- tor-relays - lists.torproject.org

Re: [tor-relays] 35C3 Tor Relay Operators Meetup
by 35C3 35C3 01 Jan '19

01 Jan '19

> Hi, I have only my smartphone at the moment. It would be great if you swap the rooms. Thank you added a second slot on the first day/night: 2018-12-28 00:30 Room M3 I did NOT replace the first slot in the smaller room (2018-12-28 16:30) because the second slot is a bit late to avoid collisions with ie "It Always Feels Like the Five Eyes Are Watching You" - Kurt Opsahl https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9951.html https://events.ccc.de/congress/2018/wiki/index.php/Session:Tor_relay_operat…

3 3

Security issue
by dns1983＠riseup.net 29 Dec '18

29 Dec '18

Hello, Do I have to worry about those many warns on my log file? [warn] Tried to establish rendezvous on non-OR circuit with purpose Acting as rendezvous (pending) I found some old posts on this warn, but I don't understand if it is a security issue and what I have to do to fix this. Someone could tell me if there is something that I can do to fix this and improve security of my Debian -derived machine? Thanks Gigi

2 2

New exit relay help
by dns1983＠riseup.net 28 Dec '18

28 Dec '18

Hi, I need to install some additional software, to make the "DirFrontPage" work? I loaded an html file on my tor directory, uncommented the diretive "DirFrontPage /path/html-file", but It doesn't works and I don't see anything related to it in the log notice file. What I am doin wrong? I don't know how to solve the problem, can you help me please? best regards Gigi

5 6

Dec 2018: 24 new relays with fishy fingerprint patterns in Aruba and "INTERNET CZ" ASN
by nusenu 26 Dec '18

26 Dec '18

these 24 relays have a rather distinct signup and fingerprint pattern usually seen for onion attacks: +------------------------------------------+---------------------+--------------+--------------------+-------+------+----------------+---------+-------------+---------------------------------+ | fingerprint | first_seen | nickname | as_name | hsdir | exit | IP | or_port | tor_version | contact | +------------------------------------------+---------------------+--------------+--------------------+-------+------+----------------+---------+-------------+---------------------------------+ | 38D26817234F6B271E6A6DED306188BC09D1AA41 | 2018-12-19 13:00:00 | Escalibur | Aruba SAS | 1 | 0 | 185.8.50.23 | 9001 | 0.3.4.9 | NULL | | 38D2A1B04D004A61D2A9599EB5EC06FE42C463F7 | 2018-12-20 10:00:00 | delecat3d | Aruba S.p.A. | 0 | 0 | 195.231.66.172 | 9001 | 0.3.4.9 | NULL | | 38D2B873966A1C392E427CD1417BC7BB0E84B058 | 2018-12-17 08:00:00 | HGSTdisks | Aruba SAS | 1 | 0 | 94.177.226.229 | 9001 | 0.3.4.9 | coreproccores(a)gmail.com | | 510FEC23762319FEEAB3B65AF4592BE21515A7C4 | 2018-12-17 10:00:00 | tM666 | ArubaCloud Limited | 1 | 0 | 185.43.209.232 | 9001 | 0.3.4.9 | NULL | | 510FEC475B2B286A1886A22B333A1CCDEE8F0117 | 2018-12-16 15:00:00 | yeeboyd | INTERNET CZ, a.s. | 1 | 0 | 185.33.144.210 | 9001 | 0.3.4.9 | NULL | | 510FED6000FFEE2B451782DB0E82C2CCA8DF2332 | 2018-12-18 11:00:00 | takeAsit | Aruba SAS | 1 | 0 | 94.177.226.7 | 9001 | 0.3.4.9 | NULL | | 6688CD00E32D45DDC25FE0F4AE31EEB460DC02EF | 2018-12-20 12:00:00 | DoeRelay | Aruba SAS | 1 | 0 | 185.8.50.62 | 9001 | 0.3.4.9 | mrmrsdoehere gmaiil _ dot COM | | 6688E3150DC2898DDBD98D8AB70C078ECA468945 | 2018-12-19 10:00:00 | reltor | Aruba S.p.A. | 1 | 0 | 195.231.66.103 | 9001 | 0.3.4.9 | tripinonuyou gmail com | | 6688F26C215F92A0EF8B0C94B03FA160E22C4E75 | 2018-12-21 11:00:00 | Unnamed | Aruba S.p.A. | 0 | 0 | 80.211.253.155 | 9001 | 0.3.4.9 | NULL | | 8F29FDC9C2F85E5E9CC3F56E81B2A3D9CCB031FB | 2018-12-16 15:00:00 | SedS0K | Aruba S.p.A. | 1 | 0 | 195.231.66.240 | 9001 | 0.3.4.9 | seds0kkkk(at)gmail(dot)com | | 8F2A173B990CAE8CB61BEFDC61F9B8C047977667 | 2018-12-18 16:00:00 | FreeW | Aruba SAS | 1 | 0 | 185.8.50.73 | 9001 | 0.3.4.9 | NULL | | 8F2AE6EBB163B9B0BC64C0EE689946CE7A36B3F1 | 2018-12-17 18:00:00 | nobobyno | Aruba S.p.A. | 1 | 0 | 80.211.253.176 | 9001 | 0.3.4.9 | smpuffy_AT_mail.pl | | 9E9DA7C5060BEAB9860F120CCA5646ECBC92382B | 2018-12-19 09:00:00 | NextDoorBar | Aruba SAS | 1 | 0 | 94.177.226.250 | 9001 | 0.3.4.9 | NULL | | 9E9DAED63FE72C571753C03B2DF7C956AF02897A | 2018-12-18 12:00:00 | Unnamed | INTERNET CZ, a.s. | 1 | 0 | 185.33.144.110 | 9001 | 0.3.4.9 | NULL | | 9E9DE2E42485FBE95DAC35138EFE372A24D64D21 | 2018-12-17 22:00:00 | LiteMoka | Aruba S.p.A. | 1 | 0 | 195.231.66.108 | 9001 | 0.3.4.9 | juseppo2199()at()gmail_com | | A380D254B25878C74087C5D74C692D0241CBD6F0 | 2018-12-20 22:00:00 | AnonHappyBox | Aruba SAS | 1 | 0 | 94.177.226.230 | 9001 | 0.3.4.9 | anonanon55a_@_secmail_dot_net | | A380D347759DA5CBDC5BCBC4B51318A0C8567B53 | 2018-12-21 15:00:00 | Pendium | ArubaCloud Limited | 0 | 0 | 185.43.209.100 | 9001 | 0.3.4.9 | strangzapsl AT gmail DOT com | | A380E80F9C6405332C8113C02B566120B8099B06 | 2018-12-19 18:00:00 | volt220 | INTERNET CZ, a.s. | 1 | 0 | 185.33.144.204 | 9001 | 0.3.4.9 | spensr555oh _AT_ gmail _ dot_cm | | BE27A8DA5463AE0B32A4BAEC4214C0CD00F70DC3 | 2018-12-18 14:00:00 | Minicana | Aruba S.p.A. | 1 | 0 | 80.211.253.249 | 9001 | 0.3.4.9 | __Valentino404()gmail_com | | BE27E56E8D6B9D3B84120804CA1C3564DA70827D | 2018-12-19 22:00:00 | Bestrddd | ArubaCloud Limited | 1 | 0 | 185.43.209.236 | 9001 | 0.3.4.9 | no please | | BE27F22046D89A1EAD690C9C291F7AE85B9025DA | 2018-12-20 15:00:00 | Unnamed | INTERNET CZ, a.s. | 1 | 0 | 185.33.144.196 | 9001 | 0.3.4.9 | NULL | | E7D8A8B5FA3CA3B668F12B5D46AB0DE94B9A9C1D | 2018-12-16 22:00:00 | Unnamed | Aruba SAS | 1 | 0 | 185.8.50.188 | 9001 | 0.3.4.9 | NULL | | E7D8B9141E5EF11526D34DC231DD32297BC3F904 | 2018-12-19 16:00:00 | FlashGordon | Aruba S.p.A. | 1 | 0 | 80.211.253.88 | 9001 | 0.3.4.9 | sinsincytyATprotrityDOTnet | | E7D8F1E61D068E7681EE81D6AFC7862FEB29D261 | 2018-12-18 20:00:00 | Andersen | ArubaCloud Limited | 1 | 0 | 185.43.209.114 | 9001 | 0.3.4.9 | NULL | +------------------------------------------+---------------------+--------------+--------------------+-------+------+----------------+---------+-------------+---------------------------------+ If you are an .onion operator I'd like to encourage you to switch to onion services version 3 so we can start dropping onion version 2 services eventually. -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

