- tor-relays - lists.torproject.org

9 routing security recommendations for relay operators
by nusenu 04 Sep '18

04 Sep '18

(mostly a copy paste from [0]) 1. Monitor your relay’s BGP prefix for suspicious BGP activity and share alerts with this mailing list. The easiest way to do so is to subscribe to your prefixes using https://bgpmon.net/. You should practically get zero alerts. 2. Check the following properties of the prefixes you use (ideally even before ordering servers): prefix length and IRR state [1] RPKI state [2] 3. Ask your ISP/IP holder to create ROAs [4] for the prefixes you use, if the ROA is currently missing. 4. Ensure the ROA creator is aware of the risks of the maxlength attribute [3] and uses it accordingly (in the best case not at all) 5. Monitor the RPKI validity state of your prefixes (can also be done with bgpmon) 6. Ask your ISP to announce the IP space of your relays in /24 prefixes (/48 for IPv6) to avoid more-specific prefix hijacks (this makes sense even if you have ROAs in place due to the low ROV coverage) 7. If your relay uses IP addresses from the RIPE region: ask your provider to create route(6) objects matching the announcements if they are not present yet. You can use RIPEstat’s prefix routing consistency widget [1] to check the current state (the “In RIS” and “RIPE IRR” columns should both say “yes”). 8. Be aware that “LEGACY” or “ERX” IP space might be less likely to get ROAs by your ISP 9. Enable IPv6 on your relays [0] https://medium.com/@nusenu/how-vulnerable-is-the-tor-network-to-bgp-hijacki… [1] https://stat.ripe.net/widget/prefix-routing-consistency [2] https://rpki-validator.ripe.net/bgp-preview [3] https://www.youtube.com/watch?v=I3Owb0u8Wuk [4] https://www.ripe.net/manage-ips-and-asns/resource-management/certification/… https://www.arin.net/resources/rpki/using_rpki.html -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

1 0

relayor v18.1.0 is released
by nusenu 04 Sep '18

04 Sep '18

Hi, relayor v18.1.0 is released. relayor helps you with running relays with minimal effort (automate everything). https://github.com/nusenu/ansible-relayor Changes since v18.0.0: ------------------------------ - enable NoExec by default on all platforms except CentOS - increase min. ansible version from 2.5.3 to v2.6.2 - fix the ExitPolicy format in the example playbook - change default shipped exit policy (remove POP3, IMAP and kerberos ports) - change the ControlSocket location -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

1 0

Unmeasured - 69D9FF1BE14B9AE77701A6BCBC075FF837F5AFF9
by Dark Matter 03 Sep '18

03 Sep '18

Greetings, my relay 69D9FF1BE14B9AE77701A6BCBC075FF837F5AFF9 (darkmatter) recently (3 days) received an Unmeasured flag and is considered to be offline. I could not detect any issues on my side and wondered if you could help me to resolve this. Best regards, Dark

2 1

Relay operators meetup part #2 @ Onionspace, Berlin
by Vasilis 03 Sep '18

03 Sep '18

Dear Tor friends and relay operators, Next Saturday (25/08/18) a follow-up relay operators meetup will take place at Onionspace, Berlin. The meetup will start at 16:00 and depending on the weather we may move afterwards to the garden. When: Saturday, August 25th, 2018 Start Time: 16:00 / 4:00 PM Where: Gottschedstrasse 4, Entrance 4, 13357 Berlin (U Nauener Platz), Onionspace Map: https://www.openstreetmap.org/#map=18/52.54978/13.36991 Event link: https://blog.torproject.org/events/tor-friends-and-relay-operators-meetup-2… Hope to see many of you there. Cheers, ~Vasilis -- Fingerprint: 8FD5 CF5F 39FC 03EB B382 7470 5FBF 70B1 D126 0162 Pubkey: https://pgp.mit.edu/pks/lookup?op=get&search=0x5FBF70B1D1260162

1 1

Exit in Turkey blocking torproject (komm EA93C), BadExit, Node Subscription Services, Censorship
by grarpamp 03 Sep '18

