- tor-relays - lists.torproject.org

tor 0.3.3.x reaches end-of-life on 2019-02-22
by nusenu 06 Jan '19

06 Jan '19

In less than 2 months from now, tor 0.3.3.x will reach its end of life date (2019-02-22). As of today there are still over 640 relays (>10% CW fraction) running that version. If you still run that or another end-of-life version of tor please update to help prevent known issues. -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

1 0

having just 1 exit port - helpful?
by Toralf Förster 06 Jan '19

06 Jan '19

If just 1 port would be opened at an relay, eg. 6697, would this help the Tor network or would only spammers and DDoS use that port? -- Toralf PGP C4EACDDE 0076E94E

4 3

Onion v2 HSDir Support (ref: v3 prop224) [was: fishy fingerprint patterns]
by grarpamp 04 Jan '19

04 Jan '19

> relays have a rather distinct signup and fingerprint pattern > usually seen for onion attacks. > ... > a) If you are an .onion operator I'd like to encourage you to switch to onion > services version 3 > ... > so we can start > ... > b) dropping onion version 2 services eventually. These are two separate things not necessarily tied together, thus split for clarity as above. The former a) is up to the onion operator based on their needs. If they have no need for v2, or need v3, they can or should switch to v3, indeed. The latter b) is a feature that some users and operators in and for onionspace explicitly choose and depend on to support common apps, and thus would definitely not like to see yanked out from under them. Better instead to advertise and update the default onion semantics for [new] users to v3, and continue support and backport doable features to v2 until time below... Node operators (tor-relays) would continue offering v2 HSDir support module until such time as the reasons for choosing v2 by those above are supported in v3 or vN. See the threads on this subject on tor-talk, tor-onions, and tickets for more. [CC for inclusion, move there if not relay specific]

4 6

hello aurum1704 tor relay operator
by nusenu 04 Jan '19

04 Jan '19

Hi aurum1704, thanks for adding so many relays. If I may ask: Are you planing to run them long term? Just be aware of the traffic pricing at DigitalOcean: https://www.digitalocean.com/community/tutorials/digitalocean-bandwidth-bil… | Up | Ext | JoinTime | Nickname | Version | IP | AS | CC | ORp | Dirp | OS | Contact | eFamMembers | FP | |------+-------+------------+------------+-----------+-----------------+-------------------+------+-------+--------+-------+-------------------------------------+---------------+------------------------------------------| | 1 | 0 | 21:26:48 | cobalt0 | 0.3.4.9 | 157.230.136.180 | None | us | 9001 | 9030 | Linux | aurum1704(at)gmail(dot)com | 14 | 4EF954752C47906CF26AFA9FDD2E82FE9B2CF040 | | 1 | 0 | 21:30:40 | cobalt00 | 0.3.4.9 | 157.230.136.180 | None | us | 9101 | 9032 | Linux | aurum1704(at)gmail(dot)com | 14 | 30BE64D2C5AAFD3F7BACFDE1E1CC8D540CE4D905 | | 1 | 0 | 06:42:48 | cobalt10 | 0.3.4.9 | 157.230.140.92 | None | us | 9001 | 9030 | Linux | aurum1704(at)gmail(dot)com [tor-rel | 14 | 31B9D3F99A32543D1FE1DC2E2B2A2B21C0DFAB97 | | 1 | 0 | 06:47:53 | cobalt100 | 0.3.4.9 | 157.230.140.92 | None | us | 9101 | 9032 | Linux | aurum1704(at)gmail(dot)com [tor-rel | 14 | 225821522D8652DCECA757D59779587FE23B245F | | 1 | 0 | 02:36:57 | cobalt11 | 0.3.4.9 | 157.230.143.151 | None | us | 9001 | 9030 | Linux | aurum1704(at)gmail(dot)com [tor-rel | 14 | 68C9268B76D27E199C7683771F3C83BE00FE3192 | | 1 | 0 | 02:54:17 | cobalt12 | 0.3.4.9 | 68.183.173.106 | DigitalOcean, LLC | us | 9001 | 9030 | Linux | aurum1704(at)gmail(dot)com [tor-rel | 14 | AFA580D001379B6CF80FA38E3A0CB2A8B7FC5046 | | 1 | 0 | 02:56:16 | cobalt13 | 0.3.4.9 | 157.230.128.91 | None | us | 9001 | 9030 | Linux | aurum1704(at)gmail(dot)com [tor-rel | 14 | 09058A1C003E5F9B7735D028D378C42DCF92CA46 | | 1 | 0 | 21:43:50 | cobalt14 | 0.3.4.9 | 157.230.132.69 | None | us | 9001 | 9030 | Linux | aurum1704(at)gmail(dot)com [tor-rel | 14 | 94BF5FB37B5F7FEE124273A8751D416AE6F61380 | | 1 | 0 | 05:10:04 | cobalt15 | 0.3.4.9 | 157.230.132.150 | None | us | 9001 | 9030 | Linux | aurum1704(at)gmail(dot)com [tor-rel | 14 | E1442DB84252242848E53E2599E1DBE7DF80278F | | 1 | 0 | 05:56:42 | cobalt16 | 0.3.4.9 | 157.230.132.151 | None | us | 9001 | 9030 | Linux | aurum1704(at)gmail(dot)com | 14 | 70FE4B7B908875359F34F22F7FC15C4F6CD7B27D | | 1 | 0 | 06:26:16 | cobalt7 | 0.3.4.9 | 157.230.132.153 | None | us | 9001 | 9030 | Linux | aurum1704(at)gmail(dot)com [tor-rel | 14 | 640B889E6FE5F8AFC5A3A8553A9BE3377E43B4C5 | | 1 | 0 | 06:27:40 | cobalt8 | 0.3.4.9 | 157.230.132.175 | None | us | 9001 | 9030 | Linux | aurum1704(at)gmail(dot)com [tor-rel | 14 | 9AE92FD739FCF3547C1ECD3C4EF71D434D5834E2 | | 1 | 0 | 06:31:00 | cobalt9 | 0.3.4.9 | 157.230.140.94 | None | us | 9001 | 9030 | Linux | aurum1704(at)gmail(dot)com [tor-rel | 14 | C3907FD65A2C0B389AB9CDF38EB6CA065064C134 | | 1 | 0 | 06:50:07 | cobalt99 | 0.3.4.9 | 157.230.140.94 | None | us | 9101 | 9032 | Linux | aurum1704(at)gmail(dot)com [tor-rel | 14 | A8AC085EAB39191F2304D7C86B5BDCB1E85A390C | -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

1 0

Re: [tor-relays] Metrics show Relay donw
by Darek Kramin 04 Jan '19

04 Jan '19

Looks problem is solved. Online now On Tue, Dec 25, 2018, 21:13 Darek Kramin <cptkramin(a)gmail.com wrote: > hi, > > I did started 2 days ago tor relay. when I set daily accounting was ok and > now with weekly set of GB relay is listed down. It is a glitch or my > misconfiguration. > Relay is named dasBoot at IP 46.175.238.8 > > brgds > Darek > > -- > > Cpt D.Kramin > +48 505 135145 >

2 1

My Fallback Directory Mirror is going down
by Viktor Nikolov 04 Jan '19

04 Jan '19

Hi! My Fallback Directory Mirror B6904ADD4C0D10CDA7179E051962350A69A63243 at 81.2.209.10 is going down permanently because my provider decommissioned the data center where I had my HW. :-( I will likely host my HW at a new provider soon, but at a new IP address. Viktor

2 1

openinternet.io: Tor Relay Configuration: 'MyFamily' missing and public munin graphs
by nusenu 03 Jan '19

03 Jan '19

Hi sysop (openinternet.io), thanks for helping the tor network by running relays. please do not forget to set your "MyFamily" configuration parameter on all your relays, so Tor clients are not at risk of using your relays in multiple positions in a single circuit. https://nusenu.github.io/OrNetStats/endtoend-correlation-groups Some more background: https://hackernoon.com/some-tor-relays-you-might-want-to-avoid-5901597ad821 Let us know if you need any help with this. Also note that it is very discouraged to publish munin network traffic graphs of tor relays (5min granularity) please remove them. kind regards, nusenu -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

1 0

Hyperlink in ContactInfo
by Ilka Schulz 03 Jan '19

03 Jan '19

Hi, I wrote a little PHP-based contact page and put the link to the /ContactInfo/ of my relay's /torrc/. I added some HTML tags (/<a href=...> ... </a>/) to let Tor Metrics show the link as such; but, of course, the string is sanitized properly, so the /Contact/ field on Tor Metrics shows the literal HTML tags. Is there any chance to show the hyperlink on Tor Metrics, so that visitors can directly click on it? The same would be interesting for clear text email addresses. Regards, Ilka

