- tor-relays - lists.torproject.org

atlas.cogentco.com Is blocking
by Paul Templeton 19 Oct '17

19 Oct '17

Has anyone come across a scenario where a carrier blocks IP traffic? atlas.cogentco.com is the point which drops any packet to 95.130.9.210 The server is up and running internal monitoring says its OK. The ISP doesn't provide an interface to the Server so I can not log on to do any other validating. Trace routes to any IP with the ISP (active or not)terminates in the ISP's network. Trace route from any point on the planet times out as soon as you hit atlas.cogentco.com Any thoughts... **IPonU could you ping from one of your servers at Digicube please and let me know. Paul

3 4

Is AboveClouds still active?
by Ralph Seichter 19 Oct '17

19 Oct '17

Does anybody here know if AboveClouds https://aboveclouds.co.uk is still in business? Emails sent to their support address have been unanswered for a month now. -Ralph

1 0

"Bug: Duplicate call to circuit_mark_for_close"
by tor 19 Oct '17

19 Oct '17

Hi, I'm troubleshooting a Linux relay where the Tor service is having problems. External monitoring alerts indicate both the ORPort and DirPort are unreachable (TCP connection timeout). I can ssh in and the Tor service is still running. The node seems to have increased memory usage at this point but there's no evidence of OOM. I restart the Tor service, monitoring says all is good again, and things seem fine for a bit, until the cycle repeats hours later. I'm still investigating, but one thing I immediately noticed was hundreds of these lines in the logs: [warn] circuit_mark_for_close_(): Bug: Duplicate call to circuit_mark_for_close at ../src/or/onion.c:238 (first at ../src/or/command.c:579) (on Tor 0.2.9.11 ) I found https://trac.torproject.org/projects/tor/ticket/20059 but it's marked as fixed with a backport to 0.2.9. Any thoughts?

4 9

vsif.ca relays: MyFamily configuration
by nusenu 18 Oct '17

18 Oct '17

Hello Vancouver Society for Internet Freedom, thanks for running tor relays. Unfortunately you are in a position that can potentially harm tor users if you do not set MyFamily (torrc) on all your relays. Please have a look at your MyFamily configuration. https://nusenu.github.io/OrNetStats/endtoend-correlation-groups#vsif-suppor… You are also running an outdated version of tor that is no longer recommended: https://atlas.torproject.org/#search/vsif%20version:0.2.9.10 some more background: https://hackernoon.com/some-tor-relays-you-might-want-to-avoid-5901597ad821 Let us know if you need help with configuring MyFamily. thanks, nusenu -- https://mastodon.social/@nusenu twitter: @nusenu_

1 0

Used TLS implementations by relays
by nusenu 15 Oct '17

15 Oct '17

Hi, are there any TLS libraries other than - openssl - libressl that are actively used by current tor relays? https://en.wikipedia.org/wiki/Comparison_of_TLS_implementations#Overview thanks, nusenu -- https://mastodon.social/@nusenu twitter: @nusenu_

1 0

Hashed password behaviour
by Geoff Down 15 Oct '17

15 Oct '17

Hello all, what sort of crazy bug would make Tor give different hashes for the same password? $ tor --hash-password hello 16:735E6FA5355D4146606AFE25B61B411DF419878C99705164D038FC99BC $ tor --hash-password hello 16:8201E7D35BB8CACB60BF8947B49A3480BA1A17E77EDA8BE45790746884 $ tor --version Tor version 0.3.1.7 (git-6babd3d9ba9318b3). (on OSX 10.4). GD

3 5

Using ContactInfo to publish additional relay properties in a standardized way (opt-in)
by nusenu 15 Oct '17

