- tor-relays - lists.torproject.org

[France] Invitation to HACKarnaval, May 17th
by gus 14 May '18

14 May '18

Hello Tor operators from France! Next thursday, May 17th, some Tor Project contributors are going to be at HACKarnaval, in Paris. Come to say 'bonjour' and meet new friends! :) cheers!, gus * * * * HACKarnaval + Tor Meetup - 17 mai au Musée des Arts et Métiers [HACKarnaval!] est un événement ouvert au publique pour célébrer le “hacking” comme une forme de partage des connaissances. Des techniciens, des chercheurs, des artistes et des bricoleurs de tous les coins du monde proposeront des ateliers, des conférences et des expositions. Rejoignez-nous le jeudi 17 mai au Musée des Arts et Métiers, de 11:00 à 21 heures. Venez explorer les mondes socio-techniques du logiciel, de l'électronique ou du wetware, et discuter des changements qu’ils promettent! https://hackarnaval.online Rencontre Tor https://hackarnaval.online/abstracts-fr/tor-meetup.html Musée des Arts et Métiers 60 rue Réaumur, 75003 Paris Métro : Arts et métiers - Entrée libre ! -- PGP: 427F 2D71 7664 D215 378C B412 8BDC 87FB 7215 E189 XMPP/OTR: 62f58f8062da3e48e0aa076f20807ecb1488658e https://gus.computer/

1 0

Strange BGP activity with my node
by Trevor Ellermann 14 May '18

14 May '18

Hi, I just a notification from my data center that someone is trying to hijack the IP of my exit node. Seems like the sort of thing someone might do when trying to attack Tor. I'm in a very remote area with limited access but any suggestions on actions I should take? ==================================================================== Possible Prefix Hijack (Code: 10) ==================================================================== Your prefix: 204.17.32.0/19: Prefix Description: GBLX-US-BGP Update time: 2018-05-09 12:11 (UTC) Detected by #peers: 1 Detected prefix: 204.17.56.42/32 Announced by: AS200005 (Asavie Technologies Limited) Upstream AS: AS200005 (Asavie Technologies Limited) ASpath: 200005 https://torstatus.blutmagie.de/router_detail.php?FP=383d6e34d9bea92e97092b1… Thanks, --Trevor

5 6

Tor Relay Bandwidth Question
by Keifer Bly 14 May '18

14 May '18

Hello, So I have been away from the computer where my relay is running off of for a few days. I have been wanting to check how much data my relay has been receiving during this time. I check it at http://torstatus.blutmagie.de/router_detail.php?FP=db1af6477bb276b6ea5e7213…, but that only shows how many “bytes” have been sent. I am wondering, is there a way to show this in megabytes / gigabytes? Thank you very much.

3 2

Problem with MyFamily config (doesn't work correctly)
by Olaf Grimm 13 May '18

13 May '18

Dear Tor controllers, For some time now I have relays in different locations and with different systems. All relays have the same torrc, except nickname. The following list shows the excerpt from metrics.torproject.org. Hydra1 (5) Hydra2 (5) Hydra5 (6) Hydra3 (2) Hydra4 (5) Hydra (5) Some time ago I checked all the torrc exactly, if the MyFamily config is correct. All relays have been restarted. Again today. I expect that the number in brackets is equal for all relays in the group. Part of my torrc: (the same for all relays (exerpt nickname), including the own fingerprint) # Hydra MyFamily $E9A31E7EFF7A062AA67DA601CC70605AACF9F385 # Hydra1 MyFamily $0647C3F8352BBFA0D57A1C3E0DCF67FC3E073D2C # Hydra2 MyFamily $B16D271047B18D29F62AE9F3CFC7094258506A03 # Hydra3 MyFamily $A766BF5C5AF7F897D81BD98797B17B1E8C014650 # Hydra4 MyFamily $2D919C1E0DFA4D7760471F971C2CA96E383AEBE0 # Hydra5 MyFamily $3E76E15E6BE6CFF409D44CCC40281AB5BB0B61C2 In the Tor Manual I've found "MyFamily fingerprint,fingerprint,… This option can be repeated many times, for convenience in defining large families: all fingerprints in all MyFamily lines are merged into one list. " With fewer relays in the past I had the variant "MyFamily $KeyID_1,$KeyID_2,$KeyID_3,...". Now this line is longer than the screen is wide. That's why I changed the spelling according the dokumentation. Why does it seem to work in one place while misrepresenting other configs? The correctly displayed one was added last week. Do I interpret the documentation incorrectly that this spelling is possible? How long is the update cycle of the metrics? I think one hour. Nothing happened for days. Now the metrics registered the restart of the relays 1:45h before, but still with the wrong MyFamily ad. Hydra1 (5) 1h 47m Hydra2 (5) 1h 44m Hydra5 (6) 1h 36m Hydra3 (2) 1h 40m Hydra4 (5) 1h 37m Hydra (5) 1h 51m Olaf

