- tor-relays - lists.torproject.org

No exit at home !!!
by for this post anon 03 Mar '18

03 Mar '18

Roger say it right: No exit relay at home! I write this mail in anon because I had bad experience with that. I had the experience to get visitors early in the morning from the police department some months ago. After that I must by new computers... Use ISP's only for exits. Or you want "fun". xyz

3 2

Port not rechable
by peter.zehetner＠liwest.at 02 Mar '18

02 Mar '18

Hi, I'm still trying to run a tor delay. Here's the error: Your server (81.10.248.112:80) has not managed to confirm that its DirPort is reachable. Relays do not publish descriptors until their ORPort and DirPort are reachable. But canyouseeme.org said: Your ISP is not blocking port 80 Whats's wrong? Thanks Peter

6 6

Port not rechable
by peter.zehetner＠liwest.at 02 Mar '18

02 Mar '18

OK, now I've set PortForwarding in Tor-Arm from "False" to "True", then restarted Tor: ...has not managed to confirm that its DirPort is reachable. Relays do not publish descriptors until their ORPort and DirPort are reachable. Please check... I'm going to run a non-exit-relay and I'm going to do this at home. Peter Am 02.03.2018 um 20:42 schrieb Matthew Finkel: > On Fri, Mar 02, 2018 at 08:27:29PM +0100, peter.zehetner(a)liwest.at wrote: >> Hi, I'm still trying to run a tor delay. Here's the error: >> > > Thank you for running a relay. > >> Your server (81.10.248.112:80) has not managed to confirm that its DirPort is reachable. Relays do not publish descriptors until their ORPort and DirPort are reachable. > > I do not see port 80 open, either: > > $ torsocks nc -v 81.10.248.112 80 > Ncat: Version 7.40 ( https://nmap.org/ncat ) > Ncat: Connection timed out. > >> >> But canyouseeme.org said: Your ISP is not blocking port 80 > > Maybe "not blocking" does not mean "is open". > > Are you running this relay at your home? If yes, then that is not > recommended, but you may need to allow port 80 on your firewall/router. > You may need to use port forwarding or add your computer into the DMZ > (if your router supports this). > > If you're not running this relay from home, is the server directly > connected to the Internet or is there a router/switch/blackbox in the > middle? > >> >> Whats's wrong? >> >> Thanks >> >> Peter > >> _______________________________________________ >> tor-relays mailing list >> tor-relays(a)lists.torproject.org >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

2 1

Port not rechable
by peter.zehetner＠liwest.at 02 Mar '18

02 Mar '18

There is no firewall installed. Peter Have you double-checked your firewall? -Cody On 03/02/2018 11:27 AM, peter.zehetner(a)liwest.at mailto:peter.zehetner@liwest.at wrote: > > Hi, I'm still trying to run a tor delay. Here's the error: > > Your server (81.10.248.112:80) has not managed to confirm that its DirPort is reachable. Relays do not publish descriptors until their ORPort and DirPort are reachable. > > But canyouseeme.org said: Your ISP is not blocking port 80 > > Whats's wrong? > > Thanks > > Peter > > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org mailto:tor-relays@lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org mailto:tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

2 1

Upcoming security releases for Tor 0.2.9 and up.
by Nick Mathewson 01 Mar '18

01 Mar '18

Hi! This coming week, we'll be putting out new stable releases for 0.2.9 and later supported branches to fix a few security bugs. The highest-severity bug to be fixed is severity "medium". (See https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/Securit… for information about how we rank security issues.) These releases will also backport the anti-DoS features from Tor 0.3.3. Relays and authorities should be sure to upgrade once packages are available; these issues are not high-priority for clients. best wishes, -- Nick

4 5

Unmeasured Flag
by Matthew Glennon 28 Feb '18

28 Feb '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 So if I'm understanding this correctly, we're still having problems with a bw testing nodes and that is why my relay has the unmetered flag? -----BEGIN PGP SIGNATURE----- Version: Keybase OpenPGP v2.0.76 Comment: https://keybase.io/crypto wsBcBAABCgAGBQJalsdlAAoJEHIAmlM/NGGbpQcH/16WQLlMAAVzx4blIRV2bIJF Hwdyj4FFQ+Ms0hHhj1DwMkB6EMa11kogLA8k+NGim8QeF2Qyobd1lARUXjZdfbV5 s/L6JYYCO+PsJxJY2+nOU41HUps1w5zLfFy+ekxkVwsX8dXq+SVy06+1HXfjY2uT HJnIpkx9/IZWMjJzRv33ylIMDq4u0MltJr+4MRrb5rSn6+9pz9m4z6CeUKJbsiLh nE0YRblkRwfrlVCP3VTaaRyQdMUwWzKwnB9S8dtKGDKb+tYz4QduFuzBf1eGGrO7 cp9GeHiittyBSGylRWveQgbkzwXRGPuUGtabXutQRqGXDvanDtEroHg+hUP0SEw= =b7/2 -----END PGP SIGNATURE-----

3 3

Re: [tor-relays] less than 3 bw auths available: self-measurement (with 10k cap in effect)
by Stian Fauskanger 27 Feb '18

27 Feb '18

if your relays behave strangely in terms of bandwidth seen, than this might be due to the fact that there are less than 3 bw auth votes available. If you run a fast relay it is capped to 10k cw. This affects currently the 857 fastest relays. It also affects "low-consensus" relays. I have a bw=5k relay which almost doubled the amount of traffic, increasing steadily from 14.30 UTC until 19.00 UTC [a.k.a. now]. I assume this is because 5k is a much higher percentage of the total bw now compared to when fast nodes was not capped at 10k and at the same time, 5k didn't "give" me enough traffic to meet RelayBandwidthRate. ~ Stian

