- tor-relays - lists.torproject.org

Reinstalling Relay
by Matthew Glennon 05 Jun '18

05 Jun '18

When I installed my relay last year, I foolishly enabled disk encryption. This has caused a few automatic reboots or power failures to turn into a weekend of downtime. Today (or sometime this week) I'd like to rectify this by reinstalling the OS. I'm going to backup /var/lib/tor and my torrc, but I wanted to alert the masses in case I mess up and have to start over. The relay will be down during the process, but it shouldn't take more than an hour or so. https://metrics.torproject.org/rs.html#details/924B24AFA7F075D059E8EEB284CC… -- Matthew Glennon matthew(a)glennon.online PGP Signing Available Upon Request https://keybase.io/crazysane

4 6

Tor relay unstable
by Pascal Levasseur 05 Jun '18

05 Jun '18

Hello, My very stable Tor relay 16102E458460349EE45C0901DAA6C30094A9BBEA is now rebooting every two days since May 31, 2018. Running Tor 0.3.3.5-rc (git-4fe9670741478750) on Linux with Libevent 2.0.21-stable, OpenSSL 1.1.0f, Zlib 1.2.8 You will find a short extract of the Tor log below : May 31 23:12:27 mkuktra systemd[1]: tor(a)default.service: Main process exited, code=killed, status=7/BUS May 31 23:12:27 mkuktra systemd[1]: tor(a)default.service: Unit entered failed state. May 31 23:12:27 mkuktra systemd[1]: tor(a)default.service: Failed with result 'signal'. May 31 23:12:28 mkuktra systemd[1]: tor(a)default.service: Service hold-off time over, scheduling restart. Jun 05 03:17:59 mkuktra tor[23419]: *** Error in `/usr/bin/tor': free(): invalid next size (normal): 0x000055ed468598d0 *** Jun 05 03:17:59 mkuktra tor[23419]: ======= Backtrace: ========= Jun 05 03:17:59 mkuktra tor[23419]: /lib/x86_64-linux-gnu/libc.so.6(+0x70bfb)[0x7fbb01af9bfb] Jun 05 03:17:59 mkuktra tor[23419]: /lib/x86_64-linux-gnu/libc.so.6(+0x76fc6)[0x7fbb01afffc6] Any idea ?? Pascal

3 3

Refusing to apply consensus diff
by Logforme 05 Jun '18

05 Jun '18

I run the non-exit relay 855BC2DABE24C861CD887DB9B2E950424B49FC34 Two days now I've seen this in my log file: Jun 05 06:25:02.000 [warn] Refusing to apply consensus diff because the base consensus doesn't match the digest as found in the consensus diff header. Jun 05 06:25:02.000 [warn] Expected: 2E3DACFB12051F4A45F7F4DC062F6D47DC75DBA85EB72F8E5D43DF134940F2DA; found: 1573CFF458492B70BFDD4E91A594521C4DDD801B11936B8C148BF27F67736713 Jun 05 06:25:02.000 [warn] Could not apply consensus diff received from server '128.31.0.34:9131' (Repeated for 204.13.164.118, 131.188.40.189, 154.35.175.225, 194.109.206.212, 171.25.193.9, 199.58.81.140) First time I assumed it was just a glitch. Now I'm wondering if there is something I should do on my side?

2 1

adding clients to obfs4proxy+private tor relay
by Hamid Safe 03 Jun '18

03 Jun '18

2 4

New DNS related fields in the ContactInfo Sharing Specification
by nusenu 01 Jun '18

01 Jun '18

Hi, I added a few new DNS related fields for exit relays to the ContactInfo sharing specification if you want to contribute towards a more complete picture on how exit relays configure DNS. https://github.com/nusenu/ContactInfo-Information-Sharing-Specification#dns… regards, nusenu -- https://mastodon.social/@nusenu twitter: @nusenu_

4 8

How to change Tor's source code
by dave` dave 29 May '18

29 May '18

I saw that i have this site https://gitweb.torproject.org/tor-browser.git which have Tor's source code, i don't understand how it works. i want to change the source code in my computer, can/how i do that?

2 1

Re: [tor-relays] Verizon AS701 blocking Tor consensus server tor26 (86.59.21.38)
by starlight.2017q4＠binnacle.cx 28 May '18

28 May '18

>Hi tor-relays mailing list, > >Good news! Verizon unblocked tor26 (86.59.21.38). > >I posted something similar on NANOG (with modifications for network people) here: >https://mailman.nanog.org/pipermail/nanog/2018-May/095386.html > >Someone nice at Verizon must have read NANOG (VZ NOC people probably do >read NANOG) and unblocked tor26. Here is a (successful) traceroute: Thank you Neel! My relay along with all the other Verizon FiOS relays are now visible to 'tor26'. This can be viewed by navigating to https://consensus-health.torproject.org/ and clicking the 'detailed page' link at the bottom (takes time to load and render). https://metrics.torproject.org/rs.html#search/as:701