1 0

Metrics show Relay down
by Darek Kramin 25 Dec '18

25 Dec '18

hi, I did started 2 days ago tor relay. when I set daily accounting was ok and now with weekly set of GB relay is listed down. It is a glitch or my misconfiguration. Relay is named dasBoot at IP 46.175.238.8 brgds darek -- Cpt D.Kramin +48 505 135145

1 0

35C3 Tor Relay Operators Meetup
by 35C3 35C3 23 Dec '18

23 Dec '18

Hi nicoo, since you organized the tor relay operators meetups during the last few years at the CCC I was wondering if you will continue with that this year as well? If so, it would be great if we could get - a slightly bigger room than we had last year - a room with a beamer (Roger will not be there this year as he previously mentioned) The 35C3 wiki is not available yet. thank you!

2 2

Extreme Exit Policy
by John Ricketts 21 Dec '18

21 Dec '18

All, I am considering only allowing ports 53, 80, and 443 only. Discussion? John Ricketts Quintex Alliance Consulting

8 13

Re: [tor-relays] consensus-health.html and fallback dirs
by starlight.2018q2＠binnacle.cx 21 Dec '18

21 Dec '18

Ran the script: output is attached to this message for anyone interested. Live-network test results will vary by time and by the location of tester. Attached run was made over Tor itself using 'torsocks'. I was bit by having disabled the unencrypted DIR port for one day recently as an experiment. >Felix zwiebel at quantentunnel.de >Sun Dec 16 10:03:33 UTC 2018 > >>> I wonder how we can come from 116 running fallbacks to 155 within >>> one week (without a new release) > >Am 16.12.2018 um 08:01 schrieb starlight.2018q2 at binnacle.cx: >> The cause is >> >> https://gitweb.torproject.org/tor.git/commit/?id=78e177d622f5f3b24023d04458… > >Ah, great! This makes sense. It's a transient to the list update. > > > >> https://trac.torproject.org/projects/tor/ticket/24803 > >The upcoming one seems to be: >https://trac.torproject.org/projects/tor/ticket/28795 > >-- >Cheers, Felix >

