- tor-relays - lists.torproject.org

Contact info on exit notice page?
by Isaac Grover, Aileron I.T. 10 Sep '18

10 Sep '18

Good morning fellow exit node operators, I am considering adding a dedicated email address (not this one) to be used for my exit nodes on the exit notice pages, where currently none exist. After reading this list for over two years and the stories of DMCA notices, court orders, etc., would an email address on the page provide some benefit to those parties who need to send complaints and piracy violations, or would it only attract more spam? Make your day great, Isaac Grover, Senior I.T. Consultant Aileron I.T. - "Practical & Proactive I.T. Solutions" Office: 715-377-0440, Fax:715-690-1029, Web: www.aileronit.com

2 1

Difference Between "Number of Routers" And "Number Of Descriptors"
by Keifer Bly 10 Sep '18

10 Sep '18

Hi, So upon checking my relay status at torstatus.blutimage.de, I saw Number of Routers In Cache: Number of Descriptors In Cache: I wanted to double check, what is the difference between “Number of Routers” and “Number of Descriptors”? I know Number of Routers means number of relays currently running. Thank you.

2 1

Reminder: Meeting in #tor-relays
by Colin Childs 10 Sep '18

10 Sep '18

Hi everyone, As promised, this is a reminder email that we will be holding our first IRC relay operator meeting this week! When: September 11th @ 1:00AM UTC Where: irc.oftc.net <http://irc.oftc.net/> @ #tor-relays You can confirm your local date / time by visiting the following page, and selecting your timezone from the dropdown menu: https://www.worldtimeserver.com/convert_time_in_UTC.aspx?y=2018&mo=9&d=11&h… <https://www.worldtimeserver.com/convert_time_in_UTC.aspx?y=2018&mo=9&d=11&h…> See everyone there!

1 0

Suspension of service (ISP Scaleway / tor exit)
by Olaf Grimm 08 Sep '18

08 Sep '18

Dear readers, some days ago I change my relay to an exit relay with a very strict policy. Today came the suspension message into my regular mail account. After login into the Scaleway account I saw that the time between the abuse log message and the deactivation of my exit relay were 6 hours only. At these time I was at work! I was not able to react of the message, neither I knew it. The "abuse message" was a raw firewall log, without spaces hard to read. I'm not a professional, so I could read only "SYNFLOOD src IP xxxx dest IP xxxx". That's all. After I learnt what this is, I responded to the provider that good providers realize own DDOS protection in the network and protect customers too. Why log the provider bad outgoing traffic and ignore bad incoming traffic? They don't know the source of the bad traffic, but have the customer to beat someone! The answer field for the reply were some lines only. Without comment from the ISP the ticket was closed and the VPS locked yet. I try to delete the old instance and build a new one. If the same occur I leave Scaleway (and give info about that again). Now I recommend to set the ISP Scaleway (in France) of the list of bad providers. Scaleway message: Hello, We have tried to contact you about an abuse report concerning one of your server. Unfortunately at this time you did not reply to this report. As stated in our terms of service, we have suspended your account. Sincerly, Scaleway End message To avoid a big shitstorm: I know what I do and it is not my first and only exit. Scaleway was the first trouble and in such a way, that I must leave a comment. To the tor website editors: It is possible to include a basic abuse protection chapter in the tor documentation (config guide)? I've found some iptable rules, but I use the user-friedly "ufw", the overlay to iptables. It would be fine if some good guys could help with an easy configuration guide in the config chapter for tor relays. Have a good time. I feel me better. Olaf

5 6

Lets increase Routing Security for Tor related BGP Prefixes
by nusenu 06 Sep '18

06 Sep '18

Hi, I measured the adoption of RPKI ROAs that help with routing security and some other properties for the >3k BGP prefixes that make up the Tor network. https://medium.com/@nusenu/how-vulnerable-is-the-tor-network-to-bgp-hijacki… You might want to jup directly to section "Recommendations for Tor Relay Operators". (I could paste it here but then all the URLs would be lost) Since OVH SAS and DO do not deploy ROAs at all yet: If you are an OVH SAS or Digital Ocean customer (directly or indirectly just on the same AS) it would be great if you could ask your customer support when they are planing to deploy RPKI ROAs (like other big hosters already did). thanks, nusenu -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