03 Sep '18

This particular case receiving mentions for at least a few months... D1E99DE1E29E05D79F0EF9E083D18229867EA93C kommissarov 185.125.33.114 The relay won't [likely] be badexited because neither it nor its upstream is shown to be doing anything malicious. Simple censorship isn't enough. And except for such limited censorship, the nodes are otherwise fully useful, and provide a valuable presence inside such regions / networks. Users, in such censoring regimes, that have sucessfully connected to tor, already have free choice of whatever exits they wish, therefore such censorship is moot for them. For everyone else, and them, workarounds exist such as,,, https://onion.torproject.org/ http://yz7lpwfhhzcdyc5y.onion/ search engines, sigs, vpns, mirrors, etc Further, whatever gets added to static exitpolicy's might move out from underneath them or the censor, the censor may quit, or the exit may fail to maintain the exitpolicy's. None of which are true representation of the net, and are effectively censorship as result of operator action even though unintentional / delayed. Currently many regimes do limited censorship like this, so you'd lose all those exits too for no good reason, see... https://ooni.torproject.org/ https://en.wikipedia.org/wiki/Internet_censorship_and_surveillance_by_count… And arbitrarily hamper spirits, tactics, and success of volunteer resistance communities and operators in, and fighting, such regimes around the world. And if the net goes chaotic, majority of exits will have limited visibility, for which exitpolicy / badexit are hardly manageable solutions either, and would end up footshooting out many partly useful yet needed exits as well. If this situation bothers users, they can use... SIGNAL NEWNYM, New Identity, or ExcludeExitNodes. They can also create, maintain and publish lists of whatever such classes of nodes they wish to determine, including various levels of trust, contactability, verification, ouija, etc... such that others can subscribe to them and Exclude at will. They can further publish patches to make tor automatically read such lists, including some modes that might narrowly exclude and route stream requests around just those lists of censored destination:exit pairings. Ref also... https://metrics.torproject.org/rs.html#search/as:AS197328%20flag:exit https://metrics.torproject.org/rs.html#search/country:tr%20flag:exit In the subect situations, you'd want to show that it is in fact the exit itself, not its upstream, that is doing the censorship. Or that if fault can't be determined to the upstream or exit, what would be the plausible malicious benefit for an exit / upstream to block a given destination such that a badexit is warranted... a) Frustrate and divert off 0.001% of Turk users smart enough to use tor, chancing through tor client random exit selection of your blocking exit, off to one of the workarounds that you're equally unlikely to control and have ranked, through your exit vs one of the others tor has open? b) Prop up weird or otherwise secretly bad nodes on the net, like the hundreds of other ones out there, for which no badexit or diverse subscription services yet exist to qualify them? c) ??? Or that some large number of topsites were censored via singular or small numbers of exits / upstreams so as to be exceedingly annoying to the network users as a whole, where no other environment of such / chaotic widespread annoyance is known to exist at the same time.

12 25

Policy Question: Tor Exits at Universities, Corporate Networks, etc
by Nathaniel Suchy 02 Sep '18

02 Sep '18

Recently we've been discussing a Tor Exit in Turkey censoring access to various websites. It's less to some err, disagreements on what should and should not be allowed. I've seen a few opinions: *) It grants an outside view at what Turkey censors *) It could push new tor users away This leads me to question if it's okay for a Tor Exit to be on a censored network are the following scenarios now allowed? *) A Tor Exit behind a Corporate Network and Web Filter *) A Tor Exit behind a University Network and Web Filter Under the logic with the Turkey exit relay it should be right? Cordially, Nathaniel

5 5

Message to devs, please don't change log strings
by gustavo 02 Sep '18

02 Sep '18

Hi In the last few months I started to monitor more closely my relays parsing their logs, but every new update changes the log strings. Can the devs be mindful to relay ops and not change strings needlessly? Here is an example 0.3.3.9 Sep 1 00:01:32 serverhostname tor[15341]: Sep 01 00:01:32.042 [notice] 0.3.something Sep 1 00:01:32 serverhostname Tor[15341]: Sep 01 00:01:32.042 [notice] 0.2.9 Sep 1 00:01:32 serverhostname Tor[15341]: [notice] I'm logging to syslog thanks! -- IRC: gfa GPG: 0X44BB1BA79F6C6333

3 3

Tor Meetup Hamburg, August 31st
by Alexander Dietrich 01 Sep '18

01 Sep '18

Hi everyone, we would like to invite people interested in the Tor project and relay operators in the Hamburg area to meet at the CCC Hamburg. There will be an introduction to Tor, a Q&A session and a brief announcement about a future Hamburg-based Tor association. We would love for relay operators to meet and discuss ways of strengthening the network. When: Friday, August 31st, 6:00 PM Where: CCC Hamburg, Zeiseweg 9 ( https://hamburg.ccc.de/#wegbeschreibung ) WWW: https://hamburg.ccc.de/2018/08/20/tor-meet-up-beim-ccchh-index/ Be seeing you, Alexander -- PGP Key: https://dietrich.cx/pgp | 0x52FA4EE1722D54EB

