- tor-relays - lists.torproject.org

Tolerant hosting for exit node.
by armenian_priest 17 Sep '17

17 Sep '17

Hello list, I was hoping to get a good suggestion from here for a hosting provider that is tolerant with Tor exit nodes. I went through the mailing list archive a few months back and there weren't any good suggestions on hosting providers. Also, I checked the 'GoodBadISPs' page in the Tor wiki but it is pretty outdated and I already got burned with one provider from there: ITLDC, it was added on 2016-04-23 but they bluntly stated that they DO NOT tolerate exit nodes after 2 abuse complaints, my exit node was running for 1 month there. One of the abuses was handled but with the second one they basically wanted me to block HTTP/S traffic on the VPS. I am not sure who edits and keeps track of the mentioned page but it would be a good idea to remove the mentioned provider from there so other people wont waste their money. Hope to get some recommendations since I want to support the network with an exit node. Thanks in advance! With regards, jack

5 6

Two-step abuse management?
by Moritz Bartl 14 Sep '17

14 Sep '17

Hi! tl;dr: We're thinking about introducing an auto responder to abuse mail which then requires clicking a link or replying to the mail again before the complaint actually reaches a human. What do you think? Can you help us set this up? So far, we do not have any auto responder for abuse mails. I always thought it was important to be friendly and get back to everyone individually, even if at the core we're reusing mail templates. There is a difference if a human gets back to you within a few hours, or you immediately get clearly a auto-sent something that basically tells you there's not much that can be done. But actually, most of what we're seeing is automated notification mail, and lately we also see more and more spam that survives the spamassassin. An ideal system would track used addresses, and only send an auto-response from our end once per sender every few months. We have very limited resources for abuse management, and it would be great to filter out the noise better than we currently do. Did anyone set up an infrastructure like that before? How would you do it? Also, if you just want to help with our abuse management, let me know! We can always use one or two more hands, it's fun, and it teaches you a lot about Tor exit operation. -- Moritz Bartl https://www.torservers.net/

3 4

Launching a Tor relay with Docker in seconds (x86-64, armhf, arm64)
by Rodrigo Martínez 14 Sep '17

14 Sep '17

Hi all, This is my humble contribution. There are prebuilt images for launching Tor relays for x86-64, armhf and arm64 architectures in seconds. The repo contains scripts for building those images and for launching a relay (bridge, middle or exit). Default configuration is provided for each type. Contributions are welcome. GitHub repo: https://github.com/brunneis/tor-relay-docker Docker Hub repo: https://hub.docker.com/r/brunneis/tor-relay/tags/ Regards, Rodrigo

2 1

Would you also like to have family-level atlas pages?
by nusenu 13 Sep '17

13 Sep '17

Hi, Iain - the atlas maintainer - asked on twitter if relay operators at the relay operators meetup in Montreal have feature requests for atlas [1]. I suggested family-level pages where an operator of more than one relay can see all the relays of his family including aggregated (stacked) graphs for the graphs that are already available on a per-relay level. Before filing this as a trac ticket - as Iain - suggested, I wanted to ask around if others would find that useful as well because it probably makes only sense to implement it if there are more people actually finding it useful. So let us know if you do. thanks, nusenu [1] https://twitter.com/iainlearmonth/status/907003817434271746 -- https://mastodon.social/@nusenu https://twitter.com/nusenu_

8 9

Re: [tor-relays] HOW-TO: Simple DNS resolver for tor exit operators
by jpmvtd261＠laposte.net 12 Sep '17

12 Sep '17

My idea is designed to protect the exit node against a DNS attack from the owner of the DNS server. Not from the ISP or an attacker monitoring the traffic going in and out of the ISP data center. On 12/09/2017 19:38, Ralph Seichter wrote: > On 12.09.17 21:17, jpmvtd261(a)laposte.net wrote: > >> My idea is to make more DNS queries than necessary, in order to hide >> the useful DNS queries among useless DNS queries. > > I'm not sure what you are trying to accomplish. Usually, a DNS query is > followed by an outbound connection to the returned IP address. Your ISP > can always monitor these connections from your exit node, no matter what > additional "query noise" you might introduce. > > This is not fiction. One of my ISPs sends me automated tickets every > once in a while, about network scans that abuse my exit nodes. Not only > are connections recorded, they are analysed for patterns. > > -Ralph

6 11

Re: [tor-relays] HOW-TO: Simple DNS resolver for tor exit operators
by jpmvtd261＠laposte.net 12 Sep '17

12 Sep '17

On 12/09/2017 20:25, Ralph Seichter wrote: > I'm not certain what you consider a "DNS attack". > > Many exit node operators run a caching DNS resolver on their exits, > which is easily done. Lacking that, you can use the resolvers run by > your ISP, who can monitor all outbound traffic anyway, as I mentioned. > An attacker can try to find what websites a Tor user has visited, by comparing : - the timing of Tor user home connection traffic and - the timing of DNS queries happening on DNS servers controlled by the attacker On this webpage, the author talks about "correlation" attack : https://nakedsecurity.sophos.com/2016/10/05/unmasking-tor-users-with-dns/

2 1

Email suggesting to send DNS requests to a specific open DNS
by jpmvtd261＠laposte.net 12 Sep '17

12 Sep '17

Hello, Recently, I installed a new Tor exit node. A few days later, I received an email on the address given in the node contact information. This email suggests to change the DNS server my node use, and gives me a specific IP address to use. Here is the mail (obfuscated with sharps) : EMAIL BEGIN *********************************** * Sender : info AT backplanedns DOT org * Subject : Your TOR node * Body : ** ** Hello, ** ** I came across your TOR relay on atlas. I run a few relays myself ** along with a bunch of DNS resolvers which are a part of the Open ** Root Server network (ORSN.org) - aimed to fight internet ** censorship and circumvent government surveillance programs ** (ie. prism). ** ** I hope you may be interested in using our anonymous open DNS ** resolvers on your relays. ** ** https://BackplaneDNS.org ** ** Resolver - 172.98.193.4# ** ** Resolver - 162.248.241.9# ** ** ------------------------------------------------------ ** ** Hostmaster@: ** Mr. D##### E#### H##### ** ** Phone: ** +1 (###) ###-#### ** ** E-Mail: ** info AT backplanedns DOT org ** abuse DOT backplanedns DOT org ** ** Linkedin: ** http://linkedin.com/in/d####-######-#########/ *********************************** EMAIL END I think it could be an attack. If this person send this email to every new exit node operators, there may be a small percentage of rookie operators who will make the change. I found this webpage about Tor exit nodes and DNS : https://nakedsecurity.sophos.com/2016/10/05/unmasking-tor-users-with-dns/ What do you think about this email ?