1 0

IPv6 for the nifty?
by nusenu 26 Feb '18

26 Feb '18

Hi Markus, since you are by far the biggest exit relay operator I was wondering if you have any plans to get IPv6 connectivity? thanks, nusenu -- https://mastodon.social/@nusenu twitter: @nusenu_

3 3

Tor Relay Setup
by Gabe D. 26 Feb '18

26 Feb '18

Hey Guys, Ive an issue... I wanted to aid the network and setup a tor exit node, however its failing to do so, everything looks perfect config wise and it says "publishing server descriptor" no errors but the node never shows up in tor atlas, is there something i may be doing wrong? This is my config: ORPort 9001 ExitRelay 1 Nickname ** ContactInfo ** DirPort 80 DisableDebuggerAttachment 0 ControlPort 9051 CookieAuthentication 1

6 9

Relay failed logins
by Olaf Grimm 25 Feb '18

25 Feb '18

Dear guys, I am now on my server with SSH and get the message during login: ... Last failed login: Sat Feb 24 14:22:47 EST 2018 from 5.188.10.179 on ssh:notty There were 1343 failed login attempts since the last successful login. ... This simple relay (no exit) is online since less days. Location Moldavia / Trabia Network; VPS Is this amount of attacks regular? In the past i had a log file of 12MB on an other server - all failed logins. It is not a problem. It is only for my feeling "Ok, That's right!". Nickname node49c Olaf

6 5

whonix tor-relay - help needed
by peter.zehetner＠liwest.at 25 Feb '18

25 Feb '18

Hi there! I try to configure a tor relay on an whonix-gateway but I allways receive the answer that my server has not managed to confirm that its ORPort and its DIRPort are rechable. How can I fix this? Thanks Peter

3 2

torproject.org outages? (was Re: Tor Relay Setup)
by tor 24 Feb '18

24 Feb '18

> Relay search appears to be down right now. It seems the website (https://www.torproject.org) and package repos (ex: deb.torproject.org) are currently down as well. Anyone working on it?

3 2

Not in the cached consensus
by katan＠ono.com 22 Feb '18

22 Feb '18

My LorneMalvo relay not in the cached consensus. Flags ok: running, v2dir, valid according to consensus-health. No estimate of my bandwidth never. Why? Best regards P.S.: Sorry for my english

2 4

Is it possible to run a Web server and tor ORPort on the same port?
by pikami 22 Feb '18

22 Feb '18

Hello, I was wondering if it's possible to run a Web server and tor ORPort on the same port. I'm using nginx for my web server and I'm using ports 80 and 443, it would be cool if the ORPort could also be 443, that would help people that are behind firewalls, but I can't find any solution for this on google. Is there any way to accomplish this? -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

4 4

scale_active_circuits assertion fail
by Logforme 21 Feb '18

21 Feb '18

My relay (855BC2DABE24C861CD887DB9B2E950424B49FC34) just crashed with the following error: Feb 20 14:33:40.000 [err] tor_assertion_failed_(): Bug: ../src/or/circuitmux_ewma.c:711: scale_active_circuits: Assertion e->last_adjusted_tick == pol->active_circuit_pqueue_last_recalibrated failed; aborting. (on Tor 0.3.2.9 ) Feb 20 14:33:40.000 [err] Bug: Assertion e->last_adjusted_tick == pol->active_circuit_pqueue_last_recalibrated failed in scale_active_circuits at ../src/or/circuitmux_ewma.c:711. Stack trace: (on Tor 0.3.2.9 ) <snip stack trace> The relay had been up for 23 days: Feb 20 12:55:12.000 [notice] Heartbeat: Tor's uptime is 23 days 17:59 hours, with 30352 circuits open. I've sent 20574.36 GB and received 20125.28 GB. When I checked htop earlier everything looked fine. Modest CPU and MEM usage. What went wrong and what can I do to prevent this from happening again?

2 2

dns name
by TorGate 20 Feb '18

20 Feb '18

Hi onion friends :-) i have 2 relays, configured with ipv4 adresses. I have write to my isp and asked: can you change the ripe data ? isp: no my: ok :-( , i can also not change the reverse dnsname 1. So the question: is that a god way to change the config from IP-adress to dnsname in the torrc. 2. Can i also set the hostname manualy ? On Atlas is that my isp. So when there is coming a abuse, all contact is going first to my isp, and not to me. 3. Is that ok when i change the exit-html expl. with my email and business adress regards Steffen TorGate torgate(at)linux-hus.dk OpenGPG 7FD5 65EF A4EF EEF3 7A13 4372 8409 49D6 01A2 0890

2 1

gabelmoo's BW scanner, temporary or permanent leave?
by starlight.2017q4＠binnacle.cx 19 Feb '18

19 Feb '18

noticed gablemoo's BW scanner is offline and the entry for it at https://consensus-health.torproject.org/#bwauthstatus was removed; is it gone or just taking an extended break?

2 2

torservers.net DNS failure rate
by nusenu 19 Feb '18

19 Feb '18

Hi Moritz and Jens, Arthur's DNS exit scanner is detecting a high DNS failure rate on some of your tor instances: https://arthuredelstein.net/exits/ Would be great if you could look into this. thanks, nusenu -- https://mastodon.social/@nusenu twitter: @nusenu_

3 2

New Relay
by Gary 18 Feb '18

18 Feb '18

Hello. I recently set up a new relay, jaffacakemonster2, I would be grateful if someone could answer some questions for me. 1. The bandwidth on Atlas is listed as "0". Is this a wait a few days/new relay issue or a configuration issue. I was surprised to find exit relays are default now, I hope I didn't disable too much so to speak. 2. My family on Atlas - the little numbers in brackets are not all the same, I only run two relays, however on the listings it reports sometimes two sometimes three. Are you meant to include "yourself" in the torrc or only other relays?? Thanks.

