- tor-relays - lists.torproject.org

Abuses for non-exit relay
by Felix 08 Apr '18

08 Apr '18

Happy today Since November my ISP and I received a hand full of abuses for a non-exit. It is about scanning ports and addresses of a certain let's say victim ISP. I received one other abuse with another server. For now I kindly want to ask if some operator received similar abuses for non-exits ? [1] Under my perspective it could be: - ip-spoofing. A third entity uses my ip and sends sync requests to the victim. There will never be a statefull connection, but the victim feels offended. As result the only one who gets trouble is me. - I got hacked (Uhh, don't like these words) which I suspect is not the case. Then statefull connections are possible and by scanning etc the attacker interfers the victim. We should not discuss this here. - There is some way out of the code which enables an attacker to perform solicited or unsolicited interference. Like [2] or not known or whatever. It is difficult to discuss with my ISP because the world expects the non-exits connect only inside the Tor network and onion services. Some facts: - The victim ISP hosts no relay - The relays are guards and potentially fallbacks (fallback and non-fallback share an ip) - I firewall blocked (outbound) all victim ISPs subnets. I logged some outbound trials but this could not stop the abuses. Why? May-be the victim ISP has changing ip ranges which usually happens from time to time or I do not know their subnets completely. Interesting was that one destination ip was x.x.x.0 which is subnet zero. - Currently I firewall block (inbound) all victim ISPs subnets and found log entries scanning (syn) my server on a non Tor port. Before blocking inbound, was there a way that someone from the vicitm ISP ip range can drive my relay (not server) to act like an offender back to the victims ISP? Pretty weired stuff but please swarm help! I apologize for my may-be foolish thoughts and please don't hit me too hard, though. [1] [tor-relays] abuse email for non-exit relay (masergy) https://lists.torproject.org/pipermail/tor-relays/2017-September/013030.html [2] Re to [1] https://lists.torproject.org/pipermail/tor-relays/2017-September/013041.html -- Cheers, Felix

3 2

Re: [tor-relays] Lost HSDir flag
by teor 08 Apr '18

08 Apr '18

> On 8 Apr 2018, at 16:25, tschador(a)posteo.de wrote: > > Hi, > > every time Tor is restarted (for example after upgrading) the HSDir flag > of my relay (6A7551EEE18F78A9813096E82BF84F740D32B911) is lost for 4 > days. Why? The minimum uptime for HSDirs is 96 hours (4 days): https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt#n2524 Why 4 days? HSDirs rotate every 24 hours. If a relay has been up for 4 days, then it is likely to be up for the next 24 hours. So it is given the flag. (If a HSDir goes down, it takes a few hours for clients and services to find out it is down. If too many HSDirs go down at the same time, the services assigned to those HSDirs are unreachable for a few hours. The minimum uptime reduces the risk of HSDir downtime.) T

1 0

empty exit policy if ipv6 address is not surrounded by [..]
by Toralf Förster 07 Apr '18

07 Apr '18

Hi atagar, ./run_nyx gives an empty exit policy: line in that case - is this bug or a feature? :-) Example for a wrong line: ExitPolicy reject6 <snip>/32 Good is ExitPolicy reject6 [<snip>]/32 Tested with latest stem and nyx Git trees. -- Toralf PGP C4EACDDE 0076E94E

2 1

Estimation of bridge traffic / Bridge or relay needed?
by Olaf Grimm 07 Apr '18

07 Apr '18

How can I check bridge traffic if it only occurs temporarily? That would also mean that there are enough bridges. I use the Tor browser with the bridge feature for me. I have relays 2x Ubuntu, 1x CentOS and 1x LFS running. Three are working at full capacity. Now I intend to establish a FreeBSD system. The provider does not allow an exit relay so that only "relay" or "bridge" remains. It was not possible to find an exit relay provider with FreeBSD for my financial resources. Should I set up a relay or bridge on www.bhost.net or cloudflexy.org? BHOST wants to become active in ASIA in 2018 too. BHOST: USA, Netherland, UK Cloudflexy: France, Romania Investments must be meaningful. (Of course I can configure a bridge for tests, but I do not know if I made a mistake or if there is no need for a bridge.) A short answer is sufficient. Thank you! Olaf