3 2

Re: [tor-relays] HOW-TO: Simple DNS resolver for tor exit operators
by jpmvtd261＠laposte.net 12 Sep '17

12 Sep '17

On August 7, 2017 20:07:05 UTC, Igor Mitrofanov <igor.n.mitrofanov at gmail.com> wrote: > The DNS issue is in the "long tail" - rare/unique websites > are unlikely to be cached, yet they likely represent the > most interesting targets. > I do agree that running dnsmasq (or a similar caching resolver) is probably > sufficient to make DNS attacks too unreliable to invest in. I have an idea to improve the efficiency of this solution (DNS cache). My idea is to make more DNS queries than necessary, in order to hide the useful DNS queries among useless DNS queries. What do you think about this ? A basic implementation of that improvement would be a script run as a daemon that fetches the IP of a random domain name at a random time. The domain name being built from random characters or chosen from a list of valid (rarely visited) domain names. The average number of dummy DNS queries per day being equal to the number of useful DNS queries the exit node has to do per day (it doubles the DNS traffic). The list of valid (rarely visited) domain names needs to be changed over time (one entry at a time). A more advanced implementation of that improvement is to only allow the exit node to perform DNS queries by bunch of three. Of the three queries, two are dummy and random, one is useful. The position of the useful query in the bunch (position 1, position 2, or position 3) is chosen randomly.

2 1

Re: [tor-relays] Email suggesting to send DNS requests to a specific open DNS
by jpmvtd261＠laposte.net 12 Sep '17

12 Sep '17

Thanks. I should have look for previous discussion about this. On 12/09/2017 16:24, Tyler Johnson wrote: > This guy sure is persistent! > > Check out this recent thread: > https://lists.torproject.org/pipermail/tor-relays/2017-September/012934.html

1 0

Re: [tor-relays] Would you also like to have family-level atlas pages?
by Tyler Johnson 12 Sep '17

12 Sep '17

I realize now why I don't tend to voice my opinion on these lists... I'm an idiot :( After seeing the below example, I think it's a great idea. Sorry for the noise On Sep 11, 2017 21:37, "John Ricketts" <john(a)quintex.com> wrote: Roger, The kind folks at Nos Oignons gave me the code. I still have it if you can't find it. https://nos-oignons.net/Services/index.en.html is an example. John On Sep 11, 2017, at 20:55, Roger Dingledine <arma(a)mit.edu> wrote: On Mon, Sep 11, 2017 at 10:10:00PM +0000, nusenu wrote: I suggested family-level pages where an operator of more than one relay can see all the relays of his family including aggregated (stacked) graphs for the graphs that are already available on a per-relay level. Good idea. The Nos Oignons folks had some scripts you can hack together to measure and visualize your group of relays, but I spent a while hunting and I couldn't find it now. While we're doing feature requests, once the "per family" view exists, I would want to use the same view on other groups of relays, like "per country" and "per AS". I can fake some of that with Compass: https://compass.torproject.org/ but it would be great to have it in a site that's maintained. :) Thanks! --Roger _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

2 1

Re: [tor-relays] Would you also like to have family-level atlas pages?
by Tyler Johnson 11 Sep '17

11 Sep '17

Hey everyone, I haven't been a relay operator for very long, so please pardon my ignorance, but doesn't Atlas already link to all family members, where you can click on each and view that relays statistics? I can see the suggested benefit of having all that info on one landing page (so to speak), but I really appreciate the simplicity of the site in its current form. My vote would be for a top 100 (or higher) option in the drop down menu that actually works. Overall, I think the site is great, keep up the great work tor project! Thanks, Tyler On Sep 11, 2017 17:11, "nusenu" <nusenu-lists(a)riseup.net> wrote: Hi, Iain - the atlas maintainer - asked on twitter if relay operators at the relay operators meetup in Montreal have feature requests for atlas [1]. I suggested family-level pages where an operator of more than one relay can see all the relays of his family including aggregated (stacked) graphs for the graphs that are already available on a per-relay level. Before filing this as a trac ticket - as Iain - suggested, I wanted to ask around if others would find that useful as well because it probably makes only sense to implement it if there are more people actually finding it useful. So let us know if you do. thanks, nusenu [1] https://twitter.com/iainlearmonth/status/907003817434271746 -- https://mastodon.social/@nusenu https://twitter.com/nusenu_ _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

Re: [tor-relays] Fwd: Your TOR [sic] node
by Dennis Emory Hannon 10 Sep '17

10 Sep '17

So let me get this straight - Because you don't agree with the way I'm marketing my network I must be malicious and this must be a "social engineering" attack? Seriously guys, put away the tin foil hats. I truly DON'T want to know what people on tor are browsing. If you 'd like to waste your time on baseless assumptions go right ahead. -Dennis

4 3

Fwd: Your TOR [sic] node
by Matt Traudt 09 Sep '17

09 Sep '17

I just got this guy's spam too. It doesn't look like anything anyone said to him last month[0] stuck. His intentions are now very suspicious to me too. I will definitely not be pointing anything at his servers. Matt [0]: https://lists.torproject.org/pipermail/tor-relays/2017-August/012735.html -------- Forwarded Message -------- Subject: Your TOR node Date: Fri, 8 Sep 2017 21:36:14 -0400 From: Dennis Emory Hannon <info(a)backplanedns.org> To: Dennis Emory Hannon <info(a)backplanedns.org> Hello, I came across your TOR relay on atlas. I run a few relays myself along with a bunch of DNS resolvers which are a part of the Open Root Server network (ORSN.org) - aimed to fight internet censorship and circumvent government surveillance programs (ie. prism). I hope you may be interested in using our anonymous open DNS resolvers on your relays. https://BackplaneDNS.org Resolver - 172.98.193.42 Resolver - 162.248.241.94 ------------------------------------------------------ Hostmaster@: Mr. Dennis Emory Hannon Phone: +1 (716) 348-0064 E-Mail: info(a)backplanedns.org abuse(a)backplanedns.org Linkedin: http://linkedin.com/in/dennis-hannon-52236019/

3 2

Rate setting in tor
by r1610091651 08 Sep '17

08 Sep '17

Hi I've a question regarding the rate setting in torrc and tor honoring it. I've set up a tor relay with following rate settings: RelayBandwidthRate 2048 KBytes RelayBandwidthBurst 2048 KBytes But using arm, I'm seeing that tor is not honoring these settings, with bursts frequently exceeding the value. The average rate control seems to be working fine though. [image: image.png] What am I missing? I'm running 0.3.0.10 on Linux. Thanks

6 7

Force OpenSSL AES-NI usage on a VPS without the AES CPU flag passthrough
by Roman Mamedov 06 Sep '17