2 1

Re: [tor-relays] tor-relays Digest, Vol 88, Issue 45
by Yash Kumar 27 May '18

27 May '18

Hi Olaf, Thank you for offering your help. I installed "ufw" and unblocked my ORPort, but still I am getting the same issue. Can you please suggest what else could be the problem ? Thank you, Yash On Thu, 24 May 2018 at 23:31, <tor-relays-request(a)lists.torproject.org> wrote: > Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > > > Today's Topics: > > 1. Re: Unable to confirm my ORPort is reachable (Luca Tortiglione) > 2. Re: Unable to confirm my ORPort is reachable (Matt Traudt) > 3. Re: Why adding more Nodes won't help? (teor) > 4. Re: Unable to confirm my ORPort is reachable (Olaf Grimm) > 5. Re: Tor Software Update Question (Keifer Bly) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 24 May 2018 16:56:15 +0200 > From: Luca Tortiglione <luca.tortiglione(a)gmail.com> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Unable to confirm my ORPort is reachable > Message-ID: > < > CABvHF-vHSQUGQwpp3iu_vat1gv3gRtoi2ra_ASOi6ZchGLYzQw(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > what about port forwarding on the router / modem adsl ? > Il giorno gio 24 mag 2018 alle ore 16:54 Yash Kumar <yashkr.99(a)gmail.com> > ha scritto: > > > Hi all, > > I have set up a tor relay on my Ubuntu machine by following the > instructions given in the link. To confirm whether the setup was done > properly, I checked the status using the command: > > > $ sudo service tor status > > > and was getting status as "Active". > > Further, I looked into the log file /var/log/tor/notices.log using the > command: > > > $ tail -f /var/log/tor/notices.log > > > and following was the output: > > > May 24 18:24:54.000 [notice] Starting with guard context "default" > > May 24 18:24:54.000 [notice] Bootstrapped 80%: Connecting to the Tor > network > > May 24 18:24:54.000 [notice] Signaled readiness to systemd > > May 24 18:24:55.000 [notice] Guessed our IP address as x.x.x.x (source: > 204.13.164.118). > > May 24 18:24:55.000 [notice] Bootstrapped 85%: Finishing handshake with > first hop > > May 24 18:24:56.000 [notice] Bootstrapped 90%: Establishing a Tor circuit > > May 24 18:24:59.000 [notice] Tor has successfully opened a circuit. Looks > like client functionality is working. > > May 24 18:24:59.000 [notice] Bootstrapped 100%: Done > > May 24 18:24:59.000 [notice] Now checking whether ORPort x.x.x.x:9001 is > reachable... (this may take up to 20 minutes -- look for log messages > indicating success) > > May 24 18:44:55.000 [warn] Your server (x.x.x.x:9001) has not managed to > confirm that its ORPort is reachable. Relays do not publish descriptors > until their ORPort and DirPort are reachable. Please check your firewalls, > ports, address, /etc/hosts file, etc. > > > Can anyone please help me with this issue? > > I am not able to figure out the reason behind this error message "Your > server (x.x.x.x:9001) has not managed to confirm that its ORPort is > reachable". > > Please also let me know if you feel there is any issue with the tor > configuration. > > > Thank you, > > Yash Kumar > > _______________________________________________ > > tor-relays mailing list > > tor-relays(a)lists.torproject.org > > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > > -- > > > > > L. > > > ------------------------------ > > Message: 2 > Date: Thu, 24 May 2018 10:56:42 -0400 > From: Matt Traudt <pastly(a)torproject.org> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Unable to confirm my ORPort is reachable > Message-ID: <00717b22-2471-5dc5-f4d1-352a455f6e73(a)torproject.org> > Content-Type: text/plain; charset=utf-8 > > On 5/24/18 10:53, Yash Kumar wrote: > > Hi all, > > I have set up a tor relay on my Ubuntu machine by following the > > instructions given in the link > > <https://trac.torproject.org/projects/tor/wiki/TorRelayGuide>. To > > > > [...] > > > > Can anyone please help me with this issue? > > I am not able to figure out the reason behind this error message "Your > > server (x.x.x.x:9001) has not managed to confirm that its ORPort is > > reachable". > > Please also let me know if you feel there is any issue with the tor > > configuration. > > > > Based on the information provided, most likely port 9001 is not > forwarded correctly at your router. > > Matt > > > > ------------------------------ > > Message: 3 > Date: Thu, 24 May 2018 08:30:16 -0700 > From: teor <teor2345(a)gmail.com> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Why adding more Nodes won't help? > Message-ID: <1B7BFAE4-778C-4D57-9E8D-0A9E0ECA8FDE(a)gmail.com> > Content-Type: text/plain; charset="utf-8" > > > > > On 24 May 2018, at 05:00, dave` dave <daved7082(a)gmail.com> wrote: > > > > i saw that is a way to change the numbers of nodes in this site > http://thesprawl.org/research/tor-control-protocol/#creating-really-fast-on… > > any one knows how it works, there is not enough information how to use > it. > > "Since we will use the same node for both entry and exit, we must find a > node which supports appropriate exist policy" > > By default, recent Tor versions do not allow single hop exits, because the > exit learns the client's IP address and the destination domain. > > If you want this feature, run your clients and exits in a test network > with: > > RefuseUnknownExits 0 > > T >

1 0

Running A Bridge Alongside My Relay
by Keifer Bly 26 May '18

26 May '18

Hello, So I am considering running a bridge alongside my relay gotland, as the network could probably use some more bridges. As I have said, I do not have any other network that I can run my relay from, however, what I might do is run my obsfacted bridge on a Linux Virtual Machine through a proxy server. Does anyone know any free proxy software out there this might be achievable with? Let me know what you think, thank you.

4 7

New relay operator here
by privatesociety Tor 25 May '18

25 May '18

Hello tor relay community! I‘d like to introduce six new relays, which are operated by privatesociety, a community of people, which fighting for privacy based in europe. The six relays provide a capacity of around 300 mbit/s (total) and are hosted on networks, which aren‘t much used - so better for the tor community. I hope we are working great together. :) Look at meetrics for more details: https://metrics.torproject.org/rs.html#search/family:7AF3F4E88A5AE224DB7757… Anyway: We are maybe setting up an exit in the future, but for this we‘d like to join forces with other exit operators like TORSERVERS.net to have better connections in case of problems. Does anyone have contacts, which could be helpful?

4 4

Tor Software Update Question
by Keifer Bly 24 May '18

24 May '18

Hello, So I just updated the tor software using command “brew upgrade tor” on macOS. It upgraded from tor 0.3.3.0 to tor 0.3.3.6. I am wondering, do I need to restart my relay after doing this? I am also wondering, I have this email address in the “ContactInfo” in my torn file for tor project to contact me regarding issues with my relay, etc, but am wondering if there is a way to have this email for them to contact without displaying it publicly on my relay? Thank you very much.

6 11

Verizon AS701 blocking Tor consensus server tor26 (86.59.21.38)
by Neel Chauhan 24 May '18

