on this server. https://metrics.torproject.org/rs.html#details/CDE4149F0DC65A7BE1AE440340BE… rgds,. Paul

4 3

FreeBSD and Libressl from the ports
by Felix 25 Oct '20

25 Oct '20

Hi everybody :: That post went as well to tor-bsd(a)lists.nycbug.org but is reposted here for a potential higher attendance :: This is for those who run FreeBSD and Libressl from the ports. Because of the issue [0] we can not compile from source. Maybe you can use Libressl from the base system or you overwrite the security/libressl or security/libressl-devel port with an older version like 3.2.0 and compile from there. (Uhh, you can go with Openssl until the fix is in place) Please find the ports files in [1]. Libressl 3.2.0 works with Tor 4.4.x like a charme. Libressl 3.2.1 and 3.2.2 cause an issue with some Tor auths. Libressl 3.2.2 is/was devel and sits as well in non-devel, so we can not switch back this time :( . [0] https://gitlab.torproject.org/tpo/core/tor/-/issues/40128 [1] https://svnweb.freebsd.org/ports/head/security/libressl/ -- Cheers, Felix

1 0

My Tor exit node not visible
by netaudit 21 Oct '20

21 Oct '20

Hi there, I've set up a new Tor exit node around 15 hours ago but despite it had been such a time and my exit is visible from outside world I still get little to no traffic at all. I also cannot see my servers IP on bulk tor exit node list. I checked the logs and everything seems alright too: [notice] Self-testing indicates your DirPort is reachable from the outside. Excellent. [notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor. Can you please tell me what I am missing here? Thank you Sent with [ProtonMail](https://protonmail.com) Secure Email.

6 6

ContactInfo Spec Version 2 is released
by nusenu 20 Oct '20

20 Oct '20

Hi, I'm happy to announce version 2 of the ContactInfo Information Sharing Specification. https://nusenu.github.io/ContactInfo-Information-Sharing-Specification/ It comes with an easy to use ContactInfo generator, which is maintained by Eran Sandler: https://torcontactinfogenerator.netlify.app/ Example ContactInfo string as defined by this specification: email:tor[]example.com url:https://example.com proof:uri-rsa uplinkbw:100 ciissversion:2 In words this ContactInfo string means: - the technical contact for this relay can be reached at tor(a)example.com - the entity responsible for this relay has a website at https://example.com - the proof file to verify the url can be fetched from https://example.com/.well-known/tor-relay/rsa-fingerprint.txt - this tor instance can provide a bandwidth up to 100 Mbit/s - this string implements version 2 of this specification The spec has many fields to choose from but I'd like to highlight these 3 fields, also used in the example above, as some of the most relevant: - email - url - proof The proof field allows operators to make their URL value verifyable (protected against spoofing) by placing their relay fingerprints in a text file located on their website. If no website is available DNS TXT records can be used instead. Now that version 2 is out, we will work on parsing to provide operators with an easy way to check their strings (and maybe also their proofs) interactively. I intend to use the data as input for OrNetStats as operators start to set their ContactInfo strings. I have operator-level graphs in mind, showing the operator how his set of relays evolved over time. See https://raw.githubusercontent.com/nusenu/tor-network-observations/master/pn… for an example. The timespan will likely be significantly smaller than the one used in this example. The release of version 2 marks the deprecation of version 1. I aim to support version 2 for at least 2 years and aim to make future releases backward compatible. I've no plans to significantly change or extend the amount of fields, with the exception of one potentially interesting use-case (see the bottom of this email). Many changes that went into version 2 are directly related to your comments after publishing version 1, thanks for that! We also got feedback for the generator and are tracking them here: https://github.com/erans/torcontactinfogenerator/issues Changelog ---------- Most notable changes since version 1: - 'operatorurl' got renamed to just "url" - "verifyurl" field simplified/replaced with "proof" (no longer requires a webserver) - email field is no longer mandatory - UTF-8 support - xmr (monero) field added - bitcoin field renamed to btc - zcash field renamed to zec - PGP keys should be on keys.openpgp.org (verifying keyserver) - removed fields: KIST, ricochet Future Idea Since some had concerns about spam: It would be trivial to add support for an encrypted email address when the operator has a webserver and a verified url field. If there is some demand for this and the Tor Project is willing to publish a GPG key that can be used for encryption I'll add support for it. That would mean only the persons at the torproject having access to that key could fetch the encrypted address and decrypt it with their private key, others would only see "encemail:y" or similar. kind regards, nusenu