06 Sep '17

Hello, Today I found that it is possible to force OpenSSL enable the use of CPU AES acceleration even if it doesn't detect the "aes" CPU flag. Many VPS hosts configure their hypervisors in a way that does not have the flag passed through into VPSes, even though all their host nodes surely have CPUs with support for AES-NI. In my experience hosts have not been forthcoming in reconfiguring their systems to include that flag passthrough. But it turns out we can force OpenSSL to believe AES is supported, even if the CPU does not report it. This can be done with the "OPENSSL_ia32cap" environment variable. Searching around, all I found was scenarios to use it for disabling AES-NI (for testing), e.g.: https://mjanja.ch/2013/11/disabling-aes-ni-on-linux-openssl/ I believe the syntax used there applies "xor" over the real flag values, e.g. OPENSSL_ia32cap="~0x200000200000000" to disable AES. But what if you need to force-enable it. Turns out the syntax working for that is simply: OPENSSL_ia32cap="+0x200000200000000" Let's take one VPS box with the aforementioned problem. # cat /proc/cpuinfo processor : 0 vendor_id : GenuineIntel cpu family : 6 model : 13 model name : QEMU Virtual CPU version 1.5.3 stepping : 3 microcode : 0x1 cpu MHz : 1695.729 cache size : 4096 KB physical id : 0 siblings : 1 core id : 0 cpu cores : 1 apicid : 0 initial apicid : 0 fpu : yes fpu_exception : yes cpuid level : 4 wp : yes flags : fpu de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pse36 clflush mmx fxsr sse sse2 syscall nx lm rep_good nopl eagerfpu pni cx16 hypervisor lahf_lm bugs : bogomips : 3391.45 clflush size : 64 cache_alignment : 64 address sizes : 46 bits physical, 48 bits virtual power management: As you can see "aes" is not present. Testing OpenSSL speed in the default configuration. # openssl speed -elapsed -evp aes-128-gcm ... type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes 16384 bytes aes-128-gcm 32332.17k 40365.80k 42265.77k 42376.19k 43196.42k 43401.22k And now we force AES hardware acceleration usage: # OPENSSL_ia32cap="+0x200000200000000" openssl speed -elapsed -evp aes-128-gcm ... type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes 16384 bytes aes-128-gcm 59047.07k 104467.39k 141712.21k 151093.93k 158321.32k 156827.65k Almost 4 times faster! For Tor this leads to higher bandwidth utilization and lower CPU usage (which will actually make your VPS host happier :) But how to apply that to Tor? Well, for some initial testing I just chose to add the following line to /etc/init.d/tor (not using systemd here), right after "#! /bin/bash": export OPENSSL_ia32cap="+0x200000200000000" (but this will get overwritten and removed by the next Tor version upgrade). Seems to work just fine, my CPU usage is half of what it was before, at similar bandwidth levels. So now it has headroom to ramp up further. A word of caution, firstly always test as shown above to verify that it works. I believe if the underlying CPU actually doesn't support AES, all programs trying to use it, including "openssl speed", will crash outright, with an incorrect instruction error, or somesuch. So there is no risk to jeopardize encryption strength or security of Tor. Also even if it works now, it may stop working down the line if the host migrates your VPS to a node with older CPU, one which doesn't support AES. But migrations of customers between do not happen very often, and in fact all CPUs used today in a hosting environment should support AES, as that's been implemented in server (and even desktop) CPUs a very very long time ago. (Apologies for double-post, I realized tor-relays should have been the better place to post). -- With respect, Roman

5 4

Re: [tor-relays] Any IP allocations available out there?
by Paul Templeton 04 Sep '17

04 Sep '17

> If you're interested in becoming your own ISP (obtaining your own ASN, > IPv6 and IPv4 scopes), you'll need to apply via APNIC, as I did in the > US with ARIN. Here is an example: Would if I could - but here in AU you have to log all metadata for two years if you are an ISP. I either listen to what others have stated and host overseas or host overseas... I might be able to get a 20/20Mbs fibre for AU$250 - Just waiting to find out if they have data caps or not. Thanx all for your input. Paul PS - whats more important - More bandwidth for exit nodes or a faster presence in AU???

6 11

Tor-arm failure
by Arisbe 03 Sep '17

03 Sep '17

Hello people, I'm not a python programmer so I need some help with a problem. I have a number of Tor nodes and some bridges. Occasionally, when I install tor_arm I get a divide by zero message as follows: Exception in thread Thread-69: Traceback (most recent call last): File "/usr/lib/python2.7/threading.py", line 801, in __bootstrap_inner selt.run() File "/usr/share/arm/util/sysTools.py", line 517, in runnewValues["cpuAvg"] = total CpuTime / uptime ZeroDivisionError: integer division or modulo by zero Exception in thread Thread-70 ...... I'm running debian jessie in this most recent example. 2 G memory, 20 G hdd. This is a bridge with only some daily use but typically 10-12 circuits. Does someone have experience debugging this problem? Thanks!

5 10

Re: [tor-relays] DIR Port. and NATO
by Dr Gerard Bulger 30 Aug '17

30 Aug '17

Roger, thank for the answer. Reason of no DIR port will be Accounting Max Enabled, although every unlikely I would reach the max I set, I use those settings to give me instant total usage within ARM While searching for some suitable wording if I ever get abuse complaints again, and searching the legal risks within Europe of Exits, I was rather surprised found NATO published a detailed appraisal of Tor. I thought it rather good, not very technical, and fair although it may be getting out of date. https://ccdcoe.org/sites/default/files/multimedia/pdf/TOR_Anonymity_Network… Gerry -----Original Message----- From: tor-relays [mailto:tor-relays-bounces@lists.torproject.org] On Behalf Of Roger Dingledine Sent: 30 August 2017 16:36 To: tor-relays(a)lists.torproject.org Subject: Re: [tor-relays] DIR Port On Wed, Aug 30, 2017 at 01:39:34PM +0100, Dr Gerard Bulger wrote: > DIR port on my relay and mini exit as being there on Atlas. > > The DIR port is open, indeed the DirPortFrontPage can be seen. > > Bandwidth is ???fast??? > > The exit is very limited in scope to avoid abuse claims, so few ports forwarded such as 443, but not 80. Is that the reason not showing? Check out your logs as the relay starts. Look for a log message like log_notice(LD_DIR, "Not advertising Dir%s (Reason: %s)", dir_port ? "Port" : "ectory Service support", reason); Common reasons include "AccountingMax enabled" and "BandwidthRate under 50KB". In general, it's fine for Tor to decide not to advertise your DirPort. Everything else is still working fine. Thanks for running a relay! --Roger _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

DIR Port
by Dr Gerard Bulger 30 Aug '17

30 Aug '17

DIR port on my relay and mini exit as being there on Atlas. The DIR port is open, indeed the DirPortFrontPage can be seen. Bandwidth is “fast” The exit is very limited in scope to avoid abuse claims, so few ports forwarded such as 443, but not 80. Is that the reason not showing? Gerry

2 1

Tor relay making normal internet unusable
by W Howard 30 Aug '17

30 Aug '17

Dear Group, I have some spare bandwidth and want to run an exit relay buy when I do the normal internet is so slow and I have to fill out so many captcha that it makes it unusable! Any ideas why? I think google etc block by default tor exit nodes. I was thinking about spinning up a vm and running tor on that. When I run as a bridge I don't see much traffic. Any ideas? Cheers!

4 5

IP Forwarding ON - on the host with tor relay - any risk ?
by Muppet96 28 Aug '17

28 Aug '17

Hi, on the one of my servers where tor relay is running I would like to configure openvpn server. In that case IP Forwarding needs to be enabled (ubuntu). Is there any security risk if this feature will be enabled on the tor-relay host ? Thanks Muppet96 Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

Fallback directory mirror DFRI7 is dead
by Linus Nordberg 25 Aug '17

25 Aug '17

Hi teor, Fallback directory mirror DFRI7 [0] is down, due to multiple disk krashes, since about 30h and will not come alive with the same key. [0] 171.25.193.131:80 orport=443 id=79861CF8522FC637EF046F7688F5289E49D94576 A new DFRI7 will appear on the same address and port within a couple of days. Should I simply update fallback_dirs.inc?