2 1

Advice for new exit relay
by dns1983＠riseup.net 20 Dec '18

20 Dec '18

Hi, excuse my bad english. I would run an exit relay on a virtual server. For now i run just a non exit relay on my own mini server. I don't like too much do not have full control on the server, but, for me, it is the only way to run an exit relay. How do I know which service allow me to customize WHOIS records, so I can put my email address on report abuse section? Could you suggest me some providers that offer unlimited monthly data too? Regards Gigi

2 4

How to use a bridge configured with "ORport auto" within Tails?
by Toralf Förster 20 Dec '18

20 Dec '18

The Tails installer asked me for the bridge line (a bridge maintained by myself), but didn't accepted the ":auto" behind the ip address. I do wonder how to proceed? -- Toralf PGP C4EACDDE 0076E94E

2 3

Why are my relays flagged?
by Langrehr, Jan Christian 20 Dec '18

20 Dec '18

Hello everyone, I'm wondering why both of my Tor relays are flagged for running an unstable or outdated version or Tor. I'm running my relays on Ubuntu 18.04 and I get Tor from the deb https://deb.torproject.org/torproject.org bionic main repository. Both of my relays run Tor version 0.3.4.8. My relays are https://metrics.torproject.org/rs.html#details/9EDA50493B537837E72D83090BE4… and https://metrics.torproject.org/rs.html#details/8E57A56487EEA341965B77AE132E… I'm looking forward for an anwser. Thank you all very much

3 2

Re: [tor-relays] consensus-health.html and fallback dirs
by starlight.2018q2＠binnacle.cx 16 Dec '18

16 Dec '18

The cause is https://gitweb.torproject.org/tor.git/commit/?id=78e177d622f5f3b24023d04458… https://trac.torproject.org/projects/tor/ticket/24803 Would be appreciated if the Tor project published outputs of UpdateFallbackDirs.py job runs used when rebuilding the list. Thus operators who have expended effort to keep their relays eligible will know why when dropped. >Felix zwiebel at quantentunnel.de >Sat Dec 15 23:59:03 UTC 2018 > >Hi everybody > >Reading [1] shows the following statistics about the fallback dirs: > >Dec 5: >Running 116 >Not Running 0 >Missing 34 > >Dec 13: >Running 155 >Not Running 0 >Missing 2 > >Today (Dec 16) shows: >Running 151 >Not Running 0 >Missing 6 > >I wonder how we can come from 116 running fallbacks to 155 within one >week (without a new release): > > >Then I checked for some fallbacks and found: > >The relay with the fp F9246DEF2B653807236DA134F2AEAB103D58ABFE was a >fallback acc. fallback_dirs.inc until around 3.2.8rc, then it changed >ip. It is still in 2.9.x lts but with the old ip, recommended but >actually useless. > >Since around Dec 13 it is listed again [1] where it wasn't through 2018. > >The same with 8FA37B93397015B2BC5A525C908485260BE9F422. > >Are the two relays newly counted as running in [1], where they are >useless because of the changed ips? The new ips aren't in any >fallback_dirs.inc's and [2] shows no fallback flag. >Would thereby [1] look better than it is? > > >[1] https://consensus-health.torproject.org/consensus-health.html >[2] https://metrics.torproject.org/rs.html#details/F9246DEF2B653807236DA134F2AE… > >-- >Cheers, Felix

2 1

Re: [tor-relays] [OrNetRadar] NickPrefix: "AYAYA" (9)
by nusenu 16 Dec '18

16 Dec '18

Hello "AYAYA" relays > 2018-12-15 > > | Up | Ext | JoinTime | Nickname | Version | IP | AS | CC | ORp | Dirp | OS | Contact | eFamMembers | FP | > |------+-------+------------+------------+-----------+---------------+---------------+------+-------+--------+-------+-----------+---------------+------------------------------------------| > | 1 | 0 | 11:23:45 | AYAYA43 | 0.2.9.14 | 51.15.88.206 | Online S.a.s. | fr | 9001 | 9030 | Linux | None | 1 | D0BADF4222F4CE7DF6D91A772E391E29FDEA82FB | > | 1 | 0 | 11:24:20 | AYAYA46 | 0.2.9.14 | 51.15.113.238 | Online S.a.s. | fr | 9001 | 9030 | Linux | None | 1 | A4D98EE5916240F1AC6348174C40848B4C7F7C0C | > | 1 | 0 | 11:23:45 | AYAYA52 | 0.2.9.14 | 51.15.71.128 | Online S.a.s. | fr | 9001 | 9030 | Linux | None | 1 | 25C3DEAE9AA786559DBB072D0470D1A6FC408846 | > | 1 | 0 | 11:23:45 | AYAYA6 | 0.2.9.14 | 51.15.78.215 | Online S.a.s. | fr | 9001 | 9030 | Linux | None | 1 | BED1681C0DDEF5DE7B8A65E2603D262FE3B1DB59 | > | 1 | 0 | 11:23:45 | AYAYA64 | 0.2.9.14 | 51.15.43.15 | Online S.a.s. | nl | 9001 | 9030 | Linux | None | 1 | F6F70FEB215929701E027B9A436A38347D377367 | > | 1 | 0 | 11:23:44 | AYAYA70 | 0.2.9.14 | 51.15.85.153 | Online S.a.s. | fr | 9001 | 9030 | Linux | None | 1 | 64FDE6159C134C606A24ADBA7A3E9A66F3810465 | > | 1 | 0 | 11:23:45 | AYAYA8 | 0.2.9.14 | 51.15.35.170 | Online S.a.s. | nl | 9001 | 9030 | Linux | None | 1 | B9A1E0C135464554ACCE036A9B5AB6F9469A9703 | > | 1 | 0 | 11:23:45 | AYAYA90 | 0.2.9.14 | 51.15.83.14 | Online S.a.s. | fr | 9001 | 9030 | Linux | None | 1 | CCD5C2E7FABACCF8CD84BCDC8E689584881545B8 | > | 1 | 0 | 11:23:46 | AYAYA98 | 0.2.9.14 | 51.15.116.94 | Online S.a.s. | fr | 9001 | 9030 | Linux | None | 1 | 706A24208BE86E84B850ECAF42EC293CECE1ECC1 | > > https://nusenu.github.io/OrNetRadar/2018/12/15/a1 -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

