- tor-relays - lists.torproject.org

Outgoing Connections to middle nodes?
by balbea16 03 Dec '16

03 Dec '16

Hi There, I've got a quick question. I have been running a tor relay since 3 months. I don't have a guard flag, however many outgoing connections to non exit relays (i.e. that should be middles than). Does that mean I run an entry node (without having guard status)? How come?TNX Mike

4 3

Re: [tor-relays] Outgoing Connections to middle nodes?
by balbea16 03 Dec '16

03 Dec '16

TNX for the fast response. Unfortunately I can't open .asc files on my mobile phone. I've to try this later at home. Von meinem Samsung Gerät gesendet. -------- Ursprüngliche Nachricht -------- Von: nusenu <nusenu(a)openmailbox.org> Datum: 03.12.16 13:12 (GMT+01:00) An: tor-relays(a)lists.torproject.org Betreff: Re: [tor-relays] Outgoing Connections to middle nodes? _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

Re: [tor-relays] [OrNetRadar] AS: "Choopa, LLC" - Linux (20), "GMO Internet, Inc" (10)
by nusenu 30 Nov '16

30 Nov '16

I hope you got them on your radar as well. Wondering for which HS they will become the hsdir +------------+----------+-------+----------------------+ | FP | nickname | hsdir | as_name | +------------+----------+-------+----------------------+ | 0759DB6F6C | schedule | 0 | GMO Internet,Inc | | 0759DB6F9F | dengue | 0 | GMO Internet,Inc | | 0759DB6FA6 | Almond | 0 | GMO Internet,Inc | | 09A54DB0F2 | epitome | 1 | Choopa, LLC | | 09A54DB35E | euler | 0 | GMO INTERNET PTE LTD | | 09A54DB3F5 | niche | 1 | GMO Internet,Inc | | 1F00D604D2 | Unnamed | 0 | Choopa, LLC | | 2FDDD920C8 | fufu | 0 | Choopa, LLC | | 32E71B90DA | zebra | 0 | GMO Internet,Inc | | 3968276F7A | pizza | 0 | Choopa, LLC | | 71363B816E | dessert | 0 | GMO Internet,Inc | | 71363B83B2 | bury | 0 | GMO Internet,Inc | | 905CC77C4B | sour | 0 | Choopa, LLC | | A0E83AA0E2 | bowl | 1 | GMO Internet,Inc | | A0E83AA191 | truth | 1 | GMO INTERNET PTE LTD | | A0E83AA283 | develop | 1 | Choopa, LLC | | DE2702F4E5 | genre | 1 | Choopa, LLC | | EBF154D8BB | quinoa | 1 | Choopa, LLC | | EBF154D9E2 | quote | 1 | Choopa, LLC | | EBF154DA21 | monk | 1 | Choopa, LLC | | F87AD9C6A1 | caker | 0 | Choopa, LLC | | FD1F34023C | Unnamed | 0 | Choopa, LLC | +------------+----------+-------+----------------------+ ornetradar(a)riseup.net: > 2016-11-23 > ----------------------------------------------------------------------------------------------------------------------- > Up|Ext|JoinTime| IP | CC | ORp | Dirp |Version | ContactInfo | Nickname | eFamlen > ----------------------------------------------------------------------------------------------------------------------- > 1 | 0 |03:34:42| 45.76.128.202 | us | 9001 | 9030 |0.2.8.9 | None | epitome | 1 > 1 | 0 |03:34:46| 45.76.128.202 | us | 9002 | 9031 |0.2.8.9 | None | develop | 1 > 0 | 0 |07:08:45| 45.32.48.248 | jp | 9001 | 9051 |0.2.8.9 | None | caker | 1 > 0 | 0 |07:13:14| 45.32.48.248 | jp | 9001 | 9051 |0.2.8.9 | None | caker | 1 > 0 | 0 |07:22:52| 45.32.48.248 | jp | 9002 | 9052 |0.2.8.9 | None | fufu | 1 > 0 | 0 |15:09:32| 104.238.165.134 | us | 9001 | 9030 |0.2.8.9 | None | pizza | 1 > 0 | 0 |15:09:44| 104.238.165.134 | us | 9002 | 9031 |0.2.8.9 | None | monk | 1 > 1 | 0 |17:20:05| 104.238.165.134 | us | 9001 | 9030 |0.2.8.9 | None | pizza | 1 > 1 | 0 |17:23:04| 104.238.165.134 | us | 9002 | 9031 |0.2.8.9 | None | monk | 1 > 1 | 0 |18:25:05| 107.191.47.191 | fr | 9001 | 9030 |0.2.8.9 | None | genre | 1 > 1 | 0 |18:27:05| 107.191.47.191 | fr | 9002 | 9031 |0.2.8.9 | None | quote | 1 > 1 | 0 |19:15:05| 45.63.20.92 | us | 9001 | 9030 |0.2.8.9 | None | sour | 1 > 1 | 0 |19:17:05| 45.63.20.92 | us | 9002 | 9031 |0.2.8.9 | None | quinoa | 1 > 1 | 0 |12:30:24| 150.95.143.40 | jp | 9001 | 9030 |0.2.8.9 | > 1 | 0 |12:30:29| 150.95.143.40 | jp | 9002 | 9031 |0.2.8.9 | > 1 | 0 |12:33:54| 133.130.122.105 | jp | 9001 | 9030 |0.2.8.9 | > 1 | 0 |12:34:02| 133.130.122.105 | jp | 9002 | 9031 |0.2.8.9 | > 0 | 0 |12:41:09| 150.95.142.186 | jp | 9001 | 9030 |0.2.8.9 | > 0 | 0 |12:41:14| 150.95.142.186 | jp | 9002 | 9031 |0.2.8.9 | > 1 | 0 |13:30:05| 163.44.113.116 | us | 9001 | 9030 |0.2.8.9 | > 1 | 0 |13:35:05| 163.44.113.116 | us | 9002 | 9031 |0.2.8.9 | > 1 | 0 |14:50:05| 150.95.142.186 | jp | 9001 | 9030 |0.2.8.9 | > 1 | 0 |14:55:05| 150.95.142.186 | jp | 9002 | 9031 |0.2.8.9 |

1 0

Assigning new IP adrees to current relay
by Sec INT 30 Nov '16

30 Nov '16

Hi I have more than one ip address in a server - I want to assign a new ip to a current relay that I am running. The new ip is correctly setup on my ubuntu server so i know thats ok In order to make the relay use the new ip I added Address <New IP Address> to the torrc file and restarted tor - this did seem to work and tor detectedthe new address and started to use it but then I got a number of warnings like 'Remote server sent bogus reason code' The relay does seem to be working but with these errors im not sure - is the method above how you should assign a particular IP address to a Tor relay? Thanks for any advice Snap