2 1

Change Tor's security settings
by dave` dave 13 May '18

13 May '18

There is a way to cancel/change Tor's security settings(which means that i can't use same ip for two parts of the circuit-Guard/Bridge or Middle or Exit) and set him to use the same ip for all his circuit(Guard, middle and exit). and or instead of doing that can i set a specific Middle-Relay?

2 2

what ip,port combinations do Tor clients need?
by Martin Kepplinger 12 May '18

12 May '18

Hi, How does a usable ipset (hash:ip,port) look like, so that it is a whitelist for in/out tcp connections? *Everything* else from/to the outside world is assumed to be dropped. (DNS too). * dir auths from src/or/auth_dirs.inc * fallback dirs from scripts/maint/fallback.whitelist * current guard relays (parsed from a consensus file) anything else? Bonus question: how would you write this whitelist in iptables rules, assuming you have the complete ipset? thanks martin

2 3

PSA regarding Quad9 DNS Resolver
by Nathaniel Suchy (Lunorian) 11 May '18

11 May '18

Like OpenDNS, Quad9 is a censoring DNS resolver and exits using it are / should be considered bad exits. I haven’t seen any exits using it yet however I thought I’d bring it up. Thoughts? Cheers, Nathaniel Sent from my iPhone

4 4

Re: [tor-relays] tor-relays Digest, Vol 88, Issue 13
by flipchan 11 May '18

11 May '18

Great thread! I just use the recommended onces that support dnssec On May 11, 2018 11:55:39 AM UTC, tor-relays-request(a)lists.torproject.org wrote: >Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > >To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > >You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of tor-relays digest..." > > >Today's Topics: > > 1. lets stop using central big DNS resolvers (Google, Level3, > OpenDNS, Quad9, Cloudflare) (nusenu) > 2. Re: lets stop using central big DNS resolvers (Google, > Level3, OpenDNS, Quad9, Cloudflare) (Tyler Durden) > 3. Re: lets stop using central big DNS resolvers (Google, > Level3, OpenDNS, Quad9, Cloudflare) (nusenu) > 4. PSA regarding Quad9 DNS Resolver (Nathaniel Suchy (Lunorian)) > 5. Re: Strange BGP activity with my node (Johan Nilsson) > 6. Re: lets stop using central big DNS resolvers (Google, > Level3, OpenDNS, Quad9, Cloudflare) (Nathaniel Suchy (Lunorian)) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Thu, 10 May 2018 22:16:00 +0000 >From: nusenu <nusenu-lists(a)riseup.net> >To: tor-relays(a)lists.torproject.org >Subject: [tor-relays] lets stop using central big DNS resolvers > (Google, Level3, OpenDNS, Quad9, Cloudflare) >Message-ID: <5e7d99ef-9514-cee4-985f-7f1d4a21dfec(a)riseup.net> >Content-Type: text/plain; charset="utf-8" > >Dear Exit Relay Operators, > >I'd like to invite you to check your exit's DNS resolver by >having a look at the following list of exits using resolvers >outside their AS (especially if it is Google, OpenDNS, Quad9 or >Cloudflare). > >You can search the list for you contactinfo, relay nickname or relay >fingerprint (first 8 characters): > >https://gist.github.com/nusenu/cb766ff7945fafd9f90ee7f211a2508f#file-tor-dn… > > >I extended the "DNS on Exit Relays" section in the Tor Relay Guide >to include specific instructions what is recommended for Tor exit >operators with >regards to DNS on exit relays. > >https://trac.torproject.org/projects/tor/wiki/TorRelayGuide#DNSonExitRelays > >If you found yourself on the list above and changed your DNS to a local >(same host or same AS) >resolver or found a false-positive, please drop me an email (off-list >is also ok). > > >The goal is to be bellow the following thresholds within one year: >- not have any single remoteAS entity control more than 10% exit >capacity >- reduce the overall remoteAS share to bellow 20% exit capacity > >the longer version of this can be found at: >https://medium.com/@nusenu/who-controls-tors-dns-traffic-a74a7632e8ca > >thanks for helping with DNS decentralization on the tor network, >nusenu > >-- >https://mastodon.social/@nusenu >twitter: @nusenu_ > >