6 7

Ubuntu LTS about to ship with a soon-to-expire Tor version?
by Roger Dingledine 06 Apr '18

06 Apr '18

Do we have any good Ubuntu contacts here? I noticed today that Ubuntu Bionic LTS will come out this month: https://wiki.ubuntu.com/Releases and they are currently on track to include Tor 0.3.2.10: https://launchpad.net/ubuntu/bionic/+source/tor which is scheduled to go end-of-life before the end of 2018: https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CoreTor… So we are on track for 4.5 years of sadness for Ubuntu users -- and since some of the most critical users of the Tor deb on Ubuntu are relay operators, this seems like a good time to try to rescue things. The best fixes I've thought of are to either: (A) Convince them to downgrade to Tor 0.2.9, which we will maintain for another few years. (B) Make a deal with them where they know that 0.3.2 will be abandoned soon, and that they'll move to our next LTS once it comes out. In the past we tried something like 'B' and it did not go smoothly. So I'm inclined to think 'A' is the better plan. See also this trac ticket where I'll aim to keep track of our progress: https://trac.torproject.org/25715 I'm also going to forward this note to tor-project@ in case there are better Ubuntu contacts there. Never a dull moment, --Roger

3 2

Heartfelt gratitude from censored region
by jackoreamnos＠tutanota.com 04 Apr '18

04 Apr '18

For those who may skip emails by the subject line, I resend my own email. There is a sinking feel in general over here, where a bunch of us learn more about Tor. We learnt we cannot run our own relays because here censorship is very strong; at the same time, we realize we have many relay operators in other countries to thank, for giving us a window into the world. Thank you. And I write this email over Tor. - Jack Date: 4. Apr 2018 03:55 From: jackoreamnos(a)tutanota.com <mailto:jackoreamnos@tutanota.com> To: tor-relays(a)lists.torproject.org <mailto:tor-relays@lists.torproject.org> Cc: tor-relays(a)lists.torproject.org <mailto:tor-relays@lists.torproject.org> Subject: Re: [tor-relays] tor-relays Digest, Vol 87, Issue 4 > We had some more discussions over here, and someone pointed out a key fact which we novices did not get at first - the Tor network does not REALLY trust the relay operators until the directory authorities DAs (whose IPs are hardcoded into the source code) can check them out and then vote about what they have learnt about these relays. If relays pass that test, they get onto a live document called the "Consensus" (between the DAs). So new clients to the network trust these DAs and they trust the consensus reached by the DAs. That is how new clients learn the network topology and find relays to connect to. > > So we were wrong on a few points: > (1) we thought we can contribute to the relay networks without being detected, but basically no - you cannot contribute to the relay network unless you are in the consensus, and if you are in the consensus, your IP address is world readable. > (2) a private bridge is providing relay WITHOUT publishing descriptors to the consensus, so it is a hybrid creature: (a) it appears as a client to the Tor network proper, being hidden from the consensus, and therefore cannot help relay traffic; (b) it appears as a relay server to connecting clients but unlike relays already on the consensus certain clients trust it because they know about the private bridge from channels they trust outside the Tor consensus; and these clients gain a extra measure of security from whatever obfuscation the bridge can offer. > > So by design, Tor does not trust and cannot completely trust a relay that just pops up one day. There is no way for Tor DAs to work with a relay node that hides itself behind a VPN. > > So in the area where we live, if we run a relay, we will be caught, plain and simple. No way around it. No way for us to contribute by running a relay. Zero, nada. We utterly depend on bridges hosted outside our geography, to have any hope of accessing Tor. Some of us who have facilities in another country might help, but for us that is comparatively difficult and expensive. > > The only reason I can access the "outside world" is due to people who hosts bridges for us. If you guys pack and go home, nothing we can do. Zero, nada. I am writing this email over Tor. > > - Jack > > 3. Apr 2018 16:02 by > development(a)jivanamara.net <mailto:development@jivanamara.net>> : > > >> Hey Jack, >> >> Here's my understanding of your concerns, anyone else please chime in if >> I'm mistaken anywhere. >> >> For running a