3 9

re
by dark side 29 Nov '16

29 Nov '16

re

1 0

(no subject)
by dark side 29 Nov '16

29 Nov '16

i need some relays bridges to use

3 2

i need some bridges
by dark side 29 Nov '16

29 Nov '16

1 0

Blocking PSN
by SuperSluether 29 Nov '16

29 Nov '16

I keep getting Account Takeover Attempt abuses on my Tor exit, and I'm not sure how to handle them: It is most likely the attack traffic is directed at one of the following endpoints: account.sonyentertainmentnetwork.com auth.np.ac.playstation.net auth.api.sonyentertainmentnetwork.com auth.api.np.ac.playstation.net These endpoints on our network are resolved by Geo DNS, so the IP addresses they resolve to will depend on the originating IP address. The destination port will be TCP 443. I used 'dig' and 'ping' to see what IP address the 4 endpoints resolved as, and blocked the resulting addresses, but I'm still getting the abuse. The Whois records show Sony and PSN owning 63.x.x.x, 64.x.x.x, 68.x.x.x, and 108.x.x.x addresses, but the websites above resolve to 23.x.x.x, so either the lists are incomplete or I'm doing something wrong. Any ideas?

2 1

Vodafone Italia blocking traffic from IPs that belong to Tor relays
by fr33d0m4all 27 Nov '16

27 Nov '16

Hi, I just want to share my recent time experience with Vodafone Italia (mobile carrier). Some days ago, for the first time, I was surfing Vodafone.it site from my home network where I run a Tor non-exit relay, and when I surfed "https://ricarica.vodafone.it/" I've got the following error page: Access denied (403) Active policy for this site prohibits access from TOR Network. For further information, do not hesitate to contact us. Contact us: support+vodafone(a)reblaze.com For a reference, please provide the following paragraph: [MyIPAddress]://vodafone-rbzr2313438303139323634335aee0f47488438e0 [1480192643] I wrote to reblaze.com, I've explained that I'm running a non-exit relay and that even if Vodafone is saying that traffic from Tor (they say TOR -__- ) Network, no traffic from Tor network can reach the public network (and so their site) from my own relay. This was my email: Hi, today I've received the attached error when trying to pay on Vodafone Italia site and I want to point out that it is a false positive. The error is "Active policy for this site prohibits access from Tor Network." and I was surfing the web directly from my public IP address X.X.X.X. As you can see on ExoneraTor this IP address also hosts a Tor <<middle>> relay: https://exonerator.torproject.org/?ip=X.X.X.X&timestamp=2016-11-24 If you gave a close look to that Tor Relay, you can see that it is DEFINITELY NOT A TOR EXIT RELAY, so you/Vodafone can't receive any traffic from Tor Network from my relay, since it is only a transit Tor relay: https://atlas.torproject.org/#details/xxxxxxx (Exit policy is reject, so it is not an Exit relay). So, I understand that you want to block sessions coming from Tor network, but you should definitely get a list of Tor exit relays only, not the full list of Tor relays that includes Tor relays that will NEVER send traffic from Tor network to public network. I'd like to understand why you're blocking sessions coming from an IP address that hosts a non-exit relay. And this is their reply: Hi currently this web site policy is to block any IP that is identified as TOR Relay: "Looking up IP address X.X.X.X on or within one day of 2016-11-24. Tor clients could have selected this or these Tor relays to build circuits." we are not checking the "Reject Policy" we will check the issue with the web site administrators Thanks Reblaze Support . I think I won't receive any further info from Vodafone, BTW if they reply, I'll share their answer with you. Have a nice weekend, Fr33d0m4all -- _____________________________________________________________ PGP Key: 0DA8 7293 D561 3AEE A3C0 7F63 101F 316A F30E ECB4 IRC Nick: fr33d0m4all (OFTC & Freenode) _____________________________________________________________

4 3

new (?) : Average packaged cell fullness: 96.772%. TLS write overhead: 96%
by Toralf Förster 27 Nov '16

27 Nov '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I do wonder about a log message which seems not to appear before : ==> /tmp/notice.log <== Nov 26 20:10:45.000 [notice] Performing bandwidth self-test...done. Nov 26 20:19:44.000 [notice] New control connection opened from 127.0.0.1. Nov 26 20:31:13.000 [notice] Received reload signal (hup). Reloading config and resetting internal state. Nov 26 20:31:13.000 [notice] Read configuration file "/etc/tor/torrc". Nov 26 20:31:13.000 [notice] Tor 0.2.9.5-alpha opening log file. Nov 26 20:36:23.000 [notice] New control connection opened from 127.0.0.1. Nov 27 02:10:32.000 [notice] Heartbeat: Tor's uptime is 5:59 hours, with 41 circuits open. I've sent 406.63 MB and received 127.30 MB. Nov 27 02:10:32.000 [notice] Average packaged cell fullness: 96.772%. TLS write overhead: 96% Nov 27 02:10:32.000 [notice] Circuit handshake stats since last time: 0/0 TAP, 3640/3640 NTor. Nov 27 02:10:32.000 [notice] Since startup, we have initiated 0 v1 connections, 0 v2 connections, 0 v3 connections, and 16 v4 connections; and received 0 v1 connections, 1 v2 connections, 15 v3 connections, and 136434 v4 connections. - -- Toralf PGP: C4EACDDE 0076E94E -----BEGIN PGP SIGNATURE----- iHYEAREIAB4FAlg6otwXHHRvcmFsZi5mb2Vyc3RlckBnbXguZGUACgkQxOrN3gB2 6U617AEAh8aGU0wEv3x3OlAOCLBr1HlvVWMVi3ZThqVAvdUmDEAA/2Ruu29iGmO+ zoLs+JRpCno2YSDBfnDmW/vv5qjsmA14 =M7JX -----END PGP SIGNATURE-----

2 2

Tor relay questions
by Sec INT 24 Nov '16

24 Nov '16

Hi Ive been running a relay as a test for a broader rollout including an exit but Im not sure of a few things and am finding it difficult to get further information so here goes - my relay is running at the moment but on atlas it has a line through the uptime? Is this something with 'Accounting' soft? - for server monitoring Im using nagios but it is very difficult to set this up to monitor bandwidth use does anyone know of a tool to do this? (Im using webmin to record bandwidth use but it doesnt have any alerting on it) - on atlas i dont seem to have any bandwidth showing? - what is HSDir and V2dir on atlas flags mean? - ive seen the good/bad isp page but this seems quite old is there anywhere to get more up to date information on good isps? Im looking at implementing 4-5 relays any suggestions about where and any isps that may allow tor in these regions? Thanks for any help Snap