1 0

consensus-health.html and fallback dirs
by Felix 15 Dec '18

15 Dec '18

Hi everybody Reading [1] shows the following statistics about the fallback dirs: Dec 5: Running 116 Not Running 0 Missing 34 Dec 13: Running 155 Not Running 0 Missing 2 Today (Dec 16) shows: Running 151 Not Running 0 Missing 6 I wonder how we can come from 116 running fallbacks to 155 within one week (without a new release): Then I checked for some fallbacks and found: The relay with the fp F9246DEF2B653807236DA134F2AEAB103D58ABFE was a fallback acc. fallback_dirs.inc until around 3.2.8rc, then it changed ip. It is still in 2.9.x lts but with the old ip, recommended but actually useless. Since around Dec 13 it is listed again [1] where it wasn't through 2018. The same with 8FA37B93397015B2BC5A525C908485260BE9F422. Are the two relays newly counted as running in [1], where they are useless because of the changed ips? The new ips aren't in any fallback_dirs.inc's and [2] shows no fallback flag. Would thereby [1] look better than it is? [1] https://consensus-health.torproject.org/consensus-health.html [2] https://metrics.torproject.org/rs.html#details/F9246DEF2B653807236DA134F2AE… -- Cheers, Felix

1 0

17 new relays at OVH (2018-10-24)
by nusenu 13 Dec '18

13 Dec '18

Hi, if you are the operator that added 17 new relays at OVH on 2018-10-24 (full list bellow), please set a ContactInfo and especially the MyFamily in your torrc to avoid putting tor clients at risk. kind regards, nusenu > added on 2018-10-24 > > | Up | Ext | JoinTime | IP | CC | ORp | Dirp | Version | Contact | Nickname | eFamMembers | FP | > |------+-------+------------+---------------+------+-------+--------+-----------+---------------------------+--------------------+---------------+------------------------------------------| > | 1 | 0 | 13:43:16 | 145.239.0.204 | de | 443 | 0 | 0.3.4.8 | None | Chief | 1 | 5EF464D06322614A3B8B6C2652C3C616F098EE8A | > | 1 | 0 | 13:43:17 | 54.37.200.155 | fr | 443 | 0 | 0.3.4.8 | None | Dash | 1 | B55F8445569407FBE6BAF205799A9EF8AC8CC256 | > | 1 | 0 | 13:43:18 | 51.68.170.247 | fr | 443 | 0 | 0.3.4.8 | None | Rebel | 1 | E7B036D933D6E0A68983E8E3F664EAA54ACDEA37 | > | 1 | 0 | 13:43:20 | 51.75.82.166 | fr | 443 | 0 | 0.3.4.8 | None | Butch | 1 | 4809E3F9A73F5373734A4D23E7E7807A4743DD8A | > | 1 | 0 | 13:43:21 | 51.75.153.17 | fr | 443 | 0 | 0.3.4.8 | None | Beauty | 1 | B66FBE3B2D9CE257AF75DEA760C69E379F7CDB80 | > | 1 | 0 | 13:43:22 | 51.68.170.74 | fr | 443 | 0 | 0.3.4.8 | None | Killer | 1 | E4CB0C293588C3E5FA7DB94485FF2686E128267F | > | 1 | 0 | 13:43:23 | 51.68.185.141 | fr | 443 | 0 | 0.3.4.8 | None | Arrow | 1 | 707F51E232E0CDAF64EC446609E7112CD3AD11F8 | > | 1 | 0 | 13:43:24 | 54.37.207.82 | fr | 443 | 0 | 0.3.4.8 | None | Dazzle | 1 | B80142DDCF8D6B72929541EFCC643ECCD99BEE36 | > | 1 | 0 | 13:50:41 | 145.239.1.97 | de | 443 | 0 | 0.3.4.8 | None | Memo | 1 | 1C514FA1A4F8A464E1853B70AA5D2F16FF087AD2 | > | 1 | 0 | 13:50:42 | 51.38.107.122 | fr | 443 | 0 | 0.3.4.8 | None | Pitch | 1 | 91B026FA459AE0DA15673AB07A9C6DFF8B41782B | > | 1 | 0 | 13:50:43 | 51.68.186.59 | fr | 443 | 0 | 0.3.4.8 | None | Smasher | 1 | 3B0EFDE689693CFDEC2305F7B99D5B2FA4A77D91 | > | 1 | 0 | 13:50:44 | 51.75.85.114 | fr | 443 | 0 | 0.3.4.8 | None | Landslide | 1 | C953A4C8DF0E233CB0D190C2A71B71F634AB4A14 | > | 1 | 0 | 13:50:45 | 51.68.182.30 | fr | 443 | 0 | 0.3.4.8 | None | Shade | 1 | EBE58DDCC51A9D23EE9DD39791695B608A1DFB29 | > | 1 | 0 | 13:50:46 | 54.37.207.37 | fr | 443 | 0 | 0.3.4.8 | None | Buster | 1 | D10C82E275A2B0121CF4075C92687F0786A72892 | > | 1 | 0 | 13:50:47 | 54.37.200.157 | fr | 443 | 0 | 0.3.4.8 | None | Digger | 1 | 6B29A78EEB42D318290DB60C6A2EDC714F1BAD42 | > | 1 | 0 | 13:50:48 | 54.37.207.84 | fr | 443 | 0 | 0.3.4.8 | None | Pipi | 1 | 150F7C9F4814C4918F4D2DEAA0C7A2255DC8C0E0 | > | 1 | 0 | 13:50:49 | 51.75.153.19 | fr | 443 | 0 | 0.3.4.8 | None | Shrimp | 1 | 51429A0F427A8DCB5B9DE64E35ECBBB76DAB0F7F | -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