3 3

Abuse Complaints
by Paul Templeton 31 Aug '18

31 Aug '18

Question: are exit operators seeing many abuse complaints now days? I have only had one in the last two months from 5 exits. I used to see a lot now nothing really. I just find it weird. Paul 137CF322859E400455E457DB920F65FFDD222CDF

9 14

log "Is your outbound address the same as your relay address?"
by Tim Kuijsten 30 Aug '18

30 Aug '18

Hi, I just setup a new relay[0]. One of the messages I got is the following: "Your relay has a very large number of connections to other relays. Is your outbound address the same as your relay address? Found 12 connections to 8 relays. Found 12 current canonical connections, in 0 of which we were a non-canonical peer. 4 relays had more than 1 connection, 0 had more than 2, and 0 had more than 4 connections." When I had setup another relay last week[1] I got the same message, and it didn't reappear so I assume this is about starting up a new relay and is nothing to worry about. I just thought I'd let you know. The hostnames of both machines matches the public dns and reverse dns names. Furthermore each machine has only one public ipv4 address, which is also set in it's local /etc/hosts file. At one machine I had set "Address" in the torrc as well, but this didn't avoid getting this message once. Kind regards, Tim [0] tosk B183A69592D2E8C8C487C054D0849E3C9561DC11 [1] kali 2C76951164C5184A3B8B7CC1914B34E4622B225F

2 1

Test bed in MyFamily?
by Totor be 30 Aug '18

30 Aug '18

Hi list, Just a quick question about families: I'm in the process of setting up a 4th relay as test bed VM in order to validate the Linux and Tor updates before updating my 3 live relays (none of these are exits) This 4th relay will be fully operational, but will only be started from time to time, when updates are available After the updates are installed, I plan to leave it running for half a day or so until it appears in Tor Metrics Question: should I include this test bed relay in MyFamily or leave it completely stand alone? What would you recommend? Thanks! Patrick

4 4

Limiting open port RST response from N to M packets/sec (FreeBSD)
by nusenu 30 Aug '18

30 Aug '18

Hi, I'm curious as to how frequent FreeBSD relay operators that do not make use of any packet filter get something like the following line in their logs: kernel: Limiting **open** port RST response from ... to 200 packets/sec -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

2 1

Cloudflare Onions Beta and Network Stability
by Nathaniel Suchy 30 Aug '18

30 Aug '18

As some of you may have heard, Cloudflare is beta testing opportunistic onions. This of course is going to create more Tor traffic. Cloudflare has several concerns about running their own relays and says they won’t at this time. That said if every Cloudflare website becomes an Onion Service overnight how would that affect network stability and what can we as relay operators do to prepare for it?

11 17

The truth about Greypony
by Tor Professional 29 Aug '18

29 Aug '18

The truth must come out eventually about the menace known as Greypony. Now that people are beginning to realize what a menace to our network Greypony really is maybe this information will finally get us to banish him once and for all. Greypony has no real customers. You will not find a legitimate customer because they do not exist. They are all one Conrad Rockenhaus. Just so you know. Do you know any of the people that are bragging about using Greypony? Are they true professionals that use Tor? I do not think so. Find one person that you can legitimately trust that has used Greypony or that has dealt with Rockenhaus legitimately and you will not find one because such a person does not exist. Greypony lies about their bandwidth numbers. Those numbers are impossible. How are they eclipsing some of the fastest tor exits on the Internet? How are they operating the fastest exits in Canada? By lying about their numbers and cheating. What are Rockenhaus' motives for doing this? He says he wants to help Tor but we all know that he is full of it. Why would someone like him want to help us? We do not need someone like him. We can do better. We are better. Let us apply a little chemotherapy to the cancer and kill off Greypony.