24 May '18

Hi tor-relays mailing list, I have noticed that the Tor consensus server tor26 (https://metrics.torproject.org/rs.html#details/847B1F850344D7876491A54892F9…) is blocked on Verizon's UUNET (AS701) backbone, and therefore, Verizon's retail services like FiOS and Wireless. I can confirm this on FiOS, but I don't use Verizon Wireless (my smartphone uses Sprint) so I can't test it there. A traceroute to tor26's IP address 86.59.21.38 from a Brooklyn apartment shows this is filtered on Verizon's backbone: neel@xb2:~ % traceroute 86.59.21.38 traceroute to 86.59.21.38 (86.59.21.38), 64 hops max, 40 byte packets 1 unknown (192.168.1.1) 1.128 ms 0.780 ms 0.613 ms 2 lo0-100.NYCMNY-VFTTP-401.verizon-gni.net (173.68.77.1) 1.001 ms 3.632 ms 0.900 ms 3 B3401.NYCMNY-LCR-22.verizon-gni.net (100.41.137.96) 2.291 ms B3401.NYCMNY-LCR-21.verizon-gni.net (100.41.137.94) 3.172 ms 4.046 ms 4 * * * 5 * * * 6 * * * 7 * * * 8 * * * 9 * * * ^C neel@xb2:~ % In a normal traceroute, you will see ALTER.NET at hop 5. Also, the subnet 86.59.21.0/24 is not filtered on UUNET. A traceroute to 86.59.21.1 works: neel@xb2:~ % traceroute 86.59.21.1 traceroute to 86.59.21.1 (86.59.21.1), 64 hops max, 40 byte packets 1 unknown (192.168.1.1) 0.863 ms 0.757 ms 0.579 ms 2 lo0-100.NYCMNY-VFTTP-401.verizon-gni.net (173.68.77.1) 1.010 ms 1.545 ms 1.034 ms 3 B3401.NYCMNY-LCR-22.verizon-gni.net (100.41.137.96) 3.616 ms B3401.NYCMNY-LCR-21.verizon-gni.net (100.41.137.94) 5.696 ms 10.062 ms 4 * * * 5 0.et-5-1-5.BR3.NYC4.ALTER.NET (140.222.2.127) 3.492 ms 3.506 ms 2.996 ms 6 204.255.168.118 (204.255.168.118) 8.462 ms 7.479 ms 7.252 ms 7 144.232.4.84 (144.232.4.84) 5.041 ms 4.688 ms sl-crs3-lon-0-6-3-0.sprintlink.net (144.232.9.165) 71.865 ms 8 sl-crs2-lon-0-0-3-0.sprintlink.net (213.206.128.181) 72.214 ms 73.579 ms 72.339 ms 9 213.206.129.142 (213.206.129.142) 81.390 ms sl-crs4-ams-0-7-0-3.sprintlink.net (213.206.129.139) 85.854 ms 93.238 ms 10 217.149.47.46 (217.149.47.46) 79.004 ms 85.669 ms 79.392 ms 11 ams5-core-1.bundle-ether1.tele2.net (130.244.82.54) 86.507 ms 78.374 ms 77.740 ms 12 ams-core-2.bundle-ether9.tele2.net (130.244.82.57) 79.642 ms 77.926 ms 81.515 ms 13 wen3-core-2.bundle-ether15.tele2.net (130.244.71.47) 105.400 ms 105.089 ms 109.751 ms 14 tele2at-bundle2-vie3.net.uta.at (212.152.189.65) 122.716 ms 110.820 ms 114.354 ms 15 86.59.21.1 (86.59.21.1) 106.389 ms * 105.379 ms neel@xb2:~ % I got in contact with Peter Palfrader and he says he couldn't help, and also with Verizon FiOS support and they said the filtering 'isn't on Verizon's network' (read: isn't on Verizon's internal FiOS network but still on Verizon's AS701 which I have to go to to get anywhere on the Internet here). I know that this IP could have been blackholed, and you may think that if Verizon is blocking it, then isn't Level 3 or Cogent? Well, Cogent doesn't block tor26: traceroute to 86.59.21.38 (86.59.21.38), 30 hops max, 60 byte packets 1 gi0-1-1-19.5.agr21.jfk02.atlas.cogentco.com (66.28.3.113) 0.727 ms 0.727 ms 2 be2605.ccr41.jfk02.atlas.cogentco.com (154.54.1.153) 2.177 ms be2606.ccr42.jfk02.atlas.cogentco.com (154.54.2.29) 0.734 ms 3 be2490.ccr42.lon13.atlas.cogentco.com (154.54.42.86) 68.557 ms be2317.ccr41.lon13.atlas.cogentco.com (154.54.30.186) 70.829 ms 4 be12488.ccr42.ams03.atlas.cogentco.com (130.117.51.42) 74.570 ms be12194.ccr41.ams03.atlas.cogentco.com (154.54.56.94) 76.767 ms 5 be2434.agr21.ams03.atlas.cogentco.com (130.117.2.241) 74.515 ms 74.612 ms 6 149.6.129.250 (149.6.129.250) 80.758 ms 74.625 ms 7 ams5-core-1.bundle-ether1.tele2.net (130.244.82.54) 75.421 ms 75.425 ms 8 ams-core-2.bundle-ether9.tele2.net (130.244.82.57) 74.516 ms 74.558 ms 9 wen3-core-2.bundle-ether15.tele2.net (130.244.71.47) 97.605 ms 95.470 ms 10 tele2at-bundle2-vie3.net.uta.at (212.152.189.65) 100.314 ms 97.947 ms 11 86.59.118.145 (86.59.118.145) 96.918 ms 98.620 ms 12 tor.noreply.org (86.59.21.38) 97.853 ms 98.110 ms (Source: http://www.cogentco.com/en/network/looking-glass) It could be possible that other Tier 1 networks formerly blocked tor26, and also unblocked, but Verizon was sloppy not to do so. It's also possible that Verizon could be doing it because the FCC repealed Net Neturality, and wants to discourage use of Tor to mine FiOS/VZW customers' browsing habits. But despite a NN repeal I can still access Tor on FiOS, and also run a relay (I do both) because other consensus relays are still unblocked. But if Verizon didn't unblock tor26, could it actually mean that Verizon wants to discourage Tor (and VPN/proxy) use to try to mine information of their customers (and sell ads/information) and direct users to VZ-owned AOL and Yahoo? Well, I hope they were just sloppy and don't mean to wage war on Tor. While I'm not saying you should avoid using anything Verizon at all costs (I certainly wouldn't want to go to the local cable company), I just want to point out a blocked consensus server. Thank You, Neel Chauhan === https://www.neelc.org/

8 13

Unable to confirm my ORPort is reachable
by Yash Kumar 24 May '18

24 May '18

Hi all, I have set up a tor relay on my Ubuntu machine by following the instructions given in the link <https://trac.torproject.org/projects/tor/wiki/TorRelayGuide>. To confirm whether the setup was done properly, I checked the status using the command: $ sudo service tor status and was getting status as "Active". Further, I looked into the log file /var/log/tor/notices.log using the command: $ tail -f /var/log/tor/notices.log and following was the output: May 24 18:24:54.000 [notice] Starting with guard context "default" May 24 18:24:54.000 [notice] Bootstrapped 80%: Connecting to the Tor network May 24 18:24:54.000 [notice] Signaled readiness to systemd May 24 18:24:55.000 [notice] Guessed our IP address as x.x.x.x (source: 204.13.164.118). May 24 18:24:55.000 [notice] Bootstrapped 85%: Finishing handshake with first hop May 24 18:24:56.000 [notice] Bootstrapped 90%: Establishing a Tor circuit May 24 18:24:59.000 [notice] Tor has successfully opened a circuit. Looks like client functionality is working. May 24 18:24:59.000 [notice] Bootstrapped 100%: Done May 24 18:24:59.000 [notice] Now checking whether ORPort x.x.x.x:9001 is reachable... (this may take up to 20 minutes -- look for log messages indicating success) May 24 18:44:55.000 [warn] Your server (x.x.x.x:9001) has not managed to confirm that its ORPort is reachable. Relays do not publish descriptors until their ORPort and DirPort are reachable. Please check your firewalls, ports, address, /etc/hosts file, etc. Can anyone please help me with this issue? I am not able to figure out the reason behind this error message "Your server (x.x.x.x:9001) has not managed to confirm that its ORPort is reachable". Please also let me know if you feel there is any issue with the tor configuration. Thank you, Yash Kumar