3 2

Collaborative Bad-Abuse-Sender Blocklist
by Matt Corallo 19 Oct '20

19 Oct '20

Hi all, I run a few relatively-small exit nodes, and still get a decent flow of the usual Fail2Ban, blocklist.de, and such garbage to abuse PoCs. I tend to proactively find appropriate abuse/noc contacts to provide a response informing them of how they can appropriately block all Tor exits from their SSH ports if they wish, but often get either no or indignant responses about how sending a stream of garbage abuse reports is a useful service to the internet (nevermind that most large providers don't bother handling abuse reports anymore because of exactly this behavior). After a reply or two I usually add senders to a blocklist and bounce them at the mailserver with a notice about spam not being useful. Is there any interest in building up a shared blocklist of senders who feel its their right to send Fail2Ban emails in non-machine-parsable formats and not bother handling replies to their emails they expect others to handle, or does anyone already have such a list? Matt

4 6

Help setting up 2 Relays
by postmaster＠coolcomputers.info 18 Oct '20

18 Oct '20

Hello, I was wondering it anyone more experienced could help me with fixing 1 TOR Exit and 1 TOR Relay. I have everything configured and fingerprints made they just seem to not me recognized by tor metrics. Tor Relay: B0852A98ECDB40E95319DEE339662EEF50708066 Tor Exit: A5D03FC9BE6EE32BD20EE59649BAD802BF4A49FC There is nothing in the notice logs as to why this would be happening. Maybe someone can see what the DA's think of them. Then give me advice on what to do. Thanks, John Csuti postmaster(a)coolcomputers.info

5 6

Network Performance Experiment - KISTSchedRunInterval - October 2020
by David Goulet 17 Oct '20

17 Oct '20

Greetings relay operators! Tor has now embarked in a 2 year long scalability project aimed, in part, at improving the network performance. The first steps will be to measure performance on the public network in order to come up with a baseline. We'll likely be adjusting circuit window size, cell scheduling (KIST) and circuit build timeout (CBT) parameters over the next months in both contained experiments and on the live network. This announcement is about KIST parameters, our cell scheduler. Roughly a year ago, we've discovered that all tor clients are capped to ~3MB/sec in maximum outbound throughput due to how the scheduler is operating. I won't get into the details but if you are curious, it is here: https://gitlab.torproject.org/tpo/core/tor/-/issues/29427 It turns out that we now believe that the entire network, not only clients, are actually capped at 3MB/sec per channel (a channel is a connection between client -> relay or relay -> relay also called an OR connection). We've recently conducted experiments with chutney [1], which operates on the loopback interface, and we indeed hit those limits. KIST has a parameter named KISTSchedRunInterval which is currently set at 10 msec and that is our culprit. By lowering it to 2 msec, our experiment showed that the cap goes from 3MB/sec to ~5MB/sec with burst a bit higher. Now, the question is why was it set to 10 msec in the first place? Again, without getting into the technical details of the KIST paper[2], our cell scheduler requires a "grace period" in order to be able to accumulate cells and then prioritize over many circuits using an EWMA algorithm which tor has been using for a long time now. Without this, one can clog the pipes (at the TCP level) with a very loud transfer by always being scheduled and filling the TCP buffers leaving nothing for the quieter circuit. Important to note that the goal of EWMA in tor is to prioritize quiet circuit for example, an SSH session will be prioritized over a bulk HTTP transfer. This is so "likely" interactive connections are not delayed and are snappy. But, lowering this to 2 msec means less time to accumulate and in theory worst cell prioritization. However, we think this will not be a problem because we believe the network is underloaded. And, because of this 3MB/sec cap per channel, it means that tor is sending burst of cells instead of a constant stream of cells and thus it is under processing what it possibly could at the relay side. Again, all this in theory. All in all, going to 2 msec should improve speed at the very least and not make the network worst. We want to test that, measure that for a couple of weeks and then transition to a higher value and doing that until we get to 10 msec so we can clearly well compare the effect on EWMA priority and performance. One possibility will be 2 msec, 5 msec, 10 msec transition period. Yesterday, a request to our 9 directory authorities have been made to set this consensus parameter: KISTSchedRunInterval=2 We are still missing 1 authority to enable this param for it to take effect network wide. Hopefully, it should be today in the coming hours/day. This is where we need your help. We would like you to notify us on this thread about any noticeable changes in CPU, RAM, or BW usage. In other words, anything that changes from the "average" you've been seeing is worth informing us. We do NOT expect big changes for your relay(s) but there could reasonably be a change in bandwidth throughput and thus some of you could see a traffic increase, unclear at the moment. Huge thanks to everyone here! We will carefully monitor this change and if things go bad, we'll revert it as fast as we can! Thus, your help becomes extremely important! Cheers! David [1] https://git.torproject.org/chutney.git/ [2] https://arxiv.org/pdf/1709.01044.pdf -- 7h1/NAPdaaGpI8WG6X4FtryAZZ4EhnznUVVLqIf/04A=