5 7

PerConnBWRate, RelayBandwidthRate, BandwidthRate
by nusenu 18 Feb '18

18 Feb '18

Hello, I've got two questions regarding some bw related torrc settings. 1) after reading tor's manpage section about PerConnBWRate: > PerConnBWRate N > bytes|KBytes|MBytes|GBytes|TBytes|KBits|MBits|GBits|TBits If set, do > separate rate limiting for each connection from a non-relay. You > should never need to change this value, since a network-wide value is > published in the consensus and your relay will use that value. > (Default: 0) I was wondering what value dir auths set in consensus, but I was not able to find anything that looked like it in consensus [1]. dir-spec [2] > "perconnbwrate" and "perconnbwburst" -- if set, each relay sets > up a separate token bucket for every client OR connectio [...]> First-appeared: 0.2.2.7-alpha > Removed-in: 0.2.2.16-alpha Does that mean that dir auths stopped including it since tor 0.2.2.16-alpha should we update the manpage then? Is there a default value if consensus does not say anything about it or is there no per connection limit in that case? 2) Is there a RelayBandwidthRate torrc setting in addition to BandwidthRate so tor instances which act as clients and relays at the same time can have independent bw rates for each role (client, relay)? BandwidthRate -> affects client and relay role RelayBandwidthRate -> affects only relay role is this correct? [1] https://collector.torproject.org/recent/relay-descriptors/consensuses/2018-… [2] https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt#n1847 -- https://mastodon.social/@nusenu twitter: @nusenu_

2 1

DoS stats from exits running 0.3.3.2-alpha
by nusenu 17 Feb '18

17 Feb '18

I was wondering if these unfriendly tor clients are using tor's default path selection or something else. If they do tor exit relays would have much smaller values in their DoS stats, right? Would any tor exit operator (listed bellow) running 0.3.3.2-alpha be willing to share (obfuscated/not exact counters) of their DoS log entries? (only if you do not have any additional firewall rules filtering packets) | abuse(a)to-surf-and-protect.net | | replace k with c : kontakt @ zwiebeltoralf . de | | <rok AT sent dot com> | | florentin aatt rochet ddoott be; LTC: LhRqJZu6U87BJNSUbkACHzVQsK39hJ3sMB | | tor-relays(a)coldhak.ca | | abuse(a)to-surf-and-protect.de | | J. Random Hacker <anonymizer(a)ccc.de> | | Exit by Reporters without Borders via https://www.torservers.net/ | | Neel Chauhan <neel AT neelc DOT org> | BTC: 1KogNvxdcXydDUNrPgqgtgV3AWktKPqXpS | | Random Person <tor AT cusse.org> | | OctaneZ-TOR <OctaneZ+toroperator(a)gmail.com> | | https://www.torservers.net/donate.html <support .AT. torservers .DOT. net> | | shallot protonmail com | | Random Person <killertor.abuse at gmail point com> | | Brandon Kuschel <kusch023 AT NOSPAM umn dot edu> | | <admin AT openbsd DOT se> | -- https://mastodon.social/@nusenu twitter: @nusenu_

6 9

cosworth@fni.pl Tor Relays MyFamily Configuration
by nusenu 17 Feb '18

17 Feb '18

Hello cosworth(a)fni.pl, thanks for adding 3 more relays, please do not forget to set your MyFamily option in your torrc files. https://torproject.org/relay-guide#ImportantifyourunmorethanoneTorinstance Let us know if you need help with that setting. regards, nusenu https://metrics.torproject.org/rs.html#search/contact:cosworth@fni.pl ornetradar(a)riseup.net: > 2018-02-16 > > | Up | Ext | JoinTime | IP | AS | CC | ORp | Dirp | OS | Version | Nickname | eFamMembers | FP | > |------+-------+------------+---------------+-----------------------+------+-------+--------+-------+-----------+------------+---------------+------------------------------------------| > | 1 | 0 | 13:06:34 | 52.158.232.63 | Microsoft Corporation | us | 443 | 0 | Linux | 0.2.9.14 | Cosworth1 | 1 | 8F9FE423932770C5912DCB10B1A0A797F4CFA782 | > | 1 | 0 | 13:07:24 | 40.65.111.124 | Microsoft Corporation | us | 443 | 0 | Linux | 0.2.9.14 | Cosworth2 | 1 | 59C8A3663F4CB5399DC5D3E9C8455ECD0818519C | > | 1 | 0 | 13:07:57 | 52.151.41.244 | Microsoft Corporation | us | 443 | 0 | Linux | 0.2.9.14 | Cosworth3 | 1 | 6466190F47F0E6DDBA566A64518E4317BCD123DE | > > https://nusenu.github.io/OrNetRadar/2018/02/16/a1 -- https://mastodon.social/@nusenu twitter: @nusenu_

1 0

Relay stuck at Bootstrapped 0%
by Paul 16 Feb '18

16 Feb '18

I am running two relays on debian (one on Raspian 9 and one on Debian 9) and one of them for over three months now. Some time ago the older one started to loop at startup. I reinstalled tor and it worked for some time only to loop again. The last notices entry looks like this "Feb 16 19:36:14.000 [notice] Bootstrapped 0%: Starting" and the next is "Feb 16 19:42:08.000 [notice] Tor 0.2.9.14 (git-a211f886ad759cab) opening log file." then it tells about opening the listeners and parsing the GEOIP files, then my relay identity and the bootstrapped 0% entry again (left some informational entries out). The debug log looks like it is getting descriptors and stuff correctly. What could be the problem?

2 7

Relay Search has moved!
by Iain Learmonth 16 Feb '18

16 Feb '18

Hi All, Relay Search has moved! It is no longer to be found at atlas.torproject.org (although a redirect is in place). The new home is at: https://metrics.torproject.org/rs.html If you prefer an onion service: http://rougmnvswfsmd4dq.onion/rs.html Thanks, Iain.

