- tor-relays - lists.torproject.org

Overload (dropped ntor) due to DDoS??
by Richard Menedetter 06 Aug '22

06 Aug '22

Hi All I have a non exit relay running on a root server (4 AMD Epyc cores, 8 GB RAM, 2.5 GBit/s Ethernet) I have limited tor to numcpus 2, relaybandwidthburst 15 MB, hardwareaccel 1, maxadvertisedbandwidth 10 MB, maxmeminqueues 3GB Usually it takes less than 1 CPU core, and like 1 GB of RAM. But recently my relay is foten shown as obverloaded. I have these LOG entries: Tor[814]: General overload -> Ntor dropped (290376) fraction 5.3451% is above threshold of 0.5000% Is this due to DDoS attacks or a misconfigration on my side? Is there something that I can do to aleviate this issue? CU, Ricsi

4 5

OT: cheap bar metal machines
by lists＠for-privacy.net 05 Aug '22

05 Aug '22

HiHo, because I switched to my own servers in colocation, I canceled some rented ones. These were all Supermicro blades 8c Opteron, 2 hd's and BMC (IPMI). https://www.supermicro.com/Aplus/system/3U/3012/AS-3012MA-H12TRF.cfm SSD: Samsung (840,850,860) EVO, SATA: WD Enterprice (WDC_WD1003FBYX) They're relatively cheap. 16 EUR + 8 EUR per 16GB RAM. So server with 16GB RAM = 24 EUR/month or 32GB = 32 EUR/month. The 16GB are more than enough for 2 Tor instances! I still operated Monero mining on 4 CPU cores. Currently there is a 10% discount (permanent) and all servers with unmetered unlimited traffic (1000 Mbit). All with no setup fee. https://servdiscount.com/ The same applies to the new servers https://www.webtropia.com/ You can rent the servers prepaid or with a term of 1,3,6,... months/notice period. Hints: If you set up a customer account beforehand, you can upload your SSH keys for server setup. When setting up, select Raid1 (mdraid on Linux) directly. If you have any questions, please write to me personally. German or English. -- ╰_╯ Ciao Marco! Debian GNU/Linux It's free software and it gives you freedom!

1 0

Re: [tor-relays] tor 0.4.6 reached end of life
by torserver 03 Aug '22

03 Aug '22

Hi, on my Raspberry Pi 4 I can 't update from 0.4.5. The armhf architecture seems to be the problem. How do I have to upgrade to the newer versions? So far I haven 't found the ultimate way to setup a TOR relay on a Raspi 4 with auto updates. Greetz ghostbuster > Op 02-08-2022 14:00 schreef tor-relays-request(a)lists.torproject.org: > > Subject: [tor-relays] tor 0.4.6 reached end of life > > If you still run tor 0.4.6, now is a good time to upgrade your tor version. > > the list of largest operators still running end of life tor versions: > https://nusenu.github.io/OrNetStats/#end-of-life-relays-share > > https://nusenu.github.io

2 1

Please update your Snowflake proxy
by gus 03 Aug '22

03 Aug '22

Hi, If you're running Snowflake proxies, please read and share the message below. Thank you! Gus ------------------------------------------------------------------------ Please Update your Snowflake Proxy to help us rollout Distributed Snowflake Server Support https://forum.torproject.net/t/please-update-your-snowflake-proxy-to-help-u… At Tor, we are constantly trying to improve Snowflake to make it accessible to more people. This means we are currently working on enabling horizontal scaling of Snowflake to distribute the traffic to more than one server. After this update is roll outed, users will be able to choose one of the secondary snowflake servers as the connection target and reduce the traffic load on the default server. However, this change requires an updated version of the snowflake to be rolled out. This means this change is not live until enough proxies are updated to the most recent version and after we start to reject the previous version of snowflake proxies. For this reason, we would like to request you to update the version of your snowflake proxy, if you haven’t done that yet. Here are some guides on how to check the version and/or update the most recent version of snowflake: ### WebExtension on Firefox To check the version: go to about:addons. Click the 3 dot symbol on the right of Snowflake, and then select manage. you will be able to check the version of Snowflake. It should be 0.6.1. To update: Click the gear symbol on the top of the page, and then select check for updates. ### WebExtension on Chrome To check the version: go to chrome://extensions/?id=mafpmfcccpbjnhfhjnllmmalhifmlcie, and you will see the option to update the snowflake WebExtension. It should be 0.6.1. To update: go to chrome://extensions/ turn on developer mode and then select update. ### Standalone with Docker To check the version: docker run thetorproject/snowflake-proxy -v should include “-allowed-relay-hostname-pattern” in the output. To update: docker pull thetorproject/snowflake-proxy ### Standalone with Go Toolchain To check the version: proxy -v should include “-allowed-relay-hostname-pattern” in the output. To update: go install git.torproject.org/pluggable-transports/snowflake.git/v2/proxy@latest -- The Tor Project Community Team Lead

1 0

When will relays disappear form tor metrics
by Anders Burmeister 01 Aug '22

01 Aug '22

Hi heroes Ended and deleted my two relays Aerodynamik02 and Aerodynamik03. When can I expect they will disappear from tor metrics?https://metrics.torproject.org/rs.html#details/EFEACD781604EB80FBC0… Best regards Anders