2 1

Compatibility issue with OpenSSL 1.1.1a
by Nick Mathewson 02 Jan '19

02 Jan '19

Hi, folks! You should know that there is a compatibility issue between Tor and OpenSSL 1.1.1a, when TLS 1.3 is in use. Only OpenSSL 1.1.1a is affected; other OpenSSL versions are not. The effect here is that Tor relays using this version of OpenSSL will not be able to negotiate TLS 1.3 connections with one another. This is caused by a regression in OpenSSL 1.1.1a's implementation of tls13_hkdf_expand() function. For more information, see https://trac.torproject.org/projects/tor/ticket/28616 We're looking into possible mitigations. best wishes, -- Nick

5 7

300mbps FreeBSD Tor relay on HPE MicroServer Gen10 (AMD X3421)
by Neel Chauhan 02 Jan '19

02 Jan '19

Hi tor-relays@, I have a Tor middle relay NeelTorRelay2 hosted on a 50 megabit symmetrical Verizon FiOS (FTTH/GPON) connection. The server used is a HPE MicroServer Gen10 (AMD X3421 quad-core version, 8GB DDR4 RAM). This relay can be seen here: https://metrics.torproject.org/rs.html#details/D5B8C38539C509380767D4DE20DE… My relay runs FreeBSD 11.2 and Tor runs in a "jail". I am using AESNI and Tor is configured to use OpenSSL cryptodev. Here's the situation: I will be moving apartments in a few days, and Verizon is upgrading my broadband speed to 300 megabits symmetrical. I plan to use this extra bandwidth for Tor. Right now, I set my RelayBandwidthRate to my line speed (yes really!), and plan to increase this setting according to my new speed. I know that Tor is not optimized for multicore CPUs, and that's the reason why I am posting here. My question is that can Tor work on the HPE MicroServer Gen10 with the AMD X3421 (or one with a similar computer of any brand with a similar performance CPU, whether desktop or server, Intel or AMD) with all 300 megabits to a single instance or would I need two instances (each at 150 megabits each)? Looking at my top usage, I average at about 20-30% CPU usage on my 50 megabit relay. Also keep in mind that: * I am using my own router instead of Verizon's and I plan to keep doing so * I want to keep using FreeBSD on my server and do not want to run Linux * I would prefer to have a single instance, but can use multiple if I have to * When I move, I will upgrade my server to FreeBSD 12.0 * My server supports hardware accelerated AES and SHA. I am using this on FreeBSD with the aesni kernel module and Tor with "HardwareAccel 1" and "AccelName cryptodev" Thank You, Neel Chauhan === https://www.neelc.org/

7 9

Re: [tor-relays] 35C3 Tor Relay Operators Meetup
by 35C3 35C3 01 Jan '19

01 Jan '19

> Hi, I have only my smartphone at the moment. It would be great if you swap the rooms. Thank you added a second slot on the first day/night: 2018-12-28 00:30 Room M3 I did NOT replace the first slot in the smaller room (2018-12-28 16:30) because the second slot is a bit late to avoid collisions with ie "It Always Feels Like the Five Eyes Are Watching You" - Kurt Opsahl https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9951.html https://events.ccc.de/congress/2018/wiki/index.php/Session:Tor_relay_operat…

3 3

Security issue
by dns1983＠riseup.net 29 Dec '18

29 Dec '18

Hello, Do I have to worry about those many warns on my log file? [warn] Tried to establish rendezvous on non-OR circuit with purpose Acting as rendezvous (pending) I found some old posts on this warn, but I don't understand if it is a security issue and what I have to do to fix this. Someone could tell me if there is something that I can do to fix this and improve security of my Debian -derived machine? Thanks Gigi

2 2

New exit relay help
by dns1983＠riseup.net 28 Dec '18

28 Dec '18

Hi, I need to install some additional software, to make the "DirFrontPage" work? I loaded an html file on my tor directory, uncommented the diretive "DirFrontPage /path/html-file", but It doesn't works and I don't see anything related to it in the log notice file. What I am doin wrong? I don't know how to solve the problem, can you help me please? best regards Gigi

5 6

Dec 2018: 24 new relays with fishy fingerprint patterns in Aruba and "INTERNET CZ" ASN
by nusenu 26 Dec '18

26 Dec '18

these 24 relays have a rather distinct signup and fingerprint pattern usually seen for onion attacks: +------------------------------------------+---------------------+--------------+--------------------+-------+------+----------------+---------+-------------+---------------------------------+ | fingerprint | first_seen | nickname | as_name | hsdir | exit | IP | or_port | tor_version | contact | +------------------------------------------+---------------------+--------------+--------------------+-------+------+----------------+---------+-------------+---------------------------------+ | 38D26817234F6B271E6A6DED306188BC09D1AA41 | 2018-12-19 13:00:00 | Escalibur | Aruba SAS | 1 | 0 | 185.8.50.23 | 9001 | 0.3.4.9 | NULL | | 38D2A1B04D004A61D2A9599EB5EC06FE42C463F7 | 2018-12-20 10:00:00 | delecat3d | Aruba S.p.A. | 0 | 0 | 195.231.66.172 | 9001 | 0.3.4.9 | NULL | | 38D2B873966A1C392E427CD1417BC7BB0E84B058 | 2018-12-17 08:00:00 | HGSTdisks | Aruba SAS | 1 | 0 | 94.177.226.229 | 9001 | 0.3.4.9 | coreproccores(a)gmail.com | | 510FEC23762319FEEAB3B65AF4592BE21515A7C4 | 2018-12-17 10:00:00 | tM666 | ArubaCloud Limited | 1 | 0 | 185.43.209.232 | 9001 | 0.3.4.9 | NULL | | 510FEC475B2B286A1886A22B333A1CCDEE8F0117 | 2018-12-16 15:00:00 | yeeboyd | INTERNET CZ, a.s. | 1 | 0 | 185.33.144.210 | 9001 | 0.3.4.9 | NULL | | 510FED6000FFEE2B451782DB0E82C2CCA8DF2332 | 2018-12-18 11:00:00 | takeAsit | Aruba SAS | 1 | 0 | 94.177.226.7 | 9001 | 0.3.4.9 | NULL | | 6688CD00E32D45DDC25FE0F4AE31EEB460DC02EF | 2018-12-20 12:00:00 | DoeRelay | Aruba SAS | 1 | 0 | 185.8.50.62 | 9001 | 0.3.4.9 | mrmrsdoehere gmaiil _ dot COM | | 6688E3150DC2898DDBD98D8AB70C078ECA468945 | 2018-12-19 10:00:00 | reltor | Aruba S.p.A. | 1 | 0 | 195.231.66.103 | 9001 | 0.3.4.9 | tripinonuyou gmail com | | 6688F26C215F92A0EF8B0C94B03FA160E22C4E75 | 2018-12-21 11:00:00 | Unnamed | Aruba S.p.A. | 0 | 0 | 80.211.253.155 | 9001 | 0.3.4.9 | NULL | | 8F29FDC9C2F85E5E9CC3F56E81B2A3D9CCB031FB | 2018-12-16 15:00:00 | SedS0K | Aruba S.p.A. | 1 | 0 | 195.231.66.240 | 9001 | 0.3.4.9 | seds0kkkk(at)gmail(dot)com | | 8F2A173B990CAE8CB61BEFDC61F9B8C047977667 | 2018-12-18 16:00:00 | FreeW | Aruba SAS | 1 | 0 | 185.8.50.73 | 9001 | 0.3.4.9 | NULL | | 8F2AE6EBB163B9B0BC64C0EE689946CE7A36B3F1 | 2018-12-17 18:00:00 | nobobyno | Aruba S.p.A. | 1 | 0 | 80.211.253.176 | 9001 | 0.3.4.9 | smpuffy_AT_mail.pl | | 9E9DA7C5060BEAB9860F120CCA5646ECBC92382B | 2018-12-19 09:00:00 | NextDoorBar | Aruba SAS | 1 | 0 | 94.177.226.250 | 9001 | 0.3.4.9 | NULL | | 9E9DAED63FE72C571753C03B2DF7C956AF02897A | 2018-12-18 12:00:00 | Unnamed | INTERNET CZ, a.s. | 1 | 0 | 185.33.144.110 | 9001 | 0.3.4.9 | NULL | | 9E9DE2E42485FBE95DAC35138EFE372A24D64D21 | 2018-12-17 22:00:00 | LiteMoka | Aruba S.p.A. | 1 | 0 | 195.231.66.108 | 9001 | 0.3.4.9 | juseppo2199()at()gmail_com | | A380D254B25878C74087C5D74C692D0241CBD6F0 | 2018-12-20 22:00:00 | AnonHappyBox | Aruba SAS | 1 | 0 | 94.177.226.230 | 9001 | 0.3.4.9 | anonanon55a_@_secmail_dot_net | | A380D347759DA5CBDC5BCBC4B51318A0C8567B53 | 2018-12-21 15:00:00 | Pendium | ArubaCloud Limited | 0 | 0 | 185.43.209.100 | 9001 | 0.3.4.9 | strangzapsl AT gmail DOT com | | A380E80F9C6405332C8113C02B566120B8099B06 | 2018-12-19 18:00:00 | volt220 | INTERNET CZ, a.s. | 1 | 0 | 185.33.144.204 | 9001 | 0.3.4.9 | spensr555oh _AT_ gmail _ dot_cm | | BE27A8DA5463AE0B32A4BAEC4214C0CD00F70DC3 | 2018-12-18 14:00:00 | Minicana | Aruba S.p.A. | 1 | 0 | 80.211.253.249 | 9001 | 0.3.4.9 | __Valentino404()gmail_com | | BE27E56E8D6B9D3B84120804CA1C3564DA70827D | 2018-12-19 22:00:00 | Bestrddd | ArubaCloud Limited | 1 | 0 | 185.43.209.236 | 9001 | 0.3.4.9 | no please | | BE27F22046D89A1EAD690C9C291F7AE85B9025DA | 2018-12-20 15:00:00 | Unnamed | INTERNET CZ, a.s. | 1 | 0 | 185.33.144.196 | 9001 | 0.3.4.9 | NULL | | E7D8A8B5FA3CA3B668F12B5D46AB0DE94B9A9C1D | 2018-12-16 22:00:00 | Unnamed | Aruba SAS | 1 | 0 | 185.8.50.188 | 9001 | 0.3.4.9 | NULL | | E7D8B9141E5EF11526D34DC231DD32297BC3F904 | 2018-12-19 16:00:00 | FlashGordon | Aruba S.p.A. | 1 | 0 | 80.211.253.88 | 9001 | 0.3.4.9 | sinsincytyATprotrityDOTnet | | E7D8F1E61D068E7681EE81D6AFC7862FEB29D261 | 2018-12-18 20:00:00 | Andersen | ArubaCloud Limited | 1 | 0 | 185.43.209.114 | 9001 | 0.3.4.9 | NULL | +------------------------------------------+---------------------+--------------+--------------------+-------+------+----------------+---------+-------------+---------------------------------+ If you are an .onion operator I'd like to encourage you to switch to onion services version 3 so we can start dropping onion version 2 services eventually. -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