normal relay compared to a client connecting to a relay >> via obfs4, it's less likely to be discovered by examining the content of >> traffic. The obfs4 protocol is designed to disguise the connection >> between a client (i.e. torbrowser). Once the traffic hits a relay, the >> interaction between relays contains less opportunities to identify it as >> tor traffic as opposed to any other encrypted traffic. >> >> That being said, there are a couple of other things that would make it >> very easy to identify a TOR relay. First, by default, relays are listed >> for anyone to examine. >> >> Second, if the authorities are watching, the change in traffic to/from >> your home computer will be pretty obvious. >> >> Regarding your concerns about children being inappropriately exposed to >> the dark web, running a relay will make very little difference compared >> to not running one. For your children to see the content of the dark >> web they'll need to install torbrowser (or equivalent) and that's going >> to be the same whether or not you're running a relay. The only >> potential difference is that if in your area it's very difficult to >> connect to the tor network and your children know you're running a >> relay, with some knowledge they could configure torbrowser to connect >> first to your relay. In some sense, if the authorities are successful >> in blocking access to the tor network, you could be enabling their romps >> on the dark web. >> >> HTH >> >> Jivan >> >> >> On 04/03/2018 02:38 AM, >> tor-relays-request(a)lists.torproject.org <mailto:tor-relays-request@lists.torproject.org>>> wrote: >>> Send tor-relays mailing list submissions to >>> >>> tor-relays(a)lists.torproject.org <mailto:tor-relays@lists.torproject.org> >>> >>> To subscribe or unsubscribe via the World Wide Web, visit >>> >>> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays> >>> or, via email, send a message with subject or body 'help' to >>> >>> tor-relays-request(a)lists.torproject.org <mailto:tor-relays-request@lists.torproject.org> >>> >>> You can reach the person managing the list at >>> >>> tor-relays-owner(a)lists.torproject.org <mailto:tor-relays-owner@lists.torproject.org> >>> >>> When replying, please edit your Subject line so it is more specific >>> than "Re: Contents of tor-relays digest..." >>> >>> >>> Today's Topics: >>> >>> 1. Re: failed setup of obfs4 on relay (>>> jackoreamnos(a)tutanota.com <mailto:jackoreamnos@tutanota.com>>>> ) >>> 2. Re: failed setup of obfs4 on relay (>>> jackoreamnos(a)tutanota.com <mailto:jackoreamnos@tutanota.com>>>> ) >>> 3. Re: Estimation of bridge traffic / Bridge or relay needed? >>> (>>> jackoreamnos(a)tutanota.com <mailto:jackoreamnos@tutanota.com>>>> ) >>> >>> >>> ---------------------------------------------------------------------- >>> >>> Message: 1 >>> Date: Tue, 3 Apr 2018 05:00:18 +0200 (CEST) >>> From: <>>> jackoreamnos(a)tutanota.com <mailto:jackoreamnos@tutanota.com>>>> > >>> To: <>>> tor-relays(a)lists.torproject.org <mailto:tor-relays@lists.torproject.org>>>> > >>> Cc: <>>> tor-relays(a)lists.torproject.org <mailto:tor-relays@lists.torproject.org>>>> > >>> Subject: Re: [tor-relays] failed setup of obfs4 on relay >>> Message-ID: <>>> L98Ret7--3-0(a)tutanota.com <mailto:L98Ret7--3-0@tutanota.com>>>> > >>> Content-Type: text/plain; charset="utf-8" >>> >>> Thank you all, that was very helpful. - Jack >>> >>> 30. Mar 2018 20:53 by >>> arma(a)mit.edu <mailto:arma@mit.edu>>>> <>>> mailto:arma@mit.edu <mailto:mailto:arma@mit.edu>>>> >: >>> >>> >>>> On Fri, Mar 30, 2018 at 04:52:23PM -0400, Roger Dingledine wrote: >>>>> For obfs4, the active prober doesn't know the secret "cert" parameter, >>>> For far far more detail on the various pluggable transports and how >>>> they look on the wire, check out this awesome page that David Fifield >>>> put together: >>>> >>>> https://trac.torproject.org/projects/tor/wiki/doc/AChildsGardenOfPluggableT… <https://trac.torproject.org/projects/tor/wiki/doc/AChildsGardenOfPluggableT…>>>>> <>>>> https://trac.torproject.org/projects/tor/wiki/doc/AChildsGardenOfPluggableT… <https://trac.torproject.org/projects/tor/wiki/doc/AChildsGardenOfPluggableT…>>>>> > >>>> >>>> --Roger >>>> >>>> _______________________________________________ >>>> tor-relays mailing list >>>> tor-relays(a)lists.torproject.org <mailto:tor-relays@lists.torproject.org>>>>> <>>>> mailto:tor-relays@lists.torproject.org <mailto:mailto:tor-relays@lists.torproject.org>>>>> > >>>> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays>>>>> <>>>> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays>>>>> > >>>