2 1

AS: "OVH SAS" - 17 relays (2018-10-24)
by nusenu 13 Dec '18

13 Dec '18

a relay gang joined in Oct 2018 at OVH 2018-10-24 | Up | Ext | JoinTime | IP | CC | ORp | Dirp | Version | Contact | Nickname | eFamMembers | FP | |------+-------+------------+---------------+------+-------+--------+-----------+---------------------------+--------------------+---------------+------------------------------------------| | 1 | 0 | 13:43:16 | 145.239.0.204 | de | 443 | 0 | 0.3.4.8 | None | Chief | 1 | 5EF464D06322614A3B8B6C2652C3C616F098EE8A | | 1 | 0 | 13:43:17 | 54.37.200.155 | fr | 443 | 0 | 0.3.4.8 | None | Dash | 1 | B55F8445569407FBE6BAF205799A9EF8AC8CC256 | | 1 | 0 | 13:43:18 | 51.68.170.247 | fr | 443 | 0 | 0.3.4.8 | None | Rebel | 1 | E7B036D933D6E0A68983E8E3F664EAA54ACDEA37 | | 1 | 0 | 13:43:20 | 51.75.82.166 | fr | 443 | 0 | 0.3.4.8 | None | Butch | 1 | 4809E3F9A73F5373734A4D23E7E7807A4743DD8A | | 1 | 0 | 13:43:21 | 51.75.153.17 | fr | 443 | 0 | 0.3.4.8 | None | Beauty | 1 | B66FBE3B2D9CE257AF75DEA760C69E379F7CDB80 | | 1 | 0 | 13:43:22 | 51.68.170.74 | fr | 443 | 0 | 0.3.4.8 | None | Killer | 1 | E4CB0C293588C3E5FA7DB94485FF2686E128267F | | 1 | 0 | 13:43:23 | 51.68.185.141 | fr | 443 | 0 | 0.3.4.8 | None | Arrow | 1 | 707F51E232E0CDAF64EC446609E7112CD3AD11F8 | | 1 | 0 | 13:43:24 | 54.37.207.82 | fr | 443 | 0 | 0.3.4.8 | None | Dazzle | 1 | B80142DDCF8D6B72929541EFCC643ECCD99BEE36 | | 1 | 0 | 13:50:41 | 145.239.1.97 | de | 443 | 0 | 0.3.4.8 | None | Memo | 1 | 1C514FA1A4F8A464E1853B70AA5D2F16FF087AD2 | | 1 | 0 | 13:50:42 | 51.38.107.122 | fr | 443 | 0 | 0.3.4.8 | None | Pitch | 1 | 91B026FA459AE0DA15673AB07A9C6DFF8B41782B | | 1 | 0 | 13:50:43 | 51.68.186.59 | fr | 443 | 0 | 0.3.4.8 | None | Smasher | 1 | 3B0EFDE689693CFDEC2305F7B99D5B2FA4A77D91 | | 1 | 0 | 13:50:44 | 51.75.85.114 | fr | 443 | 0 | 0.3.4.8 | None | Landslide | 1 | C953A4C8DF0E233CB0D190C2A71B71F634AB4A14 | | 1 | 0 | 13:50:45 | 51.68.182.30 | fr | 443 | 0 | 0.3.4.8 | None | Shade | 1 | EBE58DDCC51A9D23EE9DD39791695B608A1DFB29 | | 1 | 0 | 13:50:46 | 54.37.207.37 | fr | 443 | 0 | 0.3.4.8 | None | Buster | 1 | D10C82E275A2B0121CF4075C92687F0786A72892 | | 1 | 0 | 13:50:47 | 54.37.200.157 | fr | 443 | 0 | 0.3.4.8 | None | Digger | 1 | 6B29A78EEB42D318290DB60C6A2EDC714F1BAD42 | | 1 | 0 | 13:50:48 | 54.37.207.84 | fr | 443 | 0 | 0.3.4.8 | None | Pipi | 1 | 150F7C9F4814C4918F4D2DEAA0C7A2255DC8C0E0 | | 1 | 0 | 13:50:49 | 51.75.153.19 | fr | 443 | 0 | 0.3.4.8 | None | Shrimp | 1 | 51429A0F427A8DCB5B9DE64E35ECBBB76DAB0F7F | https://nusenu.github.io/OrNetRadar/2018/10/24/a3 -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