3 7

Api for atlas.torproject.org
by flipchan 16 Feb '18

16 Feb '18

Hey, Im trying to write an ip checker script for a mail server/firewall and i want to be able check if the ip is a tor relay, is their a api for looking up ips on atlas.torproject.org ? Or any other easier way to do it in like python :) -- Take Care Sincerly flipchan layerprox dev

6 6

tonull list
by TorGate 16 Feb '18

16 Feb '18

Hi to all, what is the best way to intergrade the tonull list in the torrc ? ExitPolicy https://tornull.org/tornull-bl.txt <https://tornull.org/tornull-bl.txt> is that working ? or via a include ? regards Steffen TorGate torgate(at)linux-hus.dk

2 2

DoS mitigation
by Fabian A. Santiago 16 Feb '18

16 Feb '18

Hello, I've been browsing the list archives looking for mentions of DOS mitigation. last night my exit relay went offline and when i logged into it, CPU was sitting at 100% and atlas reported mine as down and another service i have checking up time also did as well. so i rebooted my server and it was fine. i found this thread: 1) Drops off consensus for 1-2hours and returns w/o hsdir: DOS_CC_CIRCUIT_BURST_DEFAULT 90 DOS_CONN_MAX_CONCURRENT_COUNT_DEFAULT 100 FW: 20 connects per /32 ip, rate limited to 3 per sec. 2) Good (stable): DOS_CC_CIRCUIT_BURST_DEFAULT 50 DOS_CONN_MAX_CONCURRENT_COUNT_DEFAULT 50 FW: 20 connects per /32 ip, rate limited to 3 per sec. 3) Good (stable): DOS_CC_CIRCUIT_BURST_DEFAULT 20 DOS_CONN_MAX_CONCURRENT_COUNT_DEFAULT 20 FW: 20 connects per /32 ip, rate limited to 3 per sec. 4) Too conservative: DOS_CC_CIRCUIT_BURST_DEFAULT 10 DOS_CONN_MAX_CONCURRENT_COUNT_DEFAULT 10 FW: 20 connects per /32 ip, rate limited to 3 per sec. 5) Good (newly): DOS_CC_CIRCUIT_BURST_DEFAULT 50 DOS_CONN_MAX_CONCURRENT_COUNT_DEFAULT 50 FW: 100 connects per /32 ip, rate limited to 15 per sec. are these good mitigations? what else can or should be done? limiting memory use helpful? I'm running on ubuntu 16.04 and am using ufw for my firewall currently. are there any other suggestions given my platform? thanks for your help. -- Thanks, Fabian S. OpenPGP: 3C3FA072ACCB7AC5DB0F723455502B0EEB9070FC

2 1

torservers internet connection
by TorGate 15 Feb '18

15 Feb '18

Hi again to all, i planing more torserver but what is the best solution for a god connection. there are 2 tor servers with a Bandwidth limit: 14.6 MB/s, burst: 29.3 MB/s is this enogth ? The internet connection has 60MB. Is this a god ide to setup more servers on this 60MB connection ? regards Steffen TorGate torgate(at)linux-hus.dk

3 11

freebsd port 80 and 443
by TorGate 15 Feb '18

15 Feb '18

Hi to all, question: i have testet a config with ORPort 443 and dirport 80, hm but there are a permission issue with freebsd. On my testsystem is no http installed, Can i only install tor on freebsd with orport 9001 and dirport 9030 ? regards Steffen TorGate torgate(at)linux-hus.dk

7 12

torservers.net MyFamily Configuration
by nusenu 14 Feb '18

14 Feb '18

Hi Moritz, please have a look at your MyFamily configuration. https://nusenu.github.io/OrNetStats/endtoend-correlation-groups thanks, nusenu -- https://mastodon.social/@nusenu twitter: @nusenu_

2 1

ninja.turtle5 Tor Relays MyFamily Configuration
by nusenu 14 Feb '18

14 Feb '18

thanks for running Tor relays! Please do not forget to set your "MyFamily" configuration parameter on all your relays, so Tor clients are not at risk of using your relays in multiple positions in a single circuit. https://nusenu.github.io/OrNetStats/endtoend-correlation-groups Some more background: https://hackernoon.com/some-tor-relays-you-might-want-to-avoid-5901597ad821 Let us know if you need any help with this. regards, nusenu -- https://mastodon.social/@nusenu twitter: @nusenu_

1 0

hviv Tor Relays MyFamily Configuration
by nusenu 14 Feb '18

14 Feb '18

thanks for running Tor relays! Please do not forget to set your "MyFamily" configuration parameter on all your relays, so Tor clients are not at risk of using your relays in multiple positions in a single circuit. https://nusenu.github.io/OrNetStats/endtoend-correlation-groups Some more background: https://hackernoon.com/some-tor-relays-you-might-want-to-avoid-5901597ad821 Let us know if you need any help with this. regards, nusenu -- https://mastodon.social/@nusenu twitter: @nusenu_

1 0

Checking dos mitigation
by Felix 14 Feb '18

14 Feb '18

Hi everybody I tried several setups for dos mitigation since the dos code is available and came to the following results, where I think 5) is promising and 2) or 3) are fine. 1) Drops off consensus for 1-2hours and returns w/o hsdir: DOS_CC_CIRCUIT_BURST_DEFAULT 90 DOS_CONN_MAX_CONCURRENT_COUNT_DEFAULT 100 FW: 20 connects per /32 ip, rate limited to 3 per sec. 2) Good (stable): DOS_CC_CIRCUIT_BURST_DEFAULT 50 DOS_CONN_MAX_CONCURRENT_COUNT_DEFAULT 50 FW: 20 connects per /32 ip, rate limited to 3 per sec. 3) Good (stable): DOS_CC_CIRCUIT_BURST_DEFAULT 20 DOS_CONN_MAX_CONCURRENT_COUNT_DEFAULT 20 FW: 20 connects per /32 ip, rate limited to 3 per sec. 4) Too conservative: DOS_CC_CIRCUIT_BURST_DEFAULT 10 DOS_CONN_MAX_CONCURRENT_COUNT_DEFAULT 10 FW: 20 connects per /32 ip, rate limited to 3 per sec. 5) Good (newly): DOS_CC_CIRCUIT_BURST_DEFAULT 50 DOS_CONN_MAX_CONCURRENT_COUNT_DEFAULT 50 FW: 100 connects per /32 ip, rate limited to 15 per sec. Some hack to grab dos ips, their counts and defenses shows the well known ones like a hand full new ones. But no surprises. -- Cheers, Felix