2 1

Re: [tor-relays] tor-relays Digest, Vol 87, Issue 4
by Jivan Amara 04 Apr '18

04 Apr '18

Hey Jack, Here's my understanding of your concerns, anyone else please chime in if I'm mistaken anywhere. For running a normal relay compared to a client connecting to a relay via obfs4, it's less likely to be discovered by examining the content of traffic. The obfs4 protocol is designed to disguise the connection between a client (i.e. torbrowser). Once the traffic hits a relay, the interaction between relays contains less opportunities to identify it as tor traffic as opposed to any other encrypted traffic. That being said, there are a couple of other things that would make it very easy to identify a TOR relay. First, by default, relays are listed for anyone to examine. Second, if the authorities are watching, the change in traffic to/from your home computer will be pretty obvious. Regarding your concerns about children being inappropriately exposed to the dark web, running a relay will make very little difference compared to not running one. For your children to see the content of the dark web they'll need to install torbrowser (or equivalent) and that's going to be the same whether or not you're running a relay. The only potential difference is that if in your area it's very difficult to connect to the tor network and your children know you're running a relay, with some knowledge they could configure torbrowser to connect first to your relay. In some sense, if the authorities are successful in blocking access to the tor network, you could be enabling their romps on the dark web. HTH Jivan On 04/03/2018 02:38 AM, tor-relays-request(a)lists.torproject.org wrote: > Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > > > Today's Topics: > > 1. Re: failed setup of obfs4 on relay (jackoreamnos(a)tutanota.com) > 2. Re: failed setup of obfs4 on relay (jackoreamnos(a)tutanota.com) > 3. Re: Estimation of bridge traffic / Bridge or relay needed? > (jackoreamnos(a)tutanota.com) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 3 Apr 2018 05:00:18 +0200 (CEST) > From: <jackoreamnos(a)tutanota.com> > To: <tor-relays(a)lists.torproject.org> > Cc: <tor-relays(a)lists.torproject.org> > Subject: Re: [tor-relays] failed setup of obfs4 on relay > Message-ID: <L98Ret7--3-0(a)tutanota.com> > Content-Type: text/plain; charset="utf-8" > > Thank you all, that was very helpful. - Jack > > 30. Mar 2018 20:53 by arma(a)mit.edu <mailto:arma@mit.edu>: > > >> On Fri, Mar 30, 2018 at 04:52:23PM -0400, Roger Dingledine wrote: >>> For obfs4, the active prober doesn't know the secret "cert" parameter, >> For far far more detail on the various pluggable transports and how >> they look on the wire, check out this awesome page that David Fifield >> put together: >> >> https://trac.torproject.org/projects/tor/wiki/doc/AChildsGardenOfPluggableT… <https://trac.torproject.org/projects/tor/wiki/doc/AChildsGardenOfPluggableT…> >> >> --Roger >> >> _______________________________________________ >> tor-relays mailing list >> tor-relays(a)lists.torproject.org <mailto:tor-relays@lists.torproject.org> >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays> >