6 10

Shutdown of my digital ocean guard relay
by mick 16 Oct '20

16 Oct '20

Hi Guys I today received notification from DO that they have changed their Terms of Service and Acceptable Useage policies. Having read those changed notices it is clear to me that DO are no longer really Tor friendly. They do not allow exits and whilst my guard relay there (at roof.rlogin.net with fingerprint EA8637EA746451C0680559FDFF34ABA54DDAE831) has been running for nearly seven years I can no longer do that because of the likely bandwidth charges in future. My DO relay has been using around 12 TiB per month for some time now and I could afford to let it run because I was a "legacy" customer (i.e. early adopter of DO services who was given "free bandwidth forever"). It looks to me from their new ToS that I will no longer enjoy that status after 22 October. So I have shut it down. Any other relay operator using DO services should read their new ToS (1) and AUP (2) and decide for themselves whether they will be affected. My other guard relay at sink.rlogin.net on Hetzner's network will continue in operation. Mick (1) https://www.digitalocean.com/legal/terms-of-service-agreement/ (2) https://www.digitalocean.com/legal/acceptable-use-policy/ --------------------------------------------------------------------- Mick Morgan gpg fingerprint: FC23 3338 F664 5E66 876B 72C0 0A1F E60B 5BAD D312 https://baldric.net/about-trivia ---------------------------------------------------------------------

6 10

Is this next bad exit trick?
by lists＠for-privacy.net 14 Oct '20

14 Oct '20

Wtf, this exit has addresses that do not belong to it! https://metrics.torproject.org/rs.html#details/385527185E26937D05E0933DD29F… I'm very sure there are only nifty rabbits on the 185.220.101.0/24 subnet! -- ╰_╯ Ciao Marco! Debian GNU/Linux It's free software and it gives you freedom!

6 14

Relay JPsi2 not getting into consensus anymore
by Random Tor Node Operator 14 Oct '20