2 1

tor 0.4.6 reached end of life
by nusenu 01 Aug '22

01 Aug '22

If you still run tor 0.4.6, now is a good time to upgrade your tor version. the list of largest operators still running end of life tor versions: https://nusenu.github.io/OrNetStats/#end-of-life-relays-share -- https://nusenu.github.io

1 0

An attempt to block spam ip addresses
by Toralf Förster 01 Aug '22

01 Aug '22

Issue 40636 and others deal with DDoS / concurrent connections. Here're few numbers from my attempt [1] of the last days to block such ip addresses. The stats are from 2 relays running at the same ip. Currently there're 700 ip addresses (15 IPv6) caught in the denylist. Those either opened >4 connections to the same orport and/or produced >12 new connection attemps within 5 minutes to the orport. Those system do re-appear quickly if the denylist is flushed. Within one hour over 500K packets, mainly TCP connection attempts, are dropped. Furthermore the number of used sockets at the system is reduced from >35K to about 21K. Nevertheless both relays spew the warnings "Your computer is too slow" and "General overload" from time to time. I do assume that this is a layer 7 problem and therefore can't be fixed at layer 3. The filter is build up from iptables. Scripts for IPv4 and IPv6 can be found under [2] and [3] respectively. [1] https://gitlab.torproject.org/tpo/core/tor/-/issues/40636#note_2821683 [2] https://github.com/toralf/torutils/blob/main/ipv4-rules.sh [3] https://github.com/toralf/torutils/blob/main/ipv6-rules.sh -- Toralf

1 0

Impact on running a tor relay on other internet services?
by Thoughts 28 Jul '22

28 Jul '22

Hi all - I've been running a TOR non-exit relay for several months now. Its rare, but I'm seeing what I believe is the occasional connection attack, with my relay complaining about the number of connections and suggesting I reduce capacity. Those are rare, and most of the time my server is running at about 20% CPU. During attacks, which seem unrelated to my Tor Upload/Download rate, CPU jumps to well over 100% (quad core, so 400% is max). I'd normally just ignore this, but it seems to be impacting other aspects of my network experience: Messenger Rooms will unexpected close, NetFlix gets "unable to stream this title", family complains about slow and dropped connections, etc. Just had it happen a few minutes ago with a Messenger Room and sure enough, CPU is at 130%, even though I'm only pumping about 15MB/Sec (37.5MB/S limit, 56.2 burst, 40.3 observered) over my gigabit ISP connection. Speedtest shows the performing within acceptable parameters. So contemplating what I can do, since this is bothersome. I've come up with a few alternatives, and curious about your thoughts: 1) Do some type of connection limiting at my PFSense Plus firewall. Perhaps limiting things to, say, 30 connections per IP address? Not even sure that is possible, but figure it might lighten the load on the TOR server. 2) Drop being a TOR non-exit relay and convert to a bridge. Not sure how long, if ever, it would take for my IP address, which is now public, to fade off of block lists... Not ideal, but at least as a bridge I'd still be servicing the environment. 3) Try connection limiting via iptables on the TOR host. Just seems like doing that at the firewall would be better. Thoughts? Kevin

1 1

relay memory leak?
by Fran 26 Jul '22

26 Jul '22

Hey, new non-exit relay, Debian 11, tor 0.4.7.8-1~d11.bullseye+1, ~ 1 week old (-> no guard) KVM VM with atm 4 cores, host passthrough AMD EPYC (-> AES HW accel.). As can be seen at the attached screenshots memory consumption is irritating as well as the quite high CPU load. All was fine when it had ~100 Mbit/s but then onion skins exploded (110 per second -> up to 4k per second) as well as CPU and memory. Tor complains: > Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. And from time to time memory killer takes action torrc is pretty basic: Nickname 123 ContactInfo 123 RunAsDaemon 1 Log notice syslog RelayBandwidthRate 2X MBytes RelayBandwidthBurst 2X MBytes SocksPort 0 ControlSocket 0 CookieAuthentication 0 AvoidDiskWrites 1 Address xxxx OutboundBindAddress yyyy ORPort xxxx:yyy Address [zzzz] OutboundBindAddress [zzz] ORPort [zzz]:xxx MetricsPort hhhh:sss MetricsPortPolicy accept fffffff DirPort yy Sandbox 1 NoExec 1 CellStatistics 1 ExtraInfoStatistics 1 ConnDirectionStatistics 1 EntryStatistics 1 ExitPortStatistics 1 HiddenServiceStatistics 1 Ideas/suggestions (apart from limiting BW) to fix this? Thanks fran

3 5

Next Tor Relay operator meetup + MCH activities
by gus 26 Jul '22

26 Jul '22

Hi everyone, This month we won't have our monthly online check-in as many of us are traveling or on vacation mode. But, don't feel sad, we will have two activities this weekend! 1. (livestream): Modernizing the Tor Ecosystem for the Future, 2022-07-24, 15:00-15:50 with Alexander Færøy (ahf), Network Team Lead. Read more: https://program.mch2022.org/mch2021-2020/talk/MUP7MX/ 2. Relay Operator Meetup @ May Contain Hackers (MCH2022) ahf, Artikel10 and many others Tor contributors are at MCH and they are organizing a relay operator meetup! If you are at MCH2022, please get in touch with them!! https://blog.torproject.org/event/mch2022/ The next meetup will be at the end of August. I'll send the invitation at the beginning of August. :) cheers, Gus -- The Tor Project Community Team Lead