3 3

Tor Install Error
by Kurt Besig 24 Aug '17

24 Aug '17

While using apt-get to update my tor relay to a 'recommended' version I keep encountering this error: W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://deb.torproject.org trusty InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 74A941BA219EC810 W: Failed to fetch http://deb.torproject.org/torproject.org/dists/trusty/InRelease I've read several approaches to remedying this error, however I'm wondering what would be the 'most widely accepted as correct' method of dealing with the error? Thanks

2 1

OR banned?
by Marcus Danilo Leite Rodrigues 24 Aug '17

24 Aug '17

Hello. I was running a Tor Relay for the past month (fingerprint 71BEBB61D0D35234D57087D035F12971FA315168) at my university and it seems that it got banned somehow. I got messages on my log like the following: http status 400 ("Fingerprint is marked rejected -- please contact us?") response from dirserver '171.25.193.9:443'. Please correct. I was hoping to get some information regarding this ban and how I could correct whatever was done wrong in order to get my relay up and running again. Best wishes, Marcus Rodrigues.

3 3

Any IP allocations available out there?
by Paul Templeton 24 Aug '17

24 Aug '17

Thanx to all here on the list for input to earlier posts. Helped a lot. Question I have is there anywhere where you can get a block of IP address or lease as I'm in the process of getting a 10/10Mb SHDSL service(No flaming data cap :-)) here in AU but I want an IP range that abuse questions can be forwarded to me. The service provider doesn't provide ARIN registration but said if I have my own block I can update the BG and manage it my self. Regards, Paul PS - the best price I can do at the moment is $550pm - *SIGH* - but worth it.

4 4

Re: [tor-relays] Any IP allocations available out there?
by Paul Templeton 24 Aug '17

24 Aug '17

OVH has this in AU 5.9 For security reasons, OVH reserves the right to proceed with the immediate suspension without notice, of any Server on which there is a public service Proxy, IRC, VPN or TOR which is available free of charge or for a fee, and for which OVH has knowledge of its fraudulent or illegal misuse. > with Tor's overall architecture, does it really make sense to > route e.g. EU clients exiting to EU destinations, True - Wanted to add to the diversity in location and OS. Will look at other jurisdictions for better service... Still looking but so far all have data caps. I really want a decent exit node here in AU but getting perplexed. I'll sleep on it... Paul

2 1

Re: [tor-relays] Any IP allocations available out there?
by Paul Templeton 24 Aug '17

24 Aug '17

Thanx niftybunny, It's more political than anything. With the constant changes in policy driving censorship I feel that having a strong presence is important. At the moment there are 50 nodes in Australia with the fastest running at 357Kbs and only two exit nodes - fastest is 100Kbs. Its a reflection on the state of politics and the level of service that is provided by ISP's. Yes I could run more nodes in VMs around the world but at this stage I would like to investigate a strong presence here in AU. Regards, Paul ----- Original Message ----- From: "niftybunny" <abuse(a)to-surf-and-protect.net> To: tor-relays(a)lists.torproject.org Sent: Thursday, August 24, 2017 10:41:12 AM Subject: Re: [tor-relays] Any IP allocations available out there? The smallest block you can advertise with your own AD is a /24 as far as I know. Getting a IPv4 /24 is …. expensive and hard to get. If you are not incredible rich and very tech savvy and a hardcore Tor supporter: Forget it. Get yourself a few virtual servers. niftybunny “For too long, we have been a passively tolerant society, saying to our citizens 'as long as you obey the law, we will leave you alone'” --David Cameron, 2015 On 24. Aug 2017, at 02:29, Paul Templeton < paul(a)coffswifi.net > wrote: Thanx to all here on the list for input to earlier posts. Helped a lot. Question I have is there anywhere where you can get a block of IP address or lease as I'm in the process of getting a 10/10Mb SHDSL service(No flaming data cap :-)) here in AU but I want an IP range that abuse questions can be forwarded to me. The service provider doesn't provide ARIN registration but said if I have my own block I can update the BG and manage it my self. Regards, Paul PS - the best price I can do at the moment is $550pm - *SIGH* - but worth it. _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

2 1

Unable to compile Tor
by Alan 23 Aug '17

23 Aug '17

Up until now i've relied on updating Tor using yum update but the version on the repos is currently 0.2.9.10 . Arm reports this as unrecommended, so compiling from source looks to be the only option. I pulled down 0.3.0.10, untarred and ran ./configure && make I get these errors-- ---------------------------- In file included from src/common/tortls.c:52:0: src/common/tortls.h:140:15: error: conflicting types for SSL_SESSION_get_master_key STATIC size_t SSL_SESSION_get_master_key(SSL_SESSION *s, uint8_t *out, ^ In file included from src/common/tortls.c:40:0: /usr/local/include/openssl/ssl.h:1725:15: note: previous declaration of SSL_SESSION_get_master_key was here __owur size_t SSL_SESSION_get_master_key(const SSL_SESSION *ssl, ^ src/common/tortls.c: In function find_cipher_by_id: src/common/tortls.c:1331:21: warning: unused variable c [-Wunused-variable] const SSL_CIPHER *c; ^ src/common/tortls.c: In function tor_tls_client_is_using_v2_ciphers: src/common/tortls.c:1508:20: error: dereferencing pointer to incomplete type ciphers = session->ciphers; ^ src/common/tortls.c: At top level: src/common/tortls.c:2402:1: error: conflicting types for SSL_get_client_random SSL_get_client_random(SSL *s, uint8_t *out, size_t len) ^ In file included from src/common/tortls.c:40:0: /usr/local/include/openssl/ssl.h:1721:15: note: previous declaration of SSL_get_client_random was here __owur size_t SSL_get_client_random(const SSL *ssl, unsigned char *out, ^ In file included from src/common/tortls.c:27:0: src/common/tortls.c: In function SSL_get_client_random: src/common/tortls.c:2407:15: error: dereferencing pointer to incomplete type tor_assert(s->s3); ^ src/common/compat.h:196:51: note: in definition of macro PREDICT_UNLIKELY #define PREDICT_UNLIKELY(exp) __builtin_expect(!!(exp), 0) ^ src/common/tortls.c:2407:3: note: in expansion of macro tor_assert tor_assert(s->s3); ^ src/common/tortls.c:2408:16: error: dereferencing pointer to incomplete type memcpy(out, s->s3->client_random, len); ^ src/common/tortls.c: At top level: src/common/tortls.c:2415:1: error: conflicting types for SSL_get_server_random SSL_get_server_random(SSL *s, uint8_t *out, size_t len) ^ In file included from src/common/tortls.c:40:0: /usr/local/include/openssl/ssl.h:1723:15: note: previous declaration of SSL_get_server_random was here __owur size_t SSL_get_server_random(const SSL *ssl, unsigned char *out, ^ In file included from src/common/tortls.c:27:0: src/common/tortls.c: In function SSL_get_server_random: src/common/tortls.c:2420:15: error: dereferencing pointer to incomplete type tor_assert(s->s3); ^ src/common/compat.h:196:51: note: in definition of macro PREDICT_UNLIKELY #define PREDICT_UNLIKELY(exp) __builtin_expect(!!(exp), 0) ^ src/common/tortls.c:2420:3: note: in expansion of macro tor_assert tor_assert(s->s3); ^ src/common/tortls.c:2421:16: error: dereferencing pointer to incomplete type memcpy(out, s->s3->server_random, len); ^ src/common/tortls.c: In function SSL_SESSION_get_master_key: src/common/tortls.c:2432:13: error: dereferencing pointer to incomplete type return s->master_key_length; ^ In file included from src/common/tortls.c:27:0: src/common/tortls.c:2433:30: error: dereferencing pointer to incomplete type tor_assert(len == (size_t)s->master_key_length); ^ src/common/compat.h:196:51: note: in definition of macro PREDICT_UNLIKELY #define PREDICT_UNLIKELY(exp) __builtin_expect(!!(exp), 0) ^ src/common/tortls.c:2433:3: note: in expansion of macro tor_assert tor_assert(len == (size_t)s->master_key_length); ^ src/common/tortls.c:2435:16: error: dereferencing pointer to incomplete type memcpy(out, s->master_key, len); ^ make[1]: *** [src/common/tortls.o] Error 1 make[1]: Leaving directory `/root/tor-0.3.0.10' make: *** [all] Error 2 ---------------------------- I'm running on Centos 7 Alan