3 8

4 of Conrad Rockenhaus trial servers are in the top ten exit relays for Canada
by zimmer linux 06 Sep '18

06 Sep '18

Hi, Just to let you know that following on with the one month trial with tor exit relays that Conrad kindly offered, at least four of his exit relays are now in the top 10 listing for Canada, out of 68 Canadian exit relays. https://metrics.torproject.org/rs.html#search/country:ca%20flag:exit Well done to Conrad - I say. The more, the merrier. If you want any help with setting up your own FreeBSD tor exit relay, feel free to contact me off list. Zim

13 31

Possible problem with NYX
by arisbe 05 Sep '18

05 Sep '18

Hello ops, Today I noticed something on NYX that I find disturbing. Page 2 (list of inbound/outbound connections) showed me the IP address of an inbound connection on one of my bridges! Not the authority. This is crazy as these are indicated as <scrubbed>:port for the users protection! I have never seen this before and haven't seen it since. Of course, on low usage bridges, the connection IP address can possibly be disseminated from netstat but that's not the point. It's my sense that this should never happen. I get chills imagining this happening on a guard relay operated by an antagonist ! ! I'm using the default NYX configuration on Ubuntu server 18.04.1 LTS, Tor 0.3.3.9. Arisbe -- One person's moral compass is another person's face in the dirt.

4 5

new exit relay 4AEBDC4710D2C34FE02AB2A660B62B2A9EE97C5C
by deep.thought＠riseup.net 05 Sep '18

05 Sep '18

Dear fellow relay operators, we are a loose collective of students inside AS553 (Universität Stuttgart) running one node there. At the moment, we are not allowed to run any nodes since two abuse complaints attracted too much attention to the NOC. The complaints were probably triggered by the well-known DDOS problems a few months ago. After all, the cloud operator was not amused at all but we are in the process of getting back our right to run middle relays in AS553 to support AS diversity. However, we are happy to announce a new exit node: 4AEBDC4710D2C34FE02AB2A660B62B2A9EE97C5C (howdoyouturnthison) in AS24940 (Hetzner) running on FreeBSD with a local DNS cache. We are aware of the fact that this is not supporting AS diversity but still better than no relay :) So far and thanks for all the fish, Random Person

4 4

FW: Re: [AusNOG] Dutton decryption bill
by I 05 Sep '18

05 Sep '18

1 0

Re: [tor-relays] Congrats to Nullvoid
by Paul 05 Sep '18

05 Sep '18

For me running several FreeBSD relays this is a great hint! Maybe it will find its way to https://trac.torproject.org/projects/tor/wiki/TorRelayGuide/FreeBSD > Not a problem with FreeBSD. > > Switch over to https and latest... > > /etc/pkg/FreeBSD.conf: > > url: "pkg+https://pkg.FreeBSD.org/${ABI}/latest", > > and run 'pkg upgrade' . > Could you please explain a bit more on this - what exactly to do ? > If it's a shared box, you probably also want > devcpu-data, and optionally cpupdate.

3 5

The Assistance and Access Bill 2018
by Paul Templeton 05 Sep '18

05 Sep '18

On a satire note - https://www.youtube.com/watch?v=eW-OMR-iWOE But seriously - https://www.homeaffairs.gov.au/about/consultations/assistance-and-access-bi… And - https://www.homeaffairs.gov.au/about/national-security/five-country-ministe… The thing that worries me is that this bill will probably go through and it can hoover up relay operators. That is they can force you to add/develop tools to eavesdrop on you. Is there any real defense against this bill? IE having a parameter in the torrc that would act like a canary? Paul 137CF322859E400455E457DB920F65FFDD222CDF