3 3

Problem with sendmail on relay
by Berta Gieselbusch 24 Nov '16

24 Nov '16

Good morning, I've setup my first relay. Until now everything seems to be working fine, but I keep getting mails from logcheck I don't know how to deal with. The reported errors are: "sm-mta[15148]: STARTTLS=client, relay=smtpin.rzone.de., version=TLSv1/SSLv3, verify=FAIL, cipher=ECDHE-RSA-AES256-GCM-SHA384, bits=256/256". Thank you for any hints! Best wishes Berta

3 4

Re: [tor-relays] 33C3 Ticket
by narkopolo＠riseup.net 22 Nov '16

22 Nov '16

I am in the same position. 2016-11-21 23:17 GMT+01:00 pa011 <pa011(a)web.de>: > Looking to meet other Exits in Hamburg - just need a ticket :-) > > Paul > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

7 10

Fwd: Spam mailout
by Petrusko 21 Nov '16

21 Nov '16

Hey, Here a copy of a mail containing an attached file logs_petrusko.zip containing .js sent to my mail address used for relays... This file edit here : https://framabin.org/?0b8d246a55e76e07#deg6j9x5HjLbtOhY9rA6FIiINzthE0t+qfYU… It smells like shit... I'm not 100% sure, but first time it happens on this mailbox. May be a new bot scanning relays informations...? Take care. ps: torrc contains this mail address obfuscated... not enough may be ? Here is the mail (name changed...), : Dear petrusko We've been receiving spam mailout from your address recently. Contents and logging of such messages are in the attachment. Please look into it and contact us. Best Regards, Marian Henderson ISP Support Tel.: xxx

4 4

33C3 Ticket
by pa011 21 Nov '16

21 Nov '16

Looking to meet other Exits in Hamburg - just need a ticket :-) Paul

1 0

Bug Log
by Kevin Zvilt 20 Nov '16

20 Nov '16

11/18/2016 17:28:08 PM.600 [NOTICE] Bootstrapped 85%: Finishing handshake with first hop 11/18/2016 17:28:08 PM.900 [NOTICE] Bootstrapped 90%: Establishing a Tor circuit 11/18/2016 17:28:10 PM.300 [NOTICE] Tor has successfully opened a circuit. Looks like client functionality is working. 11/18/2016 17:28:10 PM.300 [NOTICE] Bootstrapped 100%: Done 11/18/2016 17:28:11 PM.700 [NOTICE] New control connection opened from 127.0.0.1. 11/18/2016 17:28:11 PM.700 [NOTICE] New control connection opened from 127.0.0.1. 11/18/2016 17:32:25 PM.200 [NOTICE] Closing no-longer-configured Socks listener on 127.0.0.1:9150 11/18/2016 17:32:25 PM.200 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 11/18/2016 17:32:25 PM.200 [NOTICE] Closing old Socks listener on 127.0.0.1:9150 11/18/2016 17:32:25 PM.200 [NOTICE] Delaying directory fetches: DisableNetwork is set. 11/18/2016 22:38:05 PM.400 [NOTICE] Bootstrapped 85%: Finishing handshake with first hop 11/18/2016 22:38:06 PM.400 [NOTICE] Bootstrapped 90%: Establishing a Tor circuit 11/18/2016 22:38:06 PM.600 [NOTICE] Closing no-longer-configured Socks listener on 127.0.0.1:9150 11/18/2016 22:38:06 PM.600 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 11/18/2016 22:38:06 PM.600 [NOTICE] Closing old Socks listener on 127.0.0.1:9150 11/18/2016 22:38:07 PM.200 [NOTICE] Delaying directory fetches: DisableNetwork is set.

3 5

DoS from my tor guard VPS
by Arisbe 15 Nov '16

15 Nov '16

One of my tor guard relays is a medium size VPS operating in the Czech Republic. It's been up and stable for several years. Several weeks ago I was notified that my VPS was a source of UDP DoS traffic. It was shut down. Logs showed no intrusions. I installed a different instance of linux, changed my SSH port, added fail2ban and even installed clamav. I did not make changes to the tor exit policy. Then, this week I received the following: "Hello, surveillance system detected a disproportionate outgoing DoS traffic on your VPS torexitcz and then our network under a DDoS attack. Your server torexitcz has been stopped. This is another problem with your VPS. Your service will be terminated. Thanks for understanding." Can anyone offer an opinion as to how my relay was used for DoS? How can I avoid this in the future? My goal, as always is to provide stable nodes to the tor network while protecting myself and my VPS supplier. 4061C553CA88021B8302F0814365070AAE617270 185.100.85.101

5 4

Is my relay affected by cve-2016-8860?
by nusenu 15 Nov '16

15 Nov '16

https://blog.torproject.org/blog/tor-0289-released-important-fixes If you are unsure whether you are running a vulnerable tor relay, you can search your contact string on the following page (sorted by cw fraction): https://github.com/ornetstats/stats/blob/master/o/cve-2016-8860.txt (generated daily) If you are on that page you are likely running a vulnerable version (unless someone else is using your contactinfo as well) Unfortunately the opposite does not hold true - meaning you are not 100% safe if you are not listed (I tried to keep the false positives low for the price of a higher false-negative rate).

2 1

obfs4 - how to from source
by Petrusko 15 Nov '16

15 Nov '16

Hey! Coming here to take some good tips about obfs4 compil from source... Not enough time since http://archives.seul.org/or/relays/Jul-2016/msg00101.html Now it's ok to try another time ! On the Raspbian set up, I've started with : apt-get install git golang-go golang-go.crypto-dev golang-go.net-dev golang-goptlib-dev golang-ed25519-dev golang-siphash-dev After this, with /root/ account : go get git.torproject.org/pluggable-transports/obfs4.git/obfs4proxy Result is : *package git.torproject.org/pluggable-transports/obfs4.git/obfs4proxy: cannot download, $GOPATH not set. For more details see: go help gopath* I've tried many things, GOPATH=/home/petrusko and may be GOPATH=/home/petrusko/obfs4 Tried too to clone git with /git clone https://git.torproject.org/pluggable-transports/obfs4.git /And now I'm lost with this GOPATH problem ! Is there a wiki explaining how to compil/install this obfs4proxy from source. I've found nothing about it... From readme, I don't understand this... To build: `go get git.torproject.org/pluggable-transports/obfs4.git/obfs4proxy` To install: Copy `$GOPATH/bin/obfs4proxy` to a permanent location (Eg: `/usr/local/bin`) Many thx for help :) -- Petrusko EBE23AE5