3 3

Tor bridges limit
by Me 25 Jul '22

25 Jul '22

Good day all. I am currently running two middle relays on my home network and was wondering if I can add any bridges to my existing set up. I am aware of the limit of two middle relays per ip address but do not see anything stating whether there was any such limit for bridges. I am also not clear on whether the bridges are recognized by the tor network in the same manner as Middle relays and whether the two unit limit applies to the total of devices connected. Thank you in advance for any guidance and always remember.... They are watching

2 1

Relay Overloaded and Dropping Onionskins
by bidulock_ringrose＠aleeas.com 21 Jul '22

21 Jul '22

Greetings! I hope this is the right list to be asking this, if it is not please forgive me. I am purposefully omitting some identifying information for privacy sake. I run 2 non-exit relays both with an advertised bandwidth of around 8 MiB/s each. I have noticed that they have been overloaded a lot lately. These relays have been bottlenecked at the 3-4 MiB/s mark ever since I put them online. Upon further investigation, when I curled the MetricsPort according to https://support.torproject.org/relay-operators/relay-bridge-overloaded/, the following metrics stood out to me. Both relays run on the same machine with the same IP address. I hope the obfuscation makes sense. Side note: I am using Toralf's ddos-inbound script, which has not dropped any connections at all for me when using the -b then -s switch. CPU utilization is high (80%) on one core but low on the rest (5-30%) In the syslog, I also get spammed with "Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [28xxx similar message(s) suppressed in last 34200 seconds]" Relay 1: tor_relay_load_onionskins_total{type="ntor_v3",action="processed"} 750xxxx tor_relay_load_onionskins_total{type="ntor_v3",action="dropped"} 17 tor_relay_load_global_rate_limit_reached_total{side="read"} 6xxxx tor_relay_load_global_rate_limit_reached_total{side="write"} 17xxxx Relay 2: tor_relay_load_onionskins_total{type="ntor_v3",action="processed"} 10xxxxxx tor_relay_load_onionskins_total{type="ntor_v3",action="dropped"} 28xxxx tor_relay_load_global_rate_limit_reached_total{side="read"} 20xxxxx tor_relay_load_global_rate_limit_reached_total{side="write"} 19xxxx All other metrics are normal according to the article on overloaded relays. This runs in a Debian Proxmox VM using the host cpu, so no CPU virtualization. 4 cores, 8GB memory, and AES is supported. It's 2x Xeon 2628v3s with NUMA enabled in the VM (2 sockets, 2 cores per socket). Enabling NUMA and de-virtualizing the CPU has helped increase my top bandwidth by around .7 to .9 mbytes/s, but still not great. Thank you in advance.

2 1

Bridges and Hs_vanguards
by dmz21 12 Jul '22

12 Jul '22

Dear readers, During the last week the bytes/second of my bridge dropped to 20% of its common usage over the past months, while the average number of connected clients stayed the same (according to metrics.torproject.org) I'm also seeing a dozen circuit connections with purpose Hs_vanguards in nyx recently, which are not familiar to me. Under-utilization of my bridge is not a problem to me, but maybe someone can tell me whether the two are related? Maybe it's an issue at my end or my hoster or maybe a generic issue of the tor network currently? Or maybe it's all normal? Thanks and best regards

1 0

We're trying out guard-n-primary-guards-to-use=2
by Roger Dingledine 11 Jul '22

11 Jul '22

Hi folks, As part of the hackweek projects ( https://gitlab.torproject.org/tpo/community/hackweek/ ), some of us are thinking about simple tweaks we can do to tune the network to better handle this month's traffic overload. The long term answer is to try out proposal 327: https://gitweb.torproject.org/torspec.git/tree/proposals/327-pow-over-intro… because we think a lot of the overload has to do with people sending way too many intro cells to some onion services, and giving the onion services ways to defend themselves is the only real answer. But while we're thinking about implementing that proposal, one of our earlier steps is to set the guard-n-primary-guards-to-use consensus parameter from 1 to 2. Now that it's taken effect (you can watch the votes at https://consensus-health.torproject.org/#consensusparams ), this change means that clients will now choose between two guard relays by default (rather than just one) when building circuits. This is potentially a big deal, since it puts us into a different point in the performance vs safety tradeoff space. Here is some reading for why we originally moved down to 1 guard by default: https://blog.torproject.org/improving-tors-anonymity-changing-guard-paramet… https://www-users.cse.umn.edu/~hoppernj/single_guard.pdf But on the theory that some guards are way overloaded right now and some aren't, giving clients two bites at the apple might make a dramatic improvement in terms of reliable and consistent performance. There is also some argument in favor of using two guards anyway. One reason (explained more in proposal 291) is that there are already some edge cases where clients use their second guard. And also, in the glorious future, we will want to be using multiple guards because we have switched to the multi-path Conflux design (proposal 329) -- though we're not there yet. So: I am giving you all here some early warning, in case you see anything odd on the network when we make this change. Let us know if you do. :) --Roger