1 0

TOR Relay Activity Reset
by Keifer Bly 09 May '18

09 May '18

Hello, for some reason the read/write status of my relay at http://torstatus.blutmagie.de/router_detail.php?FP=db1af6477bb276b6ea5e7213… has been reset to nothing (all flat lines) however the relay is still marked as “running” with it’s current uptime of 11 days 20 hours. I’d also like to note that my relay usually only takes 8 days to get stable flag, however it’s been up for almost 12 days now and that still hasn’t happened. Why might this have happened? Thank you.

2 2

Secret Google and Microsoft Blacklists affecting non tor IPs if on same server.
by gerard＠bulger.co.uk 09 May '18

09 May '18

Secret Google and Microsoft Blacklists affecting non tor IPs if on same server. Just had to shut down my exit temporally while Google sorts out their secret blacklisting system on my innocent non-tor IP. My server has two IPs, not consecutive. One I use for my own email server and public web server, locked tight and private. No relays, no proxy. This IP is not on any blacklist. Second IP is used for TOR alone and forced exit is via this second IP, and only has TOR-use ports open. This IP is not on any blacklist other than being listed as a tor exit. Torrc config has careful port selection, not port 80 except to a single /8 block. 443 open etc. Despite many other ports open, apart from the obvious at risk ones which are blocked, I have had no abuse notices over last year it has been up. Quiet ISP. ISP have no idea as to why Google blocked my IP (despite high traffic from second IP!). Alas it seems that both Google now and Microsoft before tar both IPs with the same brush and reject. Google just stared blocking emails from my domain to all gmail accounts It is a real performance finding out who to contact to undo this block. Microsoft was a pain last year, but this year is it is Google. Google’s own postmaster tools reports no issues about my domain! Alas: Mailog: May 8 20:17:16 server postfix/smtp[4079]: E36533E07F4: host gmail-smtp-in.l.google.com[64.233.166.26] said: 421-4.7.0 [109.228.50.196 15] Our system has detected an unusual rate of 421 -4.7.0 unsolicited mail originating from your IP address. To protect our 421-4.7.0 users from spam, mail sent from your IP address has been temporarily 421-4.7.0 rate limited. Please visit 4 21-4.7.0 https://support.google.com/mail/?p=UnsolicitedRateLimitError to 421 4.7.0 review our Bulk Email Senders Guidelines. o31-v6si13678468wrc.44 - gsmtp (in reply to end of DATA command) Really annoying that my email server IP has never sent anything, no relay, no spam, almost no traffic so what is stated is not true and even their own tools reports nothing. Is Google looking at MAC addresses to do this? How can we stop it? I really do not want to run another server just for tor as that costs! Gerry

3 4

"NoAdvertise" needed for IPv6 DirPort ?
by Toralf Förster 06 May '18

06 May '18

When I started with IPv6 I put this into my torrc: Nickname zwiebeltoralf DirPort 80 ORPort 443 DirPort [2a01:4f8:190:514a::2]:80 NoAdvertise ORPort [2a01:4f8:190:514a::2]:443 Now I do wonder why I needed to add "NoAdvertise§ to the IPv6 port. Any hints? -- Toralf PGP C4EACDDE 0076E94E