2 2

bridge questions
by Arisbe 13 Feb '18

13 Feb '18

Hello Tor users, I have several quick question: Can bridges use an IPv6 ORPort? Is there any advantage to adding this to my bridges? Has anyone actually seen IPv6 connections on a bridge? Thanks for the feedback...

3 2

[err] tor_assertion_failed_(): Bug: src/or/connection.c:5113
by Toralf Förster 13 Feb '18

13 Feb '18

Got this today: Feb 13 22:02:49.000 [err] tor_assertion_failed_(): Bug: src/or/connection.c:5113: assert_connection_ok: Assertion (conn->type == CONN_TYPE_EXIT && conn->state == EXIT_CONN_STATE_RESOLVING) || connection_is_writing(conn) || conn->write_blocked_on_bw || (CONN_IS_EDGE(conn) && TO_EDGE_CONN(conn)->edge_blocked_on_circ) failed; aborting. (on Tor 0.3.3.2-alpha efc105716283bbdf) Before I changed the config from ExitRelay 1 IPv6Exit 1 to #ExitRelay 1 #IPv6Exit 1 and a little bit later to ExitRelay 0 IPv6Exit 0 -- Toralf PGP C4EACDDE 0076E94E

2 2

1 circuit using 1.5Gig or ram? [0.3.3.2-alpha]
by starlight.2017q4＠binnacle.cx 12 Feb '18

12 Feb '18

On 12 Feb (19:44:02 UTC), David Goulet wrote: >Wow... 1599323088 bytes is insane. This should _not_ happen for only 1 >circuit. We actually have checks in place to avoid this but it seems they >either totally failed or we have a edge case. > >Can you tell me what scheduler were you using (look for "Scheduler" in the >notice log). > >Any warnings in the logs that you could share or everything was normal? > >Finally, if you can share the OS you are running this relay and if Linux, the >kernel version. Don't know if it's relevant but my relay was hit in similar fashion in December. Running 0.2.9.14 (no KIST) on Linux at the time (no other related log messages, MaxMemInQueues=1GB reduced from 2GB after OOM termination): Dec 15 15:28:52 Tor[]: assign_to_cpuworker failed. Ignoring. Dec 15 15:48:16 Tor[]: assign_to_cpuworker failed. Ignoring. Dec 15 16:39:44 Tor[]: We're low on memory. Killing circuits with over-long queues. (This behavior is controlled by MaxMemInQueues.) Dec 15 17:39:45 Tor[]: Removed 442695264 bytes by killing 1 circuits; 18766 circuits remain alive. Also killed 0 non-linked directory connections. Dec 15 19:03:22 Tor[]: We're low on memory. Killing circuits with over-long queues. (This behavior is controlled by MaxMemInQueues.) Dec 15 19:03:23 Tor[]: Removed 1060505952 bytes by killing 1 circuits; 19865 circuits remain alive. Also killed 0 non-linked directory connections. More recently (and more reasonably, MaxMemInQueues=512MB), running 0.3.2.9: Feb 4 20:12:39 Tor[]: Scheduler type KIST has been enabled. Feb 6 08:12:41 Tor[]: Heartbeat: Tor's uptime is 1 day 11:59 hours. I've sent 29.00 MB and received 364.99 MB. Feb 6 14:04:43 Tor[]: We're low on memory. Killing circuits with over-long queues. (This behavior is controlled by MaxMemInQueues.) Feb 6 14:04:43 Tor[]: Removed 166298880 bytes by killing 2 circuits; 20213 circuits remain alive. Also killed 0 non-linked directory connections. Feb 6 14:11:17 Tor[]: Heartbeat: Tor's uptime is 1 day 17:59 hours, with 20573 circuits open. I've sent 910.29 GB and received 902.58 GB. Feb 6 14:11:17 Tor[]: Circuit handshake stats since last time: 1876499/3018306 TAP, 4322015/4322131 NTor. Feb 6 14:11:17 Tor[]: Since startup, we have initiated 0 v1 connections, 0 v2 connections, 1 v3 connections, and 23846 v4 connections; and received 6 v1 connections, 7844 v2 connections, 11906 v3 connections, and 214565 v4 connections. Feb 6 14:12:41 Tor[]: Heartbeat: Tor's uptime is 1 day 17:59 hours. I've sent 31.62 MB and received 420.63 MB. Feb 6 14:22:50 Tor[]: We're low on memory. Killing circuits with over-long queues. (This behavior is controlled by MaxMemInQueues.) Feb 6 14:22:50 Tor[]: Removed 181501584 bytes by killing 2 circuits; 19078 circuits remain alive. Also killed 0 non-linked directory connections. Feb 6 15:01:50 Tor[]: We're low on memory. Killing circuits with over-long queues. (This behavior is controlled by MaxMemInQueues.) Feb 6 15:01:50 Tor[]: Removed 105918912 bytes by killing 1 circuits; 19679 circuits remain alive. Also killed 0 non-linked directory connections. Feb 6 15:46:24 Tor[]: Channel padding timeout scheduled 157451ms in the past. Feb 6 19:30:36 Tor[]: new bridge descriptor 'Binnacle' (fresh): $4F0DB7E687FC7C0AE55C8F243DA8B0EB27FBF1F2~Binnacle at 108.53.208.157 Feb 6 20:11:17 Tor[]: Heartbeat: Tor's uptime is 1 day 23:59 hours, with 18045 circuits open. I've sent 1043.74 GB and received 1034.65 GB. Feb 6 20:11:17 Tor[]: Circuit handshake stats since last time: 260970/368918 TAP, 3957087/3957791 NTor. Perhaps this indicates some newer KIST mitigation logic is effective.