2 6

Questions regarding arm on Debian
by Dennis Christ 14 Nov '16

14 Nov '16

Hi, i have installed a new relay on Debian 8 and playing around with the arm tool. 1. Issue: Seeing Connections I have added 'DisableDebuggerAttachment 0' to the config file as suggested and now i get this: 17:20:09 [ARM_NOTICE] We were unable to use any of your system's resolvers to get tor's connections. This is fine, but means that the connect- ions page will be empty. This is usually permissions related so if you would like to fix this then run arm with the same user as tor (ie, "sudo -u <tor user> arm"). 17:19:54 [ARM_NOTICE] Unable to query connections with lsof, trying ss 17:19:39 [ARM_NOTICE] Unable to query connections with sockstat, trying lsof 17:19:24 [ARM_NOTICE] Unable to query connections with netstat, trying sockstat 17:19:09 [ARM_NOTICE] Unable to query connections with proc, trying netstat Tor runs on Debian as user 'debian-tor' with no shell, so i cant just do 'sudo -u <tor user> arm' even if sudo was installed on the server. But i added my user to the debian-tor group. On a side note i never could get the CookieAuthentication working either. Seems to be permission issues with the default installation. Does somebody else have this issues on Debian? 2. Issue: It always says this message in the arm logs even if the service is just started a moment ago. If i reload the config it says the same thing shortly after. 17:18:59 [ARM_WARN] The torrc differs from what tor's using. You can issue a sighup to reload the torrc values by pressing x. - torrc values differ on lines: 118, 127 3. Issue: I dont understand this message. Nickname is edited by me so it does not match its default value. Also why is it unneeded? 17:18:59 [ARM_NOTICE] Unneeded torrc entries found. They've been highlighted in blue on the torrc page. - entry matches its default value: Nickname (line 117)

10 19

relaygroup in entry and exit position
by nusenu 14 Nov '16

14 Nov '16

Hi, thanks for running entry _and_ exit tor relays! You are one out of (currently) 7 relay operators [1] running entry _and_ exit relays (with guard probability > 0) without proper 'MyFamily' configuration. This can be dangerous for tor clients because they might choose you as entry _and_ exit relay. Please help protect tor clients by properly specifying the MyFamily configuration in your torrc files. MyFamily example configuration (a single line with all your relay fingerprints separated by comma): MyFamily 4A549160BEFA50EA10C2F4D6D80E9AFE20DBAF95,88C3708A9D71ECEC1910B63C3FAA5BF60CD7E199 https://atlas.torproject.org can help you show MyFamily misconfiguratons as well. If you need any help please let us know. kind regards, nusenu This list is auto-generated on a daily basis: [1] https://raw.githubusercontent.com/ornetstats/stats/master/o/potentially_dan…

1 0

Re: [tor-relays] torworld relays in entry and exit position
by nusenu 14 Nov '16

14 Nov '16

> We're just asking for an example line Example: MyFamily 4A549160BEFA50EA10C2F4D6D80E9AFE20DBAF95,88C3708A9D71ECEC1910B63C3FAA5BF60CD7E199 > But never the less we'll add this very soon to most of our nodes. "most"? > We're still testing our servers to see which ones will stay or get > cut from the network. We believe that next month on the 1st of > December would be a good time to add this feature. This way we'll be > done with our network testing, and the final cuts to it. This way; we > don't have to keep messing with the MyFamily line over and over > again. We've developed our own in house system for updating all the > nodes, and maintaining them. If there is an automated central management, there is no messing required at all ;)

1 0

Re: [tor-relays] torworld relays in entry and exit position
by nusenu 13 Nov '16

13 Nov '16

(resending this - not sure if the first attempt made it through) > Thank you for bringing this to our attention. We'll go a head, and do > proper research and add the MyFamily tags to all nodes. If you'd like > to give us an example copy to go off of that would be much > appreciated. If responding by email is too slow you're more than > welcomed to join our Slack team, and discuss this further in their. > https://slack.torworld.org > > Again thank you for reaching out to us. The MyFamily torrc setting is just a single line listing all your relay fingerprints. This setting tells tor clients "these are my relays: ... don't use more than one of my relays in any single circuit". This is particularly relevant if the entry _and_ exit probability of your group of relays is > 0% and your relays are spread across more than a single /16 network. Atlas.torproject.org can help you verify that the configuration is set up correctly (effective family has to list all your relays). If you expect to add/remove relays or adjust exit policies in the future on a more or less regular basis, I would suggest you use a configuration management like ansible or puppet to manage your relays - for your own convenience. I'm maintaining an ansible role to help tor relay operators manage MyFamily automatically - no more manual hassle (in addition to configure them using security features like 'OfflineMasterKey'). https://github.com/nusenu/ansible-relayor If you have any further questions - just let us know. regarding your slack group: I prefer to discuss this on the tor-relays mailing list instead of creating yet another place to discuss these topics.

1 0

Re: [tor-relays] torworld relays in entry and exit position
by nusenu 13 Nov '16

13 Nov '16

> Thank you for bringing this to our attention. We'll go a head, and do > proper research and add the MyFamily tags to all nodes. If you'd like > to give us an example copy to go off of that would be much > appreciated. If responding by email is too slow you're more than > welcomed to join our Slack team, and discuss this further in their. > https://slack.torworld.org > > Again thank you for reaching out to us. The MyFamily torrc setting is just a single line listing all your relay fingerprints. This setting tells tor clients "these are my relays: ... don't use more than one of my relays in any single circuit". This is particularly relevant if the entry _and_ exit probability of your group of relays is > 0% and your relays are spread across more than a single /16 network. Atlas.torproject.org can help you verify that the configuration is set up correctly (effective family has to list all your relays). If you expect to add/remove relays or adjust exit policies in the future on a more or less regular basis, I would suggest you use a configuration management like ansible or puppet to manage your relays - for your own convenience. I'm maintaining an ansible role to help tor relay operators manage MyFamily automatically - no more manual hassle (in addition to configure them using security features like 'OfflineMasterKey'). https://github.com/nusenu/ansible-relayor If you have any further questions - just let us know. regarding your slack group: I prefer to discuss this on the tor-relays mailing list instead of creating yet another place to discuss these topics.