15 Oct '17

Status: WIP please send your comments until 2017-10-27 I'm writing this with the following motivation: - make it easier for current and future relay operators to find (rarely used) hosters for tor relays by increasing the information sharing between relay operators. -> help the tor network grow - improve geo- and autonomous system diversity on the tor network (more diverse is better) - collect additional (self-reported) relay metrics (for things like atlas [1] and OrNetStats [2]) https://atlas.torproject.org https://nusenu.github.io/OrNetStats exmples: How many - use tor's Sandbox? - run in OfflineMasterMode? - make use of KIST? - do auto-updates? This data could provide tor developers with information on how well tested/how much used new features (like Sandboxes) are before changing defaults. - improve the ability to contact relay operators (automatically) - make provided information machine readable - provide the foundation for an automated contactInfo verification bot mutually verified email addresses (and other contact options) could be displayed differently on atlas.torproject.org - make t-shirt delivery easier since contact information is potentially already verified - increase the ability to detect undeclared relay groups / make hiding relay groups harder - make hosting costs visible - potentially detect relay operators impersonating other operators by using their email address Should 10% cw fraction and at least 50 operators use any of the defined fields I'll ask irl (atlas maintainer) to get that specific field added to atlas (separately from the contactinfo string). Example ContactInfo String -------------------------- email:user[]example-operator.com hoster:https://example-hoster.com uplinkbw:100 trafficacct:unmetered cost:10 virtualization:xen Considerations ---------------- - increases exposure of relay operators The machine readable information could be used by spammers and to target relay operators. Operators concerned about this can omit contact information but it should not be hard to create a new email address for the purpose. - more information makes targeted exploitation easier / more silent Attackers could use the additional information provided in these fields to specifically target only vulnerable systems. Operators concerned about sharing configuration information should omit this type of information, but can share other information. - increased descriptor size and directory traffic The contactinfo field size could potentially grow because of this specification. This should be mitigated with the use of directory data compression and diffs available since tor 0.3.1. - ContactInfo size constraints According to the manual [2] there is no explicit ContactInfo size limit but there is a descriptor size limit. The max. descriptor size is 20000 bytes [3]. The family size and exit policy are two other relevant inputs. [2] https://www.torproject.org/docs/tor-manual.html.en#ContactInfo [3] https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt#n364 List of information fields ---------------------------- I started to collect possible fields here: https://github.com/nusenu/ContactInfo-Information-Shareing-Specification#de… looking forward to your feedback, nusenu Document location: https://github.com/nusenu/ContactInfo-Information-Shareing-Specification -- https://mastodon.social/@nusenu twitter: @nusenu_

4 6

Relay DDoS attack?
by Peter Rogers 14 Oct '17

14 Oct '17

Hi! I've been running a Tor non-exit node at my business for a few months now. So far it's been great! Except yesterday when I noticed my internet was at a crawl. I traced the problem back to a large number of inbound connections that completely overwhelmed my little router. (4096 connections, the configured limit) All the connections were being made to my tor relay from outside IPs. The tor log file was filling with this: Oct 13 14:21:29.000 [warn] assign_to_cpuworker failed. Ignoring. Oct 13 14:21:29.000 [warn] assign_to_cpuworker failed. Ignoring. Oct 13 14:21:30.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [1779 similar message(s) suppressed in last 60 seconds] I shutdown the relay, then eventually disconnected my internal network from the router hoping the traffic would slow. It continued for maybe another 2-3 hours until I finally unplugged the router and left for the weekend. I was able to capture some of the traffic and found most of it originated from other tor (non-exit) relay nodes. In a 5 minute sample there was some 170,000 syn packets sent by some 4000+ unique IPs. I used a script to check the collected IPs against the list of known tor nodes and they're almost all tor (non-exit) relays. Hopefully it auto-fixes itself when I'm back at work Monday morning. But mostly I'm curious to know what's going on. Anybody encounter a situation like this?