2 1

Bandwidth Question
by Torix 22 Aug '17

22 Aug '17

Dear List, I run a middle node at home. I jacked up my bandwidth from 300/500 KB to 500/700 KB a fortnight ago, and my usage has more than doubled. I run it on Verizon FIOS at home; I'm looking at about 650-750 G/month estimate now from vnstat. I read that Verizon starts to take notice if I get to a TB/month, so I am asking for advice on easing this back if necessary. I can limit the daily bandwidth - or can I just ease down the bandwidth? Clearly each time I increased the bandwidth I got more connexions; would they drop off if I went back to my old bandwidth? I'm a little unclear how long it would take other relays to attach to other middle relays once they have found mine. The more general question behind this is: is it better to have a higher bandwidth for a limited time each day or a lower bandwidth up all day? Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

outdated key files in ./keys ?
by Toralf Förster 22 Aug '17

22 Aug '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I do wonder if I do still need all of these files at my exit relay with verion 0.3.1.5-alpha ? $> ls keys/ ed25519_master_id_public_key ed25519_signing_secret_key secret_onion_key_ntor ed25519_master_id_secret_key secret_id_key secret_onion_key_ntor.old ed25519_signing_cert secret_onion_key secret_onion_key.old - -- Toralf PGP C4EACDDE 0076E94E -----BEGIN PGP SIGNATURE----- iI0EAREIADUWIQQaN2+ZSp0CbxPiTc/E6s3eAHbpTgUCWZdBBxccdG9yYWxmLmZv ZXJzdGVyQGdteC5kZQAKCRDE6s3eAHbpTiqVAP0VYBto7mkqOnSirkklCU/EiiV0 CV06fXxqH8KDzW3wAwD+P/O6+gs/LEPLhP7OFo9XbgzyO2zrElusqDhPU/kSzCw= =nzsU -----END PGP SIGNATURE-----

2 1

Does fallback directory traffic go over the ORPort?
by tor 22 Aug '17

22 Aug '17

In another thread, Roger said: > Note that most clients use the ORPort for fetching directory stuff, and > that's heading towards "all clients" as people upgrade and stop using weird > configurations. I'm curious about the 100+ fallback directory mirrors. Does fallback directory traffic go over the ORPort too? Is it safe to disable the DirPort on fallback relays?

2 1

blocking >1 connections per ip address onto Tor DirPort
by Toralf Förster 22 Aug '17

22 Aug '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I do have the following iptables rule here : # Tor # dirport=80 orport=443 $IPT -A INPUT -p tcp --destination-port $dirport --match conntrack --ctstate NEW --match connlimit --connlimit-above 1 --connlimit-mask 32 -j DROP $IPT -A INPUT -p tcp --destination-port $orport --match conntrack --ctstate NEW --match connlimit --connlimit-above 1 --connlimit-mask 32 -j DROP which seems to work fine. An $> ip6tables -nvL gives 14110 746K DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 ctstate NEW #conn src/32 > 1 230K 14M DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 ctstate NEW #conn src/32 > 1 after few days so I do just like to ask here if the rules above are fine or if I overllooked something ? - -- Toralf PGP C4EACDDE 0076E94E -----BEGIN PGP SIGNATURE----- iI0EAREIADUWIQQaN2+ZSp0CbxPiTc/E6s3eAHbpTgUCWZM4sxccdG9yYWxmLmZv ZXJzdGVyQGdteC5kZQAKCRDE6s3eAHbpTqnGAQCPr7gkpaxRD3spzKp49l53A2H0 YOzXrw8G8vR8BtHZPQD+NE4Zhf7Y0w0JtKqy6E5bSowikeSJsKSDur8zxO+kf8E= =UPak -----END PGP SIGNATURE-----

8 11

Re: [tor-relays] New Here
by Paul Templeton 21 Aug '17

21 Aug '17

Another odd thin is atlas will say its down for say three hours but there are up to 1900 connections thumping away from other relays. The node has been running longer but I restarted thinking something was wrong. LOL But like I said its not a problem - I'm wait to see if the VM provider has an issue and at 5 euros per month I'll run others in other country's for that money. Shame its to expensive to run one here in OZ. *SIGH* ----- Original Message ----- From: "Keepyourprivacy" <keepyourprivacy(a)protonmail.ch> To: tor-relays(a)lists.torproject.org Sent: Saturday, August 12, 2017 12:18:03 AM Subject: Re: [tor-relays] New Here That's strange. Usually you shouldn't see more traffic than advertised. Atlas is saying: Bandwidth rate: 300 KiB/s Bandwidth burst: 500 KiB/s Observed bandwidth: 638.69 KiB/s Strange thing is, that the observed bandwidth is higher than your the one you are advertising. Maybe someone else can say something about this. The "spikes" can come from the measurments, but usually the aren't that big that you should see such a high spikes. The only thing i saw is, that you are using RelayBandwidthRate instead of just BandwidthRate in your config file. Don't know if this makes any difference? -------- Original Message -------- Subject: Re: [tor-relays] New Here Local Time: 11 August 2017 4:10 PM UTC Time: 11 August 2017 2:10 PM From: paul(a)coffswifi.net To: tor-relays(a)lists.torproject.org nickname: coffswifi Provider 1&1 torrc: RunAsDaemon 1 Address 82.223.27.82 Nickname coffswifi RelayBandwidthRate 300 KBytes RelayBandwidthBurst 500 KBytes ContactInfo Paul <paul AT coffswifi dot net> DirPort 9030 ExitRelay 1 I'm running the default exit policy... From: "Keepyourprivacy" <keepyourprivacy(a)protonmail.ch> To: tor-relays(a)lists.torproject.org Sent: Saturday, August 12, 2017 12:03:20 AM Subject: Re: [tor-relays] New Here Thanks for running an exit! Mind sharing your torrc configuration? Maybe something is wrong in there... Which provider are you using? Tor relay nickname would be helpful too <blockquote> -------- Original Message -------- Subject: [tor-relays] New Here Local Time: 11 August 2017 3:50 PM UTC Time: 11 August 2017 1:50 PM From: paul(a)coffswifi.net To: tor-relays(a)lists.torproject.org Hi all, Have been running a mirror for a couple of years and haven"t had much time to dedicate to and exit node but have finally committed to it. Found a provider that doesn"t seem to have a cap on data and it will cost me about five euros a month. Question I have is two fold. First I find that atlas.torproject.org sometime says the node is down but its running and connected. Secondly how dose the bandwidth throttling work. I have set it to 300kbits with 500kbit burst but I can see the in/out traffic staying over 1mb for large periods of time and bursting to 7/8mb. Its not a problem just curios. Regards, Paul torproject.coffswifi.net _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays </blockquote> _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