1 0

1 circuit using 1.5Gig or ram? [0.3.3.2-alpha]
by Stijn Jonker 12 Feb '18

12 Feb '18

Hi all, So in general 0.3.3.1-alpha-dev and 0.3.3.2-alpha running on two nodes without any connection limits on the iptables firewall seems to be a lot more robust against the recent increase in clients (or possible [D]DoS). But tonight for a short period of time one of the relays was running a bit "hot" so to say. Only to be greated by this log entry: Feb 12 18:54:55 tornode2 Tor[6362]: We're low on memory (cell queues total alloc: 1602579792 buffer total alloc: 1388544, tor compress total alloc: 1586784 rendezvous cache total alloc: 489909). Killing circuits withover-long queues. (This behavior is controlled by MaxMemInQueues.) Feb 12 18:54:56 tornode2 Tor[6362]: Removed 1599323088 bytes by killing 1 circuits; 39546 circuits remain alive. Also killed 0 non-linked directory connections. Feb 12 19:04:10 tornode2 Tor[6362]: Your network connection speed appears to have changed. Resetting timeout to 60s after 18 timeouts and 1000 buildtimes. So 1 Circuit being able to claim 1,5 gig or ram, now this seems a big much. Whilst the DoS protection seems to do something (see below). Now this could be a new attack or just an error etc. However wouldn't some sort of fair memory balance between circuits be an other mitigation factor to consider? Not saying it should be as strict as "circuit memory"/"# of circuits" but 99.x% of memory for one circuit feels wrong for a relay. Feb 12 13:58:34 tornode2 Tor[6362]: DoS mitigation since startup: 910770 circuits rejected, 10 marked addresses. 25972 connections closed. 324 single hop clients refused. Feb 12 19:58:34 tornode2 Tor[6362]: DoS mitigation since startup: 1222320 circuits rejected, 12 marked addresses. 33359 connections closed. 402 single hop clients refused. Thx, Stijn

3 5

torservers are not rechable
by TorGate 11 Feb '18

11 Feb '18

Hi to all, i have started my servers again and changed the wan ip adress. But the servers have the old ip after uptime of 2 times. Can i update manualy the wan ips ? The dns names are changed to the new ipadresses. regards Steffen TorGate torgate(at)linux-hus.dk

3 3

Exits lost their function
by Paul 11 Feb '18

11 Feb '18

What could bring several exits at different providers and different operating systems (Linux and FreeBSD) down on the same day, Jan 21st? Since, while they still run as relays, they don’t show as exits any more without any change from my side. They do run on Tor 0.3.1.9 or 0.3.2.9 in the same Family. Thanks Paul

5 14

new requirements for Tor Exit relays in effect as of 2018-01-20
by nusenu 10 Feb '18