2 1

Current state of HSDir attacks on hidden services
by Jonathan D. Proulx 13 Dec '18

13 Dec '18

Hi All, The recent thread on ColoCrossing nodes[1] has gotten me wondering about the current state of HSDir attacks on hidden sites my web searching has only turned up some articles that are a few years old. Is it really still the case that spending a little time crafting the "right" finger prints i sall it takes for an adversary to reliably host the HSDir for a given hidden service? Well and 4-5 days uptime... Assuming the new ColoCrossing nodes are maliciously target ina particular hidden service is it just their sloppiness of putting them all up in the same place over a short period rather than in a slower and more widely distributed manner the only thing that prevented them from acheving their unmasking goals? Seems like it would be trivial for even a moderately funded attacker to put up 16-32 nodes across a similar number of hosting providers, https://www.terraform.io framework for example seems to support about 37 different "cloud providers" so finding that number of unique providers isn't really hard. If they also set them up at semirandom intervals over the course of a month or so who could ever tell? -Jon -- [1] https://lists.torproject.org/pipermail/tor-relays/2018-December/016712.html

2 2

Re: [tor-relays] Current state of HSDir attacks on hidden services
by Isaac Grover, Aileron I.T. 13 Dec '18

13 Dec '18

Good morning Jon, In addition to fingerprint correlation and AS choice, I also recall reading this paper about identifying hidden services using clock skew based on internal CPU temperature: https://murdoch.is/papers/ccs06hotornot.pdf . The paper is older, but I'm curious if such an attack method is still effective? Make your day great, Isaac Grover, Senior I.T. Consultant Aileron I.T. - " Because #ProactiveIsBetter " O: 715-377-0440<tel:715-425-0440>, F:715-690-1029<tel:715-690-1029>, W: www.aileronit.com<http://www.aileronit.com/> LinkedIn: https://www.linkedin.com/in/IsaacGrover/ YouTube: https://www.youtube.com/channel/UCqrwZNFKdR-guKtuQzFPObQ