1 0

Metrics show Relay down
by Darek Kramin 25 Dec '18

25 Dec '18

hi, I did started 2 days ago tor relay. when I set daily accounting was ok and now with weekly set of GB relay is listed down. It is a glitch or my misconfiguration. Relay is named dasBoot at IP 46.175.238.8 brgds darek -- Cpt D.Kramin +48 505 135145

1 0

35C3 Tor Relay Operators Meetup
by 35C3 35C3 23 Dec '18

23 Dec '18

Hi nicoo, since you organized the tor relay operators meetups during the last few years at the CCC I was wondering if you will continue with that this year as well? If so, it would be great if we could get - a slightly bigger room than we had last year - a room with a beamer (Roger will not be there this year as he previously mentioned) The 35C3 wiki is not available yet. thank you!

2 2

Extreme Exit Policy
by John Ricketts 21 Dec '18

21 Dec '18

All, I am considering only allowing ports 53, 80, and 443 only. Discussion? John Ricketts Quintex Alliance Consulting

8 13

Re: [tor-relays] consensus-health.html and fallback dirs
by starlight.2018q2＠binnacle.cx 20 Dec '18

20 Dec '18

Ran the script: output is attached to this message for anyone interested. Live-network test results will vary by time and by the location of tester. Attached run was made over Tor itself using 'torsocks'. I was bit by having disabled the unencrypted DIR port for one day recently as an experiment. >Felix zwiebel at quantentunnel.de >Sun Dec 16 10:03:33 UTC 2018 > >>> I wonder how we can come from 116 running fallbacks to 155 within >>> one week (without a new release) > >Am 16.12.2018 um 08:01 schrieb starlight.2018q2 at binnacle.cx: >> The cause is >> >> https://gitweb.torproject.org/tor.git/commit/?id=78e177d622f5f3b24023d04458… > >Ah, great! This makes sense. It's a transient to the list update. > > > >> https://trac.torproject.org/projects/tor/ticket/24803 > >The upcoming one seems to be: >https://trac.torproject.org/projects/tor/ticket/28795 > >-- >Cheers, Felix >

2 1

Advice for new exit relay
by dns1983＠riseup.net 20 Dec '18

20 Dec '18

Hi, excuse my bad english. I would run an exit relay on a virtual server. For now i run just a non exit relay on my own mini server. I don't like too much do not have full control on the server, but, for me, it is the only way to run an exit relay. How do I know which service allow me to customize WHOIS records, so I can put my email address on report abuse section? Could you suggest me some providers that offer unlimited monthly data too? Regards Gigi

2 4

How to use a bridge configured with "ORport auto" within Tails?
by Toralf Förster 20 Dec '18

20 Dec '18

The Tails installer asked me for the bridge line (a bridge maintained by myself), but didn't accepted the ":auto" behind the ip address. I do wonder how to proceed? -- Toralf PGP C4EACDDE 0076E94E

2 3

Why are my relays flagged?
by Langrehr, Jan Christian 20 Dec '18

20 Dec '18

Hello everyone, I'm wondering why both of my Tor relays are flagged for running an unstable or outdated version or Tor. I'm running my relays on Ubuntu 18.04 and I get Tor from the deb https://deb.torproject.org/torproject.org bionic main repository. Both of my relays run Tor version 0.3.4.8. My relays are https://metrics.torproject.org/rs.html#details/9EDA50493B537837E72D83090BE4… and https://metrics.torproject.org/rs.html#details/8E57A56487EEA341965B77AE132E… I'm looking forward for an anwser. Thank you all very much

3 2

Re: [tor-relays] consensus-health.html and fallback dirs
by starlight.2018q2＠binnacle.cx 16 Dec '18

16 Dec '18

The cause is https://gitweb.torproject.org/tor.git/commit/?id=78e177d622f5f3b24023d04458… https://trac.torproject.org/projects/tor/ticket/24803 Would be appreciated if the Tor project published outputs of UpdateFallbackDirs.py job runs used when rebuilding the list. Thus operators who have expended effort to keep their relays eligible will know why when dropped. >Felix zwiebel at quantentunnel.de >Sat Dec 15 23:59:03 UTC 2018 > >Hi everybody > >Reading [1] shows the following statistics about the fallback dirs: > >Dec 5: >Running 116 >Not Running 0 >Missing 34 > >Dec 13: >Running 155 >Not Running 0 >Missing 2 > >Today (Dec 16) shows: >Running 151 >Not Running 0 >Missing 6 > >I wonder how we can come from 116 running fallbacks to 155 within one >week (without a new release): > > >Then I checked for some fallbacks and found: > >The relay with the fp F9246DEF2B653807236DA134F2AEAB103D58ABFE was a >fallback acc. fallback_dirs.inc until around 3.2.8rc, then it changed >ip. It is still in 2.9.x lts but with the old ip, recommended but >actually useless. > >Since around Dec 13 it is listed again [1] where it wasn't through 2018. > >The same with 8FA37B93397015B2BC5A525C908485260BE9F422. > >Are the two relays newly counted as running in [1], where they are >useless because of the changed ips? The new ips aren't in any >fallback_dirs.inc's and [2] shows no fallback flag. >Would thereby [1] look better than it is? > > >[1] https://consensus-health.torproject.org/consensus-health.html >[2] https://metrics.torproject.org/rs.html#details/F9246DEF2B653807236DA134F2AE… > >-- >Cheers, Felix