3 3

rendezvous on non-OR circuit
by gerard＠bulger.co.uk 05 May '18

05 May '18

What does this error message mean? Is it serious for users and what do I do about it? “ 09:57:16 [WARN] Tried to establish rendezvous on non-OR circuit with purpose Acting as rendevous (pending)” This is on a Ubuntu VPS Tor exit, although exit is limited range IP4 port 80 addresses. Full 443 and others. Exit, Fast, HSDir, Running, Stable, V2Dir, Valid Gerry

2 1

Removal request from fallback directory mirrors list
by Dmitrii Tcvetkov 05 May '18

05 May '18

Hello, Because of latest Digital Ocean billing changes I request to remove relay 774555642FDC1E1D4FDF2E0C31B7CA9501C5C9C7 from fallback directory mirrors list. I will keep it online and updated, but in the long run (year or two) I plan to shutdown it. Thank you all.

2 1

Request for removal of an exit from the consensus
by Nathaniel Suchy (Lunorian) 05 May '18

05 May '18

This is more of a message to the directory authorities. After a discussion with Digitalocean - they will not relent on the bandwidth policy. The server tor-exit-us-1.lunorian.is (Tor Metrics link below) has been turned off for now - if the directory authorities would like further proof to confirm my request please email me. At the end of the month the SSD of the exit will be erased from Digitalocean's systems. I would hate for this exit to gain guard status and then be suddenly removed as it'd negatively impact Tor users. Effected exit: http://rougmnvswfsmd4dq.onion/rs.html#details/DF2E0ABE681206DD886E29D5190F1… Cheers, Nathaniel

2 1

dew questions about Tor-relay
by dave` dave 03 May '18

03 May '18

what is SocksPort, Controlsocket and Exitpolicy and Exitpolicy reject ip address or :*: is in my "torrc" file. can i set in my "torrc" file what ip i dont want/want to connect me?

5 4

DigitalOcean bandwidth billing changes
by Ralph Seichter 02 May '18

02 May '18

Looks like DigitalOcean has just begun measuring bandwidth usage "officially", starting yesterday: https://www.digitalocean.com/community/tutorials/digitalocean-bandwidth-bil… "Based on our analysis of the historical usage patterns of our customers, less than one percent of users will exceed their pooled allowance." I had heard of the One Percent, but never thought I'd become a part of that illustrious group... :-) -Ralph

15 22

Help With Autoupdating Tor Software
by Keifer Bly 02 May '18

02 May '18

Hello, So on Mac OS X, I am using crontab to automatically run a script I wrote for Mac OS High Sierra to automatically update the tor relaying software every day at 1am. The cron command I am using is this: 0 1 * * * /Users/oldimac/Desktop/update\ tor.scpt The script I wrote seems to work fine for updating tor, however it seems to have trouble updating homebrew. Here are the contents of the script: do shell script "$ which brew /usr/local/bin/brew update" do shell script "$ which brew /usr/local/bin/brew upgrade tor" end When the script is run, the output is this: sh: $: command not found Error: tor 0.3.2.10 already installed So it seems to be that it updates tor ok but when it tries to update homebrew the error is “command not found”. I previously tried do shell script “brew update” however that only turns to a "command not found" error and only works in terminal but not AppleScript. Also, after writing the crontab command, I launched crontab via terminal via running “crontab” which loads to a blank Terminal screen. Do you know of a way I can check the script actually ran? Thank you very much.

4 9

Info about Provider Scaleway and cheap "ARM server"
by Olaf Grimm 02 May '18

02 May '18

Dear readers, I tried to use different operating systems and hardware architectures for my Tor relays for diversity. So I came to the Parisian provider Scaleways, which has a cheap offer for ARM servers for € 2.99 per month. Debian was available with architecture "armhf / armv7l". I knew that, but I did not want to believe it. After performance trouble and a server crash I tested "/etc/cpuinfo" and 'lscpu'. There are Raspberry Pi in the cloud! From my personal device at home I know, that full cpu performance will kill the device due to overheating. Oh no! Must change to the next offer with x86_64 for € 11,99 / month. What can I expect? An old Pentium with 400MHz? https://www.scaleway.com/baremetal-cloud-servers/ My order was "C1 - A true metal ARM server running in the cloud." "4 Dedicated ARM Cores, 2GB Memory, 50GB SSD Disk / 200Mbit/s unmetered bandwith" The information for interested parties only. No discussion required. Olaf