7 8

SSH login attempts
by Marcus Wahle 05 Sep '18

05 Sep '18

Dear all, Since 14:00 my logs (middle node) are spamed with around 100 faild ssh login attemps from different ips. Is there anybody else affected? Best regards Marcus

14 14

Multi node management programs/platforms?
by Isaac Grover, Aileron I.T. 04 Sep '18

04 Sep '18

Good evening, For those of you who manage multiple exits and/or relays, what program/platform do you use to manage them? Make your day great, Isaac Grover, Senior I.T. Consultant Aileron I.T. - "Practical & Proactive I.T. Solutions" Office: 715-377-0440, Fax:715-690-1029, Web: www.aileronit.com

9 11

9 routing security recommendations for relay operators
by nusenu 04 Sep '18

04 Sep '18

(mostly a copy paste from [0]) 1. Monitor your relay’s BGP prefix for suspicious BGP activity and share alerts with this mailing list. The easiest way to do so is to subscribe to your prefixes using https://bgpmon.net/. You should practically get zero alerts. 2. Check the following properties of the prefixes you use (ideally even before ordering servers): prefix length and IRR state [1] RPKI state [2] 3. Ask your ISP/IP holder to create ROAs [4] for the prefixes you use, if the ROA is currently missing. 4. Ensure the ROA creator is aware of the risks of the maxlength attribute [3] and uses it accordingly (in the best case not at all) 5. Monitor the RPKI validity state of your prefixes (can also be done with bgpmon) 6. Ask your ISP to announce the IP space of your relays in /24 prefixes (/48 for IPv6) to avoid more-specific prefix hijacks (this makes sense even if you have ROAs in place due to the low ROV coverage) 7. If your relay uses IP addresses from the RIPE region: ask your provider to create route(6) objects matching the announcements if they are not present yet. You can use RIPEstat’s prefix routing consistency widget [1] to check the current state (the “In RIS” and “RIPE IRR” columns should both say “yes”). 8. Be aware that “LEGACY” or “ERX” IP space might be less likely to get ROAs by your ISP 9. Enable IPv6 on your relays [0] https://medium.com/@nusenu/how-vulnerable-is-the-tor-network-to-bgp-hijacki… [1] https://stat.ripe.net/widget/prefix-routing-consistency [2] https://rpki-validator.ripe.net/bgp-preview [3] https://www.youtube.com/watch?v=I3Owb0u8Wuk [4] https://www.ripe.net/manage-ips-and-asns/resource-management/certification/… https://www.arin.net/resources/rpki/using_rpki.html -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

1 0

relayor v18.1.0 is released
by nusenu 04 Sep '18

04 Sep '18

Hi, relayor v18.1.0 is released. relayor helps you with running relays with minimal effort (automate everything). https://github.com/nusenu/ansible-relayor Changes since v18.0.0: ------------------------------ - enable NoExec by default on all platforms except CentOS - increase min. ansible version from 2.5.3 to v2.6.2 - fix the ExitPolicy format in the example playbook - change default shipped exit policy (remove POP3, IMAP and kerberos ports) - change the ControlSocket location -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

1 0

Unmeasured - 69D9FF1BE14B9AE77701A6BCBC075FF837F5AFF9
by Dark Matter 03 Sep '18

03 Sep '18

Greetings, my relay 69D9FF1BE14B9AE77701A6BCBC075FF837F5AFF9 (darkmatter) recently (3 days) received an Unmeasured flag and is considered to be offline. I could not detect any issues on my side and wondered if you could help me to resolve this. Best regards, Dark

2 1

Relay operators meetup part #2 @ Onionspace, Berlin
by Vasilis 03 Sep '18

03 Sep '18

Dear Tor friends and relay operators, Next Saturday (25/08/18) a follow-up relay operators meetup will take place at Onionspace, Berlin. The meetup will start at 16:00 and depending on the weather we may move afterwards to the garden. When: Saturday, August 25th, 2018 Start Time: 16:00 / 4:00 PM Where: Gottschedstrasse 4, Entrance 4, 13357 Berlin (U Nauener Platz), Onionspace Map: https://www.openstreetmap.org/#map=18/52.54978/13.36991 Event link: https://blog.torproject.org/events/tor-friends-and-relay-operators-meetup-2… Hope to see many of you there. Cheers, ~Vasilis -- Fingerprint: 8FD5 CF5F 39FC 03EB B382 7470 5FBF 70B1 D126 0162 Pubkey: https://pgp.mit.edu/pks/lookup?op=get&search=0x5FBF70B1D1260162