2 1

Re: [tor-relays] [OrNetRadar] NickPrefix: "AYAYA" (9)
by nusenu 16 Dec '18

16 Dec '18

Hello "AYAYA" relays > 2018-12-15 > > | Up | Ext | JoinTime | Nickname | Version | IP | AS | CC | ORp | Dirp | OS | Contact | eFamMembers | FP | > |------+-------+------------+------------+-----------+---------------+---------------+------+-------+--------+-------+-----------+---------------+------------------------------------------| > | 1 | 0 | 11:23:45 | AYAYA43 | 0.2.9.14 | 51.15.88.206 | Online S.a.s. | fr | 9001 | 9030 | Linux | None | 1 | D0BADF4222F4CE7DF6D91A772E391E29FDEA82FB | > | 1 | 0 | 11:24:20 | AYAYA46 | 0.2.9.14 | 51.15.113.238 | Online S.a.s. | fr | 9001 | 9030 | Linux | None | 1 | A4D98EE5916240F1AC6348174C40848B4C7F7C0C | > | 1 | 0 | 11:23:45 | AYAYA52 | 0.2.9.14 | 51.15.71.128 | Online S.a.s. | fr | 9001 | 9030 | Linux | None | 1 | 25C3DEAE9AA786559DBB072D0470D1A6FC408846 | > | 1 | 0 | 11:23:45 | AYAYA6 | 0.2.9.14 | 51.15.78.215 | Online S.a.s. | fr | 9001 | 9030 | Linux | None | 1 | BED1681C0DDEF5DE7B8A65E2603D262FE3B1DB59 | > | 1 | 0 | 11:23:45 | AYAYA64 | 0.2.9.14 | 51.15.43.15 | Online S.a.s. | nl | 9001 | 9030 | Linux | None | 1 | F6F70FEB215929701E027B9A436A38347D377367 | > | 1 | 0 | 11:23:44 | AYAYA70 | 0.2.9.14 | 51.15.85.153 | Online S.a.s. | fr | 9001 | 9030 | Linux | None | 1 | 64FDE6159C134C606A24ADBA7A3E9A66F3810465 | > | 1 | 0 | 11:23:45 | AYAYA8 | 0.2.9.14 | 51.15.35.170 | Online S.a.s. | nl | 9001 | 9030 | Linux | None | 1 | B9A1E0C135464554ACCE036A9B5AB6F9469A9703 | > | 1 | 0 | 11:23:45 | AYAYA90 | 0.2.9.14 | 51.15.83.14 | Online S.a.s. | fr | 9001 | 9030 | Linux | None | 1 | CCD5C2E7FABACCF8CD84BCDC8E689584881545B8 | > | 1 | 0 | 11:23:46 | AYAYA98 | 0.2.9.14 | 51.15.116.94 | Online S.a.s. | fr | 9001 | 9030 | Linux | None | 1 | 706A24208BE86E84B850ECAF42EC293CECE1ECC1 | > > https://nusenu.github.io/OrNetRadar/2018/12/15/a1 -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

1 0

consensus-health.html and fallback dirs
by Felix 15 Dec '18

15 Dec '18

Hi everybody Reading [1] shows the following statistics about the fallback dirs: Dec 5: Running 116 Not Running 0 Missing 34 Dec 13: Running 155 Not Running 0 Missing 2 Today (Dec 16) shows: Running 151 Not Running 0 Missing 6 I wonder how we can come from 116 running fallbacks to 155 within one week (without a new release): Then I checked for some fallbacks and found: The relay with the fp F9246DEF2B653807236DA134F2AEAB103D58ABFE was a fallback acc. fallback_dirs.inc until around 3.2.8rc, then it changed ip. It is still in 2.9.x lts but with the old ip, recommended but actually useless. Since around Dec 13 it is listed again [1] where it wasn't through 2018. The same with 8FA37B93397015B2BC5A525C908485260BE9F422. Are the two relays newly counted as running in [1], where they are useless because of the changed ips? The new ips aren't in any fallback_dirs.inc's and [2] shows no fallback flag. Would thereby [1] look better than it is? [1] https://consensus-health.torproject.org/consensus-health.html [2] https://metrics.torproject.org/rs.html#details/F9246DEF2B653807236DA134F2AE… -- Cheers, Felix

1 0

17 new relays at OVH (2018-10-24)
by nusenu 13 Dec '18

13 Dec '18

Hi, if you are the operator that added 17 new relays at OVH on 2018-10-24 (full list bellow), please set a ContactInfo and especially the MyFamily in your torrc to avoid putting tor clients at risk. kind regards, nusenu > added on 2018-10-24 > > | Up | Ext | JoinTime | IP | CC | ORp | Dirp | Version | Contact | Nickname | eFamMembers | FP | > |------+-------+------------+---------------+------+-------+--------+-----------+---------------------------+--------------------+---------------+------------------------------------------| > | 1 | 0 | 13:43:16 | 145.239.0.204 | de | 443 | 0 | 0.3.4.8 | None | Chief | 1 | 5EF464D06322614A3B8B6C2652C3C616F098EE8A | > | 1 | 0 | 13:43:17 | 54.37.200.155 | fr | 443 | 0 | 0.3.4.8 | None | Dash | 1 | B55F8445569407FBE6BAF205799A9EF8AC8CC256 | > | 1 | 0 | 13:43:18 | 51.68.170.247 | fr | 443 | 0 | 0.3.4.8 | None | Rebel | 1 | E7B036D933D6E0A68983E8E3F664EAA54ACDEA37 | > | 1 | 0 | 13:43:20 | 51.75.82.166 | fr | 443 | 0 | 0.3.4.8 | None | Butch | 1 | 4809E3F9A73F5373734A4D23E7E7807A4743DD8A | > | 1 | 0 | 13:43:21 | 51.75.153.17 | fr | 443 | 0 | 0.3.4.8 | None | Beauty | 1 | B66FBE3B2D9CE257AF75DEA760C69E379F7CDB80 | > | 1 | 0 | 13:43:22 | 51.68.170.74 | fr | 443 | 0 | 0.3.4.8 | None | Killer | 1 | E4CB0C293588C3E5FA7DB94485FF2686E128267F | > | 1 | 0 | 13:43:23 | 51.68.185.141 | fr | 443 | 0 | 0.3.4.8 | None | Arrow | 1 | 707F51E232E0CDAF64EC446609E7112CD3AD11F8 | > | 1 | 0 | 13:43:24 | 54.37.207.82 | fr | 443 | 0 | 0.3.4.8 | None | Dazzle | 1 | B80142DDCF8D6B72929541EFCC643ECCD99BEE36 | > | 1 | 0 | 13:50:41 | 145.239.1.97 | de | 443 | 0 | 0.3.4.8 | None | Memo | 1 | 1C514FA1A4F8A464E1853B70AA5D2F16FF087AD2 | > | 1 | 0 | 13:50:42 | 51.38.107.122 | fr | 443 | 0 | 0.3.4.8 | None | Pitch | 1 | 91B026FA459AE0DA15673AB07A9C6DFF8B41782B | > | 1 | 0 | 13:50:43 | 51.68.186.59 | fr | 443 | 0 | 0.3.4.8 | None | Smasher | 1 | 3B0EFDE689693CFDEC2305F7B99D5B2FA4A77D91 | > | 1 | 0 | 13:50:44 | 51.75.85.114 | fr | 443 | 0 | 0.3.4.8 | None | Landslide | 1 | C953A4C8DF0E233CB0D190C2A71B71F634AB4A14 | > | 1 | 0 | 13:50:45 | 51.68.182.30 | fr | 443 | 0 | 0.3.4.8 | None | Shade | 1 | EBE58DDCC51A9D23EE9DD39791695B608A1DFB29 | > | 1 | 0 | 13:50:46 | 54.37.207.37 | fr | 443 | 0 | 0.3.4.8 | None | Buster | 1 | D10C82E275A2B0121CF4075C92687F0786A72892 | > | 1 | 0 | 13:50:47 | 54.37.200.157 | fr | 443 | 0 | 0.3.4.8 | None | Digger | 1 | 6B29A78EEB42D318290DB60C6A2EDC714F1BAD42 | > | 1 | 0 | 13:50:48 | 54.37.207.84 | fr | 443 | 0 | 0.3.4.8 | None | Pipi | 1 | 150F7C9F4814C4918F4D2DEAA0C7A2255DC8C0E0 | > | 1 | 0 | 13:50:49 | 51.75.153.19 | fr | 443 | 0 | 0.3.4.8 | None | Shrimp | 1 | 51429A0F427A8DCB5B9DE64E35ECBBB76DAB0F7F | -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