4 3

Re: [tor-relays] tor-relays Digest, Vol 88, Issue 41
by Yash Kumar 24 May '18

24 May '18

Hi Jonathan, Thank you for offering your support. Yes, you are absolutely right.The exact problem which I was facing was that, I wasn't able to find the "Self-testing" line in /var/log/syslog file. I followed the instructions as told by you and I'm mentioning their results as well below. 1. I executed the command: $ sudo systemctl status tor I got the following output: [image: tor status.jpg] 2. I checked whether there was an issue related to permissions for the command: $ cat /var/log/syslog I figured out that there wasn't any error running that command (although I'm not attaching the output of that command). I am still not getting that "Self-testing" line in /var/log/syslog, which is the problem I'm facing specifically. It would be of great help if you can think of any other possible issue because of which I am facing this problem. Thanks, Yash Kumar On Wed, 23 May 2018 at 17:30, <tor-relays-request(a)lists.torproject.org> wrote: > Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > > > Today's Topics: > > 1. Re: tor enters uninterruptible sleep forever when using > transparent proxy (Zack Weinberg) > 2. Setting up tor relay (Yash Kumar) > 3. Re: Setting up tor relay (Jonathan Marquardt) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 22 May 2018 20:25:33 -0400 > From: Zack Weinberg <zackw(a)cmu.edu> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] tor enters uninterruptible sleep forever > when using transparent proxy > Message-ID: > <CAKCAbMgwDwAsKLf3egHAprr=Up==jmpoEd= > a_Y1iP11WXJRPVg(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > On Tue, May 22, 2018 at 8:11 PM, Nicolás Dato <nicolas.dato(a)gmail.com> > wrote: > >> tor enters uninterruptible sleep forever when using transparent proxy > > > > For future references, the issue was the kernel version 4.4.118, > > upgraded and the problem was gone. > > A bit of Unix sysadmin lore that isn't as widely advertised as it once > was (because, thankfully, it comes up far less often than it used to): > there are only three reasons why a process would remain in an > uninterruptible sleep for more than a few milliseconds: an abnormally > slow storage peripheral (e.g. a tape drive being rewound, or a hard > drive that's about to fail), a network file server that isn't > responding to messages, or a kernel bug. > > zw > > > ------------------------------ > > Message: 2 > Date: Wed, 23 May 2018 10:48:10 +0530 > From: Yash Kumar <yashkr.99(a)gmail.com> > To: tor-relays(a)lists.torproject.org > Subject: [tor-relays] Setting up tor relay > Message-ID: > <CAGagdeCFKM=pw5+E5+YFn5Y9Fj3yOvq5N5R0= > C7N2kvBKLDWCQ(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Dear all, > I want to setup my machine as a tor relay. I am using Ubuntu 16.04 LTS on > a Intel i5 processor with 4 GB of memory. > I followed the instructions given on this link > <https://trac.torproject.org/projects/tor/wiki/TorRelayGuide>, but was > getting some issue. In one of the later steps, it says "Verify that your > relay works". This is done by checking my logfile(syslog) contains the > following text: > > "Self-testing indicates your ORPort is reachable from the outside. > Excellent. Publishing server descriptor." > > I checked the syslog by the command: > > $ cat /var/log/syslog > > > To bring it to your knowledge, I have followed all the previous steps > mentioned on that link > <https://trac.torproject.org/projects/tor/wiki/TorRelayGuide>, and was > successfully able to execute all the commands. I would request you to > please help me out in setting up my machine as a relay to make tor network > faster and more usable. > > Thank you, > Yash Kumar >

1 0

Re: [tor-relays] can dirport be disabled on fallback directory?
by teor 23 May '18

23 May '18

Hi, I didn't get your original email, it appears my spam filter is eating all your emails. (And a few other emails.) At 12:25 5/18/2018 -0400, starlight.2017q4 at binnacle.cx wrote: >Lately seeing escalating abuse traffic on the relay dirport, now up to 20k rotating source IP addresses per week. > >The simple solution is to disable dirport, but the relay is a fallback directory and I don't want to make a change that will negatively affect the relay's ability to function as such. Would >disabling dirport be a problem? All supported Tor clients use the ORPort. They won't notice if you remove the DirPort. >also: > >can a non-advertised dirport be left configured for local-system use while the public advertised dirport is disabled? This config doesn't work, and that's a bug: https://trac.torproject.org/projects/tor/ticket/26136 >does a command utility or method exist for querying dirport documents via tunnelled-dir-server? including miscellanous documents such as > >/tor/status-vote/current/consensus.z … Stem master supports ORPort endpoints in stem.descriptor.remote.Query requests: https://stem.torproject.org/change_log.html There might not be convenience functions for some of the document types you listed, so you'll need to pass their paths in the resource argument. You might also want to avoid compression locally by dropping the ".z". There don't seem to be any examples of ORPort endpoints in the Stem repository. I think Dave plans to add some more documentation as part of Tor Summer of Privacy. T

2 2

Setting up tor relay
by Yash Kumar 23 May '18

23 May '18

Dear all, I want to setup my machine as a tor relay. I am using Ubuntu 16.04 LTS on a Intel i5 processor with 4 GB of memory. I followed the instructions given on this link <https://trac.torproject.org/projects/tor/wiki/TorRelayGuide>, but was getting some issue. In one of the later steps, it says "Verify that your relay works". This is done by checking my logfile(syslog) contains the following text: "Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor." I checked the syslog by the command: $ cat /var/log/syslog To bring it to your knowledge, I have followed all the previous steps mentioned on that link <https://trac.torproject.org/projects/tor/wiki/TorRelayGuide>, and was successfully able to execute all the commands. I would request you to please help me out in setting up my machine as a relay to make tor network faster and more usable. Thank you, Yash Kumar

2 1

tor enters uninterruptible sleep forever when using transparent proxy
by Nicolás Dato 22 May '18

22 May '18

Hello there, First thanks for reading! I've been running a tor relay for almost two weeks from my home. Yesterday,* I did some upgrades to my Slackware 14.2 including glibc and kernel*. I run tor there and it worked fine. After upgrading Slackware I had to reboot and run windows for the night. Windows messes with the machine time. Today, *I rebooted and run Slackware and (as usual after running windows) *the clock was -3 hours apart. I do run NTP but looks like it doesn't make the adjustment if the difference is way too big. I adjusted the time and run the NTP service again. *Tor daemon launches at startup* so it was running when my clock was -3 hours from present time. I use irssi (IRC client) connecting to the tor transparent proxy using iptables. As usual, I runned irssi and tried to connect to a server but the connection hangs forever and tor hangs forever too, hanging the relay too. I tried a different server but hangs too. *Before trying to connect with irssi, this works:* The tor relay works fine and accepts connections and delivers traffic. I can run nyx and it connects fine and shows me the stats. I can connect to the socks proxy and it works and doesn't hangs tor daemon. After trying to connect with irsse, *all of that stop working.* I didn't changed any tor configuration neither the iptables configuration I did build the tor packages (recompiling it) and installed it, but didn't work I removed some files and folders from /var/log/tor, only removed the ones modified yesterday and today, but it didn't work neither. tor is reported by ps to be on uninterruptible sleep 1347 ? Dl 0:06 11 0 491216 87432 2.2 /usr/bin/tor and there is no way to kill it other than rebooting, neither kill -9 as root works after all the reboots, after removing some /var/lib/tor files, and having the machine clock on time, tor still hangs when using the transparent proxy this are the last lines from the debug log: https://paste.debian.net/plain/1025878 (that's from the time I tried to connect to freenode and it hanged, no more logs after that) this is my iptables: http://paste.debian.net/plainh/c949bc2a (irssi runs as ircuser) this is my torrc: http://paste.debian.net/plain/1025881 (I didn't copy some lines) Thanks again for reading.