6 6

significant rise in fail2ban alerts for ssh abuse
by Dirk 21 Aug '17

21 Aug '17

Dear all, we receive a significant rise of ssh login abuse mails which reach us and unfortunately our providers. By significant I mean an amount that starts flooding our abuse inbox. All abuse emails are structured the same way and point to Fail2Ban as originator. Do we have just bad luck and someone uses our severs to brute force all of SSH out there OR is there a new Fail2Ban or Linux distribution release which fosters or enables this fail2ban abuse mails be default ? As far as I know the functionality of Fail2Ban is old. If there would be a Linux distribution which enables this I would like to talk to the maintainer and let him know that he at least tries to read the correct abuse entry from ripe instead of bothering our provider as well. For a limited time we will now reject port 22. But really do not like this solution. I would rather like to find out the source of this rise in numbers. best regards Dirk Example 1 ---- Dear Sir/Madam, We have detected abuse from the IP address 1.1.1.x, which according to a whois lookup is on your network. We would appreciate if you would investigate and take action as appropriate. Log lines are given below, but please ask if you require any further information. (If you are not the correct person to contact about this please accept our apologies - your e-mail address was extracted from the whois record by an automated process. This mail was generated by Fail2Ban.) Note: Local timezone is +0300 (MSK) Aug 6 08:35:23 srv sshd[3534]: Invalid user admin from 1.1.1.x Aug 6 08:35:25 srv sshd[3534]: Failed password for invalid user admin from 1.1.1.x port 50789 ssh2 Aug 6 08:35:25 srv sshd[3534]: Connection closed by 1.1.1.x [preauth] Aug 6 12:26:03 srv sshd[28169]: Invalid user admin from 1.1.1.x Aug 6 12:26:05 srv sshd[28169]: Failed password for invalid user admin from 1.1.1.x port 35677 ssh2 Aug 6 12:26:06 srv sshd[28169]: Connection closed by 1.1.1.x [preauth] Example 2 ---- Dear Sir/Madam, We have detected abuse from the IP address 1.1.1.x, which according to a whois lookup is on your network. We would appreciate if you would investigate and take action as appropriate. Log lines are given below, but please ask if you require any further information. (If you are not the correct person to contact about this please accept our apologies - your e-mail address was extracted from the whois record by an automated process. This mail was generated by Fail2Ban.) Note: Local timezone is +0200 (CEST) Aug 7 17:41:14 vps3xxx sshd[32746]: Invalid user admin from 1.1.1.x Aug 7 17:41:14 vps3xxx sshd[32746]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.1.1.x Aug 7 17:41:16 vps3xxx sshd[32746]: Failed password for invalid user admin from 1.1.1.x port 60497 ssh2 Aug 7 17:41:16 vps3xxx sshd[32746]: Connection closed by 1.1.1.x port 60497 [preauth]

6 6

End of Life Relays
by nusenu 19 Aug '17

19 Aug '17

Hello relay operator, Please note that recently (2017-08-01) a few tor releases reached end of life and are no longer maintained (no security and bugfixes) [1]. Please consider upgrading to a supported release if you are affected. To find out whether you are running an end of life tor release you can search for your relay nickname on [2] or on https://atlas.torproject.org. As of 2017-08-19 still >9% of the tor network run on end of life releases. thanks for running tor relays, nusenu [1] https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CoreTor… [2] https://nusenu.github.io/OrNetStats/eolrelays -- https://mastodon.social/@nusenu https://twitter.com/nusenu_

1 0

bwauth in testing
by Tom Ritter 18 Aug '17

18 Aug '17

After suffering the loss of maatuska's bwauth several months ago, we have re-provisioned it thanks to the gracious help from https://coldhak.ca/ It has completed an initial scan of the network[0] and is reporting its data here: http://198.51.75.50/bwauth/bwscan.V3BandwidthsFile This week I intend to flesh out the remaining aspects of the bwauth (debug logging, alerting to detect downtime, get a proper domain name, ssl cert, etc) as well as do some sanity checking on its output. If all goes well, I'll submit it to maatuska for inclusion at the end of the week. But I wanted to announce it here, both to give an update, and let the community take a look at its output and see if anything looks fishy. The bwauths themselves tend to disagree, partly because of the eb and flow of network speeds and partly because they are designed to (they all measure from different network vantage points) - but they ideally are in some sort of rough agreement. -tom [0] "Measured 99.7% of all tor nodes (99.6% of previous consensus bw)."

3 4

r-pi tor relay fails after debian stretch update
by jah knee 18 Aug '17

18 Aug '17

hi i am running a relay on a raspberry pi v.1. it ran along just fine until i updated to debian stretch. i have reviewed the config to see what could be wrong, but i cannot find anything. this is what gets put in the logs over and over: Aug 18 09:52:41.000 [notice] Tor 0.2.9.11 (git-572f4570e1771890) opening log file. Aug 18 09:52:41.116 [notice] Tor 0.2.9.11 (git-572f4570e1771890) running on Linux with Libevent 2.0.21-stable, OpenSSL 1.1.0f and Zlib 1.2.8. Aug 18 09:52:41.122 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning Aug 18 09:52:41.122 [notice] Read configuration file "/usr/share/tor/tor-service-defaults-torrc". Aug 18 09:52:41.123 [notice] Read configuration file "/etc/tor/torrc". Aug 18 09:52:41.194 [notice] Opening OR listener on 0.0.0.0:9001 Aug 18 09:52:41.199 [notice] Opening Directory listener on 0.0.0.0:9030 Aug 18 09:52:41.000 [notice] Parsing GEOIP IPv4 file /usr/share/tor/geoip. Aug 18 09:52:44.000 [notice] Parsing GEOIP IPv6 file /usr/share/tor/geoip6. Aug 18 09:52:45.000 [notice] Configured to measure statistics. Look for the *-stats files that will first be written to the data directory in 24 hours from now. Aug 18 09:52:48.000 [notice] Your Tor server's identity key fingerprint is <X> Aug 18 09:52:48.000 [notice] Bootstrapped 0%: Starting Linux <hostname> 4.9.41+ #1023 Tue Aug 8 15:47:12 BST 2017 armv6l GNU/Linux i've been thinking about moving this node to another machine as i've read on this list how underpowered machines do not really help the network [i can't say i could repeat the details of the arguments, but they made sense to me when i read them]. but i'd still like to contribute ... any help or pointers appreciated. dankon