4 3

Re: [tor-relays] The IP of relay 6A7551EEE18F78A9813096E82BF84F740D32B911 has changed
by teor 04 Apr '18

04 Apr '18

> On 2 Apr 2018, at 02:19, tschador(a)posteo.de wrote: > > FYI > > My relay "TorMachine" (FallbackDir) has moved to another ISP. > > New IP is: 94.130.186.5 and will be longterm stable too. Thanks, we are tracking this change in: https://trac.torproject.org/projects/tor/ticket/24805#comment:16 T

1 0

decommissioning 2 fallback directory mirrors
by tor 04 Apr '18

04 Apr '18

I am planning on decommissioning the following 2 relays which have the FallbackDir flag: 175921396C7C426309AB03775A9930B6F611F794 1DBAED235E3957DE1ABD25B4206BE71406FB61F8 They've been running as fallback directory mirrors for 2+ years, but I'm unable to continue running them.

2 1

Outdated relay versions are they secure to use?
by Gary 03 Apr '18

03 Apr '18

Hello. Go to https://check.torproject.org > "...for more info about this relay...relay search" link If I receive a message saying this relay uses an outdated version does that mean that my traffic is any less secure? Does Tor take potentially insecure relay versions in to account when creating circuits? Thanks

3 2

failed setup of obfs4 on relay
by jackoreamnos＠tutanota.com 03 Apr '18

03 Apr '18

Am a novice compiling Tor (0.3.2.9) and been successful using this from a Tor Browser as a private bridge by entering "a.b.c.d:9001" into Tor Browser. However, pointing my Tor Browser to the obfs4 on the same machine fails with something like General SOCKS failure in the log. Below is my torrc: SOCKSPort 0 CookieAuthentication 1 ControlPort 9051 ORPort 9001 ExtORPort auto ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy # ServerTransportListenAddr obfs4 [::]:60443 ServerTransportListenAddr obfs4 0.0.0.0:60443 ExitRelay 0 BridgeRelay 1 PublishServerDescriptor 0 Tests I have done: (1) using obfs4 compiled from git repository, as well as the OS package. (2) opening port 60443, as well as dropping all firewalls - does not make a difference; meanwhile, pointing telnet at a.b.c.d 60443 connects successfully (3) using Tor Browser with default supplied obfs4 bridges works well (log shows I was able to download a list of bridges and their fingerprints). So I think I have ruled out problems with my Tor client (Tor Browser), and I have ruled out firewall configurations on the server, and ruled out obfs4 being blocked on my ISP. Since Tor itself works, and I have tried obfs4 from source as well as from the OS package, the only thing I can think of is something wrong with the config above. Any hints would be appreciated, as well as any steps I can do to further diagnose would be helpful. Thanks, Jack

3 5

running relay excluded from votes
by Dark Matter 01 Apr '18

01 Apr '18

Hello, my relay 69D9FF1BE14B9AE77701A6BCBC075FF837F5AFF9 (darkmatter) disappeared from all votes (and hence from the consensus) starting today at the voting for valid after 07:00:00. Any explanation for this behavior? There is nothing unusual in the relay's logs and there was no reboot today. In my opinion it's strange that a relay suddenly disappears from the votes. If I got it right, usually an authority votes for "not running" if a relay can't be reached for some reason. But ALL votes excluded my relay starting today at seven am. Would like to understand what happened... Bye, Dark