2 1

hi-jacking an onion address
by Toralf Förster 14 Oct '17

14 Oct '17

2 4

spurios warning about using the nickname instead of the key
by Toralf Förster 12 Oct '17

12 Oct '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I'm wondering why I suddenly got at both of my 2 Tor exit relays (0.3.2.2.-alpha, running at the same machine) the following message: /tmp/notice2.log:Oct 07 22:41:58.000 [warn] You specified a relay "zwiebeltoralf2" by name, but nicknames can be used by any relay, not just the one you meant. To make sure you get the same relay in the future, refer to it by key, as "$6EABEBF38CE7E3DF672C4DB01383606FE3EB2215". /tmp/notice.log:Oct 07 22:39:53.000 [warn] You specified a relay "zwiebeltoralf" by name, but nicknames can be used by any relay, not just the one you meant. To make sure you get the same relay in the future, refer to it by key, as "$1AF72E8906E6C49481A791A6F8F84F8DFEBBB2BA". when I queried the Tor status via a home-brewed Python script [1]. I do assume that the message is related to line 90 ot that script: flags = controller.get_network_status(relay=srv.nickname).flags Because I'm using the script few times per day I do wonder why this happens today for the first time at all (IIRC) and just only once. [1] https://github.com/toralf/torutils/blob/master/info.py - -- Toralf PGP C4EACDDE 0076E94E -----BEGIN PGP SIGNATURE----- iI0EAREIADUWIQQaN2+ZSp0CbxPiTc/E6s3eAHbpTgUCWdk/PxccdG9yYWxmLmZv ZXJzdGVyQGdteC5kZQAKCRDE6s3eAHbpTpf8APwO30SS3Sbn1OhzOpFoJocdhj4k 7h/h6s5c0asDdwWkfwD/aaZpaP/ds9l4N9rivQSGW40Rv1Deqhuj/5fPtVizHeE= =8w5x -----END PGP SIGNATURE-----

8 11

Revert back to a stable build of Tor from an alpha
by Jacki M 12 Oct '17

12 Oct '17

How do I revert back to a stable build of Tor from an alpha? Im running Tor 0.3.2.2-alpha and need to revert back to Tor 0.3.1.7. Im running Ubuntu 16.04.3 LTS.

3 3

(no subject)
by Laty Luck 11 Oct '17

11 Oct '17

help

2 1

dnsmasq configuration for an exit relay (Debian)
by jpmvtd261＠laposte.net 10 Oct '17

10 Oct '17

Hello, I am looking for instructions on how to configure dnsmasq on a Debian exit relay (in order to cache DNS queries). It looks like this package could introduce vulnerabilities if not handled properly, because it provides more than just local DNS cache. If I had to install it without any advice, I would do this : 1) Install dnsmaq package with the command "aptitude install dnsmask" . 2) Make sure that the first line of the file /etc/resolv.conf is "nameserver 127.0.0.1" (see https://wiki.debian.org/HowTo/dnsmasq#Local_Caching ). 3) Make sure that the file /etc/dnsmasq.conf contains the line "listen-address=127.0.0.1" (to restrict dnsmasq to the local system). 4) Set the cache size to 10000 by adding or editing this line "cache-size=10000" in the file /etc/dnsmasq.conf (as suggested by Igor Mitrofanov here https://lists.torproject.org/pipermail/tor-relays/2017-August/012708.html ). 5) Reboot (is it necessary ?). Does anyone think that this procedure could start a daemon listening on a port of my server ? Or is it safe to do this on my exit relay ? Regards

6 30

Looking for a 34C3 Voucher
by Paul 10 Oct '17

10 Oct '17

Anybody holding a Voucher for 34C3 in Leipzig at the end of December? https://tickets.events.ccc.de/34c3/docs/? While still running several Exits I would be more than happy to meet others there Thanks, Paul

3 3

Re: [tor-relays] Tor exit nodes attacking SSH?
by me＠eugenemolotov.ru 08 Oct '17

08 Oct '17

On 08/08/2017 01:48 PM, Steven Chamberlain wrote: > Further investigation shows that this happens for any destination IP > address, even where there's no SSH service running: Make a "trap" ssh server (for example on virtualbox machine without any sensitive data) and log in into it through tsocks. After that check from which ip it was logged in. This probably would be ip of the exit node.