2 1

blocking >1 connections per ip address onto Tor DirPort
by Felix 17 Aug '17

17 Aug '17

Hi everybody >>> Does a particular Tor server/client will open more than 1 >>> connection at a time from to the DirPort ? >> If you're worried about denial of service issues on the DirPort, >> maybe the simple answer is to turn off the DirPort? I think the >> only real impact might have something to do with whether old >> clients believe that you're a usable guard. > understood - removed those iptables rules Good discussion. My experience is protecting the dirport makes sense to avoid ddos attempts. During my Debian times this rule worked fine for me: /sbin/iptables -A INPUT -p tcp -d $IPEXT --dport 80 -j ACCEPT -m limit --limit 5/s --limit-burst 50 On FreeBSB I go with something like: pass in on $IFEXT inet proto tcp from !<blockDIR> to $IPEXT port 80 flags S/SA keep state (max 150,max-src-states 50,max-src-conn 50, max-src-conn-rate 20/10,overload <blockDIR>) # release the blockDIR after some hours pfctl -t blockDIR -T expire 7200 # hourly cron job -- Cheers, Felix

1 0

Shirts
by Sebastian Urbach 17 Aug '17

17 Aug '17

Good Morning, I was asked recently by friends & family if i could get the traditional Tor shirt for them. I showed them the new Tor shirt and well let's say they really want the traditional shirt. Any chance to get it anywhere ? torservers.net is just offering size M /L and that's not going to work ... Thanks -- Sincerely yours / M.f.G. / Sincères salutations Sebastian Urbach --------------------------------------------------------------------------- Those who surrender freedom for security will not have, nor do they deserve, either one. --------------------------------------------------------------------------- Benjamin Franklin (1706-1790)

2 2

Relay Operators Meetup at BornHack
by Alexander Færøy 16 Aug '17

16 Aug '17

Hello relay operators, DrWhax and I will host a small relay operators meetup at the upcoming BornHack festival in Denmark. If you happen to be around and want to join please keep yourself updated with the event schedule on the BornHack website or track the meetup event directly at https://www.bornhack.dk/bornhack-2017/program/tor-relay-operators-meetup/ :-) All the best, Alex.

1 0

What causes circuits to collapse?
by Igor Mitrofanov 16 Aug '17

16 Aug '17

Hi, I have configured a Tor bridge to go through a particular Tor guard relay (that I also own), as an experiment. Upon initialization I am getting this warning: "Your guard [fingerprint] is failing an extremely large amount of circuits. This could indicate a route manipulation attack, extreme network overload, or a bug. Success counts are 52/275. Use counts are 67/67. 268 circuits completed, 0 were unusable, 217 collapsed and 1 timed out. For reference, your timeout cutoff is 60 seconds". Both relays are running Tor 3.0.10. I have never received this warning before. How do I interpret the numbers above, and debug the issue? The guard is far from saturating its network bandwidth. It has 98% idle CPU and plenty of free memory. I am not running any attacks against it. It does use a tuned-up sysctl.conf but I have never had any problems with it. "tcpdump icmp" does not show anything interesting. There are no warnings in the guard's log. Thanks, Igor

2 1

Re: [tor-relays] keepyourprivcay: Introducing a new 100 mbit/s relay
by Keepyourprivacy 16 Aug '17

16 Aug '17

Another 100 mbit/s relay has been added, located in sweden. MyFamily entry set in torrc. https://atlas.torproject.org/#details/B92CADBD1E9A2F72E64D7DE5A1BF5B2B30DA7…

2 1

IXPs in the United States
by Christopher 14 Aug '17

14 Aug '17

Hello, Emerald Onion (https://twitter.com/EmeraldOnion) is researching Internet Exchange Points in the United States in order to bolster Tor relay deployments within our legal jurisdiction. We have blogged a list of IXPs we've identified so far: https://emeraldonion.org/internet-exchange-points-in-the-united-states/ Please note that Emerald Onion would not be the org to deploy more relays in other cities. We are interested in helping others in those regions become their own ISP. (See https://emeraldonion.org/development/ for related education.) 1. Are there any Tor routers connected to any United States-based IXPs? If so, which ones and who operates them? We know of at least four: a. Calyx Institute on NYIIX https://www.peeringdb.com/net/4594 b. XMission on Equinix Ashburn, SIX Seattle, and SLIX https://www.peeringdb.com/net/789 c. Riseup Networks on SIX Seattle https://www.peeringdb.com/net/9021 d. Emerald Onion on SIX Seattle https://www.peeringdb.com/net/14010 2. Is this IXP friendly to Tor? 3. What is the organizational structure of this IXP? Such as corporate-run or community-driven, etc. Please let me know if you have any helpful information. I'm also reachable via Signal. https://yawnbox.com/contact/ Cheers, Yawnbox

1 0

Re: [tor-relays] 60 new neu.edu relays in 16 minutes
by privacy＠ccs.neu.edu 12 Aug '17

12 Aug '17

Hello nusenu, DocTor and OrNetRadar detected that someone added 60 tor relays [1] with your email address in the contact info field on 2017-08-08 between 15:45 and 16:01 UTC. [1] https://nusenu.github.io/OrNetRadar/2017/08/08/a7.html <https://nusenu.github.io/OrNetRadar/2017/08/08/a7.html> Since tor relay contact information is not authenticated I was wondering if these are in fact your relays? (I guess they are) Yes indeed they are ours. We started them all at the same time to make it clear that they are all run but one group of researchers. You obviously don't have to answer but if you want to I'm curious: Are these just temporary relays and part of your research or are they here to stay to increase the capacity of the tor network for more than just a few weeks or months? I assume you are not planing to run them for a longer period of time (>6months), but if you do you: Please consider network diversity when adding that amount of tor relay capacity. All your relays are operated in AS "Online S.a.s" - which is already the second biggest AS in terms of tor network capacity. At this stage we are not planning to run it for more than 6 months or so (but this might change). We understand that your concern is primarily about capacity diversity not trust in "Online S.a.s" since anyway it's already the second largest provider for Tor relays. Our experiments are not related to the traffic (and since all our relays are part of the same family at most one of them would be used in any circuit). We are using Online S.a.s because it it is cheap (I guess it's the same reason why others use it). We will check in the next couple of days if there is an alternative low cost provider. We have also limited our bandwidth but can increase it if more people express interest and it can help (we didn’t want to look like we are trying to attract/intercept traffic). +-----------------------------+-------------+ | AS Name | CW Fraction | +-----------------------------+-------------+ | OVH SAS | 15.95 | | Online S.a.s. | 13.41 | | Hetzner Online GmbH | 7.74 | | Digital Ocean, Inc. | 6.65 | | myLoc managed IT AG | 2.63 | +-----------------------------+-------------+ Also the country (FR) is not ideal from a diversity point of view. :) 14 of our relays are in the Netherlands but will make sure to diversify if we have to restart them. thanks for running relays, nusenu Note: There is nothing wrong with adding 60 tor relays, especially with proper MyFamily configuration as you did. Thank you for the positive note and feedback!