14 Oct '20

Hi all, some weeks ago, my relay JPsi2 (F6EC46933CE8D4FAD5CCDAA8B1C5A377685FC521) started experiencing moderate stability problems. It would freeze after a few hours or days. The provider said it was due to Spectre mitigations and the only way for me to fix this would be to switch to a newer (more expensive) plan... Some time later I did so and reinstalled it with Ubuntu 18.04 and placed the old keys into the new installation. It seems they are now expected to be in /var/lib/tor/.tor/keys, as opposed to /var/lib/tor/keys as I was used to in Ubuntu 16.04. However, it does not seem to be making it into the consensus anymore. Only the authority nodes moria1, dizum, and longclaw vote for Running. The others don't. So far I haven't been able to figure out the reason for that, so any help is appreciated. Here is part of the output of journalctl -u tor and the torrc file: Oct 11 15:04:32 j60204.servers.jiffybox.net tor[11183]: Oct 11 15:04:32.000 [notice] Heartbeat: It seems like we are not in the cached consensus. Oct 11 15:04:32 j60204.servers.jiffybox.net tor[11183]: Oct 11 15:04:32.000 [notice] Heartbeat: Tor's uptime is 8 days 0:00 hours, with 0 circuits open. I've sent 54.04 MB and received 163.30 MB. Oct 11 15:04:32 j60204.servers.jiffybox.net tor[11183]: Oct 11 15:04:32.000 [notice] While bootstrapping, fetched this many bytes: Oct 11 15:04:32 j60204.servers.jiffybox.net tor[11183]: Oct 11 15:04:32.000 [notice] 9368438 (server descriptor fetch) Oct 11 15:04:32 j60204.servers.jiffybox.net tor[11183]: Oct 11 15:04:32.000 [notice] 1060775 (consensus network-status fetch) Oct 11 15:04:32 j60204.servers.jiffybox.net tor[11183]: Oct 11 15:04:32.000 [notice] 13332 (authority cert fetch) Oct 11 15:04:32 j60204.servers.jiffybox.net tor[11183]: Oct 11 15:04:32.000 [notice] 2762395 (microdescriptor fetch) Oct 11 15:04:32 j60204.servers.jiffybox.net tor[11183]: Oct 11 15:04:32.000 [notice] While not bootstrapping, fetched this many bytes: Oct 11 15:04:32 j60204.servers.jiffybox.net tor[11183]: Oct 11 15:04:32.000 [notice] 111548029 (server descriptor fetch) Oct 11 15:04:32 j60204.servers.jiffybox.net tor[11183]: Oct 11 15:04:32.000 [notice] 100899 (server descriptor upload) Oct 11 15:04:32 j60204.servers.jiffybox.net tor[11183]: Oct 11 15:04:32.000 [notice] 15307429 (consensus network-status fetch) Oct 11 15:04:32 j60204.servers.jiffybox.net tor[11183]: Oct 11 15:04:32.000 [notice] 1785 (authority cert fetch) Oct 11 15:04:32 j60204.servers.jiffybox.net tor[11183]: Oct 11 15:04:32.000 [notice] 942746 (microdescriptor fetch) Oct 11 15:04:32 j60204.servers.jiffybox.net tor[11183]: Oct 11 15:04:32.000 [notice] Average packaged cell fullness: 96.710%. TLS write overhead: 31% Oct 11 15:04:32 j60204.servers.jiffybox.net tor[11183]: Oct 11 15:04:32.000 [notice] Circuit handshake stats since last time: 1/1 TAP, 0/0 NTor. Oct 11 15:04:32 j60204.servers.jiffybox.net tor[11183]: Oct 11 15:04:32.000 [notice] Since startup we initiated 0 and received 0 v1 connections; initiated 0 and received 2 v2 connections; initiated 0 and received 114 v3 connections; initiated 0 and received 1899 v4 connections; initiated 46 and received 5694 v5 connections. Oct 11 15:04:32 j60204.servers.jiffybox.net tor[11183]: Oct 11 15:04:32.000 [notice] DoS mitigation since startup: 0 circuits killed with too many cells. 0 circuits rejected, 0 marked addresses. 0 connections closed. 0 single hop clients refused. 0 INTRODUCE2 rejected. Oct 11 18:14:03 j60204.servers. # cat /etc/tor/torrc OfflineMasterKey 1 SOCKSPort 0 SOCKSPolicy reject * RunAsDaemon 1 ControlPort 9051 HashedControlPassword 16:28CD63819CB35660601EB9CED4BC2A4252D3DB80488DFD4F22CA4AE930 ORPort 9001 ORPort [2a00:1158:3::1ba]:9001 Nickname JPsi2 RelayBandwidthRate 12500 KB RelayBandwidthBurst 12500 KB ContactInfo 0xF1ADC390 Random Tor Node Operator <tor at unterderbruecke (dot) de> bitcoin:1LBoEppezy2HauE957HzfFn9UGywK6aboB DirPort 9030 MyFamily $B198C0B4B8C551F174FBB841A172616E3DB3124D, $F6EC46933CE8D4FAD5CCDAA8B1C5A377685FC521 IPv6Exit 0 ExitPolicy reject *:* ExitPolicy reject6 *:*

3 3

Riseup invite code
by lists＠for-privacy.net 09 Oct '20

09 Oct '20

Hiho rise up members, I would like to receive the mails for my hosted Tor relays, such as support tickets from my provider, via Riseup. Can one of the Riseup.net users on this list send me an invite code? Right on me, not in the list ;-) mailto:admin@for-privacy.net or my lists address -- ╰_╯ Ciao Marco! Debian GNU/Linux It's free software and it gives you freedom!