1 0

Tor Fails to Start on Ubuntu 16.04
by heartsucker 13 Nov '16

13 Nov '16

Hey everyone I have a fresh install of Ubuntu 16.04 that is unable to start Tor. Some useful output: root@tor-1 ~ # uname -a Linux tor-1 4.4.0-47-generic #68-Ubuntu SMP Wed Oct 26 19:39:52 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux root@tor-1 ~ # apt-cache policy tor tor: Installed: 0.2.8.9-1~xenial+1 Candidate: 0.2.8.9-1~xenial+1 Version table: *** 0.2.8.9-1~xenial+1 500 500 http://deb.torproject.org/torproject.org xenial/main amd64 Packages 100 /var/lib/dpkg/status root@tor-1 ~ # journalctl -u tor ... Nov 13 00:52:39 tor-1 systemd[1]: Starting Anonymizing overlay network for TCP (multi-instance-master)... Nov 13 00:52:39 tor-1 systemd[1]: Started Anonymizing overlay network for TCP (multi-instance-master). <and then nothing else as it hangs> Tor fails to get beyond this message for any config I have tried (including the default). I tried replacing the systemd unit file with one of my own and was able to start Tor, however it would crash every 5 minutes (though the logs. The commands used in the systemd file and the command init.d script are both able to start Tor correctly if I run them in a TTY as I can see from a second terminal. Is anyone else running Tor on Xenial, and if so, have they run into this problem? -h

4 4

Automatic IPv6 address detection in Tor
by diffusae 10 Nov '16

10 Nov '16

Hi! Is this already solved in 0.2.8.9-1 for addresses with global scope? https://trac.torproject.org/projects/tor/ticket/17153 I was trying to configure a global reachable IPv6 address, but getting the following error: "unable to use configured ipv6 address "[::]" in a descriptor." The only way ist to set a clear global address in the config. The ISP is changing the 64 bit prefix a bit from time to time and I don't want to configure it manually every two weeks or so. Best regards,

2 7

Research - Tor and the shaping of resistance technologies
by COLLIER Ben 09 Nov '16

09 Nov '16

Hello all, Greetings from (currently freezing cold) Scotland and apologies for the cross-posting. I'm a researcher at the University of Edinburgh studying antisurveillance technologies, software development and how these are shaped at different levels by ideas about crime and surveillance. I'd describe my work as criminological but with a strong critical dimension - my research isn't about "fighting crime" or developing cybersecurity policy. I'm interested instead in exploring the power relationships, social and technological factors which determine how actions and communities are labelled criminal, and include harms caused by states and other powerful actors which may not traditionally be considered as "crimes". >From this perspective, I would like to explore how the values and perspectives of people who develop software to resist surveillance and promote anonymity online shape the technologies they work on, and whether this expertise changes how they see these issues. I have a background in (statistical) programming and I'm particularly interested in finding out how people see these issues playing out in practice in their work. While I'd like to carry out more in-depth research in the new year, at this stage I'm interested in making sure I'm asking the right questions. As such, I'd be very grateful if anyone involved in Tor development, either as a core developer or as a volunteer, would be interested in having a chat, or if possible a short interview. Any discussions would be anonymous and carried out in accordance with the ethics policy of the University of Edinburgh, and you would be able to withdraw consent for participation at any time for any reason - or none at all. I'll be contactable at this email address (listed in my signature) and on the IRC channels as JHistone - if you're interested (or just want to say hi or have a chat) please feel free to get in touch. Best wishes, Ben Collier Doctoral Researcher The University of Edinburgh SCCJR profile: http://www.sccjr.ac.uk/about-us/people/ben-collier/ Edinburgh University profile: http://www.law.ed.ac.uk/research/students/viewstudent?ref=339 Twitter: @JohnnyHistone Email: s1263350(a)sms.ed.ac.uk The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.

1 0

Tor relay balks with "router_pick_published_address(): Success: chose address x.x.x.x"
by Tobias Sachs 08 Nov '16

08 Nov '16

Hey, my Tor relay https://atlas.torproject.org/#details/B567E8E39641F61091C1F2CAAAF73D3D1BF9C… balks with the following message which is repeated in the log with the "info" logging level up to 23251 times at the exact same millisecond. The relay responds at :9030/tor/server/authority with a 503 error. router_pick_published_address(): Success: chose address 'x.x.x.x' This is a counting from the log with the corresponding timestamp. Nov 01 18:37:13.000 - 23251 Nov 01 18:37:22.000 - 59 Nov 01 18:38:17.000 - 23195 Nov 01 18:38:22.000 - 57 Nov 01 19:19:22.000 - 50 Nov 01 19:19:23.000 - 312 Nov 01 19:19:24.000 - 333 Nov 01 19:19:25.000 - 74 Nov 01 19:20:22.000 - 52 Nov 01 19:38:17.000 - 23207 Nov 01 20:38:17.000 - 23232 140 times exactly 49 repeats in around 2 hours. Interesting is that there is no error about this 503 error in the log only my monitoring is aware of the issue. I hope you coul'd help me out with this issue. Best Regards Tobias

3 3

Drop in consensus weight
by r1610091651 08 Nov '16

08 Nov '16

Hi all The consensus weight of the relay I'm running drop recently (5th of nov) to almost half of previous value. To my knowledge there was no changes on my end. https://atlas.torproject.org/#details/36EE8D47E570B8D5515460A9972F3CFD9EDFD… Is there a way to identify the cause of this drop? Is there anyone else in same situation? Thanks Seb

3 8

Interrogated by Finnish police for alleged idendity crimes, fraud and attempts of fraud
by Juuso Lapinlampi 08 Nov '16

08 Nov '16

Putting the word out: I was interrogated by the Finnish police today for multiple alleged counts (15+) of identity crimes, fraud and attempts of fraud. The invitation letter to be interrogated was sent out on 2016-10-21 and received by me on 2016-10-25. Today is 2016-10-31. The police suspects me because of an "IP-address assigned to my name", which I can't confirm or deny to have a relation to me. As a suspect, I was not told what this aclaimed IP-address was on a specific date to my knowledge. It is only speculation if these allegations wrongly against me have something to do with my relation with the Tor community or activism about digital rights online. Pending ongoing investigation, I am not allowed by law to share more specific details about to the investigation. I'd be glad to reveal more details about the case once the investigation is over and share/hear how I became a suspect, once I know about it. (Note that my story is at least slightly opinionated.) I had a witness with me and I feel like my rights were being violated during the interrogation. The officer (not to be named publicly in respect for privacy) didn't want to allow me to write down their badge number by taking the badge away from me while trying to write down the numbers. The officer looked slightly anxious. After refusing to comment on few questions (to which I have a legal right as a suspect), soon after me and my belongings with me were searched for aclaimed "security reasons" and "making sure I'm not recording this interrogation (with a phone)". I'll let you decide on the implications on unwarranted searches and individual legal protection. (See supreme court decision KKO:1990:36.) I audibly and multiple times in calm manner protested to not consent to searches, but alas it happened against my will without being suspected of wrongdoing at the police station in front of my witness. I didn't physically resist but also didn't voluntarily help the officer. The officer asked me inappropriate questions which were not related to the investigation. I was asked about my previous involvement with the police, how much I knew about the law and unsolicited advice about how "it will be easier for me if I talked". I demanded the officer to write down every question since the beginning of interrogation to the interrogation minutes, including the inappropriate ones, but the officer refused, trying to make up a fake reason how they were "irrelevant". The officer raised their voice once or twice during the 45 minutes of interrogation, apparently angry that I would not "make a confession" or "help out and tell more" to prove innocence. Confronting the officer again with a simple question "am I a suspect or a witness" to confirm my position, I was confirmed again that I was a suspect in the case. Subtly reminding that "I have my rights" that should be respected, the officer replied among the lines of "I have my rights too" with disrespect. After the interrogation minutes did not rightfully represent what was actually questioned, the only sensible thing to me was to not sign the minutes. The officer after the officer made threatening claims about how I "would be going to court" over this, but didn't spend too much effort on trying to get my signature. Once the interrogation was concluded, the officer made an unsolicited comment of "gladly not seeing people like [me] often". I told that I would be in contact with my lawyers. I am glad that I was not detained in a cell or arrested, which in my opinion I can likely attribute to having a witness with me. Looking back at what just happened at the police station, I should have demanded a lawyer immediately to the interrogation after having my rights violated, but I'm relying on my witness for now to make a testimony if necessary. I repeat that I absolutely deny being guilty of any suspected crimes. Be safe out there, tor-relays@ and all. (I have legal support behind me and have never been particularly worried about the investigation or outcome of this case.) Proof of invitation letter: https://wubthecaptain.eu/files/legal/2016-10-21-alleged-fraud-identity-crim…