2 2

New Here
by Paul Templeton 12 Aug '17

12 Aug '17

Hi all, Have been running a mirror for a couple of years and haven't had much time to dedicate to and exit node but have finally committed to it. Found a provider that doesn't seem to have a cap on data and it will cost me about five euros a month. Question I have is two fold. First I find that atlas.torproject.org sometime says the node is down but its running and connected. Secondly how dose the bandwidth throttling work. I have set it to 300kbits with 500kbit burst but I can see the in/out traffic staying over 1mb for large periods of time and bursting to 7/8mb. Its not a problem just curios. Regards, Paul torproject.coffswifi.net

5 7

keepyourprivcay: Introducing a new 100 mbit/s relay
by Keepyourprivacy 11 Aug '17

11 Aug '17

Hello fellow operators of tor relays out there! :) I'd like to introduce my new relay, it's called keepyourprivacy and hosted in the Netherlands, at a provider which is known for high uptime and great network connectivity. Because it isn't very cheap, it's not very common used for tor relays, so i think it's a good choice for a better network diversity. :) Sure, i liked the idea of running a cheap relay at Kimsufi or something, but there are so many of this relays out there, which isn't good for the basic idea of Tor. It's running on a dedicated server with an dedicated 100 mbit/s full-duplex uplink, which is only used for Tor. So over 60 TB can be pushed each month. In these days Tor needs more help than ever, because VPN bans becoming more and more common - look at China or Russia for example. https://atlas.torproject.org/#details/59633E5F42DDA009798B173944367D7F50B1B… I'm also playing with the idea to change this relay to an exit node, but i'm a little bit worried about possible legal consequences. I would run it with an reduced policy however, but there is still the risk, that someone is doing fraud - or even worse - transmit child pornography over it. And that's nothing i'd like to be involved with it. But i know that it would help the Tor network even more. But for now, i think the middle relay with high uptime, capacity and with a not so common provider like OVH or online.net will still help the community to improve the connectivity. Let me know your thoughts! :)

6 6

Two research groups studying onion services and running relays
by Roger Dingledine 10 Aug '17

10 Aug '17

Hi relay operators! I want to let you know about two upcoming research projects by academic research groups. The tl;dr is that they're running relays to do certain measurements, and so far as we can tell the proposed methodology is safe enough and worthwhile enough, but we invite you (and everybody) to evaluate it too. If you didn't already know about the Tor Research Safety Board, now you do: https://research.torproject.org/safetyboard.html https://blog.torproject.org/blog/tor-heart-pets-and-privacy-research-commun… The board's goal is to help researchers do better and safer research, that is, to *minimize privacy risks while fostering a better understanding of the Tor network and its users*. The board has been low-profile so far because it's just starting up, but now that we've handled six cases, I've put the details of some of these cases up on the safety board page: https://research.torproject.org/safetyboard.html#examples (Some of the cases are still anonymized because their paper is not yet finished or submitted or accepted.) In particular, check out cases 2017-02 and 2017-03. They have each put up a web page explaining their research project and why it's safe, and listing which relays are associated with the research. http://tor.ccs.neu.edu/ https://onionpop.github.io/ Let us know if you have any questions. --Roger

2 2

60 new neu.edu relays in 16 minutes
by nusenu 09 Aug '17

09 Aug '17

Hello privacy(a)ccs.neu.edu, DocTor and OrNetRadar detected that someone added 60 tor relays [1] with your email address in the contact info field on 2017-08-08 between 15:45 and 16:01 UTC. [1] https://nusenu.github.io/OrNetRadar/2017/08/08/a7.html Since tor relay contact information is not authenticated I was wondering if these are in fact your relays? (I guess they are) You obviously don't have to answer but if you want to I'm curious: Are these just temporary relays and part of your research or are they here to stay to increase the capacity of the tor network for more than just a few weeks or months? I assume you are not planing to run them for a longer period of time (>6months), but if you do you: Please consider network diversity when adding that amount of tor relay capacity. All your relays are operated in AS "Online S.a.s" - which is already the second biggest AS in terms of tor network capacity. +-----------------------------+-------------+ | AS Name | CW Fraction | +-----------------------------+-------------+ | OVH SAS | 15.95 | | Online S.a.s. | 13.41 | | Hetzner Online GmbH | 7.74 | | Digital Ocean, Inc. | 6.65 | | myLoc managed IT AG | 2.63 | +-----------------------------+-------------+ Also the country (FR) is not ideal from a diversity point of view. thanks for running relays, nusenu Note: There is nothing wrong with adding 60 tor relays, especially with proper MyFamily configuration as you did. -- https://mastodon.social/@nusenu https://twitter.com/nusenu_

2 2

alternating consensus weight
by Toralf Förster 09 Aug '17

09 Aug '17

1 0

Tor exit nodes attacking SSH?
by Steven Chamberlain 09 Aug '17

09 Aug '17

Hi, I often run my SSH sessions via Tor using tsocks. But today I see: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the RSA key sent by the remote host is e7:0e:73:a5:88:23:67:9c:01:87:3c:61:96:f6:e8:0a. Further investigation shows that this happens for any destination IP address, even where there's no SSH service running: $ tsocks ssh -vC root(a)8.8.8.8 OpenSSH_6.7p1 Debian-5+deb8u3, OpenSSL 1.0.1t 3 May 2016 debug1: Reading configuration data /home/steven/.ssh/config debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 19: Applying options for * debug1: Connecting to 8.8.8.8 [8.8.8.8] port 22. debug1: Connection established. debug1: identity file /home/steven/.ssh/id_rsa type 1 debug1: key_load_public: No such file or directory debug1: identity file /home/steven/.ssh/id_rsa-cert type -1 debug1: identity file /home/steven/.ssh/id_dsa type 2 debug1: key_load_public: No such file or directory debug1: identity file /home/steven/.ssh/id_dsa-cert type -1 debug1: key_load_public: No such file or directory debug1: identity file /home/steven/.ssh/id_ecdsa type -1 debug1: key_load_public: No such file or directory debug1: identity file /home/steven/.ssh/id_ecdsa-cert type -1 debug1: key_load_public: No such file or directory debug1: identity file /home/steven/.ssh/id_ed25519 type -1 debug1: key_load_public: No such file or directory debug1: identity file /home/steven/.ssh/id_ed25519-cert type -1 debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_6.7p1 Debian-5+deb8u3 debug1: Remote protocol version 2.0, remote software version dropbear_2015.67 debug1: no match: dropbear_2015.67 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-ctr hmac-sha2-256 zlib(a)openssh.com debug1: kex: client->server aes128-ctr hmac-sha2-256 zlib(a)openssh.com debug1: sending SSH2_MSG_KEX_ECDH_INIT debug1: expecting SSH2_MSG_KEX_ECDH_REPLY debug1: Server host key: RSA e7:0e:73:a5:88:23:67:9c:01:87:3c:61:96:f6:e8:0a The authenticity of host '8.8.8.8 (8.8.8.8)' can't be established. RSA key fingerprint is e7:0e:73:a5:88:23:67:9c:01:87:3c:61:96:f6:e8:0a. Are you sure you want to continue connecting (yes/no)? : I could be wrong, but I think this "dropbear" service is most likely something malicious, running on one or more Tor exit nodes, attempting to collect passwords of people logging in this way. If a user ignored the error (or trusts the fingerprint without verifying), their password, and further activity on the shell could all be captured by the attacker. Since Tor makes my client connections anonymous, and the dropbear is seen even for hosts that don't provide an SSH service, makes me think this attack is indiscriminate, not targetted only at me or my servers. The first time you connect to some machine, be careful to verify the fingerprint through independent means. Pay attention to notices like this of changed key fingerprints. And if you haven't already, disable PasswordAuthentication to something that cannot be intercepted (like authorization of private RSA/ECDSA keys). Regards, -- Steven Chamberlain steven(a)pyro.eu.org

7 8