10 Feb '18

Dear Tor Exit Operator, I'm sending you this email to inform you that on 2018-01-20 the requirements for exit operators changed. Since that date your exit policy MUST allow exiting to port 80 _and_ 443 to be eligible for the exit flag. If your exit policy does not meet these new requirements, you lost your exit flag on 2018-01-20 (if you used to have it before that date). Find below a list of 34 exit relays that are affected by these requirement changes (consensus data as of 2018-01-19 13:00): contactInfo: 022F 0FF2 CB04 2342 7178 334F BA3F 9725 266C DD10 (OstwaldRipening) contactInfo: 0x49FAB046 Chris Jeane <chris jeane AT gmail dot com> (SpikeNJ) contactInfo: 0xB4F409D25BC71927 18NkcxXvFQKo2qyTqa6sQNt6bNEgXAvF9U (anoncat1) contactInfo: 0xd3956a77 Your pure Manifestation of Peace (newton) contactInfo: 0xFDB8716D Gerald Turner <gturner(a)unzane.com> - 1FRMLK42AvHNwn2NV3ASrxdMDYd12C1qbs (Unzane) contactInfo: 1024R/0FCE8549 Alexander Oelzant <alexander(a)oelzant.priv.at> (SCggHJTyWbtzDA9YZi) contactInfo: 145tXZyQEfdmpYhmbFtYe84kjghB5ymPA4 (NormalCitizen) contactInfo: 145tXZyQEfdmpYhmbFtYe84kjghB5ymPA4 (OrdinaryCitizen) contactInfo: 145tXZyQEfdmpYhmbFtYe84kjghB5ymPA4 (RegularCitizen) contactInfo: <admin AT openbsd DOT se> (che) contactInfo: Eran Sandler <eran(a)sandler.co.il> (tor4thepeople2) contactInfo: flo(a)gmx.it (DannenTor) contactInfo: Magnus <magnus(a)1337.cf> (Pandora) contactInfo: nobody AT example dot com (blent) contactInfo: Piotr <unknown(a)yahoo.com> (icubdw2o2xipsdc) contactInfo: replace k with c : kontakt @ zwiebeltoralf . de (zwiebeltoralf) contactInfo: replace k with c : kontakt @ zwiebeltoralf . de (zwiebeltoralf2) contactInfo: Systems Manager <service(a)ns.sol.net> (soltor0) contactInfo: Thor Exit <thor.exit AT yandex dot com> (ThorExit) contactInfo: torinternetzforall(a)aol.com (jUsTwAnTaFREEsHiRt) contactInfo: tor-mngr AT scalaire DOT fr (servicePublic2) contactInfo: Tsen <tsenchi.ng AT yandex dot com> (mycontribution) contactInfo: TvdW <tor AT tvdw DOT eu> - bitcoin 1NKKoCQwKs67eKBGedMD8wYoAs3Z4mMAex (EmpokNor) contactInfo: TvdW <tor AT tvdw DOT eu> - bitcoin 1NKKoCQwKs67eKBGedMD8wYoAs3Z4mMAex (TerokNor) contactInfo: VolkerWilcken at web dot de (EXITNODESAVE) contactInfo: yv3r3nd5yi1k(a)mail.ru (relay651054) contactInfo: <zwiebeln at online de> please donate BTC 1K38x9xqK3YDzjehYFAEPzsESEC4ScH5wJ (alsaceonion) contactInfo: <zwiebeln at online de> please donate BTC 1K38x9xqK3YDzjehYFAEPzsESEC4ScH5wJ (alsaceonionb) contactInfo: <zwiebeln at online de> please donate BTC 1K38x9xqK3YDzjehYFAEPzsESEC4ScH5wJ (mandela) contactInfo: <zwiebeln at online de> please donate BTC 1K38x9xqK3YDzjehYFAEPzsESEC4ScH5wJ (mandelab) contactInfo: <zwiebeln at online de> please donate BTC 1K38x9xqK3YDzjehYFAEPzsESEC4ScH5wJ (montrealonion) contactInfo: <zwiebeln at online de> please donate BTC 1K38x9xqK3YDzjehYFAEPzsESEC4ScH5wJ (montrealonionb) contactInfo: <zwiebeln at online de> please donate BTC 1K38x9xqK3YDzjehYFAEPzsESEC4ScH5wJ (quebeconion) contactInfo: <zwiebeln at online de> please donate BTC 1K38x9xqK3YDzjehYFAEPzsESEC4ScH5wJ (quebeconionb) @niftybunny: I you are motivated, you can send them an email directly by extracting valid email data from this list. zwiebeln at online de, zwiebeltoralf and TvdW are aware, I don't know about the rest, and I obviously omitted those for which we do not have any contactInfo. The actual learning here are: Missing proper per-notifications for exit operators. This topic (new req: 80+443) has been discussed before [1] but has not been properly announced, this could have been a TPO tweet or a blog post or an email to this list with proper subject and not hidden in a long thread. I should auto-detect such events (multiple relays loosing flags at the same time) without knowing about them. [1] https://lists.torproject.org/pipermail/tor-relays/2017-December/013663.html https://lists.torproject.org/pipermail/tor-relays/2018-January/014278.html -- https://mastodon.social/@nusenu twitter: @nusenu_

1 0

Question regarding exit sizing
by Conrad Rockenhaus 10 Feb '18

10 Feb '18

Hello, I have a question regarding relay sizing to add additional nodes to the network. What scenario is better for the network - adding five 100mbps nodes, or one 500 mbps node? Let’s keep it easy and say all five of those 100 mbps nodes would be in the same datacenter, configured in the same configuration, etc. I’m just curious, because I”m getting ready to add a few more nodes, but I’m wondering if it’ll be better to go big, or just stay small. Thanks, Conrad Rockenhaus

3 3

unreplied conntrack sessions
by Quintin 10 Feb '18

10 Feb '18

nusenu wrote: > If your hoster suspends your server if you exceed 10k concurrent connections > I'm afraid it is probably not suitable for an exit relay The response from the hoster was: > Your server should not have over 20,000 unreplied connections. This is a sign of abuse. What about the exit node causes such abormally high conntrack sessions? Q -- 0101100101000001010010000101010101000001010010000010000001000010 0100110001000101010100110101001100100000010110010100111101010101

3 5

Report on the FOSDEM relays meetup
by Nicolas Braud-Santoni 10 Feb '18

10 Feb '18

Hi, I facilitated the meetup at FOSDEM, last Sunday, and I wanted to report back on what happened, and what worked (or did not). We had around 20 people, with relatively little overlap with the 34C3 meetup (I could be wrong, though, as I'm bad at recognising faces). This seems quite good, esp. considering that the 34C3 meetup was a month before, and that the meetup wasn't announced especially early (we announced ~2 weeks in advance there would be one, but the time and precise location couldn't be fixed until Sat. morning) The room configuration wasn't exactly ideal (typical lecture room, not great if you want people to talk to one another). That's something we can probably improve next year, by organising the meetup at a side-event (say, on Friday early evening) at one of the local hackerspaces or somesuch; this way, we get a better location and we could communicate time & locations much more in advance. Communication-wise, I started publishing the events in blog.tpo (thanks hiro!), which seems to have helped some people; if we organise it as a side-event next year, we shoudl also get it on their website: https://fosdem.org/2018/fringe/ Content-wise, there were some pretty fruitful discussion, but we spent quite a bit of time on questions that recurr at other meetups too: - What's the most useful thing I can bring to the network? (TL;DR: Ideally, fast relays (if possible exits); if you can't contribute more than 1MB/s, make it a bridge) - Can I run my relay on a Raspberry Pi (or similar) ? - Why does my relay (or Internet connection) die once I have TLS connections established to most other relays? (This instance was likely caused by an ISP-provided router with bad TCP connection tracking.) - Why doesn't Tor support IPv6 yet? (Feel free to add more questions if I forgot some here) Those are all somewhat simple, and I think we would definitely benefit from having better, and more visible, FAQs for those. I will try to take the time and make/improve wiki pages for those, but I wouldn't mind some help from one of the website-makers to see how we can make it more visible. Getting people to ask a bunch of questions at the start, and broadly categorizing them, as suggested by Roger last meetup, seemed to work well: we managed to cover all topics people were interested in, and were only 20 minutes over time. However, I had people shortly introduce themselves before adding their question, and that might not be so good in retrospect, as the intros took a bunch of time, and might have been an obstacle to people suggesting more questions. If people are interested, I can start collating advise on how to facilitate tor-relays meetups in some wiki page, though I'm not sure yet how to convey that “nicoo's way of relays meetup” isn't meant to be authoritative or prescriptive at all (read: I have no clue what I'm doing, but hopefully it works not too bad.) Best, nicoo