3 4

Re: [tor-relays] Individual Operator Exit Probability Threshold
by Paul Templeton 28 Aug '18

28 Aug '18

> About finding sponsors for high speed exits, it could be nice > to gather ideas. Can I ask what is a high speed/capacity exit? For me it would be >10MiB/s am I correct? Paul

4 6

[release] ExoneraTor 3.0.1
by Karsten Loesing 28 Aug '18

28 Aug '18

Hi relay operators, today we released ExoneraTor 3.0.1 which fixes links to IP addresses in the same /24 or /48 IP network (#27266). This is also the first release after making several code improvements, which ideally should not affect operation. But just in case something breaks that was previously working, this could be the reason. Please direct any comments or questions to the (public) metrics-team mailing list: https://lists.torproject.org/cgi-bin/mailman/listinfo/metrics-team All the best, Karsten

1 0

Protecting Tor Circuit path selection from correlation attacks by an autonomous system
by Nathaniel Suchy 28 Aug '18

28 Aug '18

This thread continues the broader discussion of Tor Circuit path selection discussed at https://lists.torproject.org/pipermail/tor-relays/2018-August/015994.html regarding possible correlation attacks by an autonomous system. *Current measures include:* * Preventing two relays from the same /16 in IPv4 and /32 in IPv6 networks, from being in the same Tor circuit. CIDR is helpful, but is it enough? * The MyFamily directive, this does rely on relay operators being honest and we shouldn't rely on this as the sole indicator. * Others things that I am not aware of? *Some measures worth considering include:* * Preventing two relays in the same ASN from being in a circuit. * Maybe prevent two relays in the same ASN from being Guard and Exit, excluding the middle relay from this calculation. * Bridges could be a challenge when implementing this, although it's not impossible. * Looking at relays with same/similar names, heuristics maybe? It's really guesswork but hey it might work. * Looking at relays with same/similar contact info * Looking at relays in the same geographic regions and avoiding them * Relays with the same non-standard ports - excluding 9001, 9030, 80, 443 (anything else that's super common?) * On device models looking at the above data to make decisions of which relays are most likely run by the same entity, use machine learning to make an informed decision based on all factors maybe? *Papers worth reviewing:* * AS-awareness in Tor Path Selection https://www.freehaven.net/anonbib/cache/DBLP:conf/ccs/EdmanS09.pdf * Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries https://www.ohmygodel.com/publications/usersrouted-ccs13.pdf * Moving Tor Circuits Towards Multiple-Path: Anonymity and Performance Considerations https://pdfs.semanticscholar.org/aa94/7dd4762bd0f6531bacfeac9d29ef1e1d4cd6.… * Avoiding The Man on the Wire: Improving Tor’s Security with Trust-Aware Path Selection https://www.nrl.navy.mil/itd/chacs/sites/www.nrl.navy.mil.itd.chacs/files/p… *Outside the scope:* * In AS-es where Virtual Machines are sold, and Physical Machines are not. It's quite possible that the provider may steal relay keys. Little research exists where you could successfully protect against such an adversary who isn't playing nice. Legislation (For example, GDPR) in the EU exists where such activity may violate local laws. This may or may not be enough. Certainly not against a government actor, but against an AS doing it per their only devices maybe. * An AS hosting a Tor relay who logs or watches network traffic will always be able to learn something about the circuit, but perhaps we can prevent them from learning everything about the circuit most of the time. Everyone on the list has a had very insightful and helpful thoughts on this discussion so far and I'm looking forward to getting more discussion of the broader issue. Cordially, Nathaniel Suchy

2 1

Avoiding Off-Topic Posts
by teor 28 Aug '18

28 Aug '18

Hi, A healthy, robust, and growing tor network needs a lot of different ways to run tor relays. Focusing on one or two models creates single points of failure. So we encourage individual volunteers, organisations, donations, paid services, and researchers: as long as they operate ethically and prioritise user safety. That said, this list is for "support and questions about running Tor relays". In future, please: * keep on topic, we are here to help each other run Tor relays * make sure each post contains new, useful information. You can search the archives before posting: https://lists.torproject.org/pipermail/tor-relays/ * avoid promoting or criticising the same providers more than once a month * deal with commercial / payment issues off-list But you should feel free to ask questions about operating relays at any time. T -- teor Please reply @torproject.org New subkeys 1 July 2018 PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ----------------------------------------------------------------------

1 0

Issues regarding 185.125.33.114 relay
by Nathaniel Suchy 27 Aug '18

27 Aug '18

Can the operator of the relay 185.125.33.114 please reach out to me? There is not any contact information available on Tor Metrics for the relay. Cordially, Nathaniel Suchy

3 2

Congrats to Nullvoid
by Conrad Rockenhaus 27 Aug '18

27 Aug '18

I just wanted to say congratulations to Nullvoid, who is currently running the second fastest exit in France in my colo in Europe. https://metrics.torproject.org/rs.html#details/51420DFB2047A33803A9A6E456D6… Also, go FreeBSD! Thanks, Conrad