4 5

Is ExoneraTor still alive?
by Christian Pietsch 07 Jul '22

07 Jul '22

Dear all, ExoneraTor is/was useful for showing law enforcement authorities that a given IP address acted as a Tor exit relay at a given day. Unfortunately, ExoneraTor seems to be offline. This page does not work at all, returning an HTTP 503 error immediately: https://exonerator.torproject.org/ This page returns the following error whenever I submit an IP address: https://metrics.torproject.org/exonerator.html | Server problem | | Unable to connect to the database. Please try again later. If this problem persists, please let us know! Can it be revived? Can I help? Cheers, Christian -- Christian Pietsch volunteering for Digitalcourage e.V. https://digitalcourage.de/ – Swarm support: https://digitalcourage.de/swarm-support – German BigBrotherAwards: https://bigbrotherawards.de/

2 1

[Event] Tor relay operator meetup - June 25th @ 1900 UTC
by gus 27 Jun '22

27 Jun '22

Hello, The next Tor relay operator meetup will happen on Saturday, June 25 @ 1900 UTC. Where: BigBlueButton - https://tor.meet.coop/gus-og0-x74-dzn No need for a registration or anything else, just use the room-link above. We will open the room 10 minutes before so you can test your mic setup. Everyone is free to bring up additional questions or topics at the meeting itself. Please share with your friends, social media and other mailing lists! cheers, Gus -- The Tor Project Community Team Lead

1 2

Relay "unmeasured" after update to 0.4.7.8
by Martin 27 Jun '22

27 Jun '22

Hi all! After updatering to the latest version, my relay consensus went down to 20 and was marked unmeasured. However it still serves a couple of thousand connections (capped at 10 MB/s) and all flags are still there, but when I try to use it to build a circuit manually it won't let me... Cheers

2 1

Metrics shows my relay down. But it's not.
by Eddie 25 Jun '22

25 Jun '22

The metrics is showing one of my relays (40D13096BBD11AF198CE61DEE4EAECCE5472F2E7) as down for around the last 3 hours. Logging in to it, I see everything running normally. This server has also lost a bunch of flags for no apparent reason, so I'm not sure if they're connected. Cheers.

2 1

FreeBSD 13.1: clock_gettime(CLOCK_MONOTONIC_FAST) ~ 50 % performance gain
by Andreas Kempe 22 Jun '22

22 Jun '22

Hello everyone, I was doing some profiling on my two relays running on FreeBSD 13.1 and noticed that they were spending a lot of time in clock_gettime() which prompted me to have a look at the implementation. Time implementation =================== The time implementation is abstracted in src/lib/time/compat_time.c where different mechanisms are used for different operating systems. On Linux CLOCK_MONOTONIC_COARSE is a clock that gives worse precision than CLOCK_MONOTONIC, but is faster and the abstraction layer checks for its presense and provides more performat less precise time where applicable. On FreeBSD, there is also a fast monotonic time source available called CLOCK_MONOTONIC_FAST. In the header file src/lib/time/compat_time.h, a comment references this clock, but it is not used. I thought it might be worth a shot seeing what difference it would make if I enable the use of CLOCK_MONOTONIC_FAST on FreeBSD and on the VM where I run my two FreeBSD relays, the difference was stunning. I made did a quick patch simply replacing CLOCK_MONOTONIC_COARSE with CLOCK_MONOTONIC_FAST, see patches attached, compiled and tested. Tracing system calls to make sure the correct call was being used, which it was. Results ======= This lead to reducing the CPU usage of the patched relay by about 50 % compared to the unpatched relay. I was a bit shocked so I wrote a small benchmark program and ran it on my VM giving the following results: CLOCK_MONOTONIC: 4.776675 s CLOCK_MONOTONIC_FAST: 0.260002 s Showing that on my VM the performance of CLOCK_MONOTONIC_FAST is about 20 times better than CLOCK_MONOTONIC. I have tested on a few different systems and I think that the performance increase of CLOCK_MONOTONIC_FAST is thanks to commit 60b0ad10dd0fc7ff6892ecc7ba3458482fcc064c - "vdso: lower precision of vdso implementation of CLOCK_MONOTONIC_FAST and CLOCK_UPTIME_FAST" that was cherry-picked to 13.1. Try it yourself and report your results ======================================= If you want to benchmark your server to see whether switching clock could benefit you, you can compile and run my attached test program by doing user>clang -o bench.c -o bench user>./bench In case the program terminates too quickly or slowly for your liking, adjust const unsigned long iterations = 1000000; up or down to change the execution time. My supplied patches appear to work fine on my system, but aren't really upstream appropriate since a solution that works for both FreeBSD and Linux is needed. If you want to test them and you're building Tor from the ports tree, drop them in /usr/ports/security/tor/files and build and install. I'm very interested in seeing some performance data from other people to see whether I think it worth either pestering some Tor devs to have a look at this or putting in some effort myself to write an upstreamable patch. Thank you for reading! Cordially, Andreas Kempe

3 4

From [tor-announce] Tor stable release 0.4.7.8 - Security Fix
by Felix 20 Jun '22

20 Jun '22

> We have released tor 0.4.7.8 earlier today, a new stable version for > the 0.4.7.x series containing an important High severity security > fix. The affected tor are only those of the 0.4.7.x series as in from > tor-0.4.7.1-alpha to tor-0.4.7.7. Jun 18 10:08:46.000 [notice] This version of Tor (0.4.7.8) is newer than any recommended version, according to the directory authorities. -- Cheers Felix