1 1

Malicious Tor relays - post-analysis after two months
by Corl3ss 07 Oct '20

07 Oct '20

Hello, This summer Nusenu shared his posts about malicious relays [1][2] and it was followed by many answers. A very important is Roger's one [3] explaining that the malicious relays have been kicked out of the network and that any new one should be reported. I was wondering if, with some distance with this summer situation / discussion : * new malicious relays have been reported in any way ? * vigilance / watchfulness is still needed ? if yes : * is there specific cases to share (e.g. nodes that block HTTPS on a site or redirect to HTTP ?) * any concern to have on other protocols that use SSL (imaps, smtps, ssh) ? * is there / will there be things implemented as a conclusion of the "call for support for proposal to limit large scale attacks" ? * has it been possible to prepare / set up precautions to avoid this king of situation or it is a too long shot for such a problem ? These questions come with a lot of respect for the project, its teams and the work done. No critics, it is just made to update the knowloedge on the subject as these questions came back with other friends and relay operators. And perhaps a last one, perhaps specific for Nusenu : how do you define a malicious relay ? Sorry but I did not get that precisely, moreover in big group analysis. All answers will be read with care and gratitude ! --- Corl3ss 2042 5D39 E7C1 E657 025E A28F 937D 8A90 FCB0 E24A [1] https://lists.torproject.org/pipermail/tor-relays/2020-July/018643.html [2] https://lists.torproject.org/pipermail/tor-relays/2020-August/018817.html [3] https://lists.torproject.org/pipermail/tor-relays/2020-August/018845.html

6 7

question
by prizzz＠Safe-mail.net 05 Oct '20

05 Oct '20

Hello. Why is my Consensus Weight constantly changing? What factors influence its change? Thanks in advance for your reply =))

2 1

Reconfiguring a middle relay as a bridge
by torix＠protonmail.com 30 Sep '20

30 Sep '20

Is there a security problem with turning a middle relay, whose ip address is known, into a bridge? TIA, --Torix Sent with [ProtonMail](https://protonmail.com) Secure Email.

3 3

Heartbeat: It seems like we are not in the cached consensus.
by Fran 27 Sep '20

27 Sep '20

Hello, I'm taking care of a server of a friend who's on holiday. The server is up and running but not part of the consensus. As beeing instructed I updated to the lastest OpenBSD snapshot when I saw that a new tor release is available (Tor 0.4.3.5 on OpenBSD). Excerpts from the log: Jul 13 20:04:02.000 [notice] Self-testing indicates your DirPort is reachable from the outside. Excellent. Jul 13 20:05:02.000 [notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor. Jul 13 20:05:35.000 [notice] Performing bandwidth self-test...done. Jul 14 02:04:01.000 [notice] Heartbeat: It seems like we are not in the cached consensus. Jul 14 02:04:01.000 [notice] Heartbeat: Tor's uptime is 6:00 hours, with 0 circuits open. I've sent 2.04 MB and received 6.25 MB. Jul 14 02:04:01.000 [notice] Average packaged cell fullness: 12.450%. TLS write overhead: 33% Jul 14 02:04:01.000 [notice] Circuit handshake stats since last time: 0/0 TAP, 5/5 NTor. Jul 14 02:04:01.000 [notice] Since startup we initiated 0 and received 157 v1 connections; initiated 0 and received 0 v2 connections; initiated 0 and received 0 v3 connections; initiated 0 and received 5 v4 connections; initiated 48 and received 124 v5 connections. Jul 14 02:04:01.000 [notice] DoS mitigation since startup: 0 circuits killed with too many cells. 0 circuits rejected, 0 marked addresses. 0 connections closed. 0 single hop clients refused. 0 INTRODUCE2 rejected. Jul 14 06:04:02.000 [notice] Your relay has a very large number of connections to other relays. Is your outbound address the same as your relay address? Found 9 connections to 6 relays. Found 4 current canonical connections, in 0 of which we were a non-canonical peer. 3 relays had more than 1 connection, 0 had more than 2, and 0 had more than 4 connections. Jul 14 08:04:01.000 [notice] Heartbeat: It seems like we are not in the cached consensus. Jul 14 08:04:01.000 [notice] Heartbeat: Tor's uptime is 12:00 hours, with 1 circuits open. I've sent 3.46 MB and received 11.22 MB. Jul 14 08:04:01.000 [notice] Average packaged cell fullness: 12.450%. TLS write overhead: 47% Jul 14 08:04:01.000 [notice] Circuit handshake stats since last time: 2/2 TAP, 1/1 NTor. Jul 14 08:04:01.000 [notice] Since startup we initiated 0 and received 340 v1 connections; initiated 0 and received 0 v2 connections; initiated 0 and received 0 v3 connections; initiated 0 and received 10 v4 connections; initiated 57 and received 246 v5 connections. Jul 14 08:04:01.000 [notice] DoS mitigation since startup: 0 circuits killed with too many cells. 0 circuits rejected, 0 marked addresses. 0 connections closed. 0 single hop clients refused. 0 INTRODUCE2 rejected. Jul 14 14:04:01.000 [notice] Heartbeat: It seems like we are not in the cached consensus. Jul 14 14:04:01.000 [notice] Heartbeat: Tor's uptime is 18:00 hours, with 1 circuits open. I've sent 4.89 MB and received 15.33 MB. Jul 14 14:04:01.000 [notice] Average packaged cell fullness: 26.760%. TLS write overhead: 51% Jul 14 14:04:01.000 [notice] Circuit handshake stats since last time: 2/2 TAP, 6/6 NTor. Jul 14 14:04:01.000 [notice] Since startup we initiated 0 and received 493 v1 connections; initiated 0 and received 0 v2 connections; initiated 0 and received 0 v3 connections; initiated 0 and received 18 v4 connections; initiated 64 and received 370 v5 connections. Jul 14 14:04:01.000 [notice] DoS mitigation since startup: 0 circuits killed with too many cells. 0 circuits rejected, 0 marked addresses. 0 connections closed. 0 single hop clients refused. 0 INTRODUCE2 rejected. Atlas show the server as down: https://metrics.torproject.org/rs.html#details/AC601DBDB7FBD53454045EDC08DA… Accessing the status page on port 80 works. No FW on the machine. Any ideas? Thanks and regards Fran