2 3

VPNGate Project Exit Node Volunteers / I2P
by grarpamp 22 May '18

22 May '18

http://www.vpngate.net/ For those relay operators who may have extra non tor listed IP addresses and want to help a related projects / userbase. https://geti2p.net/ I2P also has an exit proxy function. " VPNGate: Free Access to World Knowledge Beyond Government's Firewall. VPN Gate Academic Experiment Project is an online service as an academic research at Graduate School of University of Tsukuba, Japan. The purpose of this research is to expand the knowledge of "Global Distributed Public VPN Relay Servers" . You can take these advantages by using VPN Gate: You can get through the government's firewall to browse restricted web sites (e.g. YouTube). You can disguise your IP address to hide your identity while surfing the Internet. You can protect yourself by utilizing its strong encryption while using public Wi-Fi. Unlike traditional VPN services, VPN Gate can get through most firewalls. VPN Gate is free of charge. Not a single registration is required " " I2P I2P is an anonymous overlay network - a network within a network. It is intended to protect communication from dragnet surveillance and monitoring by third parties such as ISPs. "

3 5

Running a bridge remotely
by Keifer Bly 21 May '18

21 May '18

Hello, I have been running my home computer as a public tor relay for some time now with no issues, and unfortunately do not have a data center or anywhere else to run my relay from. I have noticed that there are far fewer bridges (about 2,000) then there are relays (about 7,000). As I have been running my home computer as a relay since last year, my ip address has already been in the tor network for a while, and thus will already be known as a relay to begin with. Is there a free way that I could remotely run an obfuscated bridge as well? I would need a way to do this remotely as I said my only available network ip has been on the public tor network for a considerable while.

3 2

DirPort DOS activity against Fallback Directories
by starlight.2017q4＠binnacle.cx 21 May '18

21 May '18

Recently I noticed excessive DirPort requests to my relay, where DirPort bandwidth reached 15% of ORPort bandwidth. Normal DirPort load is around 2%. https://lists.torproject.org/pipermail/tor-relays/2018-May/015253.html Just looked over a sample of FallBackDir relays in Relay Search and it appears this excess-load abuse is directed at them in particular. Some fall-back directories show more than a month of excess request traffic, presumably on the DirPort. Logs here indicate six weeks of abuse escalating in increments. Possibly this foreshadows a major increase in an effort to impair FallBackDir relay functionality. Either an iptables connection-rate limit or disabling DirPort resolves the problem.

3 3

Nyx and Arm
by gerard＠bulger.co.uk 21 May '18

21 May '18

Arm says I have 3506 outbound 354 exit Nyx has long blue list but states 50 outbound. No mention of exits. What am I doing wrong with Nyx? Gerry

2 2

Re: [tor-relays] can dirport be disabled on fallback directory?
by starlight.2017q4＠binnacle.cx 20 May '18

20 May '18

On May 20, 2018 17:37:07 UTC, Damian Johnson atagar at torproject.org wrote: > >> There don't seem to be any examples of ORPort endpoints in the Stem >> repository. I think Dave plans to add some more documentation as part of Tor >> Summer of Privacy. > >Oh interesting. You're right. I recently added Stem's ORPort >capabilities but seems I forgot to add usage examples in the docs. >Thanks for pointing that out, I'll add it to my todo list. In the >meantime I provided an example here... > >https://blog.atagar.com/april2018/ Thank you! Does a command-line utility to make such requests exist or can one be created? The availability of a command tool for ORPort document downloads would bring DirPort one step closer to complete obsolesce.

1 0

Re: [tor-relays] can dirport be disabled on fallback directory?
by starlight.2017q4＠binnacle.cx 20 May '18

20 May '18

On May 20, 2018 10:08:17 UTC, gustavo <gfa(a)zumbi.xyz> wrote: > >On May 18, 2018 4:25:23 PM UTC, starlight.2017q4 at binnacle.cx wrote: >>Lately seeing escalating abuse traffic on the relay dirport, now up to >>20k rotating source IP addresses per week. > >How do you detect it? FIRST: your relays are not impacted by this issue because DirPort is disabled in their configuration. So you can stop reading here if you like. >Will tor log it in the logs where I can look for >it or do you monitor the TCP/IP stack ? > >I run two relays (milanese one of them) besides basic >OS level monitoring I don't monitor much else. > >I wonder if I should monitor more or what to search for >in logs (I run my relays without logs since I don't >have an use for) Simply perusing the /var/log/messages log lines for the relay on occasion should be sufficient for most operators. The daemon will complain about many if not all important problems. ---------- For those with DirPort configured, one can check for the problem by looking at the 'state' file with the command egrep '^BWHistory.*WriteValues' state and calculating the percent BWHistoryDirWriteValues is relative to BWHistoryWriteValues for the same samples. Should be under 5%, more like 1-3%. If 15% the attacker is harassing your relay. This particular abuse scenario can be mitigated by applying an 'iptables -m limit' rule set to incoming DirPort connection requests -or- by disabling DirPort in the config since clear-text DirPort is no longer required for the Tor network to function properly. Those running FallBack directories should probably send an update to this list if they apply this change as I belive the FallBackDir script excludes relays where ports differ from the whitelist or have changed in OnionOO historical data.

1 0

can dirport be disabled on fallback directory?
by starlight.2017q4＠binnacle.cx 20 May '18

20 May '18

Lately seeing escalating abuse traffic on the relay dirport, now up to 20k rotating source IP addresses per week. The simple solution is to disable dirport, but the relay is a fallback directory and I don't want to make a change that will negatively affect the relay's ability to function as such. Would disabling dirport be a problem? also: can a non-advertised dirport be left configured for local-system use while the public advertised dirport is disabled? does a command utility or method exist for querying dirport documents via tunnelled-dir-server? including miscellanous documents such as /tor/status-vote/current/consensus.z /tor/keys/all.z /tor/server/all.z /tor/extra/all.z /tor/server/fp/<fp1>+<fp2>+<fp3>.z /tor/extra/fp/<fp1>+<fp2>+<fp3>.z /tor/micro/d/<hash1>-<hash2>.z /tor/keys/fp/<v3ident1>+<v3ident2>.z thanks!

3 3

Help! I'm ripping my hair out trying to get Quintex on IPv6 exit
by John Ricketts 18 May '18

18 May '18

All, I've been trying to bring a relay up for testing IPv6. Relay name is QuintexAirVPN1. Metrics website says that the OR Port is unreachable on [2620:7:6000::ffff:c759:df51]:80 - which isn't where I set the ORPort - should be 443... https://metrics.torproject.org/rs.html#details/F7447E99EB5CBD4D5EB913EE0E35… Config is as follows: ORPort 443 ORPort [2620:7:6000::ffff:c759:df51]:443 Nickname QuintexAirVPN1 ContactInfo John L. Ricketts, PhD <john AT quintex dot com> DirPort 80 # what port to advertise for directory connections DirPortFrontPage /etc/tor/tor-exit-notice.html DisableDebuggerAttachment 0 Sandbox 1 ExitRelay 1 IPv6Exit 1 ExitPolicy accept *:* ExitPolicy accept6 *:* NumCPUs 2 Help!! LOL John L. Ricketts, PhD Quintex Alliance Consulting (325) 262-3488 john(a)quintex.com