2 1

AS: "OVH SAS" - 17 relays (2018-10-24)
by nusenu 13 Dec '18

13 Dec '18

a relay gang joined in Oct 2018 at OVH 2018-10-24 | Up | Ext | JoinTime | IP | CC | ORp | Dirp | Version | Contact | Nickname | eFamMembers | FP | |------+-------+------------+---------------+------+-------+--------+-----------+---------------------------+--------------------+---------------+------------------------------------------| | 1 | 0 | 13:43:16 | 145.239.0.204 | de | 443 | 0 | 0.3.4.8 | None | Chief | 1 | 5EF464D06322614A3B8B6C2652C3C616F098EE8A | | 1 | 0 | 13:43:17 | 54.37.200.155 | fr | 443 | 0 | 0.3.4.8 | None | Dash | 1 | B55F8445569407FBE6BAF205799A9EF8AC8CC256 | | 1 | 0 | 13:43:18 | 51.68.170.247 | fr | 443 | 0 | 0.3.4.8 | None | Rebel | 1 | E7B036D933D6E0A68983E8E3F664EAA54ACDEA37 | | 1 | 0 | 13:43:20 | 51.75.82.166 | fr | 443 | 0 | 0.3.4.8 | None | Butch | 1 | 4809E3F9A73F5373734A4D23E7E7807A4743DD8A | | 1 | 0 | 13:43:21 | 51.75.153.17 | fr | 443 | 0 | 0.3.4.8 | None | Beauty | 1 | B66FBE3B2D9CE257AF75DEA760C69E379F7CDB80 | | 1 | 0 | 13:43:22 | 51.68.170.74 | fr | 443 | 0 | 0.3.4.8 | None | Killer | 1 | E4CB0C293588C3E5FA7DB94485FF2686E128267F | | 1 | 0 | 13:43:23 | 51.68.185.141 | fr | 443 | 0 | 0.3.4.8 | None | Arrow | 1 | 707F51E232E0CDAF64EC446609E7112CD3AD11F8 | | 1 | 0 | 13:43:24 | 54.37.207.82 | fr | 443 | 0 | 0.3.4.8 | None | Dazzle | 1 | B80142DDCF8D6B72929541EFCC643ECCD99BEE36 | | 1 | 0 | 13:50:41 | 145.239.1.97 | de | 443 | 0 | 0.3.4.8 | None | Memo | 1 | 1C514FA1A4F8A464E1853B70AA5D2F16FF087AD2 | | 1 | 0 | 13:50:42 | 51.38.107.122 | fr | 443 | 0 | 0.3.4.8 | None | Pitch | 1 | 91B026FA459AE0DA15673AB07A9C6DFF8B41782B | | 1 | 0 | 13:50:43 | 51.68.186.59 | fr | 443 | 0 | 0.3.4.8 | None | Smasher | 1 | 3B0EFDE689693CFDEC2305F7B99D5B2FA4A77D91 | | 1 | 0 | 13:50:44 | 51.75.85.114 | fr | 443 | 0 | 0.3.4.8 | None | Landslide | 1 | C953A4C8DF0E233CB0D190C2A71B71F634AB4A14 | | 1 | 0 | 13:50:45 | 51.68.182.30 | fr | 443 | 0 | 0.3.4.8 | None | Shade | 1 | EBE58DDCC51A9D23EE9DD39791695B608A1DFB29 | | 1 | 0 | 13:50:46 | 54.37.207.37 | fr | 443 | 0 | 0.3.4.8 | None | Buster | 1 | D10C82E275A2B0121CF4075C92687F0786A72892 | | 1 | 0 | 13:50:47 | 54.37.200.157 | fr | 443 | 0 | 0.3.4.8 | None | Digger | 1 | 6B29A78EEB42D318290DB60C6A2EDC714F1BAD42 | | 1 | 0 | 13:50:48 | 54.37.207.84 | fr | 443 | 0 | 0.3.4.8 | None | Pipi | 1 | 150F7C9F4814C4918F4D2DEAA0C7A2255DC8C0E0 | | 1 | 0 | 13:50:49 | 51.75.153.19 | fr | 443 | 0 | 0.3.4.8 | None | Shrimp | 1 | 51429A0F427A8DCB5B9DE64E35ECBBB76DAB0F7F | https://nusenu.github.io/OrNetRadar/2018/10/24/a3 -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

2 1

Current state of HSDir attacks on hidden services
by Jonathan D. Proulx 13 Dec '18

13 Dec '18

Hi All, The recent thread on ColoCrossing nodes[1] has gotten me wondering about the current state of HSDir attacks on hidden sites my web searching has only turned up some articles that are a few years old. Is it really still the case that spending a little time crafting the "right" finger prints i sall it takes for an adversary to reliably host the HSDir for a given hidden service? Well and 4-5 days uptime... Assuming the new ColoCrossing nodes are maliciously target ina particular hidden service is it just their sloppiness of putting them all up in the same place over a short period rather than in a slower and more widely distributed manner the only thing that prevented them from acheving their unmasking goals? Seems like it would be trivial for even a moderately funded attacker to put up 16-32 nodes across a similar number of hosting providers, https://www.terraform.io framework for example seems to support about 37 different "cloud providers" so finding that number of unique providers isn't really hard. If they also set them up at semirandom intervals over the course of a month or so who could ever tell? -Jon -- [1] https://lists.torproject.org/pipermail/tor-relays/2018-December/016712.html

2 2

Re: [tor-relays] Current state of HSDir attacks on hidden services
by Isaac Grover, Aileron I.T. 13 Dec '18

13 Dec '18

Good morning Jon, In addition to fingerprint correlation and AS choice, I also recall reading this paper about identifying hidden services using clock skew based on internal CPU temperature: https://murdoch.is/papers/ccs06hotornot.pdf . The paper is older, but I'm curious if such an attack method is still effective? Make your day great, Isaac Grover, Senior I.T. Consultant Aileron I.T. - " Because #ProactiveIsBetter " O: 715-377-0440<tel:715-425-0440>, F:715-690-1029<tel:715-690-1029>, W: www.aileronit.com<http://www.aileronit.com/> LinkedIn: https://www.linkedin.com/in/IsaacGrover/ YouTube: https://www.youtube.com/channel/UCqrwZNFKdR-guKtuQzFPObQ