3 2

ansible-relayor, how to ?
by Petrusko 01 Apr '18

01 Apr '18

Hey! I'm planning to try the "ansible-relayor" to deploy some Tor relay instances. If I'm not wrong, it's a main goal ? 2 instances / IP... (soooory for being really noob about this!!!) But I'm lost... not found a tutorial, step by step, you know the tutorial so loved by all noobs! For now, on a fresh Debian8 install, there are : - tor 0.2.9.8 (fresh install from depo, client is ok when opening log file) - ansible - ansible-galaxy install nusenu.relayor - git clone https://github.com/nusenu/ansible-relayor (the folder is stored in my /home...) Will it configure (automatically) many torrc file per instance ? +every key files /relay ? (I'm not too much lost!) Do have I to do this install on every server built ? Or relayor can manage few servers on different locations ? Command lines list use this tool if available ? Many thx for help !!! (and hard work for this tool :) -- Petrusko C0BF 2184 4A77 4A18 90E9 F72C B3CA E665 EBE2 3AE5

6 9

My middle relay has 2x the no. of incoming as outgoing connexions
by torix＠protonmail.com 31 Mar '18

31 Mar '18

I'm asking because before the update to the tor v. 3.2.10 it was usually about even. I've let things settle in for a few weeks while the throughput dropped to half what it was before, but the 2 to 1 connexion imbalance which started a few days after the update has persisted. Should I worry? It does seem to be working. TIA, --Torix Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

Hello relay operator aahana*
by Vasilis 30 Mar '18

30 Mar '18

Dear relay operator, I noticed that you added 6 relays [1], thank you! Please be sure to set the `MyFamily` configuration parameter on all your relays [1], so Tor clients are not at risk of using your relays in multiple positions in a single circuit [2], [3]. Thank you for running Tor relays. [0] https://nusenu.github.io/OrNetRadar/2018/03/28/a4 [1] https://trac.torproject.org/projects/tor/wiki/TorRelayGuide#Importantifyour… [2] https://hackernoon.com/some-tor-relays-you-might-want-to-avoid-5901597ad821 [3] https://nusenu.github.io/OrNetStats/endtoend-correlation-groups Cheers, ~Vasilis -- Fingerprint: 8FD5 CF5F 39FC 03EB B382 7470 5FBF 70B1 D126 0162 Pubkey: https://pgp.mit.edu/pks/lookup?op=get&search=0x5FBF70B1D1260162

1 0

"Your IP seems to have changed" notice
by Alexander Nasonov 29 Mar '18

29 Mar '18

This morning (9:30 UTC), my relay (nebo.xmmswap.com) printed 09:30:08.000 Your IP seems to have changed to <<Search Guide AS36029 range>> (METHOD=GETHOSTNAME HOSTNAME=nebo). Updating. 09:30:08.000 Our IP Address has changed from 217.182.198.76 to <<Search Guide AS36029 range>>; rebuilding descriptor (source: METHOD=GETHOSTNAME HOSTNAME=nebo). ... Six minutes later it was back to normal: 09:36:08.000 Your IP address seems to have changed to 217.192.198.76 (METHOD=INTERFACE). Updating. What was that? A DNS hijack? I'm running 0.3.2.10 on NetBSD. My DNS upstream is GoDaddy. Secondary DNS is OVH. -- Alex

2 3

Hello new exit operator privateinternetaccess.com
by nusenu 28 Mar '18

28 Mar '18

Hello PIA, I noticed that you added 47 new tor exit relays [1] and wanted to welcome you as an exit relay operator. Are you planing to run them for a longer time or is this a short term operation? thanks, nusenu [1] https://nusenu.github.io/OrNetRadar/2018/03/27/a8.html -- https://mastodon.social/@nusenu twitter: @nusenu_