2 2

Relay advocate introduction
by Colin Childs 18 May '18

18 May '18

Hello tor-relays! My name is Colin Childs, I have been the support and translation coordinator at the Tor Project for a number of years. I am also a founding director of a TorServers partner named Coldhak here in Canada. Recently, my role within the Tor Project has changed, and I am starting as the new relay advocate (as well as localization coordinator, until this responsibility can be reassigned). My job will be improving the health / happiness of the relay operator community, expanding the relay operator community, and helping improve the community bonds between operators. A few of the things I will be working on are: 1. Open a #tor-relays IRC channel (this is now open, everyone should join!) 2. Reach out to realy operator groups / individuals to introduce myself and solicit feedback (beginning today) 3. Plan a relay operators meet-up at PETS in July (details to come in another email) 4. Form a team of trusted technical and legal volunteers able to help operators around the world. 5. Organizing a larger "relay operator summit" event 6. Working with operators to resolve some of the recent issues brought up on this list (DNS provider, DNSSEC, EOL releases, etc..) While reaching out to operators is point 2 in that list, if you have suggestions or feedback that you'd like to send, please do not hesitate to reach out to me! I would love to hear from all of you with the things you would find most helpful from me / the Tor Project. While I cannot guarantee we can facilitate every request, we will do our best to help! I look forward to working with all of you in the future, and I hope you're having a great week!

9 11

Bridge to Relay Balance Notice
by Keifer Bly 18 May '18

18 May '18

Hello List, There are some things I have noticed, I have been getting emails from this list regarding people setting up groups of new relays. I have also noticed that according to https://metrics.torproject.org/networksize.html, there are around 6-7 thousand public relays running in the network, and only about 1,500 to 2,000 bridge relays running (I’m guessing a fair number of which aren’t even obfuscated). Seeing as there is only roughly ¼ the number or bridges available as there are public tor relays, I think that it would be a good idea for new people running groups of relays to run one of their new relays as a bridge, especially with censorship growing in some countries such as the United Kingdom and even I’ve heard some US isps starting to block websites. Please let me know what you all think, thank you.

2 1

Re: [tor-relays] Unusual load returning?
by starlight.2017q4＠binnacle.cx 18 May '18

18 May '18

At 19:25 5/15/2018 +0000, r1610091651 <r1610091651(a)telenet.be> wrote: >I've noticed unusual load on the relay. Notice the huge change in load >between 3-8 am (CET). ... >Wondering if others experienced it recently? One here. Perhaps isolated probes? May 18 11:23 Tor[]: Circuit ... : 10279/10279 TAP, 296594/296595 NTor. May 18 17:23 Tor[]: Heartbeat: uptime is 68 days ... May 18 17:23 Tor[]: Circuit ... : 654119/660742 TAP, 318906/318907 NTor.

1 0

Obfs4 Bridge Advertised Bandwidth
by nottryingtobelame＠protonmail.com 18 May '18

18 May '18

Hello, I am running a bridge and I have my RelayBandwidthRate set to 1024 KB (8 Mbps). However, the Relay Search page never shows the full Advertised Bandwidth. Right now it is showing 259 KiB/s. Sometimes it creeps higher but not by much. Just wondering what the reason for that big of a difference would be. Thanks!

2 1

FallbackDir maintenance
by Nurtic-Vibe 18 May '18

18 May '18

Due to a disk outtage, the FallbackDir 8C00FA7369A7A308F6A137600F0FA07990D9D451 is currently offline. I will keep you posted with updates. Cheers, Nurtic-Vibe

1 1

lets stop using central big DNS resolvers (Google, Level3, OpenDNS, Quad9, Cloudflare)
by nusenu 18 May '18

18 May '18

Dear Exit Relay Operators, I'd like to invite you to check your exit's DNS resolver by having a look at the following list of exits using resolvers outside their AS (especially if it is Google, OpenDNS, Quad9 or Cloudflare). You can search the list for you contactinfo, relay nickname or relay fingerprint (first 8 characters): https://gist.github.com/nusenu/cb766ff7945fafd9f90ee7f211a2508f#file-tor-dn… I extended the "DNS on Exit Relays" section in the Tor Relay Guide to include specific instructions what is recommended for Tor exit operators with regards to DNS on exit relays. https://trac.torproject.org/projects/tor/wiki/TorRelayGuide#DNSonExitRelays If you found yourself on the list above and changed your DNS to a local (same host or same AS) resolver or found a false-positive, please drop me an email (off-list is also ok). The goal is to be bellow the following thresholds within one year: - not have any single remoteAS entity control more than 10% exit capacity - reduce the overall remoteAS share to bellow 20% exit capacity the longer version of this can be found at: https://medium.com/@nusenu/who-controls-tors-dns-traffic-a74a7632e8ca thanks for helping with DNS decentralization on the tor network, nusenu -- https://mastodon.social/@nusenu twitter: @nusenu_

14 24

The Onion Box v4.2: Web Interface to monitor your Tor node(s)
by Ralph Wetzel 18 May '18

18 May '18

2 2

New upcoming requirement for relays related to Ed25519 support
by nusenu 17 May '18

17 May '18

Dear tor relay operators, we want to inform you that in future*, tor directory authorities will enforce a new security measurement that disallows relays to drop Ed25519 support in case they ever supported it at some point. In practice that means that if you run tor 0.2.7.2-alpha or later you can not downgrade to an older tor version without Ed25519 support anymore. Tor directory authorities will reject such relays in the future. You are safe if you do _not_ downgrade from any tor version >= 0.2.7.2-alpha to a version older than that. We will send a second email to this list once we are near the actual enforcement of this new requirement (which will not be to soon from now). kind regards, nusenu * This will come into effect when the majority of tor directory authorities are on tor 0.3.4.x ticket: https://trac.torproject.org/projects/tor/ticket/20522 -- https://mastodon.social/@nusenu twitter: @nusenu_

2 2

gratitude
by charlie 15 May '18

15 May '18

i just wanted to put this out there. i greatly appreciate what you guys do with the tor network. it's an awesome thing and i know you guys go through a lot to run it and it's appreciated beyond words. i use the tor network all the time now, especially since i live in america and privacy and net neutrality are not regarded as being important and i feel safe only using the tor network. so thank you! maybe one of these days i can contribute to it with my own relay, node, bridge, anything. keep up the good work. you're the warriors of a free and open internet. charlie

3 2

Unusual load returning?
by r1610091651 15 May '18

15 May '18

Hi I've noticed unusual load on the relay. Notice the huge change in load between 3-8 am (CET). Unusual logs: May 14 03:49:44.000 [notice] Circuit handshake stats since last time: 5592/5592 TAP, 40516/40516 NTor. May 14 09:49:44.000 [notice] Circuit handshake stats since last time: 5864/5864 TAP, 58290/58290 NTor. May 14 15:49:44.000 [notice] Circuit handshake stats since last time: 35313/35313 TAP, 72399/72399 NTor. May 14 21:49:44.000 [notice] Circuit handshake stats since last time: 98315/98315 TAP, 77724/77724 NTor. May 15 03:49:44.000 [notice] Circuit handshake stats since last time: *420868*/423426 TAP, 89627/89627 NTor. May 15 09:49:44.000 [notice] Circuit handshake stats since last time: *1362584*/1364077 TAP, 81196/81197 NTor. May 15 15:49:44.000 [notice] Circuit handshake stats since last time: 5488/5488 TAP, 78317/78317 NTor. For info: middle relay (no exit/guard), no directory, running 3.2.10 [image: image.png] Wondering if others experienced it recently? Regards Seb