1 0

AS: "ColoCrossing" - 28 new relays
by nusenu 12 Dec '18

12 Dec '18

these relays look rather strange and are likely operated by a single entity, watch out. 2018-12-10 | Up | Ext | JoinTime | IP | CC | ORp | Dirp | Version | Contact | Nickname | eFamMembers | FP | |------+-------+------------+----------------+------+-------+--------+---------------+---------------------------+--------------+---------------+------------------------------------------| | 1 | 0 | 03:18:23 | 23.95.85.216 | us | 9447 | 0 | 0.3.5.5-alpha | bddwwell6_at_gmail_com | Bottom00S | 1 | C00BF86148C5391530FAFB550BD79706BCB55EB7 | | 1 | 0 | 03:26:38 | 107.173.70.100 | us | 10401 | 0 | 0.3.5.5-alpha | _bch440w AT yeezee.io | Porksoundz | 1 | C00BCA7A0EE03FD6E8B9BBBE1D9250DC2194EFD9 | | 1 | 0 | 03:36:15 | 107.173.70.107 | us | 15888 | 0 | 0.3.5.5-alpha | look4dotme at-hotmail.com | PLZTornode | 1 | C00B7102C5E1CF4F18CB529F05830FCCC1BDC611 | | 1 | 0 | 03:58:30 | 172.245.97.224 | us | 9700 | 0 | 0.3.5.5-alpha | abaubum@ mail_com | LikeTORLike | 1 | 2D56F86ABB41462E1CAA58F55F0BA15E843B5FDB | | 1 | 0 | 04:16:08 | 198.46.182.191 | us | 10534 | 0 | 0.3.5.5-alpha | fofalafel_gmail_com | RedSBoll999 | 1 | 2D56F2422C0DC5BA859E9167321314A26B1557C6 | | 1 | 0 | 04:20:57 | 23.95.0.211 | us | 13013 | 0 | 0.3.5.5-alpha | crab33s(a)yahoo.com | ifufcrab | 1 | 2D56FB048E4838534CA3F5276591632A64FE99F5 | | 1 | 0 | 05:23:14 | 107.173.70.105 | us | 12712 | 0 | 0.3.5.5-alpha | evertme2_atmail_net | ihaZtordrunk | 1 | 2EBFF85DAEB4CB84A117F801801BE9A536AE7524 | | 1 | 0 | 05:31:33 | 23.95.85.216 | us | 9404 | 0 | 0.3.5.5-alpha | __do_wwoo_rry___at__gmail | UKNOWnoto | 1 | 48A3DD64243F50550ABEFA1EB73D8D50E701C370 | | 1 | 0 | 06:27:32 | 172.245.97.194 | us | 12059 | 0 | 0.3.5.5-alpha | distorikATgmail.COM | erRHeroes | 1 | 2EBFFE2CBC8F1AC47EF3406B8010BDBDD9A83084 | | 1 | 0 | 06:32:40 | 107.173.70.103 | us | 11930 | 0 | 0.3.5.5-alpha | strapaganzza at mail.net | nerevgiuap | 1 | 48A3F20EA43CC7B4B124D3F8894795D31A3F90E4 | | 1 | 0 | 07:20:14 | 107.173.70.100 | us | 9902 | 0 | 0.3.5.5-alpha | painkillsde __AT__gmail_c | coldBloodT | 1 | 48A3F9E9990FB122839DD301D2195E2040DFD02F | | 1 | 0 | 08:28:44 | 107.173.70.104 | us | 9581 | 0 | 0.3.5.5-alpha | grave345235(a)gm__ail.com | rEPlace3r | 1 | AA08AE727D782C71930D828C4236CB2434E559C6 | | 1 | 0 | 08:33:40 | 107.173.70.102 | us | 16870 | 0 | 0.3.5.5-alpha | nneoodww9 at mail.com | Historitian | 1 | 8788B1A28148ABD7C48ADF00791BBE795BC4A282 | | 1 | 0 | 09:17:47 | 107.173.70.105 | us | 9292 | 0 | 0.3.5.5-alpha | ultimost_gmail_at | Bailarumba | 1 | AA088A35AFC64BE27806EB4CEB8DA059F157EBD9 | | 1 | 0 | 09:21:48 | 198.46.182.211 | us | 13873 | 0 | 0.3.5.5-alpha | augllsdn4(a)gmail.com | lighTOR | 1 | 878874CD42DE8695A0C02B6A5385E18638C0F95A | | 1 | 0 | 09:55:11 | 198.46.182.191 | us | 14037 | 0 | 0.3.5.5-alpha | elistranoob AT gmail dot. | ChOue | 1 | AA08CE96617B2D3B6F4753805B6C8244E07A40E9 | | 1 | 0 | 10:01:14 | 107.173.70.107 | us | 11389 | 0 | 0.3.5.5-alpha | to_me_baby at yahoo.com | bagarabild | 1 | 8788AAB8C1E28693C30CFC4159EE0F313C25D610 | | 1 | 0 | 15:30:33 | 107.173.70.10 | us | 9075 | 0 | 0.3.5.5-alpha | besktrsop(a)gmail.com | TorpDay | 1 | A099DAA630AC76F03FBB6138E2EBA884151E8706 | | 1 | 0 | 15:34:27 | 23.95.85.215 | us | 17563 | 0 | 0.3.5.5-alpha | bebe_rexa AT nomail.com | RepeldeVay | 1 | FB346238C8FCB515A49F53049D0129BF69EAD7CA | | 1 | 0 | 15:39:48 | 198.46.182.208 | us | 15199 | 0 | 0.3.5.5-alpha | pokerspot1(a)yahoo.com | delldivision | 1 | A099ED2475CE64280119ECDE46EA414931014540 | | 1 | 0 | 15:43:46 | 192.227.155.34 | us | 14413 | 0 | 0.3.5.5-alpha | justnomail1 AT gmail com | elitor00 | 1 | FB34E30229A265047A6A136AECA4CBBAA88EA12E | | 1 | 0 | 15:48:34 | 107.173.70.102 | us | 18204 | 0 | 0.3.5.5-alpha | spint000r_AT_jepajio.io | SPintro | 1 | A099DBA1456E1A185613DE047F728BA48D8CB79B | | 1 | 0 | 16:21:19 | 172.245.97.194 | us | 17781 | 0 | 0.3.5.5-alpha | mustamus3d_at_gmail_ | mustaHesh | 1 | FB347A7601D71BA4F929C27EDCC2A9B168DF0B79 | 2018-12-09 | Up | Ext | JoinTime | IP | CC | ORp | Dirp | Version | Contact | Nickname | eFamMembers | FP | |------+-------+------------+----------------+------+-------+--------+---------------+---------------------------+-------------+---------------+------------------------------------------| | 1 | 0 | 11:48:20 | 23.95.85.215 | us | 15349 | 0 | 0.3.5.5-alpha | vejj2dw_at_gmail.com | Veloprises | 1 | A677EE072DA6F8E6E902EC4B6CE35AE78CF450B6 | | 1 | 0 | 12:11:32 | 107.173.70.106 | us | 12001 | 0 | 0.3.5.5-alpha | yeeeyahoo dog yooh.net | nightmareON | 1 | A677EA1818F2EC649B583CBDD8F30AF3B7A09A23 | | 1 | 0 | 12:21:13 | 23.95.0.211 | us | 10509 | 0 | 0.3.5.5-alpha | meyuo AT school DOT ymail | DinoSource0 | 1 | A677F3CC1019AB162174CBB58C803E4C17268CD4 | | 1 | 0 | 13:42:45 | 107.173.70.101 | us | 11766 | 0 | 0.3.5.5-alpha | LOTOLOT_at yahoo.com | L0t0siaa | 1 | D021F4D88E2A87A184D72EC0FC7558DB29D161F5 | | 1 | 0 | 14:01:04 | 192.227.155.34 | us | 13968 | 0 | 0.3.5.5-alpha | chemie333 AT_vfmail.net | Hemabab3 | 1 | D021FF49FEF26D36C27E68C1A89E6F237DCDF5AC | -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

8 11

Monitoring a Tor-Relay - Telegraf / InfluxDB / Grafana ?
by petrarca＠protonmail.ch 08 Dec '18

08 Dec '18

I was thinking about setting up a monitoring of a Tor-Relay using Telegraf, InfluxDB and Grafana. Although I did read quite some documenation about it already I thought it might be good to check for possible experiences made here before spending (wasting) too much time trying it out myself. Questions I could not answer yet myself include e.g. - What will be the performance impact of running Telegraf on a Tor-Realy (CPU, disk, I/O,...)? - What happens if the InfluxDB (running on another system) is not reachable (maintenance, outages) - is the data lost or buffered somehow? - I would like to also keep see old/historical data but not as granular as more recent data - is there any way to boild down old data, e.g. to only keep hourly data for data older that a month etc.? There are an overwhelmingly number of monitoring possibilities (munin, collecd, monit, nyx, RRDtool, Cacti, Monitorix, Nagios, Zabbix,...) out there and one could easily spend days if not weeks with reading and testing. So any kind of shared experiences, hints or tips are more than welcome. .

3 2

Re: [tor-relays] Monitoring a Tor-Relay - Telegraf / InfluxDB / Grafana ?
by Olaf Grimm 08 Dec '18

08 Dec '18

For a tor relay that is not neccessary. After I thought about this in the past I decided it so after local watching. Now I use "htop" and "bwm-ng", "nload" and "nyx" via SSH on the remote server. You can use the website "uptime monitor" if you want to get a mail after server crash or other network errors. My preference is the tor monitoring network https://metrics.torproject.org. Why you want to use a big monitoring solution? If your tor relay is a second paylod on the server this ist ok, but this is not the right discussion channel here. Olaf Am 08.12.18 um 10:01 schrieb petrarca(a)protonmail.ch: > I was thinking about setting up a monitoring of a Tor-Relay using Telegraf, InfluxDB and Grafana. Although I did read quite some documenation about it already I thought it might be good to check for possible experiences made here before spending (wasting) too much time trying it out myself. > > Questions I could not answer yet myself include e.g. > > - What will be the performance impact of running Telegraf on a Tor-Realy (CPU, disk, I/O,...)? > - What happens if the InfluxDB (running on another system) is not reachable (maintenance, outages) - is the data lost or buffered somehow? > - I would like to also keep see old/historical data but not as granular as more recent data - is there any way to boild down old data, e.g. to only keep hourly data for data older that a month etc.? > > There are an overwhelmingly number of monitoring possibilities (munin, collecd, monit, nyx, RRDtool, Cacti, Monitorix, Nagios, Zabbix,...) out there and one could easily spend days if not weeks with reading and testing. So any kind of shared experiences, hints or tips are more than welcome. > > . > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

Re: [tor-relays] Who is permanently checking my bridge relay?
by teor 04 Dec '18

04 Dec '18

Hi, > On 4 Dec 2018, at 21:27, tschador(a)posteo.de wrote: > > Hi all! > > I wonder who is permanently connecting/checking(?) my Tor bridge relay. > The ip is 66.111.2.129 and the period of the connects are 21 min 21 sec, > e.g.: > > Dec 4 10:32:00 SRC=66.111.2.129 > Dec 4 10:53:21 SRC=66.111.2.129 > Dec 4 11:14:43 SRC=66.111.2.129 > Dec 4 11:36:04 SRC=66.111.2.129 > Dec 4 11:57:26 SRC=66.111.2.129 > Dec 4 12:18:52 SRC=66.111.2.129 > > https://metrics.torproject.org/rs.html#search/66.111.2.129 gives no match. > > Any more experiences with other bridges? A few years ago, I opened a ticket to randomise authority reachability testing: https://trac.torproject.org/projects/tor/ticket/13928 But we triaged it out with the comment: My rationale for redlining it during triage was that the best place to do unpredictable-order testing is probably in a successor to torflow. (sbws is a successor to torflow, and it does randomise the testing order.) Are there any good reasons to randomise the order of authority tests? One good reason is that it breaks patterns in the authority checks, so relays really do need to be up all the time to be listed as reachable. T

1 0

IP addresses on the list
by Charly Ghislain 04 Dec '18

04 Dec '18

We have seen ip addresses posted on this list recently. They were coming from the logs. I think it would be nice if the software powering this list could scramble all ips in message bodies. At least having to reformat them in order to avoid that filter would give the poster some time to realize if it is a good idea to post it in the first place. I am also questioning myself whether addresses should be printed in log files altogether. Maybe even with the unsafe flag on - at least for released versions. If one wants to know which ip is connecting to her bridge, she can use whatever network capture software already existing. Any opinion? Thanks, Charly