4 7

Exit not utilizing full bandwidth
by 4punk7＠mailbox.org 26 Sep '20

26 Sep '20

Hi, i am running a tor exit node for over 2 years now and it's just using around 1.7 MiB/s of a 100 MBit/s connection. My other relays (not exits) from the same hoster (same bandwidth) are using around 10 MiB/s (which is the rate I expect). I have tried to limit the bandwithrate, set no limits, adding IPv6 and also excluding relays from overseas (i'm located in Germany). Nothing happened. CPU is around 10%... Any idea how to speed up the exit ? Thanks, apunkt Tor Version is 0.4.2.7, here is my current torrc: /var/log/tor/notices.log RunAsDaemon 1 DataDirectory /var/lib/tor ControlPort 9051 ORPort 1234 ORPort [2a0a:51c0::103]:9001 Nickname 4punk7e1 RelayBandwidthRate 100 MBytes # Throttle traffic to 100KB/s (800Kbps) RelayBandwidthBurst 100 MBytes # But allow bursts up to 200KB (1600Kb) MyFamily $CEFBCB5FCE5FB37784AD489BCDEC46F1D59C06CB,$ABA31795BAD2AB8097F3AD0FE1A9 20E518D3D3F3 ExitRelay 1 IPv6Exit 1 ExitPolicy reject6 *:22 ExitPolicy reject6 *:587 #ExitPolicy reject6 *:* ExitPolicy accept *:20-21 # FTP #ExitPolicy accept *:22 # SSH ExitPolicy accept *:23 # Telnet ExitPolicy accept *:43 # WHOIS ExitPolicy accept *:53 # DNS ExitPolicy accept *:79 # finger ExitPolicy accept *:80-81 # HTTP ExitPolicy accept *:88 # kerberos ExitPolicy accept *:110 # POP3 ExitPolicy accept *:143 # IMAP ExitPolicy accept *:194 # IRC ExitPolicy accept *:220 # IMAP3 ExitPolicy accept *:389 # LDAP ExitPolicy accept *:443 # HTTPS ExitPolicy accept *:464 # kpasswd ExitPolicy accept *:465 # URD for SSM (more often: an alternative SUBMISSION port, see 587) ExitPolicy accept *:531 # IRC/AIM ExitPolicy accept *:543-544 # Kerberos ExitPolicy accept *:554 # RTSP ExitPolicy accept *:563 # NNTP over SSL #ExitPolicy accept *:587 # SUBMISSION (authenticated clients [MUA's like Thunderbird] send mail over STARTTLS SMTP here) ExitPolicy accept *:636 # LDAP over SSL ExitPolicy accept *:706 # SILC ExitPolicy accept *:749 # kerberos ExitPolicy accept *:853 # DNS over TLS ExitPolicy accept *:873 # rsync ExitPolicy accept *:902-904 # VMware ExitPolicy accept *:981 # Remote HTTPS management for firewall ExitPolicy accept *:989-990 # FTP over SSL ExitPolicy accept *:991 # Netnews Administration System ExitPolicy accept *:992 # TELNETS ExitPolicy accept *:993 # IMAP over SSL ExitPolicy accept *:994 # IRCS ExitPolicy accept *:995 # POP3 over SSL