1 0

[France] Invitation to HACKarnaval, May 17th
by gus 14 May '18

14 May '18

Hello Tor operators from France! Next thursday, May 17th, some Tor Project contributors are going to be at HACKarnaval, in Paris. Come to say 'bonjour' and meet new friends! :) cheers!, gus * * * * HACKarnaval + Tor Meetup - 17 mai au Musée des Arts et Métiers [HACKarnaval!] est un événement ouvert au publique pour célébrer le “hacking” comme une forme de partage des connaissances. Des techniciens, des chercheurs, des artistes et des bricoleurs de tous les coins du monde proposeront des ateliers, des conférences et des expositions. Rejoignez-nous le jeudi 17 mai au Musée des Arts et Métiers, de 11:00 à 21 heures. Venez explorer les mondes socio-techniques du logiciel, de l'électronique ou du wetware, et discuter des changements qu’ils promettent! https://hackarnaval.online Rencontre Tor https://hackarnaval.online/abstracts-fr/tor-meetup.html Musée des Arts et Métiers 60 rue Réaumur, 75003 Paris Métro : Arts et métiers - Entrée libre ! -- PGP: 427F 2D71 7664 D215 378C B412 8BDC 87FB 7215 E189 XMPP/OTR: 62f58f8062da3e48e0aa076f20807ecb1488658e https://gus.computer/

1 0

Strange BGP activity with my node
by Trevor Ellermann 14 May '18

14 May '18

Hi, I just a notification from my data center that someone is trying to hijack the IP of my exit node. Seems like the sort of thing someone might do when trying to attack Tor. I'm in a very remote area with limited access but any suggestions on actions I should take? ==================================================================== Possible Prefix Hijack (Code: 10) ==================================================================== Your prefix: 204.17.32.0/19: Prefix Description: GBLX-US-BGP Update time: 2018-05-09 12:11 (UTC) Detected by #peers: 1 Detected prefix: 204.17.56.42/32 Announced by: AS200005 (Asavie Technologies Limited) Upstream AS: AS200005 (Asavie Technologies Limited) ASpath: 200005 https://torstatus.blutmagie.de/router_detail.php?FP=383d6e34d9bea92e97092b1… Thanks, --Trevor

5 6

Tor Relay Bandwidth Question
by Keifer Bly 14 May '18

14 May '18

Hello, So I have been away from the computer where my relay is running off of for a few days. I have been wanting to check how much data my relay has been receiving during this time. I check it at http://torstatus.blutmagie.de/router_detail.php?FP=db1af6477bb276b6ea5e7213…, but that only shows how many “bytes” have been sent. I am wondering, is there a way to show this in megabytes / gigabytes? Thank you very much.

3 2

Problem with MyFamily config (doesn't work correctly)
by Olaf Grimm 13 May '18

13 May '18

Dear Tor controllers, For some time now I have relays in different locations and with different systems. All relays have the same torrc, except nickname. The following list shows the excerpt from metrics.torproject.org. Hydra1 (5) Hydra2 (5) Hydra5 (6) Hydra3 (2) Hydra4 (5) Hydra (5) Some time ago I checked all the torrc exactly, if the MyFamily config is correct. All relays have been restarted. Again today. I expect that the number in brackets is equal for all relays in the group. Part of my torrc: (the same for all relays (exerpt nickname), including the own fingerprint) # Hydra MyFamily $E9A31E7EFF7A062AA67DA601CC70605AACF9F385 # Hydra1 MyFamily $0647C3F8352BBFA0D57A1C3E0DCF67FC3E073D2C # Hydra2 MyFamily $B16D271047B18D29F62AE9F3CFC7094258506A03 # Hydra3 MyFamily $A766BF5C5AF7F897D81BD98797B17B1E8C014650 # Hydra4 MyFamily $2D919C1E0DFA4D7760471F971C2CA96E383AEBE0 # Hydra5 MyFamily $3E76E15E6BE6CFF409D44CCC40281AB5BB0B61C2 In the Tor Manual I've found "MyFamily fingerprint,fingerprint,… This option can be repeated many times, for convenience in defining large families: all fingerprints in all MyFamily lines are merged into one list. " With fewer relays in the past I had the variant "MyFamily $KeyID_1,$KeyID_2,$KeyID_3,...". Now this line is longer than the screen is wide. That's why I changed the spelling according the dokumentation. Why does it seem to work in one place while misrepresenting other configs? The correctly displayed one was added last week. Do I interpret the documentation incorrectly that this spelling is possible? How long is the update cycle of the metrics? I think one hour. Nothing happened for days. Now the metrics registered the restart of the relays 1:45h before, but still with the wrong MyFamily ad. Hydra1 (5) 1h 47m Hydra2 (5) 1h 44m Hydra5 (6) 1h 36m Hydra3 (2) 1h 40m Hydra4 (5) 1h 37m Hydra (5) 1h 51m Olaf

2 1

Change Tor's security settings
by dave` dave 13 May '18

13 May '18

There is a way to cancel/change Tor's security settings(which means that i can't use same ip for two parts of the circuit-Guard/Bridge or Middle or Exit) and set him to use the same ip for all his circuit(Guard, middle and exit). and or instead of doing that can i set a specific Middle-Relay?

2 2

what ip,port combinations do Tor clients need?
by Martin Kepplinger 12 May '18

12 May '18

Hi, How does a usable ipset (hash:ip,port) look like, so that it is a whitelist for in/out tcp connections? *Everything* else from/to the outside world is assumed to be dropped. (DNS too). * dir auths from src/or/auth_dirs.inc * fallback dirs from scripts/maint/fallback.whitelist * current guard relays (parsed from a consensus file) anything else? Bonus question: how would you write this whitelist in iptables rules, assuming you have the complete ipset? thanks martin

2 3

PSA regarding Quad9 DNS Resolver
by Nathaniel Suchy (Lunorian) 11 May '18

11 May '18

Like OpenDNS, Quad9 is a censoring DNS resolver and exits using it are / should be considered bad exits. I haven’t seen any exits using it yet however I thought I’d bring it up. Thoughts? Cheers, Nathaniel Sent from my iPhone