1 0

Please use mailing lists for questions
by teor 28 Mar '18

28 Mar '18

Hi, In the past few weeks, at least 5 relay operators have emailed me directly to ask questions. I haven't answered most of those emails, because I was on leave, then at a meeting, then on leave again. I won't have time to check all my backlog for another 1-2 weeks. If you want a quick answer to your question, use a mailing list. If it doesn't matter who answers your question, use a mailing list. If your answer contains private information, redact it, then use a mailing list. If your question can only be answered by a single person, then use a mailing list, so other people can learn the answer. Please try really hard to use a list. Emailing a single person doesn't scale. And please don't feel hurt if someone asks you to use a list. It means your question is valuable to other people. T

1 0

Decommissioning (middle) relay
by tor-relays 27 Mar '18

27 Mar '18

In case anyone is keeping an eye on things or otherwise monitoring relays, I have just decommissioned the relay "wsmith6079" (with fingerprint 01AE002B4E60AE5A8FF40FDB67260F85AB0878AE) within the last several minutes. This relay has been in service for a little over two years but, unfortunately, it's time has come. Thanks.

2 1

My relay lost concensus
by victoring＠riseup.net 27 Mar '18

27 Mar '18

Hi, After a power cut a couple of weeks ago, my tor relay is not longer part of the consensus: B33BFA9AA0005730C1C0E8F7E6F53CF3C5716BD6 Current tor process has been running since 2018-03-14. How much time is it needed to come back? Cheers, S

2 4

arm crashes
by smichel0 26 Mar '18

26 Mar '18

Hello, from time to time, arm looks like below: https://smichel.ocloud.de/index.php/s/q2knnq3AD67rPjK But with a simple keystroke (arrow) it runs again. After a few days it seems to crash completely: https://smichel.ocloud.de/index.php/s/GjwdCLebR4iDkuv I dont't know then, if the relay is still working. Last time this happend, I simply startet arm again and it worked. But thiis way I will never reach the guard-flag :) Yours SMichel Sent with [ProtonMail](https://protonmail.com) Secure Email.

5 18

relayor v0.3.3 is released
by nusenu 26 Mar '18

26 Mar '18

Hi, relayor v0.3.3 is released. relayor helps you with running relays with minimal effort (automate everything). https://github.com/nusenu/ansible-relayor Changes since v0.3.2: ------------------------------ - major workaround for an upstream bug in tor that prevented us from running more than 2 instances per server. This affected only users with a non-default tor_maxPublicIPs setting. (#153) Thanks to Tim Niemeyer (@RedDog99) (f3netze.de) for bringing this to our attention. - relayor now ships a kitchen file for integration testing (#149) Thanks to Ondrej Vaško (@Lirt) for the patch. Main benefits for a tor relay operator ====================================== * automation - no more manual setup tasks * security: offline Ed25519 master keys every tor instance is run with a distinct user * automatically makes use of IPv6 IPs (if available) * automatic tor instance generation (two by default - configurable) * enables tor's Sandbox feature by default on Debian-based systems * easily choose between alpha/non-alpha releases * easily restore a relay setup * easily choose between exit relay/non-exit relay mode * automatic deployment of a tor exit notice html page via tor's DirPort * automatic MyFamily management Supported Operating Systems ---------------------------- Debian 8, 9 and Debian Testing OpenBSD 6.2 FreeBSD 10.4, 11.1 HardenedBSD 11 Ubuntu 16.04 CentOS 7 Fedora 27 regards, nusenu -- https://mastodon.social/@nusenu twitter: @nusenu_