1 0

AS: "ColoCrossing" - 28 new relays
by nusenu 12 Dec '18

12 Dec '18

these relays look rather strange and are likely operated by a single entity, watch out. 2018-12-10 | Up | Ext | JoinTime | IP | CC | ORp | Dirp | Version | Contact | Nickname | eFamMembers | FP | |------+-------+------------+----------------+------+-------+--------+---------------+---------------------------+--------------+---------------+------------------------------------------| | 1 | 0 | 03:18:23 | 23.95.85.216 | us | 9447 | 0 | 0.3.5.5-alpha | bddwwell6_at_gmail_com | Bottom00S | 1 | C00BF86148C5391530FAFB550BD79706BCB55EB7 | | 1 | 0 | 03:26:38 | 107.173.70.100 | us | 10401 | 0 | 0.3.5.5-alpha | _bch440w AT yeezee.io | Porksoundz | 1 | C00BCA7A0EE03FD6E8B9BBBE1D9250DC2194EFD9 | | 1 | 0 | 03:36:15 | 107.173.70.107 | us | 15888 | 0 | 0.3.5.5-alpha | look4dotme at-hotmail.com | PLZTornode | 1 | C00B7102C5E1CF4F18CB529F05830FCCC1BDC611 | | 1 | 0 | 03:58:30 | 172.245.97.224 | us | 9700 | 0 | 0.3.5.5-alpha | abaubum@ mail_com | LikeTORLike | 1 | 2D56F86ABB41462E1CAA58F55F0BA15E843B5FDB | | 1 | 0 | 04:16:08 | 198.46.182.191 | us | 10534 | 0 | 0.3.5.5-alpha | fofalafel_gmail_com | RedSBoll999 | 1 | 2D56F2422C0DC5BA859E9167321314A26B1557C6 | | 1 | 0 | 04:20:57 | 23.95.0.211 | us | 13013 | 0 | 0.3.5.5-alpha | crab33s(a)yahoo.com | ifufcrab | 1 | 2D56FB048E4838534CA3F5276591632A64FE99F5 | | 1 | 0 | 05:23:14 | 107.173.70.105 | us | 12712 | 0 | 0.3.5.5-alpha | evertme2_atmail_net | ihaZtordrunk | 1 | 2EBFF85DAEB4CB84A117F801801BE9A536AE7524 | | 1 | 0 | 05:31:33 | 23.95.85.216 | us | 9404 | 0 | 0.3.5.5-alpha | __do_wwoo_rry___at__gmail | UKNOWnoto | 1 | 48A3DD64243F50550ABEFA1EB73D8D50E701C370 | | 1 | 0 | 06:27:32 | 172.245.97.194 | us | 12059 | 0 | 0.3.5.5-alpha | distorikATgmail.COM | erRHeroes | 1 | 2EBFFE2CBC8F1AC47EF3406B8010BDBDD9A83084 | | 1 | 0 | 06:32:40 | 107.173.70.103 | us | 11930 | 0 | 0.3.5.5-alpha | strapaganzza at mail.net | nerevgiuap | 1 | 48A3F20EA43CC7B4B124D3F8894795D31A3F90E4 | | 1 | 0 | 07:20:14 | 107.173.70.100 | us | 9902 | 0 | 0.3.5.5-alpha | painkillsde __AT__gmail_c | coldBloodT | 1 | 48A3F9E9990FB122839DD301D2195E2040DFD02F | | 1 | 0 | 08:28:44 | 107.173.70.104 | us | 9581 | 0 | 0.3.5.5-alpha | grave345235(a)gm__ail.com | rEPlace3r | 1 | AA08AE727D782C71930D828C4236CB2434E559C6 | | 1 | 0 | 08:33:40 | 107.173.70.102 | us | 16870 | 0 | 0.3.5.5-alpha | nneoodww9 at mail.com | Historitian | 1 | 8788B1A28148ABD7C48ADF00791BBE795BC4A282 | | 1 | 0 | 09:17:47 | 107.173.70.105 | us | 9292 | 0 | 0.3.5.5-alpha | ultimost_gmail_at | Bailarumba | 1 | AA088A35AFC64BE27806EB4CEB8DA059F157EBD9 | | 1 | 0 | 09:21:48 | 198.46.182.211 | us | 13873 | 0 | 0.3.5.5-alpha | augllsdn4(a)gmail.com | lighTOR | 1 | 878874CD42DE8695A0C02B6A5385E18638C0F95A | | 1 | 0 | 09:55:11 | 198.46.182.191 | us | 14037 | 0 | 0.3.5.5-alpha | elistranoob AT gmail dot. | ChOue | 1 | AA08CE96617B2D3B6F4753805B6C8244E07A40E9 | | 1 | 0 | 10:01:14 | 107.173.70.107 | us | 11389 | 0 | 0.3.5.5-alpha | to_me_baby at yahoo.com | bagarabild | 1 | 8788AAB8C1E28693C30CFC4159EE0F313C25D610 | | 1 | 0 | 15:30:33 | 107.173.70.10 | us | 9075 | 0 | 0.3.5.5-alpha | besktrsop(a)gmail.com | TorpDay | 1 | A099DAA630AC76F03FBB6138E2EBA884151E8706 | | 1 | 0 | 15:34:27 | 23.95.85.215 | us | 17563 | 0 | 0.3.5.5-alpha | bebe_rexa AT nomail.com | RepeldeVay | 1 | FB346238C8FCB515A49F53049D0129BF69EAD7CA | | 1 | 0 | 15:39:48 | 198.46.182.208 | us | 15199 | 0 | 0.3.5.5-alpha | pokerspot1(a)yahoo.com | delldivision | 1 | A099ED2475CE64280119ECDE46EA414931014540 | | 1 | 0 | 15:43:46 | 192.227.155.34 | us | 14413 | 0 | 0.3.5.5-alpha | justnomail1 AT gmail com | elitor00 | 1 | FB34E30229A265047A6A136AECA4CBBAA88EA12E | | 1 | 0 | 15:48:34 | 107.173.70.102 | us | 18204 | 0 | 0.3.5.5-alpha | spint000r_AT_jepajio.io | SPintro | 1 | A099DBA1456E1A185613DE047F728BA48D8CB79B | | 1 | 0 | 16:21:19 | 172.245.97.194 | us | 17781 | 0 | 0.3.5.5-alpha | mustamus3d_at_gmail_ | mustaHesh | 1 | FB347A7601D71BA4F929C27EDCC2A9B168DF0B79 | 2018-12-09 | Up | Ext | JoinTime | IP | CC | ORp | Dirp | Version | Contact | Nickname | eFamMembers | FP | |------+-------+------------+----------------+------+-------+--------+---------------+---------------------------+-------------+---------------+------------------------------------------| | 1 | 0 | 11:48:20 | 23.95.85.215 | us | 15349 | 0 | 0.3.5.5-alpha | vejj2dw_at_gmail.com | Veloprises | 1 | A677EE072DA6F8E6E902EC4B6CE35AE78CF450B6 | | 1 | 0 | 12:11:32 | 107.173.70.106 | us | 12001 | 0 | 0.3.5.5-alpha | yeeeyahoo dog yooh.net | nightmareON | 1 | A677EA1818F2EC649B583CBDD8F30AF3B7A09A23 | | 1 | 0 | 12:21:13 | 23.95.0.211 | us | 10509 | 0 | 0.3.5.5-alpha | meyuo AT school DOT ymail | DinoSource0 | 1 | A677F3CC1019AB162174CBB58C803E4C17268CD4 | | 1 | 0 | 13:42:45 | 107.173.70.101 | us | 11766 | 0 | 0.3.5.5-alpha | LOTOLOT_at yahoo.com | L0t0siaa | 1 | D021F4D88E2A87A184D72EC0FC7558DB29D161F5 | | 1 | 0 | 14:01:04 | 192.227.155.34 | us | 13968 | 0 | 0.3.5.5-alpha | chemie333 AT_vfmail.net | Hemabab3 | 1 | D021FF49FEF26D36C27E68C1A89E6F237DCDF5AC | -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

8 11

Monitoring a Tor-Relay - Telegraf / InfluxDB / Grafana ?
by petrarca＠protonmail.ch 08 Dec '18

08 Dec '18

I was thinking about setting up a monitoring of a Tor-Relay using Telegraf, InfluxDB and Grafana. Although I did read quite some documenation about it already I thought it might be good to check for possible experiences made here before spending (wasting) too much time trying it out myself. Questions I could not answer yet myself include e.g. - What will be the performance impact of running Telegraf on a Tor-Realy (CPU, disk, I/O,...)? - What happens if the InfluxDB (running on another system) is not reachable (maintenance, outages) - is the data lost or buffered somehow? - I would like to also keep see old/historical data but not as granular as more recent data - is there any way to boild down old data, e.g. to only keep hourly data for data older that a month etc.? There are an overwhelmingly number of monitoring possibilities (munin, collecd, monit, nyx, RRDtool, Cacti, Monitorix, Nagios, Zabbix,...) out there and one could easily spend days if not weeks with reading and testing. So any kind of shared experiences, hints or tips are more than welcome. .