ExitPolicy accept *:1194 # OpenVPN ExitPolicy accept *:1220 # QT Server Admin ExitPolicy accept *:1293 # PKT-KRB-IPSec ExitPolicy accept *:1500 # VLSI License Manager ExitPolicy accept *:1533 # Sametime ExitPolicy accept *:1677 # GroupWise ExitPolicy accept *:1723 # PPTP ExitPolicy accept *:1755 # RTSP ExitPolicy accept *:1863 # MSNP ExitPolicy accept *:2082 # Infowave Mobility Server ExitPolicy accept *:2083 # Secure Radius Service (radsec) ExitPolicy accept *:2086-2087 # GNUnet, ELI ExitPolicy accept *:2095-2096 # NBX ExitPolicy accept *:2102-2104 # Zephyr ExitPolicy accept *:3128 # SQUID ExitPolicy accept *:3389 # MS WBT ExitPolicy accept *:3690 # SVN ExitPolicy accept *:4321 # RWHOIS ExitPolicy accept *:4643 # Virtuozzo ExitPolicy accept *:5050 # MMCC ExitPolicy accept *:5190 # ICQ ExitPolicy accept *:5222-5223 # XMPP, XMPP over SSL ExitPolicy accept *:5228 # Android Market ExitPolicy accept *:5900 # VNC ExitPolicy accept *:6660-6669 # IRC ExitPolicy accept *:6679 # IRC SSL ExitPolicy accept *:6697 # IRC SSL ExitPolicy accept *:8000 # iRDMI ExitPolicy accept *:8008 # HTTP alternate ExitPolicy accept *:8074 # Gadu-Gadu ExitPolicy accept *:8080 # HTTP Proxies ExitPolicy accept *:8082 # HTTPS Electrum Bitcoin port ExitPolicy accept *:8087-8088 # Simplify Media SPP Protocol, Radan HTTP ExitPolicy accept *:8232-8233 # Zcash ExitPolicy accept *:8332-8333 # Bitcoin ExitPolicy accept *:8443 # PCsync HTTPS ExitPolicy accept *:8888 # HTTP Proxies, NewsEDGE ExitPolicy accept *:9418 # git ExitPolicy accept *:9999 # distinct ExitPolicy accept *:10000 # Network Data Management Protocol ExitPolicy accept *:11371 # OpenPGP hkp (http keyserver protocol) ExitPolicy accept *:19294 # Google Voice TCP ExitPolicy accept *:19638 # Ensim control panel ExitPolicy accept *:50002 # Electrum Bitcoin SSL ExitPolicy accept *:64738 # Mumble ExitPolicy reject *:* ExcludeNodes {US},{CA}

1 0

"Your server (xxxx:443) has not managed to confirm that its ORPort is reachable."
by Pham Minh Duc 23 Sep '20

23 Sep '20

I see this in syslog: Your server (xxxx:443) has not managed to confirm that its ORPort is reachable. Relays do not publish descriptors until their ORPort and DirPort are reachable. Please check your firewalls, ports, address, /etc/hosts file, etc. torrc: Nickname Contake ORPort 443 ExitRelay 0 SocksPort 0 ControlSocket 0 ContactInfo contakechuyennghicmt(a)gmail.com What happened and how to fix this?