1 1

Exit in Turkey blocking torproject (komm EA93C), BadExit, Node Subscription Services, Censorship
by grarpamp 02 Sep '18

02 Sep '18

This particular case receiving mentions for at least a few months... D1E99DE1E29E05D79F0EF9E083D18229867EA93C kommissarov 185.125.33.114 The relay won't [likely] be badexited because neither it nor its upstream is shown to be doing anything malicious. Simple censorship isn't enough. And except for such limited censorship, the nodes are otherwise fully useful, and provide a valuable presence inside such regions / networks. Users, in such censoring regimes, that have sucessfully connected to tor, already have free choice of whatever exits they wish, therefore such censorship is moot for them. For everyone else, and them, workarounds exist such as,,, https://onion.torproject.org/ http://yz7lpwfhhzcdyc5y.onion/ search engines, sigs, vpns, mirrors, etc Further, whatever gets added to static exitpolicy's might move out from underneath them or the censor, the censor may quit, or the exit may fail to maintain the exitpolicy's. None of which are true representation of the net, and are effectively censorship as result of operator action even though unintentional / delayed. Currently many regimes do limited censorship like this, so you'd lose all those exits too for no good reason, see... https://ooni.torproject.org/ https://en.wikipedia.org/wiki/Internet_censorship_and_surveillance_by_count… And arbitrarily hamper spirits, tactics, and success of volunteer resistance communities and operators in, and fighting, such regimes around the world. And if the net goes chaotic, majority of exits will have limited visibility, for which exitpolicy / badexit are hardly manageable solutions either, and would end up footshooting out many partly useful yet needed exits as well. If this situation bothers users, they can use... SIGNAL NEWNYM, New Identity, or ExcludeExitNodes. They can also create, maintain and publish lists of whatever such classes of nodes they wish to determine, including various levels of trust, contactability, verification, ouija, etc... such that others can subscribe to them and Exclude at will. They can further publish patches to make tor automatically read such lists, including some modes that might narrowly exclude and route stream requests around just those lists of censored destination:exit pairings. Ref also... https://metrics.torproject.org/rs.html#search/as:AS197328%20flag:exit https://metrics.torproject.org/rs.html#search/country:tr%20flag:exit In the subect situations, you'd want to show that it is in fact the exit itself, not its upstream, that is doing the censorship. Or that if fault can't be determined to the upstream or exit, what would be the plausible malicious benefit for an exit / upstream to block a given destination such that a badexit is warranted... a) Frustrate and divert off 0.001% of Turk users smart enough to use tor, chancing through tor client random exit selection of your blocking exit, off to one of the workarounds that you're equally unlikely to control and have ranked, through your exit vs one of the others tor has open? b) Prop up weird or otherwise secretly bad nodes on the net, like the hundreds of other ones out there, for which no badexit or diverse subscription services yet exist to qualify them? c) ??? Or that some large number of topsites were censored via singular or small numbers of exits / upstreams so as to be exceedingly annoying to the network users as a whole, where no other environment of such / chaotic widespread annoyance is known to exist at the same time.