2 1

EXPKEYSIG when running 'apt update'
by Imre Jonk 17 Jun '22

17 Jun '22

Hi tor-relays, I'm getting this error when running 'apt update': Err:4 https://deb.torproject.org/torproject.org bullseye InRelease The following signatures were invalid: EXPKEYSIG 74A941BA219EC810 deb.torproject.org archive signing key The signing key in /etc/apt/trusted.gpg.d/deb.torproject.org-keyring.gpg does not appear to be expired, so I guess some repository metadata signature has expired. Does anyone else encounter this issue? Thanks, Imre

4 4

Identifying a relay
by Eddie 16 Jun '22

16 Jun '22

Have a question about how a server I connect to can tell I am running a guard/middle relay. All I can think of is that they check the published list of tor nodes against the IP. Or (maybe, but unlikely) portscan the IP and probe any open ports to determine the service. Are there any other methods that can be used. Background: The corp my wife works for blocked our IP. The excuse they gave was that it was due to a change made by a vendor they use to identify malicious IP addresses. I have been running the relay for almost 5 years without any previous flagging. They also state that running a middle relay is not in violation of any policy, but the vendor mis-identified our relay as an exit, hence blocking it. After changing the IP, the new IP was also blocked in less than 24 hours. My feeling is that the vendor is now just using the full list of tor nodes and indiscriminately blocking everything, despite what the corp security folks say. I'm looking for some sort of validation I can use to counter their claims.

5 5

(No Subject)
by Admin Platinum Host 14 Jun '22

14 Jun '22

Hi there, I currently own a Tor Relay that has been running since 2022-05-24. A day ago it restarted, which was a bit strange. Recently I found that the Relay has changed to a Guard Relay, which I am pleased about. I was wondering why the restart occurred as the VPS Server has been online since the first start. The Relay is called UKLondonRelay1 with the IP address 80.64.218.62. https://metrics.torproject.org/rs.html#details/B1B1CAD0A73EC5148B06A0A0E819… Any help on this matter would be appreciated. Kind regards, Leon The content of this email is confidential and intended for the recipient specified in message only. It is strictly forbidden to share any part of this message with any third party, without a written consent of the sender. If you received this message by mistake, please reply to this message and follow with its deletion, so that we can ensure such a mistake does not occur in the future.

1 0

[Workshop] Sysadmin 101 for (new) relay operators - June 4th @ 1900 UTC
by gus 14 Jun '22

14 Jun '22

Join us June 4th at 1900 UTC for new and prospective Tor relay and bridge operators on the basic "sysadmin foo" required to contribute to the network! ## Sysadmin 101 for new relay operators So you want to contribute to the open-source Tor network by running a relay or maybe a bridge? The Tor network is the most important tool for evading surveillance and bypassing internet censorship. And Tor relays and bridges are vital to the health and integrity of the Tor network. Millions of users rely on relays and bridges to stay safe, and how you configure and maintain that relay or bridge is critical. Volunteers aren't a nice enhancement. They are a core feature. Running a relay or a bridge raises frequent questions: * Should I run a relay or a bridge? * Should I run a relay or a bridge from a residential/home internet connection? * Which operating system should I run for my Tor node (hint: the one you are most comfortable with securing and maintaining) * More generally, what does it take to keep that relay or bridge operating safely, but both you and Tor users? This workshop will start with a presentation approaching some of the core issues that arise when running a Tor node. The session will move into an "ask me anything" discussion to approach other common and less common questions. The 90-minute event will be geared towards current and prospective Tor bridge and relay operators, particularly those relatively new to running public internet services. Seasoned Linux and BSD Tor operators will be attending the event ready to address the discussion. ## How to join the workshop The workshop is entirely free, and participants need to fill out this registration form. The event will take place on BigBlueButton, an online video conference platform, on June 4th at 1900 - 2030 UTC. You can register here: https://nc.torproject.net/apps/forms/cDLPxryHJcP5kMeW ## Facilitators The workshop will be facilitated by: * George (@gman999) - Tor *BSD Diversity Project member, Serge bridge directory authority maintainer, long-time relay operator and a wide variety of other contributions. * Kushal Das (@kushal) - RPM Tor maintainer and member of the Tor Community team. -- The Tor Project Community Team Lead