3 2

>1100 relays still run end-of-life tor versions
by nusenu 01 May '18

01 May '18

As of today, with the EOL date of tor 0.2.5 the amount of EOL relays increased to over 1100 and more than 7% of the tor network capacity. https://nusenu.github.io/OrNetStats/#end-of-life-relays-share Here is the list of affected operators by contactInfo sorted by consensus weight fraction. https://gist.githubusercontent.com/nusenu/b867fb18c00dd1893820408877ed1470/… (the first 8 readable entries are in BCC) We encourage everyone to configure their relays to do updates automatically: https://trac.torproject.org/projects/tor/wiki/TorRelayGuide#AutomaticSoftwa… Happy updating! nusenu -- https://mastodon.social/@nusenu twitter: @nusenu_

1 0

create Tor-Guard and Tor-Middle
by dave` dave 29 Apr '18

29 Apr '18

i want to build my own Guard-Relay and Middle-Relay and use them. i already have Tor-Bridge and Exit-Relay and i want to add the Guard and Middle, but i don't know how.

3 4

Tor relay marked as hibernating?
by Nathaniel Suchy (Lunorian) 29 Apr '18

29 Apr '18

Hi, The Tor relay https://metrics.torproject.org/rs.html#details/B0BF533DA3BC09DEEB4AF2BEC16F… of mine is marked as hibernating however I have not set a bandwidth limit. Any idea on why this is happening? Cheers, Nathaniel Suchy

3 2

Timeframe for a relay to be removed from the consensus and tor metrics
by Nathaniel Suchy (Lunorian) 28 Apr '18

28 Apr '18

While setting up my fleet of Tor Relays, one relay IP Address 206.189.165.140 had a bad config so I decided to delete it from the cloud provider and setup a new one in its place. When will it be removed from the tor consensus and tor metrics for the downtime? Cheers, Nathaniel

2 2

nyx tor controller password
by smichel0 27 Apr '18

27 Apr '18

Hello! I want to monitor my new tor relay (set up on a raspbian pi 3 by migrating my former relay incl. keys) with nyx. When try to start nyx by "nyx" in the command line "Tor controller password" is prompted. I can't find a password except the hashpassword in the torrc-file but that doesn't work. I tried to set a password by "tor --hash-password <password>" but it didn't work as well. When I start nyx with sudo it works and I can see that tor is doing well. Any solutions? Sent with [ProtonMail](https://protonmail.com) Secure Email.

4 6

reminder: Tor 0.2.5.x LTS will reach its end-of-life in a few days on 2018-05-01
by nusenu 27 Apr '18

27 Apr '18

Hi, this is a reminder that in a few days the tor LTS branch 0.2.5.x will reach its end-of-life date [1]. Currently there are still over 440 relays (~3.2% of the network capacity) running that tor version [2]. Please upgrade to one of the currently supported tor versions: - 0.2.9.x - 0.3.1.x - 0.3.2.x If you are still on Debian oldstable (jessie) with tor 0.2.5.16 you have multiple options: - use the the torproject's debian repository (tor 0.3.2.10) https://www.torproject.org/docs/debian.html.en#ubuntu - use debian backports (tor 0.2.9.14) https://packages.debian.org/jessie-backports/tor - or upgrade to debian stable (stretch) (tor 0.2.9.14) [1] https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CoreTor… [2] https://nusenu.github.io/OrNetStats/#tor-version-distribution-relays -- https://mastodon.social/@nusenu twitter: @nusenu_

1 0

What's the timeline for a Tor relay to start routing a large amount of traffic?
by Nathaniel Suchy (Lunorian) 27 Apr '18

27 Apr '18

I started to run a few Tor Exit Relays (My exit policy only allows ports 80 and 443 only to minimize the amount of abuse) a few days ago. Currently Tor Metrics shows the relays are only advertising 700Kb/s despite the fact the minimum port speed on the VPSes I host on is 100Mb/s. I've been told by friends of mine it's because it's a new relay - at what point does the relay start to route a large amount of traffic equivalent to the port speed. I'm hoping to contribute to the Tor Project in a variety of ways over the next few months and the summer and starting relays is a first step. Cheers, Nathaniel

3 3