5 4

Re: [tor-relays] Feedback wanted: letter to my university's library
by Alison Macrina 08 Oct '17

08 Oct '17

Hi AJ, Thank you for supporting Tor! I think it's a great idea to try to work with your university library to run a relay. I run the Library Freedom Project which helps libraries understand and use privacy tools (libraryfreedomproject.org) I can give you some advice based on my experience. William Denton: > On 1 October 2017, AJ Jordan wrote: > >> However I've just started college at the University of Rochester, >> which obviously presents a great opportunity to set up a relay on a >> really great network. I'm planning to reach out to the library with >> the following email and would love some feedback: > > Scott Bennett had excellent advice, +1 > Academic libraries can be very experimental in some of their work, but > they are generally risk-averse. (This is good, because they're in the > business of preserving knowledge and cultural artifacts for decades and > centuries.) There is, I'm afraid, close to zero chance they would let a > non-employee student run a server on their network---and running Tor, > even a non-exit relay, makes the chances even lower. > > However, don't give up. I suggest thinking about this as a long-term > project that could get you involved with the library, faculty and campus > IT. There must be people on campus interested in privacy issues, who > know about Tor, and perhaps who have been thinking about running a > relay. These people could be librarians or they could be professors or > grad students in political science, communcations, journalism, computer > science, privacy studies, etc. Find out who they are and approach > them! Perhaps there is a student club interested in the same > issues---if not, you could start one. Students and student groups > advocating for a Tor relay or exit, while demonstrating the importance > of Tor and how it fits in with the library's and university's mission, > would very much help the project be successful. William's advice is good. You definitely need to begin by building a relationship with the library. Don't be discouraged by the amount of work this may take; the payoff might end up being a cultural shift wherein the library, university IT, and CS departments all work on this as a project together! You'll want to approach the library by showing that Tor is an excellent way to uphold the values of librarianship, which are privacy, intellectual freedom, and access. Really, be explicit about it; don't assume that they'll just get why you think it matters. Here's something I wrote about intellectual freedom + Tor Browser a while ago and you can borrow the arguments I've made: https://www.scribd.com/document/272919852/Alison-Macrina-The-Tor-Browser-an… As William said, libraries are mostly risk-averse, so you also need to be ready to answer their questions about legal and technical concerns. LFP has collected some resources to help with all of that here: https://github.com/LibraryFreedom/tor-exit-package/blob/master/resources.md. Before you email the university librarian, I'd start by talking to some of the regular academic librarians about your ideas and gauge their responses. Ask them if they've heard of the Library Freedom Project and feel free to send them any of our resources. See if they think the administration would be receptive to you offering a presentation about Tor to library staff (even better if you can make it open to students and faculty, too, because that can get you more support). You are welcome to adapt these slides for that presentation: https://libraryfreedomproject.org/allabouttor/. Make sure to show them this academic library that has used their Tor relay as a teaching tool for students: https://boingboing.net/2016/03/16/first-ever-tor-node-in-a-canad.html. LFP is fairly well known and respected in libraries and so if it can be beneficial to involve me further, I'm happy to assist! Alison

6 11

About relay size
by IPonU 08 Oct '17

08 Oct '17

Hi Tor list, I'm already running a small exit node (100Mbps bandwidth) and I'm ready to spend more money on it, so have a question for you guys : Is it better if I run other small ones (100Mbps too) or only 1 big exit relay (1 Gbps) ? What's best for the network stability/security ? Thanks a lot IPonU