12 25

Policy Question: Tor Exits at Universities, Corporate Networks, etc
by Nathaniel Suchy 02 Sep '18

02 Sep '18

Recently we've been discussing a Tor Exit in Turkey censoring access to various websites. It's less to some err, disagreements on what should and should not be allowed. I've seen a few opinions: *) It grants an outside view at what Turkey censors *) It could push new tor users away This leads me to question if it's okay for a Tor Exit to be on a censored network are the following scenarios now allowed? *) A Tor Exit behind a Corporate Network and Web Filter *) A Tor Exit behind a University Network and Web Filter Under the logic with the Turkey exit relay it should be right? Cordially, Nathaniel

5 5

Message to devs, please don't change log strings
by gustavo 02 Sep '18

02 Sep '18

Hi In the last few months I started to monitor more closely my relays parsing their logs, but every new update changes the log strings. Can the devs be mindful to relay ops and not change strings needlessly? Here is an example 0.3.3.9 Sep 1 00:01:32 serverhostname tor[15341]: Sep 01 00:01:32.042 [notice] 0.3.something Sep 1 00:01:32 serverhostname Tor[15341]: Sep 01 00:01:32.042 [notice] 0.2.9 Sep 1 00:01:32 serverhostname Tor[15341]: [notice] I'm logging to syslog thanks! -- IRC: gfa GPG: 0X44BB1BA79F6C6333

3 3

Tor Meetup Hamburg, August 31st
by Alexander Dietrich 01 Sep '18

01 Sep '18

Hi everyone, we would like to invite people interested in the Tor project and relay operators in the Hamburg area to meet at the CCC Hamburg. There will be an introduction to Tor, a Q&A session and a brief announcement about a future Hamburg-based Tor association. We would love for relay operators to meet and discuss ways of strengthening the network. When: Friday, August 31st, 6:00 PM Where: CCC Hamburg, Zeiseweg 9 ( https://hamburg.ccc.de/#wegbeschreibung ) WWW: https://hamburg.ccc.de/2018/08/20/tor-meet-up-beim-ccchh-index/ Be seeing you, Alexander -- PGP Key: https://dietrich.cx/pgp | 0x52FA4EE1722D54EB

3 3

Abuse Complaints
by Paul Templeton 30 Aug '18

30 Aug '18

Question: are exit operators seeing many abuse complaints now days? I have only had one in the last two months from 5 exits. I used to see a lot now nothing really. I just find it weird. Paul 137CF322859E400455E457DB920F65FFDD222CDF

9 14

log "Is your outbound address the same as your relay address?"
by Tim Kuijsten 30 Aug '18

30 Aug '18

Hi, I just setup a new relay[0]. One of the messages I got is the following: "Your relay has a very large number of connections to other relays. Is your outbound address the same as your relay address? Found 12 connections to 8 relays. Found 12 current canonical connections, in 0 of which we were a non-canonical peer. 4 relays had more than 1 connection, 0 had more than 2, and 0 had more than 4 connections." When I had setup another relay last week[1] I got the same message, and it didn't reappear so I assume this is about starting up a new relay and is nothing to worry about. I just thought I'd let you know. The hostnames of both machines matches the public dns and reverse dns names. Furthermore each machine has only one public ipv4 address, which is also set in it's local /etc/hosts file. At one machine I had set "Address" in the torrc as well, but this didn't avoid getting this message once. Kind regards, Tim [0] tosk B183A69592D2E8C8C487C054D0849E3C9561DC11 [1] kali 2C76951164C5184A3B8B7CC1914B34E4622B225F

2 1

Test bed in MyFamily?
by Totor be 30 Aug '18

30 Aug '18

Hi list, Just a quick question about families: I'm in the process of setting up a 4th relay as test bed VM in order to validate the Linux and Tor updates before updating my 3 live relays (none of these are exits) This 4th relay will be fully operational, but will only be started from time to time, when updates are available After the updates are installed, I plan to leave it running for half a day or so until it appears in Tor Metrics Question: should I include this test bed relay in MyFamily or leave it completely stand alone? What would you recommend? Thanks! Patrick

4 4

Limiting open port RST response from N to M packets/sec (FreeBSD)
by nusenu 30 Aug '18

30 Aug '18

Hi, I'm curious as to how frequent FreeBSD relay operators that do not make use of any packet filter get something like the following line in their logs: kernel: Limiting **open** port RST response from ... to 200 packets/sec -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

2 1