8 11

33C3 Ticket
by pa011 07 Nov '16

07 Nov '16

First poor round of selling is over - anybody holding more tickets than he needs already? Would still take one :-) Paul

1 0

proper way to insert PGP key in torrc?
by anemoi＠tutanota.de 04 Nov '16

04 Nov '16

When I insert my PGP key just like a block of text below the contactinfo line my Tor relay stops working. What is the correct way to insert the PGP key into the torrc file?

11 13

Guard before Stable flag?
by John Ricketts 03 Nov '16

03 Nov '16

Hello Everyone, When looking at my list on Atlas (21 entries) I'm seeing that some of my relays are getting the Guard flag before they become stable. https://atlas.torproject.org/#search/quintex I'm going to make the assumption this is normal behavior but I still find it odd. I also find it odd that I haven't received the stable flag all of the relays given their uptime. Thoughts, anyone? Thank you! John L. Ricketts, PhD Quintex Alliance Consulting john(a)quintex.com<mailto:john@quintex.com> @aquintex on Twitter

3 4

Tor bandwith question
by anemoi＠tutanota.de 02 Nov '16

02 Nov '16

In order to clarify this once and for all: If I setup a Tor relay with 200 kBps, do I slow down the Tor network? What amount of bandwith is needed in order to not slow down the network?

7 7

most (>57% cwfr) of the tor network still vulnerable to CVE-2016-8860 - update your relay!
by nusenu 01 Nov '16

01 Nov '16

just a reminder since most of the tor network (including some of the biggest operators) still runs vulnerable relays https://blog.torproject.org/blog/tor-0289-released-important-fixes Since 2/3 directory authorities removed most vulnerable versions from their 'recommended versions' you should see a log entry if you run outdated versions (except if you run 0.2.5.12). It is not possible to reliable determine the exact CW fraction affected[1] due to the fact that patches were released that didn't increase tor's version number. Therefore it is also possible that you get log entries even if you run a patched version (IMHO this hasn't been handled in the most professional way). Update instructions Debian/Ubuntu ============== make sure you use the Torproject repository: https://www.torproject.org/docs/debian.html.en (you can also use the debian repository but the Torproject's repo will provide you with the latest releases) aptitude update && aptitude install tor CentOS/RHEL/Fedora =================== yum install --enablerepo=epel-testing tor FreeBSD ============ pkg update pkg upgrade OpenBSD =========== pkg_add -u tor Windows ======== No updated binaries available for this platform yet. [1] as of 2016-10-25 18:00 (onionoo data) conservative estimate ---------------------- (counts only 0.2.8.9 and 0.2.9.4-alpha as patched) 31% CW fraction patched optimistic estimate ------------------- (additionally assumes every non-Windows running 0.2.4.27, 0.2.5.12, 0.2.6.10, 0.2.7.6 that restarted since 2016-10-17 is patched): 43% CW fraction patched

9 16

assign_to_cpuworker failed. Ignoring.
by Felix 01 Nov '16

01 Nov '16

Hi everybody May be someone can help with this warning: The security update (Tor v0.2.8.9 running on FreeBSD with Libevent 2.0.22-stable, OpenSSL LibreSSL 2.4.3 and Zlib 1.2.8.) shows the following log entry each hour: Oct 19 02:51:07.000 [warn] Your system clock just jumped 136 seconds forward; assuming established circuits no longer work. Oct 19 02:51:07.000 [warn] assign_to_cpuworker failed. Ignoring. ... Oct 19 02:51:07.000 [warn] assign_to_cpuworker failed. Ignoring. Oct 19 02:51:15.000 [notice] Tor has successfully opened a circuit. Looks like client functionality is working. ... Oct 19 03:51:10.000 [warn] Your system clock just jumped 138 seconds forward; assuming established circuits no longer work. Oct 19 03:51:11.000 [warn] assign_to_cpuworker failed. Ignoring. ... Oct 19 04:50:37.000 [warn] Your system clock just jumped 105 seconds forward; assuming established circuits no longer work. Oct 19 04:50:37.000 [warn] assign_to_cpuworker failed. Ignoring. ... Oct 19 05:51:14.000 [warn] Your system clock just jumped 142 seconds forward; assuming established circuits no longer work. Oct 19 05:51:15.000 [warn] assign_to_cpuworker failed. Ignoring. ... The warning first appeared on 2.8.7 after update on September 13th (Tor v0.2.8.7 running on FreeBSD with Libevent 2.0.22-stable, OpenSSL LibreSSL 2.4.2 and Zlib 1.2.8.). That time I switched back (Tor v0.2.7.6 running on FreeBSD with Libevent 2.0.22-stable, OpenSSL LibreSSL 2.4.2 and Zlib 1.2.8.) and the warning disappeared. What can I do? The warning is reproted in tor-talk: https:// lists.torproject.org/pipermail/tor-talk/2016-October/042425.html -- Best regards, Felix

3 7

Blocking Domains
by Tristan 01 Nov '16

01 Nov '16

Is it possible to block domain names in Tor's ExitPolicy? I've been getting abuses on *.panelboxmanager.com, and I'd like to be proactive about this if possible.