13 34

anonymaid tor relays: MyFamily configuration
by nusenu 07 Oct '17

07 Oct '17

Hello anonymaid Relay Operator, thanks for running relays. Since you recently added more relays you are now in a position that can potentially harm tor users if you do not set MyFamily (torrc) on all your relays. Please have a look at you MyFamily configuration. https://nusenu.github.io/OrNetStats/endtoend-correlation-groups some more background: https://hackernoon.com/some-tor-relays-you-might-want-to-avoid-5901597ad821 Let us know if you need help with configuring MyFamily. thanks, nusenu -- https://mastodon.social/@nusenu twitter: @nusenu_

1 0

More recent rpm somewhere?
by Patrick DERWAEL 07 Oct '17

07 Oct '17

Hi folks, I'm running a few relays on CentOS 7 As I'm sticking to the ease of rpm distributions, I'm left behind on 0.2.9.10 from EPEL Does anyone know of another rpm repository with a more up to date version ? Thanks! Patrick

5 7

Blocking outbound 22 or no?
by AMuse 06 Oct '17

06 Oct '17

Hi all! I'm getting a number of ISP Abuse complaints around outbound ssh brute-forcing from our exit relay. I'm personally of the opinion that people should run fail2ban (or equiv) and get on with life and I generally ignore the complaints - but wondered, what are other operators doing? Is anyone exit-policy blocking outbound 22 to make the internet a kinder place? Is anyone refusing to on principle?

5 4

Quintex Exit Relays
by John Ricketts 05 Oct '17

05 Oct '17

All, I am performing some operating system upgrades and my exit nodes may be down for a period of time. Just a heads up. John

1 0

Re: [tor-relays] AU Relays and data retention
by Paul Templeton 05 Oct '17

05 Oct '17

Thanx Teor, I did speak to a lawyer and there is no requirement to retain any data if you run a node. It's treated as a VPN. My question that I sent was more about whether a service (non commercial service) was exempt. They don't delineate. Paul

2 1

AU Relays and data retention
by Paul Templeton 05 Oct '17

05 Oct '17

Hi All, I have asked the Attorney Generals Department about data retention and got the following response. If you run a relay/bridge here you seem to be exempt from retaining data. If your not an ISP and you run a service from home the ISP/carrier will retain the data though. This just general information. Regards, Paul UNCLASSIFIED Dear Mr Templeton Thank you for your enquiry to the Office of Communications and Cybercrime. I am re-sending our reply to your original enquiry that we sent on 12 September 2017 that seems to have not arrived. The extent of data retention obligations for your relevant service would relate to the extent to which elements of the data set “visible” to you. For example, where a provider does not have “visibility” of a customer’s IP address, it is likely that the IP address was assigned as part of a different relevant service. For example, if you have a record of the MAC addresses of users who access your network then this information must be retained for the required period. You are not obliged to retain the identity of the user if this is not information to which you have access. Whether the service is being offered on a commercial basis or is free is irrelevant in determining a service provider's obligations. In your email you noted that "The true origin of a connection and the true destination will never be known and there will be no way of obtaining the information. That also pertains to the ports used in the circuit and all data passing through the circuit will be encrypted." This sentence appears to suggest that you may be looking to offer some kind of an internet access service, in which case the destination is not required to be retained. Your reference to encrypted content suggests a VPN. If this is the case and this service is not operated you, obligations do not apply. Also, data retention would not require you to store the contents of the communications. Please do not hesitate to contact our office if you require further information. Regards Kerry Office of Communications Access & Cybercrime Intelligence and Identity Security Division T: (02) 6141 2884 The information contained in this email is intended as guidance only. It does not constitute legal advice and should not be relied upon as such. If you require legal advice, you should consult an independent legal adviser.