2 3

My current node setup
by Nyasaki Server 08 Jun '22

08 Jun '22

Hi to all new ppl that may have joined after the sysadmin101 workshop. I decided to share my setup here in case any newbies are interested and maybe somebody who is doing this for a while longer than me sees any flaws in my setup. Feedback is always welcome! I was tired of using the debian testing for running my node and decided to redo my node with arch because of the fast package updates and rolling release model. Currently my setup consists of 3 servers: Exit-Node: Archlinux with tor, unbound and prometheus running, prometheus is a nice metric collection service that nicely collects the statics that tor exposes. It's a VPS hosted at Terrahost in Norway for 20$ / month with 2 vCPU’s and 4GB Memory. Unbound only resolves requests from localhost, due to a high percentage of DNS timeouts in the past I decided to use this just as backup and resolve everything else via the dedicated DNS server. Tor is set up to expose the metrics to localhost, where prometheus is running. The actual prometheus metrics port is just allowed for 1 IP, thats the one my Dashboard server has. The firewall is set up to allow every port that's listed in my torrc, my non-default ssh port and the IP of my dashboard for the metrics port. DNS: Ubuntu 22.04 LTS (due to oracle clouds small selection of images) with unbound as DNS and prometheus. Hosted at Oracle Cloud via the free tier with 1 vCPU and 1GB Memory. The firewall is open for DNS requests from my node ip, metrics requests from my dashboard IP and non-default ssh port. Dashboard: Ubuntu 22.04 LTS with unbound as DNS and prometheus. Hosted at Oracle Cloud via the free tier with 1 vCPU and 1GB Memory. There's a Grafana dashboard and the Prometheus server running. Again all ports blocked but ssh and http/https are open Image of the Dashboard https://imgur.com/a/fYpRD8O My Node https://metrics.torproject.org/rs.html#details/017342E197B8C575A5C5301CD008… My GPG Key https://keyserver.ubuntu.com/pks/lookup?search=nyasaki.srv%40gmail.com&fing…

3 2

New OrNetStats Section: Largest Bridge Operators
by nusenu 08 Jun '22

08 Jun '22

Hi, OrNetStats got a new section today showing the largest bridge operators by advertised bandwidth grouped by ContactInfo: https://nusenu.github.io/OrNetStats/#bridge-operators-grouped-by-contactinfo This is possible because the Torproject started to publish bridge ContactInfos. The listing only includes operators with at least 50 Mbit/s aggregated advertised bandwidth. AROI support for bridges You can also protect your bridge ContactInfo against spoofing now. The same fields as for relays apply. If you have setup your AROI [1] on your relays already you can simply copy the ContactInfo to your bridges and publish the list of hashed bridge fingerprints under this URL: https://-your-hostname-/.well-known/tor-relay/hashed-bridge-rsa-fingerprint.txt After successful validation your bridges will be added to your operator level pages on OrNetStats. OrNetRadar will also be extended to support bridges. kind regards, nusenu [1] https://nusenu.github.io/OrNetStats/#authenticated-relay-operator-ids -- https://nusenu.github.io

3 3

Error 403 connecting to Sysadmin 101 Workshop
by Eldalië 07 Jun '22

07 Jun '22

Hello there, I'm trying to connect to the Sysadmin 101 Workshop, but after waiting for moderator approval I keep getting the following error (also in the attached image): You have been removed from the meeting User has an invalid sessionToken due to ejection --- 403 Any idea about what's happening here or how to solve it? -- Eldalië My private key is attached. Please, use it and provide me yours!

2 2

Will pay but need someone
by paul＠coffswifi.net 07 Jun '22

07 Jun '22

5 4

[Event] Relay Operators Meetup - May 21, 2022 @ 1900 UTC
by gus 07 Jun '22

07 Jun '22

Hello relay operators, The next Tor relay operator meetup will happen on Saturday, May 21 @ 1900 UTC. Where: BigBlueButton - https://tor.meet.coop/gus-og0-x74-dzn No need for a registration or anything else, just use the room-link above. We're working on the agenda here: https://pad.riseup.net/p/tor-relay-meetup-may-2022-keep Everyone is free to bring up additional questions or topics at the meeting itself. Please share with your friends, social media and other mailing lists! cheers, Gus -- The Tor Project Community Team Lead

5 6

Does Tor work with Intel QAT acceleration
by Andreas Bollhalder 07 Jun '22

07 Jun '22

Hi all I have my first Tor relay up und running. It's currently installed on a little desktop computer with an Intel i5 9500T CPU. My Internet connection is 10Gb/s symetric. From this bandwidth, I would be able to spend a good part for supporting the Tor network. With that little machine, it seems that it would max out at somewhere at ~30 MBytes/s. For my definitive Tor relay hardware, I'm currently researching some options, which would be capable of handling Tor traffic at the rate of 200 to 300MBytes. Even it would be used nowadays, but who knows whats coming in the future and I hope this relay would last 5 years ore so. It looks to me, that with a normal CPU, it's impossible to reach my goal. But then I encountered, that Intel has the Quick Assist Technoloy (QAT) integrated in some of their products (ie. Atom C3xx8). This QAT can be used with OpenSSL as a hardware accelerator for encryption. There also exist dedicated PCIe cards with QAT (ie. Netgate CPIC-8955). Searching the Internet, I couldn't find any information if QAT would be helpful with Tor. But Tor uses the OpenSSL library and this can use the QAT acceleration. Is there anyone who has tried this und can share his expirience? Thanks in advance Andreas

4 6

[warn] Received a bad CERTS cell: Link certificate does not match TLS certificate
by Felix 07 Jun '22

07 Jun '22

Hi all I found a message in the logs: Apr 16 15:07:46.000 [warn] Received a bad CERTS cell: Link certificate does not match TLS certificate -- Cheers Felix

2 1

Debian is not allowing tor to update despite it being listed as a trusted respritory
by Keifer Bly 07 Jun '22

07 Jun '22

7 25

Weird spike in written bytes per second
by Marco Predicatori 07 Jun '22

07 Jun '22

Hi, the graph shows a marked difference between written bytes per second and read bytes per second om 2022-05-19 and 2022-05-20. In any other day the bytes are roughly the same. What might my node have "written" on those two days? https://metrics.torproject.org/rs.html#details/A4E74410D83705EEFF24BC265DE2… Thanks, Marco