2 2

TorAtlas/Relay Search: false-positive warnings about outdated tor version eliminated
by nusenu 09 Feb '18

09 Feb '18

I'd like to highlight a small but important change Iain (Atlas developer) implemented and deployed today on atlas. Previously there was a rare edge case where atlas would say that your relay runs an outdated version (with the big red banner some of you might know) even though you actually did update your relay already. This false positive is now gone! After you update your relay you might see something like this on Atlas (under the platform field): Tor 0.2.9.14 on Linux (version is 0.2.9.12 in consensus) This is nothing you should be worried about, it is expected to happen after a version upgrade. If it stays there for more than 2 days on a running relay you might consider reaching out to this list. happy relaying, nusenu [1] http://lists.nycbug.org/pipermail/tor-bsd/2018-January/000620.html -- https://mastodon.social/@nusenu twitter: @nusenu_

1 0

Disable CellStatistics !!!
by starlight.2017q4＠binnacle.cx 09 Feb '18

09 Feb '18

After many crashes and much pain, I determined that having CellStatistics enabled causes a busy relay to consume at least two or three _gigabytes_ of additional memory. Relay operators with less than 16GB per instance are advised to disable it. By default CellStatistics is disabled unless explicitly set in torrc. CellStatistics can be turned off without restarting, via the control-channel command setconf CellStatistics=0

2 1

Disable CellStatistics to reduce RAM usage
by teor 08 Feb '18

08 Feb '18

Hi, If your relay is using too much RAM, please disable CellStatistics. (It's not on by default.) For more details, please see: https://trac.torproject.org/projects/tor/ticket/25141 https://trac.torproject.org/projects/tor/ticket/24806#comment:13 T

3 3

High processor usage - just curious
by Gary Smith 08 Feb '18

08 Feb '18

Hi, I have noticed that after a few minutes of becoming online, and randomly perhaps a couple of times every hour (??) tor uses 100 % processor on all cores for about 40/50 seconds. I am curious what is tor doing internally to need so much power? There is normally isn't more than 4 mbits going through my relay, I noticed this a while back on htop before the December load increase and on previous versions so this has got to be an "internal thing". There is no log entry when this happens. I do not think it is a bug I am just curious why it needs this much computational power, Thanks.

3 5

Exit Relay Up
by Conrad Rockenhaus 05 Feb '18

05 Feb '18

Hello All, I just brought up my third relay, ConradsOVHRelay03, as an exit. I appreciate the feedback that everyone provided me with before and I hope that this relay is configured perfectly. I’m glad to add more bandwidth to the cause. Thanks, Conrad

2 1

relayor v0.3.1 is released
by nusenu 05 Feb '18

05 Feb '18

Hi, relayor v0.3.1 has been released. https://github.com/nusenu/ansible-relayor Whether you run a single or many relays, relayor helps you with running relays with minimal effort (automate everything). Introduction to get you started: https://medium.com/@nusenu/deploying-tor-relays-with-ansible-6612593fa34d Main benefits for a tor relay operator ====================================== * automation - no more manual setup tasks * security: offline Ed25519 master keys every tor instance is run with a distinct user * automatically makes use of IPv6 IPs (if available) * automatic tor instance generation (two by default - configurable) * enables tor's Sandbox feature by default on Debian-based systems * easily choose between alpha/non-alpha releases * easily restore a relay setup * easily choose between exit relay/non-exit relay mode * automatic deployment of a tor exit notice html page via tor's DirPort * automatic MyFamily management Supported Operating Systems ---------------------------- Debian 8, 9 and Debian Testing OpenBSD 6.2 FreeBSD 10.4, 11.1 HardenedBSD 11.1 Ubuntu 16.04 CentOS 7 Fedora 27 Changes since v0.3.0: ------------------------------ - support custom tor-exit-notice.html files (fixes #140) - increase tor_alpha_version: 0.3.2.x -> 0.3.3.x - Debian/Ubuntu: add support for tor nightly builds - implement per-instance ExitRelay settings (fixes #146) - make tor package state configurable (latest vs. present) regards, nusenu -- https://mastodon.social/@nusenu twitter: @nusenu_

1 0

Relays not in cached consensus
by Tyler Durden 05 Feb '18

05 Feb '18

Hi Just ~3 weeks before the 34C3, two of our newer Exits were thrown out of the consensus weight and since than never came back in. I'm talking about: geri (geri.enn.lu) 93FAB6F91C2EF33D0ACEEF7448177FCA2CEB99A0 freki (freki.enn.lu) C8AB1B2AF0CBAAE3611A814B4C7D38DCE0CBFEB4 We tried to purge the Tor installation, generate completely new keys, switched to alpha versions, switched back to stable, waited for weeks but it's always the same result. Only the authority servers moria1, longc. and dizum seem to "recognise" our exits. The logs say the same for every authority server except the 3 ones mentioned above: [info] handle_response_fetch_desc(): Received http status code 404 ("Servers unavailable") from server '154.35.175.225:80' while fetching "/tor/server/d/[__redacted__] I'll try again soon. Any ideas how to fix this? Greetings -- Frënn vun der Ënn A.S.B.L. (NGO) e. virii(a)enn.lu (GPG: 0xce8c12f32a2cf11b) t. +352-27-40-20-30-4 w. https://enn.lu/

2 2