3 3

SSH Bruteforce Attempts
by tanous .c 05 Oct '17

05 Oct '17

Hi, I have been running one tor exit relay for about 51 days and i recently got this abuse report: Good afternoon, Your Ip address (212.47.239.73) has been reported to us by profihost because it seems to have attempted to bruteforce. Thank you to take the necessary action as soon as possible. You will find more information about this report below this message. Feel free to contact Online.net technical assistance for more information. Online.net Abuse service ------------------------------------------------------------------------------ (time is MET / GMT+1): Tue Oct 3 08:59:40 2017: user: root service: ssh target: 77.75.252.250 source: 212.47.239.73 Tue Oct 3 08:59:10 2017: user: root service: ssh target: 77.75.252.250 source: 212.47.239.73 Tue Oct 3 08:59:10 2017: user: root service: ssh target: 77.75.252.250 source: 212.47.239.73 Tue Oct 3 08:36:18 2017: user: admin service: ssh target: 37.228.155.188 source: 212.47.239.73 Tue Oct 3 07:06:42 2017: user: user service: ssh target: 77.75.252.80 source: 212.47.239.73 Tue Oct 3 07:06:12 2017: user: user1 service: ssh target: 77.75.252.80 source: 212.47.239.73 Tue Oct 3 06:14:12 2017: user: admin service: ssh target: 77.75.251.85 source: 212.47.239.73 Tue Oct 3 06:01:41 2017: user: admin service: ssh target: 77.75.252.78 source: 212.47.239.73 Tue Oct 3 05:37:01 2017: user: admin service: ssh target: 185.39.221.52 source: 212.47.239.73 Tue Oct 3 02:07:46 2017: user: admin service: ssh target: 77.75.249.19 source: 212.47.239.73 Tue Oct 3 01:23:57 2017: user: admin service: ssh target: 85.158.176.137 source: 212.47.239.73 Mon Oct 2 20:10:45 2017: user: admin service: ssh target: 77.75.255.76 source: 212.47.239.73 Mon Oct 2 17:30:13 2017: user: admin service: ssh target: 185.39.221.145 source: 212.47.239.73 Mon Oct 2 17:30:13 2017: user: admin service: ssh target: 185.39.221.145 source: 212.47.239.73 Mon Oct 2 17:09:32 2017: user: admin service: ssh target: 37.228.154.149 source: 212.47.239.73 Mon Oct 2 17:09:23 2017: user: admin service: ssh target: 37.228.154.102 source: 212.47.239.73 Mon Oct 2 16:43:12 2017: user: admin service: ssh target: 77.75.252.233 source: 212.47.239.73 Mon Oct 2 16:23:41 2017: user: admin service: ssh target: 37.228.155.125 source: 212.47.239.73 Mon Oct 2 14:17:24 2017: user: admin service: ssh target: 77.75.250.84 source: 212.47.239.73 Mon Oct 2 13:24:14 2017: user: supervisor service: ssh target: 37.228.159.139 source: 212.47.239.73 Mon Oct 2 13:24:14 2017: user: support service: ssh target: 37.228.159.139 source: 212.47.239.73 Mon Oct 2 13:23:44 2017: user: super service: ssh target: 37.228.159.139 source: 212.47.239.73 Mon Oct 2 12:48:09 2017: user: user service: ssh target: 37.228.159.98 source: 212.47.239.73 Mon Oct 2 12:47:39 2017: user: user service: ssh target: 37.228.159.98 source: 212.47.239.73 ------ This data has been truncated because it was too long ------ Have any of you had this sort of problem? I'm having difficulty determining if this log information represents a normal exit relay ocurrence or if my server has been compromised... What could i do in order to solve this? Thank you all, Tanous

4 4

SSH brute force attempts to connect to my Middle Relay IP address
by Fr33d0m4all 04 Oct '17

04 Oct '17

Hi, My Tor middle relay public IP address is victim of SSH brute force connections’ attempts and the attack is going on since two weeks ago. It’s not a problem, the server that is listening with SSH on the same IP address than my Tor relay blocks the connections and bans the IP addresses (with Fail2Ban) but I just wanted to know if there is some campaign of attacks carried against Tor relays.. are you experiencing the same? The attacks are carried on with a botnet given the large amount of different IP addresses that I see in the logs. Best regards, Fr33d0m4All

10 11