8 13

Stats not updated for several days?
by Pascal Terjan 01 Nov '16

01 Nov '16

For example https://atlas.torproject.org/#details/20462CBA5DA4C2D963567D17D0B7249718114… says uptime is 12 days and current version is 0.2.6.10 but I upgraded the machine and updated tor to 0.2.8.9 over a day ago: # uptime 09:30:50 up 1 day, 8:32, 1 user, load average: 0.68, 0.81, 0.88 # ps aux | grep t[o]r debian-+ 3389 60.4 15.3 510300 314260 ? Ssl Oct31 1177:17 /usr/bin/tor --defaults-torrc /usr/share/tor/tor-service-defaults-torrc -f /etc/tor/torrc --RunAsDaemon 0 # dpkg -l tor Desired=Unknown/Install/Remove/Purge/Hold | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad) ||/ Name Version Architecture Description +++-=========================================-=========================-=========================-======================================================================================== ii tor 0.2.8.9-1~xenial+1 amd64 anonymizing overlay network for TCP My new relay also is not known yet, and does not appear in "Family Members" while it was added yesterday.

5 7

OpenWrt
by Nima Fatemi 31 Oct '16

31 Oct '16

Hi relay operators, I'm curious to see if there are any openwrt users here and if by any chance any of you is running a relay or a bridge on it. Here's why: The current Tor package on openwrt is left without an active maintainer. I just send a patch to update it to 0.2.8.9 and I'm wondering whether it's worth to put the time and maintain the package. Best, -- Nima 0X58C4B928A3E218F6 | @mrphs "I disapprove of what you say, but I will defend to the death your right to say it" --Evelyn Beatrice Hall

2 1

ExitPolicy reject 184.107.0.0/16* funio.com
by Markus Koch 28 Oct '16

28 Oct '16

Getting abuse mass mails on nearly all exist in the last hours: The following intrusion attempts were detected: ./pilipia/pilipiak.com:188.166.63.113 - - [27/Oct/2016:18:06:35 -0400] "GET / HTTP/1.1" 200 5734 "-" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1" ./pilipia/pilipiak.com:188.166.63.113 - - [27/Oct/2016:18:06:36 -0400] "GET /?subscribe-email=dlcw87%40hotmail.com&subscribe-submit=Informez-moi& HTTP/1.1" 200 5734 "http://pilipiak.com/" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1" ./autoparcs.promoafrik.com:188.166.63.113 - - [27/Oct/2016:00:30:30 -0400] "GET / HTTP/1.1" 200 26737 "-" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1" ./autoparcs.promoafrik.com:188.166.63.113 - - [27/Oct/2016:00:30:31 -0400] "GET /search-listing.php?list_search_box=&subscribe=Search& HTTP/1.1" 200 9280 "http://autoparcs.com/" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1" ./pilipiak.com:188.166.63.113 - - [27/Oct/2016:18:06:35 -0400] "GET / HTTP/1.1" 200 5734 "-" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1" ./pilipiak.com:188.166.63.113 - - [27/Oct/2016:18:06:36 -0400] "GET /?subscribe-email=dlcw87%40hotmail.com&subscribe-submit=Informez-moi& HTTP/1.1" 200 5734 "http://pilipiak.com/" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1" ./promoaf/autoparcs.promoafrik.com:188.166.63.113 - - [27/Oct/2016:00:30:30 -0400] "GET / HTTP/1.1" 200 26737 "-" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1" ./promoaf/autoparcs.promoafrik.com:188.166.63.113 - - [27/Oct/2016:00:30:31 -0400] "GET /search-listing.php?list_search_box=&subscribe=Search& HTTP/1.1" 200 9280 "http://autoparcs.com/" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [26/Oct/2016:23:41:12 -0400] "GET /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [26/Oct/2016:23:41:16 -0400] "POST /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 116 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:00:02:49 -0400] "GET /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:00:02:51 -0400] "POST /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 116 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:10:32:33 -0400] "GET /index.php?option=com_user&task=activate&activation=e36afd6ab6a066e3485fcd4aedbc74ac HTTP/1.1" 200 11230 "-" "" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:10:32:34 -0400] "GET /index.php?option=com_user&view=login HTTP/1.1" 200 12349 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:10:32:36 -0400] "POST /index.php?option=com_user&view=login HTTP/1.1" 200 116 "http://hq-hospitality.com/index.php?option=com_user&view=login" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:10:32:38 -0400] "GET /index.php?option=com_user&view=user&task=edit HTTP/1.1" 200 25720 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:12:55:40 -0400] "GET /index.php?option=com_user&task=activate&activation=72ca806c4be186be71e7a5e0316e8681 HTTP/1.1" 200 11230 "-" "" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:19:28:56 -0400] "GET /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [26/Oct/2016:23:41:12 -0400] "GET /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [26/Oct/2016:23:41:16 -0400] "POST /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 116 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:00:02:49 -0400] "GET /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:00:02:51 -0400] "POST /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 116 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:10:32:33 -0400] "GET /index.php?option=com_user&task=activate&activation=e36afd6ab6a066e3485fcd4aedbc74ac HTTP/1.1" 200 11230 "-" "" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:10:32:34 -0400] "GET /index.php?option=com_user&view=login HTTP/1.1" 200 12349 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:10:32:36 -0400] "POST /index.php?option=com_user&view=login HTTP/1.1" 200 116 "http://hq-hospitality.com/index.php?option=com_user&view=login" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:10:32:38 -0400] "GET /index.php?option=com_user&view=user&task=edit HTTP/1.1" 200 25720 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:12:55:40 -0400] "GET /index.php?option=com_user&task=activate&activation=72ca806c4be186be71e7a5e0316e8681 HTTP/1.1" 200 11230 "-" "" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:19:28:56 -0400] "GET /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0" Abuse Department Funio to stop the mass flood of abuse bot mails I tried to reject the IP space of funio but Tor is telling me its not allowed. Why? Markus

5 6

Abuses: Suspicious botnet ramnit attack
by pa011 28 Oct '16

28 Oct '16

Hi, got the abuse below on three different exits. Anybody having any idea what to do and how to possibly to stop this in the future? Thanks Paul CERT-EU has received information regarding an infected IP belonging to your network, which may have security problems. The information regarding the problems is also included as attachments in both CSV and XML formats. All timestamps are in UTC. At this time we do not have any more information. Where: - ASN: is the Autonomous System Number; - IP: the Internet Protocol address associated with this activity; - TIME: discovery time of the malicious activity; - PTR/DNAME: PTR/DNAME record - CC: ISO 3166-1 alpha-2 two-letter country code; - TYPE: type of the security problem or threat; - INFO: provides any additional information, if available.asn|ip|time|ptr|cc|type|info|info2 ASxxxxx|xxx.xxx.xxx.xxx|25-10-2016 12:10:09Z|XX|botnet drone|Description: Ramnit botnet victim connection to sinkhole details, Timestamp : 1477397409.72, City : none, Count: 8, First Seen: 25-10-2016 12:10:09, Last Seen: 25-10-2016