3 7

Who am I?
by Kencf0618＠riseup.net 22 Sep '20

22 Sep '20

Whatever the torrc, with "Tor" I get Sep 18 08:02:12.538 [notice] Tor 0.3.2.10 (git-0edaa32732ec8930) running on Linux with Libevent 2.1.8-stable, OpenSSL 1.1.1, Zlib 1.2.11, Liblzma 5.2.2, and Libzstd 1.3.3. Sep 18 08:02:12.538 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning Sep 18 08:02:12.538 [notice] Read configuration file "/etc/tor/torrc". Sep 18 08:02:12.542 [notice] Based on detected system memory, MaxMemInQueues is set to 8192 MB. You can override this by setting MaxMemInQueues by hand. Sep 18 08:02:12.542 [notice] Scheduler type KIST has been enabled. Sep 18 08:02:12.542 [notice] Opening OR listener on 0.0.0.0:443 Sep 18 08:02:12.542 [warn] Could not bind to 0.0.0.0:443: Permission denied Sep 18 08:02:12.542 [warn] Failed to parse/validate config: Failed to bind one of the listener ports. Sep 18 08:02:12.542 [err] Reading config failed--see warnings above. whereas with "sudo Tor" (yeah, yeah, I know, I know -"bad form") I get ep 18 08:04:12.236 [notice] Tor 0.3.2.10 (git-0edaa32732ec8930) running on Linux with Libevent 2.1.8-stable, OpenSSL 1.1.1, Zlib 1.2.11, Liblzma 5.2.2, and Libzstd 1.3.3. Sep 18 08:04:12.236 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning Sep 18 08:04:12.237 [notice] Read configuration file "/etc/tor/torrc". Sep 18 08:04:12.240 [notice] Based on detected system memory, MaxMemInQueues is set to 8192 MB. You can override this by setting MaxMemInQueues by hand. Sep 18 08:04:12.240 [notice] Scheduler type KIST has been enabled. Sep 18 08:04:12.240 [notice] Opening OR listener on 0.0.0.0:443 Sep 18 08:04:12.241 [warn] /home/kenneth/.tor is not owned by this user (root, 0) but by kenneth (1000). Perhaps you are running Tor as the wrong user? Sep 18 08:04:12.241 [warn] Failed to parse/validate config: Couldn't access/create private data directory "/home/kenneth/.tor" Sep 18 08:04:12.241 [err] Reading config failed--see warnings above. What is happening?

4 6

Expiration time from torbulkexitlist
by Julien Moutinho 22 Sep '20

22 Sep '20

Hello Tor fans, New to Tor here, nonetheless this month I've tried to work on some type-checking and hardening of Tor in NixOS (see https://github.com/NixOS/nixpkgs/pull/97740 in case this interests you), hence I've tested Tor as an Exit node a few hours behind 80.67.180.251, as visible in: https://collector.torproject.org/recent/exit-lists/2020-09-22-01-02-00 > ExitNode 483F3347218DA225540D67AC3B9D48235A23DB89 > Published 2020-09-07 19:22:15 > LastStatus 2020-09-08 01:00:00 > ExitAddress 80.67.180.251 2020-09-08 01:59:25 And, if I'm not mistaken, only used it as a non Exit node since then (mostly to test a new NixOS abstraction around onion services). It's now 14 days past my Exit node test, yet that IPv4 is still listed in: https://check.torproject.org/torbulkexitlist despite https://lists.torproject.org/pipermail/tor-project/2020-March/002759.html announcing that: > This list is updated at most once every 40 minutes depending on the > number of exit relays in the network at the time, fetching it every hour > would be reasonable. A quick grep in https://collector.torproject.org/archive/exit-lists/exit-list-2020-07.tar.xz shows that in the past at least some exit nodes have been removed after one month: > $ grep LastStatus exit-list-2020-07/13/2020-07-13-18-02-00 | sort -r | tail -1 > LastStatus 2020-06-15 03:00:00 > $ grep LastStatus exit-list-2020-07/13/2020-07-13-19-02-00 | sort -r | tail -1 > LastStatus 2020-07-11 20:00:00 Am I right to assume that one month is the expiration time from torbulkexitlist? And can I do anything to trigger the removal before that delay? Thanks in advance for your answers, Julien

1 0