4 4

Re: [tor-relays] tor-relays Digest, Vol 88, Issue 13
by flipchan 11 May '18

11 May '18

Great thread! I just use the recommended onces that support dnssec On May 11, 2018 11:55:39 AM UTC, tor-relays-request(a)lists.torproject.org wrote: >Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > >To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > >You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of tor-relays digest..." > > >Today's Topics: > > 1. lets stop using central big DNS resolvers (Google, Level3, > OpenDNS, Quad9, Cloudflare) (nusenu) > 2. Re: lets stop using central big DNS resolvers (Google, > Level3, OpenDNS, Quad9, Cloudflare) (Tyler Durden) > 3. Re: lets stop using central big DNS resolvers (Google, > Level3, OpenDNS, Quad9, Cloudflare) (nusenu) > 4. PSA regarding Quad9 DNS Resolver (Nathaniel Suchy (Lunorian)) > 5. Re: Strange BGP activity with my node (Johan Nilsson) > 6. Re: lets stop using central big DNS resolvers (Google, > Level3, OpenDNS, Quad9, Cloudflare) (Nathaniel Suchy (Lunorian)) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Thu, 10 May 2018 22:16:00 +0000 >From: nusenu <nusenu-lists(a)riseup.net> >To: tor-relays(a)lists.torproject.org >Subject: [tor-relays] lets stop using central big DNS resolvers > (Google, Level3, OpenDNS, Quad9, Cloudflare) >Message-ID: <5e7d99ef-9514-cee4-985f-7f1d4a21dfec(a)riseup.net> >Content-Type: text/plain; charset="utf-8" > >Dear Exit Relay Operators, > >I'd like to invite you to check your exit's DNS resolver by >having a look at the following list of exits using resolvers >outside their AS (especially if it is Google, OpenDNS, Quad9 or >Cloudflare). > >You can search the list for you contactinfo, relay nickname or relay >fingerprint (first 8 characters): > >https://gist.github.com/nusenu/cb766ff7945fafd9f90ee7f211a2508f#file-tor-dn… > > >I extended the "DNS on Exit Relays" section in the Tor Relay Guide >to include specific instructions what is recommended for Tor exit >operators with >regards to DNS on exit relays. > >https://trac.torproject.org/projects/tor/wiki/TorRelayGuide#DNSonExitRelays > >If you found yourself on the list above and changed your DNS to a local >(same host or same AS) >resolver or found a false-positive, please drop me an email (off-list >is also ok). > > >The goal is to be bellow the following thresholds within one year: >- not have any single remoteAS entity control more than 10% exit >capacity >- reduce the overall remoteAS share to bellow 20% exit capacity > >the longer version of this can be found at: >https://medium.com/@nusenu/who-controls-tors-dns-traffic-a74a7632e8ca > >thanks for helping with DNS decentralization on the tor network, >nusenu > >-- >https://mastodon.social/@nusenu >twitter: @nusenu_ > >

1 0

TOR Relay Activity Reset
by Keifer Bly 09 May '18

09 May '18

Hello, for some reason the read/write status of my relay at http://torstatus.blutmagie.de/router_detail.php?FP=db1af6477bb276b6ea5e7213… has been reset to nothing (all flat lines) however the relay is still marked as “running” with it’s current uptime of 11 days 20 hours. I’d also like to note that my relay usually only takes 8 days to get stable flag, however it’s been up for almost 12 days now and that still hasn’t happened. Why might this have happened? Thank you.

2 2

Secret Google and Microsoft Blacklists affecting non tor IPs if on same server.
by gerard＠bulger.co.uk 08 May '18

08 May '18

Secret Google and Microsoft Blacklists affecting non tor IPs if on same server. Just had to shut down my exit temporally while Google sorts out their secret blacklisting system on my innocent non-tor IP. My server has two IPs, not consecutive. One I use for my own email server and public web server, locked tight and private. No relays, no proxy. This IP is not on any blacklist. Second IP is used for TOR alone and forced exit is via this second IP, and only has TOR-use ports open. This IP is not on any blacklist other than being listed as a tor exit. Torrc config has careful port selection, not port 80 except to a single /8 block. 443 open etc. Despite many other ports open, apart from the obvious at risk ones which are blocked, I have had no abuse notices over last year it has been up. Quiet ISP. ISP have no idea as to why Google blocked my IP (despite high traffic from second IP!). Alas it seems that both Google now and Microsoft before tar both IPs with the same brush and reject. Google just stared blocking emails from my domain to all gmail accounts It is a real performance finding out who to contact to undo this block. Microsoft was a pain last year, but this year is it is Google. Google’s own postmaster tools reports no issues about my domain! Alas: Mailog: May 8 20:17:16 server postfix/smtp[4079]: E36533E07F4: host gmail-smtp-in.l.google.com[64.233.166.26] said: 421-4.7.0 [109.228.50.196 15] Our system has detected an unusual rate of 421 -4.7.0 unsolicited mail originating from your IP address. To protect our 421-4.7.0 users from spam, mail sent from your IP address has been temporarily 421-4.7.0 rate limited. Please visit 4 21-4.7.0 https://support.google.com/mail/?p=UnsolicitedRateLimitError to 421 4.7.0 review our Bulk Email Senders Guidelines. o31-v6si13678468wrc.44 - gsmtp (in reply to end of DATA command) Really annoying that my email server IP has never sent anything, no relay, no spam, almost no traffic so what is stated is not true and even their own tools reports nothing. Is Google looking at MAC addresses to do this? How can we stop it? I really do not want to run another server just for tor as that costs! Gerry

3 4

"NoAdvertise" needed for IPv6 DirPort ?
by Toralf Förster 05 May '18

05 May '18

When I started with IPv6 I put this into my torrc: Nickname zwiebeltoralf DirPort 80 ORPort 443 DirPort [2a01:4f8:190:514a::2]:80 NoAdvertise ORPort [2a01:4f8:190:514a::2]:443 Now I do wonder why I needed to add "NoAdvertise§ to the IPv6 port. Any hints? -- Toralf PGP C4EACDDE 0076E94E

3 3

rendezvous on non-OR circuit
by gerard＠bulger.co.uk 05 May '18

05 May '18

What does this error message mean? Is it serious for users and what do I do about it? “ 09:57:16 [WARN] Tried to establish rendezvous on non-OR circuit with purpose Acting as rendevous (pending)” This is on a Ubuntu VPS Tor exit, although exit is limited range IP4 port 80 addresses. Full 443 and others. Exit, Fast, HSDir, Running, Stable, V2Dir, Valid Gerry

2 1

Removal request from fallback directory mirrors list
by Dmitrii Tcvetkov 04 May '18

04 May '18

Hello, Because of latest Digital Ocean billing changes I request to remove relay 774555642FDC1E1D4FDF2E0C31B7CA9501C5C9C7 from fallback directory mirrors list. I will keep it online and updated, but in the long run (year or two) I plan to shutdown it. Thank you all.

2 1

Request for removal of an exit from the consensus
by Nathaniel Suchy (Lunorian) 04 May '18

04 May '18

This is more of a message to the directory authorities. After a discussion with Digitalocean - they will not relent on the bandwidth policy. The server tor-exit-us-1.lunorian.is (Tor Metrics link below) has been turned off for now - if the directory authorities would like further proof to confirm my request please email me. At the end of the month the SSD of the exit will be erased from Digitalocean's systems. I would hate for this exit to gain guard status and then be suddenly removed as it'd negatively impact Tor users. Effected exit: http://rougmnvswfsmd4dq.onion/rs.html#details/DF2E0ABE681206DD886E29D5190F1… Cheers, Nathaniel

2 1

dew questions about Tor-relay
by dave` dave 03 May '18

03 May '18

what is SocksPort, Controlsocket and Exitpolicy and Exitpolicy reject ip address or :*: is in my "torrc" file. can i set in my "torrc" file what ip i dont want/want to connect me?

5 4