3 2

Re: [tor-relays] Who is permanently checking my bridge relay?
by Charly Ghislain 04 Dec '18

04 Dec '18

If it wasn't, would posting the ip address of a client connecting to a bridge in here compromise her anonymity and/or allow one to firewall/blacklist her traffic? Im assuming one could guess the ip address of the running bridge based on the poster email address. On Tue, Dec 4, 2018 at 2:57 PM <tschador(a)posteo.de> wrote: > On 2018-12-04 13:15, George wrote: > > > tschador(a)posteo.de: > > >> I wonder who is permanently connecting/checking(?) my Tor bridge relay. > > > > > > That's the bridge directory authority. > > Ok, thank you. > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >

4 5

Fwd: Throughput of each circuit
by marziyeh latifi 04 Dec '18

04 Dec '18

Hello,I have two questions about tor's relay: 1-How can I calculate the throughput of each circuit in a relay?I mean that how can I calculate the number of cells that are sent from circuit queue to the output buffer per second in each relay? 2-What is the difference between circuit and channel in relays? I'm looking forward to hearing from you! thanks! Marziyeh

3 2

Re: [tor-relays] Who is permanently checking my bridge relay?
by Logforme 04 Dec '18

04 Dec '18

On 2018-12-04 16:33:33, tschador(a)posteo.de wrote: >Furthermore it was clear for me that fix periods of 21 min 21 sec >couldn't be a normal client. Missing more information about bridge >directory authority … >From https://blog.torproject.org/new-bridge-authority: "The Bridge Authority is a simple but essential piece of the Tor Network. Unlike the other directory authorities, the Bridge Authority does not get a vote in Tor's consensus protocol. Instead, it serves to aggregate relay descriptors which Tor Bridges send to it, checking their cryptographic validity and testing that the Bridges' ORPorts within these descriptors are reachable" The last part is what causes the connections you see

1 0

Re: [tor-relays] Who is permanently checking my bridge relay?
by George 04 Dec '18

04 Dec '18

tschador(a)posteo.de: > Hi all! > > I wonder who is permanently connecting/checking(?) my Tor bridge relay. That's the bridge directory authority. g -- 34A6 0A1F F8EF B465 866F F0C5 5D92 1FD1 ECF6 1682

1 0

UbuntuCore relays
by nusenu 02 Dec '18

02 Dec '18

Roger Dingledine wrote: > Btw, all of these UbuntuCore relays are from snap packages run by Tor > enthusiasts Do you indeed mean "all"? Since there have also been other hypothesis about at least some of these "UbuntuCore" relays in the past (see bad-relays ML archive from 2017-11-13), it would be great if you could elaborate on how you came to that conclusion. thanks, nusenu -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

3 5

tor irc
by deadcow＠tuta.io 01 Dec '18

01 Dec '18

i needed som fast help i tried IRC .... started well and when iv got help a= nd pasted the whole torrc file ... bot kicked me out i cant log in ive got = this answer deadcow sets mode +i on deadcow -NickServ- This nickname is registered and protected.=C2=A0 If it is your n= ickname, you may -NickServ- authenticate yourself to services with the IDENTIFY command.=C2= =A0 You are -NickServ- getting this message because you are not on the access list for = the -NickServ- deadcow nickname. * #tor-relays :Cannot join channel (Need to be identified and verified to j= oin this channel, '/msg NickServ help' to learn how to register and verify.= ) how do i get back to the chat ? ive never used irc :( anyway tha question was about bridge. i've started but i have no logs and dont know what is wrong. VPN is off. end of torrc #Bridge config RunAsDaemon 1 ORPort 9001 BridgeRelay 1 ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy # For a fixed obfs4 port (i.e. 9002), uncomment the following line. #ServerTransportListenAddr obfs4 0.0.0.0:9002 # Local communication port between Tor and obfs4. Always set this to "auto"= . "Ext" means # "extended", not "external". Don't try to set a specific port number, nor = listen on 0.0.0.0. ExtORPort auto #Set your bridge nickname and contact info ContactInfo deadcow(a)tuta.io <mailto:deadcow@tuta.io> <mailto:deadcow@tuta.io <mailto:deadcow@tuta.io>> Nickname deadcow something is wrong but what :) thx for help --- Google, Facebook, The government and others are spying on your emails! DO YOU LIKE IT? If not, CHANGE! Securely sent with Tutanota. Claim your encrypted mailbox today! https://tutanota.com

2 1

Conrad Rockenhaus
by torix＠protonmail.com 30 Nov '18

30 Nov '18

Dear All, Has anyone news of Conrad? His servers at greypony have been down a week, which is worrying. TIA, --Torix Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

Re: [tor-relays] Relay with VPN
by deadcow＠tuta.io 29 Nov '18

29 Nov '18

Hi thanks for the answers. I understand your answers. I can not agree or disagree because I have no idea about it so I believe you and I wont do Relay with VPN :) I am using VPN all the time and I wanted to try run relay.... what you say make sense, so for the time I try, i'll disconnect VPN. I just want to see that my internet is good enough to run it 10/1 but as i've read in the instructions maybe bridge would be better for me ... i have access to internet 120/10 so i could set up relay on that but i need a PC with linux and remote control so getting complicated ... first try out what i have, if cool, later try more and more :) I love the concept of tor, I'd like to promote it :) question: can be laptop ? i think why not, but maybe i'm wrong thanks for helps :) --- Google, Facebook, The government and others are spying on your emails! DO YOU LIKE IT? If not, CHANGE! Securely sent with Tutanota. Claim your encrypted mailbox today! https://tutanota.com Nov 28, 2018, 11:53 PM by tor-relays-request(a)lists.torproject.org: > Send tor-relays mailing list submissions to > > tor-relays(a)lists.torproject.org <mailto:tor-relays@lists.torproject.org> > > To subscribe or unsubscribe via the World Wide Web, visit > > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays> > or, via email, send a message with subject or body 'help' to > > tor-relays-request(a)lists.torproject.org <mailto:tor-relays-request@lists.torproject.org> > > You can reach the person managing the list at > > tor-relays-owner(a)lists.torproject.org <mailto:tor-relays-owner@lists.torproject.org> > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > > > Today's Topics: > > 1. Re: Relay with VPN (s7r) > 2. Compatibility issue with OpenSSL 1.1.1a (Nick Mathewson) > 3. Re: Relay with VPN (Roger Dingledine) > 4. Re: tor relay warning - what is mean ? (> dlugasny(a)protonmail.com <mailto:dlugasny@protonmail.com>> ) > 5. Re: Relay with VPN (teor) > 6. Re: tor relay warning - what is mean ? (teor) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 28 Nov 2018 14:23:38 +0200 > From: s7r <> s7r(a)sky-ip.org <mailto:s7r@sky-ip.org>> > > To: > tor-relays(a)lists.torproject.org <mailto:tor-relays@lists.torproject.org> > Subject: Re: [tor-relays] Relay with VPN > Message-ID: <> eba112e6-f60b-6278-2bf3-e86c34dc0dc4(a)sky-ip.org <mailto:eba112e6-f60b-6278-2bf3-e86c34dc0dc4@sky-ip.org>> > > Content-Type: text/plain; charset="utf-8" > > 11:18 PM, > deadcow(a)tuta.io <mailto:deadcow@tuta.io>> wrote: > >> Hi everyone, first time ever using mailing lists. Please let me know if something I'm doing wrong. >> >> I'd like to run a middle relay. >> I'm using Linux mint 19 >> >> The question. Can i set up relay through VPN? (nordvpn) >> Or if i want relay i have to stop using vpn? >> Thank you for help >> >> >> --- >> Google, Facebook, The government and others are spying on your emails! >> DO YOU LIKE IT? If not, CHANGE! >> Securely sent with Tutanota. Claim your encrypted mailbox today! >> https://tutanota.com <https://tutanota.com> >> > > Hello, > > Thanks for your interest in running a relay. > > You say you want to run a middle relay, why do you want to run it behind > a VPN in this case? Middle relays get no abuse complaints or anything as > they can not be used as exit points. Maybe you can explain to us why you > think you need to run your middle relay behind a VPN, do you have a > particular reason? Because for Tor running a relay behind a VPN is not a > + on security or privacy at all, instead it just complicates things. > > Secondly, if you have justified reason to still want to use a VPN on a > middle relay, here are some things you need to take into consideration > as well as disadvantages: > > - you will have higher latency; > - the bandwidth of your relay will be of the speed of the VPN itself, > and shared VPN usually are slow for high grade server connections that > run 24x7 with constant bandwidth usage; > - when the VPN tunnel will fail, due to an endpoint problem or internet > connectivity problem or route to destination problem, etc., the relay > will update its descriptor with the real IP address instead of the VPN > address, and when the VPN tunnel connects again change again and so on > until clients will be confused. One way around this is for your to > specify 'Address' in torrc and bind to explicit <address>:<port>. > > - you don't need just any VPN, you need a VPN with a public and static > IP address, so that you can actually open ports on that IP address > applications can bind and listen to certain ports. A normal shared VPN > that just changes the IP address for browsing is not sufficient, because > that does not assign a public static IP address directly. > > There are VPN services out there that offer public and static IP > addresses, but they are more expensive. > > - you should tell the VPN provider that you plan to use the maximum > available bandwidth 24x7, because all say it's unlimited because they > think "nobody will use that much", but when running Tor relays this is > not true. > >