3 2

Re: [tor-relays] Monitoring a Tor-Relay - Telegraf / InfluxDB / Grafana ?
by Olaf Grimm 08 Dec '18

08 Dec '18

For a tor relay that is not neccessary. After I thought about this in the past I decided it so after local watching. Now I use "htop" and "bwm-ng", "nload" and "nyx" via SSH on the remote server. You can use the website "uptime monitor" if you want to get a mail after server crash or other network errors. My preference is the tor monitoring network https://metrics.torproject.org. Why you want to use a big monitoring solution? If your tor relay is a second paylod on the server this ist ok, but this is not the right discussion channel here. Olaf Am 08.12.18 um 10:01 schrieb petrarca(a)protonmail.ch: > I was thinking about setting up a monitoring of a Tor-Relay using Telegraf, InfluxDB and Grafana. Although I did read quite some documenation about it already I thought it might be good to check for possible experiences made here before spending (wasting) too much time trying it out myself. > > Questions I could not answer yet myself include e.g. > > - What will be the performance impact of running Telegraf on a Tor-Realy (CPU, disk, I/O,...)? > - What happens if the InfluxDB (running on another system) is not reachable (maintenance, outages) - is the data lost or buffered somehow? > - I would like to also keep see old/historical data but not as granular as more recent data - is there any way to boild down old data, e.g. to only keep hourly data for data older that a month etc.? > > There are an overwhelmingly number of monitoring possibilities (munin, collecd, monit, nyx, RRDtool, Cacti, Monitorix, Nagios, Zabbix,...) out there and one could easily spend days if not weeks with reading and testing. So any kind of shared experiences, hints or tips are more than welcome. > > . > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

Re: [tor-relays] Who is permanently checking my bridge relay?
by teor 05 Dec '18

05 Dec '18

Hi, > On 4 Dec 2018, at 21:27, tschador(a)posteo.de wrote: > > Hi all! > > I wonder who is permanently connecting/checking(?) my Tor bridge relay. > The ip is 66.111.2.129 and the period of the connects are 21 min 21 sec, > e.g.: > > Dec 4 10:32:00 SRC=66.111.2.129 > Dec 4 10:53:21 SRC=66.111.2.129 > Dec 4 11:14:43 SRC=66.111.2.129 > Dec 4 11:36:04 SRC=66.111.2.129 > Dec 4 11:57:26 SRC=66.111.2.129 > Dec 4 12:18:52 SRC=66.111.2.129 > > https://metrics.torproject.org/rs.html#search/66.111.2.129 gives no match. > > Any more experiences with other bridges? A few years ago, I opened a ticket to randomise authority reachability testing: https://trac.torproject.org/projects/tor/ticket/13928 But we triaged it out with the comment: My rationale for redlining it during triage was that the best place to do unpredictable-order testing is probably in a successor to torflow. (sbws is a successor to torflow, and it does randomise the testing order.) Are there any good reasons to randomise the order of authority tests? One good reason is that it breaks patterns in the authority checks, so relays really do need to be up all the time to be listed as reachable. T

1 0

IP addresses on the list
by Charly Ghislain 05 Dec '18

05 Dec '18

We have seen ip addresses posted on this list recently. They were coming from the logs. I think it would be nice if the software powering this list could scramble all ips in message bodies. At least having to reformat them in order to avoid that filter would give the poster some time to realize if it is a good idea to post it in the first place. I am also questioning myself whether addresses should be printed in log files altogether. Maybe even with the unsafe flag on - at least for released versions. If one wants to know which ip is connecting to her bridge, she can use whatever network capture software already existing. Any opinion? Thanks, Charly

3 2

Re: [tor-relays] Who is permanently checking my bridge relay?
by Charly Ghislain 04 Dec '18

04 Dec '18

If it wasn't, would posting the ip address of a client connecting to a bridge in here compromise her anonymity and/or allow one to firewall/blacklist her traffic? Im assuming one could guess the ip address of the running bridge based on the poster email address. On Tue, Dec 4, 2018 at 2:57 PM <tschador(a)posteo.de> wrote: > On 2018-12-04 13:15, George wrote: > > > tschador(a)posteo.de: > > >> I wonder who is permanently connecting/checking(?) my Tor bridge relay. > > > > > > That's the bridge directory authority. > > Ok, thank you. > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >

4 5

Fwd: Throughput of each circuit
by marziyeh latifi 04 Dec '18

04 Dec '18

Hello,I have two questions about tor's relay: 1-How can I calculate the throughput of each circuit in a relay?I mean that how can I calculate the number of cells that are sent from circuit queue to the output buffer per second in each relay? 2-What is the difference between circuit and channel in relays? I'm looking forward to hearing from you! thanks! Marziyeh

3 2