2 1

Hello new exit operator F3 Netze
by nusenu 25 Mar '18

25 Mar '18

Hello F3 Netze, I saw you recently added 8 new tor exit instances and wanted to thank you for contributing exit bandwidth to the tor network! Should there arise questions related to the operations of tor relays you can reach out to the public tor-relays mailing list [0]. Your AS information is not yet in Maxmind's databases so it does not show yet on Relay Search [1] pages but this will solve itself over time. I saw your have IPv6 addresses [2]. If your connectivity/routing allows also for IPv6 exiting and ORPorts, enabling IPv6 on your exits would be great and appreciated. Looking at your ORPorts and your perfect MyFamily configuration this looks like an ansible-relayor setup, in which case IPv6 will be automatically enabled on the next playbook run once the servers have IPv6 addresses (if you didn't opt-out). thanks for joining the network and happy packet forwarding! nusenu [0] https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays [1] https://metrics.torproject.org/rs.html#search/family:6BCB964AB74E23F8986BDA… [2] https://bgp.he.net/AS205100#_prefixes6 -- https://mastodon.social/@nusenu twitter: @nusenu_

3 7

Publishing bridge contact information
by Karsten Loesing 23 Mar '18

23 Mar '18

Hello relay and/or bridge operators, you might already know this: we're publishing sanitized versions of bridge descriptors on Tor Metrics. https://metrics.torproject.org/collector.html#bridge-descriptors We're using these sanitized descriptors to visualize interesting facts about Tor bridges, among other things: https://metrics.torproject.org/bridges-ipv6.html We're now considering to drop one step in the sanitizing step, which is to remove contact information. The result would be that we'd keep contact information in sanitized descriptors in the exact same way as the bridge operator put it into their torrc file. https://metrics.torproject.org/bridge-descriptors.html#contact https://trac.torproject.org/projects/tor/ticket/20983 Possible advantages are: - Relay Search would support searching for bridges by contact information. - People who keep a watching eye on the Tor network could reach out to bridge operators to inform them that they're running an outdated tor/PT version, or that running bridges and exits together is not cool. - If somebody ever revives OnionTip/TorTip, bridges could participate and receive donations for running a bridge. Or t-shirts, who knows. Note that I'm not promising either here, but without contact information, neither would even be possible. Possible disadvantages are: - If somebody runs a relay and a bridge, both with the same contact information, a censoring adversary might guess that the bridge might run on a nearby IP address as the relay. However, they could as well assume that for all relays and block or scan the IP space around all known relays. - Bridge operators might be surprised to see their contact information in a public archive. We do have a warning in the tor manual https://www.torproject.org/docs/tor-manual.html.en#ContactInfo, but maybe nobody reads the fine manual. Your opinion counts. Is this a good or a bad idea, and why? I'll keep this discussion open for a week and not start changing anything during that time. If you want to state your opinion, please do it on this list by Wednesday, February 14. Thanks! All the best, Karsten

8 21

DoSer is back, Tor dev's please consider
by starlight.2017q4＠binnacle.cx 23 Mar '18

23 Mar '18

Please note: Here parameter DoSCircuitCreationMinConnections=1 is set (rather than the default value of 3). Mar 11 17:23:53 Tor[]: DoS mitigation since startup: 0 circuits rejected . . . . . . Mar 22 11:23:54 Tor[]: DoS mitigation since startup: 299608 circuits rejected. . . Mar 22 17:23:54 Tor[]: DoS mitigation since startup: 806025 circuits rejected. . . I.E. mitigation circuit rejections increased 170% in six hours after moving vaguely for over ten days. Also: top - 19:05:53 up 11 days. PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 1998 tor 20 0 662m 611m 108m R 47.2 15.4 7901:32 tor 2000 tor 20 0 662m 611m 108m S 42.2 15.4 343:28.28 tor 2001 tor 20 0 662m 611m 108m R 56.8 15.4 343:24.46 tor I.E. crypto workers pegged after barely registering since DoSer shut it down on March 7th. 'iptables' mitigation rule here shows the DoS source-IPs ablaze. ========== Suggestion: DoSCircuitCreationMinConnections=1 be established in consensus

3 3