2 1

tor relay warning - what is mean ?
by dlugasny＠protonmail.com 28 Nov '18

28 Nov '18

Hi, does any could tell me what is mean that Warn ? 16:32:33 [WARN] {BUG} Bug: 0x1076f25 <_start+0xa5> at /usr/local/bin/tor (on Tor 0.3.4.9 4ec3ccf2863b86e7) │ 16:32:33 [WARN] {BUG} Bug: 0x1077119 <main+0x19> at /usr/local/bin/tor (on Tor 0.3.4.9 4ec3ccf2863b86e7) │ 16:32:33 [WARN] {BUG} Bug: 0x107727c <tor_main+0x4c> at /usr/local/bin/tor (on Tor 0.3.4.9 4ec3ccf2863b86e7) │ 16:32:33 [WARN] {BUG} Bug: 0x107bfe9 <tor_run_main+0xb9> at /usr/local/bin/tor (on Tor 0.3.4.9 4ec3ccf2863b86e7) │ 16:32:33 [WARN] {BUG} Bug: 0x107a221 <do_main_loop+0x411> at /usr/local/bin/tor (on Tor 0.3.4.9 4ec3ccf2863b86e7) ─┘ 16:32:33 [WARN] {BUG} Bug: 0x801b4de1f <event_base_loop+0x51f> at /usr/local/lib/libevent-2.1.so.6 (on Tor 0.3.4.9 4ec3ccf2863b86e7) I extracted that from Nyx. FreeBSD 11.1 Cheers Dlugasny Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 3

Relay with VPN
by deadcow＠tuta.io 28 Nov '18

28 Nov '18

Hi everyone, first time ever using mailing lists. Please let me know if something I'm doing wrong. I'd like to run a middle relay. I'm using Linux mint 19 The question. Can i set up relay through VPN? (nordvpn) Or if i want relay i have to stop using vpn? Thank you for help --- Google, Facebook, The government and others are spying on your emails! DO YOU LIKE IT? If not, CHANGE! Securely sent with Tutanota. Claim your encrypted mailbox today! https://tutanota.com

5 4

Is There A Windows CMD Command To Update Tor.exe?
by Keifer Bly 28 Nov '18

28 Nov '18

Hello, so today when I started my bridge relay, tor popped up with a warning saying this WARNING: According to directory authorities, this version of tor [0.3.4.8] is out of date or no longer recommended. I am running the obfs4 bridge via tor expert bundle, and was told previously that that is updated when the tor browser is updated, but am wondering, seeing as there is a way to do this on MacOS and Linux, is there a way to update the tor process (I guess I would also need to update the obfs4 exe process) via the Windows command line? Thank you.

2 1

Re: [tor-relays] tor relay - impact on e-mail system reputation
by starlight.2018q2＠binnacle.cx 26 Nov '18

26 Nov '18

If you have a good deal on a powerful VPS you wish to run as a relay, suggest you rent a second dirt-cheap low resource VPS for email. MTA softwares tolerate flaky connectivity and system performance well. RBLs are a fact of life. I use them to great benefit on my MTAs. Reason no-port-25 exits are blacklisted is that web-form spammers use them. Here are two excellent resources for viewing the blacklist status of IP addresses (helpful to check IPs, when known, before purchase): http://multirbl.valli.org/lookup/x.x.x.x.html # single IP https://www.senderbase.org/lookup/?search_string=x.x.x.x/24 # block, directs to Talos The lists which matter most are Spamhaus, CBL and Barracuda. Good luck with it! On 2Thu Nov 22 13:08:55 UTC 2018, Artem Dziubenko wrote: > >Hi, > >no its not possible. This is powerful VPS with single IP. I simply do not >want to have blacklisted IP because tor relay is running on it. > >In the past many times IP was blaclisted and afterwards I had >several problems with email delivery. > >I do not understand why rbls blocking tor non exit relay ip's... It stupid... > >Cheers >Dlugasny > >Sent from ProtonMail mobile > >-------- Original Message -------- >On 22 Nov 2018, 08:30, Artem Dziubenko wrote: > >> Is it possible to get a second IP address for that server from your ISP? >> >> ------ Original Message ------ >>> Hi, >>> >>> I haven an e-mail server which has a lot of not consumed >>> resources (CPU/Traffic etc.). Base on my practice I know that my >>> E-mail server will loose reputation if Tor relay will run on the same IP. >>> >>> Is there any other way to utilize resources of that machine without >>>> any reputation impact on the IP. >>> >>> Thanks in advance for any feedback. >>> >>> Cheers >>> Dlugasny

4 5

Raspberry pi 3 relay performace
by tor_manager＠autistici.org 26 Nov '18

26 Nov '18

Hello everyone, I have a tor relay running on a raspberry with raspbian 9 and tor version 3.4.8, everything is working fine for more then a year. I noticed that the average download/upload is just 1.5 MB and the peak 3.3 MB The Bandwidth configuration is the following: BandwidthRate 9 MB BandwidthBurst 10 MB RelayBandwidthRate 9 MB RelayBandwidthBurst 10 MB MaxAdvertisedBandwidth 9 MB It doesn't look the CPU or memory usage are too high. Is this something normal? How can I improve the performance? Thanks a lot

4 8

How To Update The Tor Expert Bundle To Tor 0.3.4.9
by Keifer Bly 26 Nov '18

26 Nov '18

Hello, So I am running an obfscated bridge on Windows 10 via the tor expert bundle, which, even when I tried downloading it today, is running tor 0.3.4.8. I was unaware that tor 0.3.4.9 had been released due to this. Do to being away from where the relay is running, I will not be able to update it for about 4 days, but how could I update the tor expert bundle to tor 0,3,4,9? How could I update the tor expert bundle to the newest tor in general? Thank you.

2 2

Is the public information for relays trustable?
by Gunnar Wolf 24 Nov '18

24 Nov '18

Hi, I just asked a superset of this question to the IRC channel - But I want to be able to better refer to the subset that wasn't answered there ;-) I am working together with some other people to increase the number of relays in Mexico. We have finally started to increase the number - from our usual two active relays to four, still WAY too low, but it's a beginning: https://metrics.torproject.org/rs.html#search/country:mx But there are some issues / questions bugging me: When we set out to pursue this, we faced the reality that most Mexican ISPs block Tor relays in some way or another: The main ISP in the country (Telmex / Infinitum / Uninet, depending on the business branch in question) blocks all communication to seven of the dirauths, thereby making it impossible to operate a relay (although bridges do work); many other ISPs employ a set of nested NAT systems, making it impossible for external computers to reach a server inside it... However, we have at least one relay claiming to be from Uninet (5F6E720D7F0A95D6276B6F6DF8C210735A331B9D - Not currently online, but made it to the consensus at least at several points over the past months). We also have some in an ISP that gives addresses behind multiple layers of NAT and are unworkable (FF3FF664B0811B2E3C237BECA4382966AD9E393C, 6E483A91105C647A65ED04E1CB637AAD84F5943F) So... Is this information right? Can this be in some way spoofed? How should I interpret this? Thanks,

4 4

Tor ContactInfo generator
by Eran Sandler 23 Nov '18

23 Nov '18

Hi everyone, I've build a small website with nusenu's help to generate the Tor ContactInfo field value based on nusenu's specification: https://github.com/nusenu/ContactInfo-Information-Sharing-Specification Check out the website here: https://torcontactinfogenerator.netlify.com/ The code is in Github (there is a link to the repo at the end of the website). Feel free to send pull requests for changes/fixes/updates. Thanks, Eran

3 6

notices.log: "[warn] Rejecting DNS request from disallowed IP"
by petrarca＠protonmail.ch 23 Nov '18

23 Nov '18

Hi, on a small server I did try to force local DNS requests to the local Tor via iptables/ferm (Nat, Output-Chain, protocol udp dport domain REDIRECT to-ports 5300). Torrc has the following included: 'DNSPort 127.0.0.1:5300'. Unfortunately, it doesn't work as expected, but I get a warning in Tor's notices.log stating "[warn] Rejecting DNS request from disallowed IP" for each DNS request and even after hours of searching around and trying different configs I could't find the root cause yet. Question: what does "disallowed IP" really mean, i.e. what IPs are allowed by Tor and which ones are not? Any ideas and hints on how to investigate further are highly welcome! :-) to

2 2