4 5

Re: [tor-relays] Individual Operator Exit Probability Threshold
by livak 25 Aug '18

25 Aug '18

Hi ! In a an older thread I read: > Like Teor mentioned, it's important for operators to increase capacity > and stability, while still meaningfully supporting diversity. Emerald > Onion is not going to surpass 10% of exit capacity without first > helping ~10 other groups set up and manage their own 1%+ relays. As > more and more high-capacity groups come online, I think orgs like > Quintex and Emerald Onion can slowly increase capacity but stick > around the 10% line. Is there any help for setting up new high capacity exit relays ? Livak Sent with [ProtonMail](https://protonmail.com) Secure Email.

4 6

Yay, Complaints
by Conrad Rockenhaus 25 Aug '18

25 Aug '18

So, new equipment gets plugged into a colo…. I’m a dude that was looking to increase AS diversity on Tor and well, decided to add a new colo to the mix. Two exit relays are brought online on properly SWIPed IP addresses. These exit relays have only been online for about 24 hours. An organization, known as Irdeto Intelligence, ignores the fact that the IP addresses are SWIPed and sends abuse complaints to my upstream providers asking them to straighten me out, because I’m a pox on society because people are torrenting via Tor. They have sent over 40 emails in the last 12 hours. Some dude-man, who calls himself a “Network Security Administrator” who asked me to explain what Tor is……….because he’s a Network Security Administrator……..has told me that due to the volume of complaints I need to block the offending applications from their network. I told him that I spoke with them prior to bringing this stuff online, explained what Tor was, explained what a Tor exit was, explained that it will generate complaints, explained the DCMA liability, explained the whole thing…..and was told that they were okay with it. I’m sorry for the bitching and moaning…it’s just another case of doing everything right and now I’m quite worried that they’ll not only pull the plug, that I’ll have to fight to get my Cisco UCS blade server back (and other assorted equipment) which is totally not going to be cool. Conrad

6 9

Freebsd trial with greypony.it was a success
by zimmer linux 24 Aug '18

24 Aug '18

Hi, Conrad Rockenhaus - with your guidance and support with freebsd, within just 21 days total running time, you have helped me set up and manage the fastest exit relay in all of Canada. See https://metrics.torproject.org/rs.html#search/country:ca%20flag:exit https://metrics.torproject.org/rs.html#details/D9B1E08CC91F7F42EEE5578EA8B0… Give yourself a pat on the back. If anyone wants to talk through running a freebsd relay, feel free to contact me off list. Zim

1 0

Snowflake PT
by Nathaniel Suchy 24 Aug '18

24 Aug '18

Hi everyone, Tor Browser 8 Alpha includes the Snowflake PT as it comes near a final release, the adoption and usage of the Snowflake PT will continue to rise. I now have the following questions... 1) Will a command line tool like an obfs4proxy come out so those of us with infrastructure can run high capacity snowflake bridges. 2) Is the goal to replace OBFS4 with Snowflake or will they continue to co-exist? 3) How does Snowflake attempt to obfuscate, if at all it's traffic? How strong is the cryptography compared to obfs4proxy Looking forward to learning more about this :) Cordially, Nathaniel Suchy

3 7

Dropping packets with TCP MSS=1400 to foil GFW active probing
by David Fifield 22 Aug '18

22 Aug '18

A paper from FOCI 2018 by Arun Dunna, Ciarán O'Brien, and Phillipa Gill on the subject of Tor bridge blocking in China has this interesting suggestion (Section 5.2): https://www.usenix.org/conference/foci18/presentation/dunna To do this, we write a series specific rules using iptables in order to drop packets from Chinese scanners. ... We use a rule to drop incoming Tor packets with an MSS of 1400. Further investigation would be needed to analyze potential false positives... We note that this method of dropping scan traffic successfully keeps our bridge relays from being blocked and allows our client in China to maintain access to the bridge. Like https://github.com/NullHypothesis/brdgrd, surely this trick won't work forever, but if you're setting up a new bridge, it's worth a try? This is completely untested, but I think the iptables rule would look something like this: iptables -A INPUT --protocol tcp --dport [your-bridge-port] -m tcpmss --mss 1400 -j DROP Then, after a while, check /var/lib/tor/stats/bridge-stats and see if you have any connections from "cn".

3 6