3 3

Update on tor issue on my debian
by Keifer Bly 07 Jun '22

07 Jun '22

4 6

Re: [tor-relays] [Workshop] Sysadmin 101 for (new) relay operators - June 4th
by Isaac Grover, Aileron I.T. 07 Jun '22

07 Jun '22

Good morning Gus, For those of us with families and other weekend commitments, will an on-demand replay be made available afterwards? Make your day great, Isaac Grover

3 2

bridge issue
by potlatch 07 Jun '22

07 Jun '22

Hello, I have a bridge [1] that doesn't have any keys in /var/lib/tor/keys! How is that possible and how do I fix the problem? potlatch [1] FB45183DD82D572CA2B2641C1AB0EB0D8CE7B858 Sent with [Proton Mail](https://proton.me/) secure email.

3 2

EOL after changing operatin system
by Fred 03 Jun '22

03 Jun '22

Hey there, I had to change my operating system and started an new relay instead of using the old keys. The new one is runnig fine. Dead relay: 67D1278A974D61104F7273E6266DEF3A5C26F191 T heoor Sorry, Daniel -- Gesendet mit Vivaldi Mail. Laden Sie Vivaldi kostenlos von vivaldi.com herunter.

1 0

EOL 2 x relay
by Anders Burmeister 03 Jun '22

03 Jun '22

Hi Heroes I’m sorry to inform you, that my two relays will discontinue and no longer participating from 28 july 2022. Had a lot of fun here. Fingerprint: EFEACD781604EB80FBC025EDEDEA2D523AEAAA2F Fingerprint: 484A10BA2B8D48A5F0216674C8DD50EF27BC32F3 I wish you all the best Regards Anders

2 1

Relay migration: best practices?
by tor＠nullvoid.me 29 May '22

29 May '22

Hello, I operate a small family of relays, over the 5 years it's been very set and forget and easy to maintain. Over those 5 years the servers have been cluttered with other half completed projects and general mess. I plan on reinstalling the OS from scratch, and understand I must backup the "keys/ed25519_master_id_secret_key" and "keys/secret_id_key" in the DataDirectory. Then copy them over on the new server. The hostname will change but the IP will stay the same. The server I am working on is not listed as a fallback directory server, but has been in the past. Is there any other things I can do to disrupt the damage done to the tor network during this downtime? Especially to any clients using it as a bridge. Thanks,

2 1

Sanity check on NumCPUs
by Thoughts 29 May '22

29 May '22

For a non-exit relay, is "NumCPUs 2" still the recommended maximum? Running on a quad core and recently saw a message indicating I had insufficient CPU power to support the desired number of connections... Thanks, Kevin

6 7

Loss of Guard and HS Dir flags
by Eddie 29 May '22

29 May '22

I currently run 3 relays, across different servers and today I noticed that one has now lost it's Guard and HS Dir flags. What's surprising is that this particular relay has the highest Bandwidth and Consensus Weight of all 3 and has not been restarted for over a month. The stats for all 3 can be found with: OhNoAnotherRelay I know that just running the relay is the important part and caring about what flags it has is a side issue, but I'm just interested in seeing why this has happened. Cheers.

4 7

Bridge operators contact addresses online ;-)
by lists＠for-privacy.net 27 May '22

27 May '22

I happened to see that Bridge operators contact addresses can now be displayed. https://gitlab.torproject.org/tpo/network-health/metrics/relay-search/-/iss… Demo on Tor Metrics for all 'bauruine' and 'ForPrivacyNET' bridges. Thanks to the torproject team. -- ╰_╯ Ciao Marco! Debian GNU/Linux It's free software and it gives you freedom!

1 0

Question about new log messages after 0.4.7.7 upgrade
by wardz 27 May '22

27 May '22

Been getting these syslog messages occasionally *after* the 0.4.7.7 upgrade on my bridge: -- May 26 21:00:58 torbridge Tor[ ]: Unexpected path length 4 for exit circuit 66 5, purpose 5 [3 similar message(s) suppressed in last 5400 seconds] May 26 16:26:17 torbridge kernel: [ ] TCP: eth0: Driver has suspect GRO implementation, TCP performance may be compromised. -- Anyone know what they mean and if it's something I should be worried about? Calculated advertised bandwidth seems to be about the same. For reference, im running latest Raspbian 64-bit Lite on a Raspberry 4 with latest firmware aswell. driver: bcmgenetversion: 5.15.41-v8+ Sent with [Proton Mail](https://proton.me/) secure email.

2 1

Ext Relay Operators: Please Upgrade to 0.4.7.7!
by Mike Perry 27 May '22

27 May '22

Tor 0.4.7.7-stable contains a very important performance improvement, called Congestion Control. You can read more about this improvement here: https://blog.torproject.org/congestion-contrl-047/ The TL;DR is that users of Tor 0.4.7 will experience faster performance when using Exits or Onion Services that have upgraded to 0.4.7. We have packages in available for Debian, Ubuntu, Fedora, CentOS, and BSD: - Debian: https://support.torproject.org/apt/tor-deb-repo/ - Ubuntu: https://support.torproject.org/relay-operators/operators-4/ - Fedora/CentOS: https://support.torproject.org/rpm/tor-rpm-install/ - BSD: https://lists.torproject.org/pipermail/tor-relays/2022-May/020528.html We would like to have a large fraction of Exit relays upgraded before our next Tor Browser Stable Release, on May 31st. Please let us know if you have any problems upgrading to this release. Additionally, while non-Exit relays do not need to upgrade, they will notice the effects of congestion control. All relay operators who pay for bandwidth by the gigabyte may want to consider enabling hibernation, to avoid surprise cost increases: https://support.torproject.org/relay-operators/limit-total-bandwidth/ All relays may also experience higher CPU usage. If this is a problem, rate limiting relay bandwidth will also help: https://support.torproject.org/relay-operators/bandwidth-shaping/ We also recently fixed an issue with overload reporting in 0.4.6.10 and 0.4.7.7: https://gitlab.torproject.org/tpo/core/tor/-/issues/40560 This should mean that there are far fewer false positives in the overload reporting on https://metrics.torproject.org/rs.html. If after upgrading to either of those versions, you still see overload, please see: https://support.torproject.org/relay-operators/relay-bridge-overloaded/ P.S. There is a known warn bug with vanguards-lite on first startup. It is harmless: https://gitlab.torproject.org/tpo/core/tor/-/issues/40603 -- Mike Perry

5 7

Revisit issue on incorrect time stamps on metrics
by a tor op 21 May '22

21 May '22

Hi I wrote about incorrect date stamps for relays/bridges on atlas/metrics site in December 2021. This has reappeared since some time (dont know for how long). First seen fullt incorrect by years and all times unlogic, first seen later than last restarted etc. Is this a common problem or just some relays? TIA, A tor op

2 1

Introduction
by roelquerimi 18 May '22

18 May '22

Hello the Tor relay operators. Nice to meet you. I'm Roel Querimi, I operate 9 exit relays: 0B1120660999AD1022D08664BE1AD08A77F55E50, 05757E11F488C50E3425F5F7E9319411B4270365, 5D2871217ABD67C2569C49919B46F3DFC6281D63, 983548730C7F3F52170BF2195C85D1423C33253B, 72152AE84ECF44727A9506237A93D63EAFB22B07, 7AE15D809ED86C1F2998B45985A40E7F07F078B6, 5C1B834B2E8D982B82B23D05773C78CC23BB0EB9, 3075E246EE9AAE3EECABF92A9B40A598EC77608E, 92A9547A61E21357CBA0A6E64340BCD5DF29D94F Sent with [ProtonMail](https://protonmail.com/) secure email.

1 0

Tor exit Spain
by potlatch 17 May '22

17 May '22

Hello Paul, I've run exit relays for 15-years. I put the first relay into Albania and followed with the first exit relay in Albania. I lost my two Albanian relays when the Ukraine conflict started. I currently have relays in Moldova (2), Romania, Finland (2), Chile, Estonia, Latvia, Bulgaria. Most are smaller than your server w/Consensus Weight around 8000. Further, I operate bridges in Kazahkstan (3), Finland and Albania. I would like to know a bit more before offering to take your server. Do you have good relationship with IONOS SE? What is physical machine compliment? etc.? I operate out of Seattle Washington and have good communications with the Tor office here. I am retired electrical engineer with time to help Tor and Electronic Frontier Foundation. Hope you find a good operator for your primo relay. I can be contacted directly at potlatch(a)proton.me Stay safe always,potlatch The imagination of nature is far, far greater than the imagination of man. --Richard Feynman Sent with [ProtonMail](https://protonmail.com/) secure email.

1 0

Re: [tor-relays] (No Subject) (allforprivacy)
by Isaac Grover, Aileron I.T. 12 May '22

12 May '22

Good afternoon, The Library Freedom Project is what you're seeking, for libraries: https://libraryfreedom.org/ Also, I found this response on Slashdot for hosting at a university: https://yro.slashdot.org/comments.pl?sid=7773441&cid=50227785 Make your day great, Isaac Grover

1 0

(No Subject)
by allforprivacy 12 May '22

12 May '22

Good evening, I'd like to ask: How would one go about encouraging an organization (such as a college, university or library), that they are affiliated with to some extent, to operate a Tor Exit Relay? I currently operate a Non-Exit relay at home, but I would like to also see if me and some others in my organization could start an exit relay as well (Our jurisdiction is the United Kingdom). Thank you for reading, allforprivacy operator.

1 0

OpenBSD -stable net/tor and 0.4.7.7
by George 10 May '22

10 May '22

The OpenBSD net/tor -current port is correctly on 0.4.7.7, but the -stable port is still on 0.4.6.10. I submitted a diff to update -stable port to 0.4.7.7 last week, but it has not been committed yet. https://marc.info/?l=openbsd-ports&m=165179875418235&w=2 It's attached and should work fine. In order to update the OpenBSD -stable port you need an updated -stable 7.1 ports tree, then you apply the patch within the /usr/ports/net/tor port, and build from there. I can provide more guidance if necessary, but in order to not bore everyone else, maybe the Tor-BSD list is more appropriate? https://lists.nycbug.org:8443/mailman/listinfo/tor-bsd I can send out an amd64 -stable package, but then you'd have to trust me. g

1 0