3 2

Re: [tor-relays] Digital Ocean - running Exit node locked
by Tristan 27 Oct '16

27 Oct '16

Guess I'm next. My relay has been running for 3 months now. I'm doing my best to be a good neighbor though. After the first month, I got an SSH abuse, so now I reject SSH traffic. A month later I got an SQL hack attempt, and I switched to the reduced-reduced exit policy. Haven't gotten anything else yet. On Oct 7, 2016 4:34 PM, "Markus Koch" <niftybunny(a)googlemail.com> wrote: They will kick you after 2-3 months. Delete account, make new account. They will kick you after 2-3 months. Delete account, make new account. They will kick you after 2-3 months. Delete account, make new account. They will kick you after 2-3 months. Delete account, make new account. Welcome to DigitalOcean! Markus 2016-10-07 23:23 GMT+02:00 pa011 <pa011(a)web.de>: > Seems like even DO is not very much in favour of running Exits any more ? > > Anybody made the same experience - how to handle this please ? > > Thanks and Regards > Paul > > > "Hello -Although we do not specifically disallow TOR exit nodes, as the account holder you are responsible for all the traffic going through your droplet (including traffic that an exit node may generate). > > Also be aware that we do not allow some of the traffic types that come out of a typical TOR exit node (torrents, spam, SSH probes, hacking attempts, botnets, DDoS, etc). > > If you are unable to stop this sort of traffic, please reconsider running a TOR exit node as it may lead to your account suspension or termination. > > Please refer to our Terms of Service for greater detail on this issue: https://www.digitalocean.com/legal/terms/ > > Best, > > DigitalOcean Support " > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

6 12

Rampup speed of Exit relay
by D.S. Ljungmark 27 Oct '16

27 Oct '16

Hi all, I'm looking at some traffic patterns for my Exit relay, and I'm frankly a bit disappointed with the utilization. Currently it's running at a load average of 0.3-0.5, and CPU idle at 70-80%. We're not limited on Bandwidth (tests show that our max cap is more than safe to produce), yet, we're barely reaching 20% of our potential allocated traffic. We've reached "fast" and "guard", and got the "stable" flag as well, so in theory we ought to see traffic move a bit higher than currently. So, how do we get tor to move past 100-200Mbit? Is it just a waiting game? //D.S. -- 8362 CB14 98AD 11EF CEB6 FA81 FCC3 7674 449E 3CFC

10 21

Really bad ISP
by Lluís 27 Oct '16

27 Oct '16

Hello, I am a relay operator in Spain (or at least I try to). I am just desperate with my ISP, he is just leaving the VDSL2 connection down several times a day, taking the relay with it. Does anyone know a much more stable, tor-friendly, ISP for an Spanish user ? The following record of assigned IPs in a **single** day shows the dimension of the drama: 95.23.157.152 - Tue Oct 25 01:00:02 CEST 2016 95.23.156.52 - Tue Oct 25 07:00:02 CEST 2016 95.23.157.180 - Tue Oct 25 11:54:06 CEST 2016 188.79.227.152 - Tue Oct 25 12:20:52 CEST 2016 95.23.155.112 - Tue Oct 25 13:12:30 CEST 2016 95.23.144.75 - Tue Oct 25 13:15:19 CEST 2016 188.77.208.15 - Tue Oct 25 13:29:02 CEST 2016 95.23.159.249 - Tue Oct 25 14:00:06 CEST 2016 95.23.146.89 - Tue Oct 25 14:12:12 CEST 2016 95.23.159.163 - Tue Oct 25 14:19:21 CEST 2016 188.79.238.188 - Tue Oct 25 14:34:55 CEST 2016 188.79.237.90 - Tue Oct 25 14:36:05 CEST 2016 188.79.229.164 - Tue Oct 25 14:57:30 CEST 2016 95.23.149.124 - Tue Oct 25 15:08:51 CEST 2016 188.79.237.0 - Tue Oct 25 15:10:12 CEST 2016 188.77.213.199 - Tue Oct 25 16:28:47 CEST 2016 95.23.153.98 - Tue Oct 25 16:32:50 CEST 2016 95.23.146.46 - Tue Oct 25 16:49:03 CEST 2016 188.79.235.239 - Tue Oct 25 17:10:03 CEST 2016 188.77.215.232 - Tue Oct 25 17:20:03 CEST 2016 95.23.146.36 - Tue Oct 25 17:30:03 CEST 2016 95.23.148.238 - Tue Oct 25 18:10:03 CEST 2016 95.23.149.136 - Tue Oct 25 18:20:03 CEST 2016 188.77.211.53 - Tue Oct 25 18:50:03 CEST 2016 188.77.211.90 - Tue Oct 25 19:30:03 CEST 2016 188.79.225.153 - Tue Oct 25 20:10:01 CEST 2016 95.23.157.171 - Tue Oct 25 21:00:02 CEST 2016 188.77.212.227 - Tue Oct 25 22:00:02 CEST 2016 95.23.157.179 - Tue Oct 25 22:30:02 CEST 2016 Thanks for your assintance, Lluís

3 5

Re: [tor-relays] most (>57% cwfr) of the tor network still vulnerable to CVE-2016-8860 - update your relay!
by Alan 27 Oct '16

27 Oct '16

0.2.5.12 is the latest version from the repo. Im assuming I should pull down the source and compile it. >> Thanks for the update, my main relay was vulnerable but i've patched it now to 0.2.8.9. >> >> My Raspberry Pi is running 0.2.5.12 -- is that ok? > > If your version is from before 2016-10-17, your relay is vulnerable. > > To be sure you should be running 0.2.8.9. > > > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >

4 5

cryptsetup some folders
by Petrusko 26 Oct '16

26 Oct '16

Hey all, I'm planning to customise a RPi with Raspbian already running, and using cryptsetup (LUKS) to have a partition more secure for some reasons... So the goal is to move some existing sensitive folders to this new encrypted partition. Some sym-links will be used for those directories. About Tor, if I'm not wrong, those directories can be moved to this encrypted partition : /var/lib/tor : so I'm planning to move /var... So at final, planning to move : /home /var /tmp (why not swap file ?) Any suggestions and master's thoughts are welcome :) -- Petrusko EBE23AE5

7 17

Re: [tor-relays] most (>57% cwfr) of the tor network still vulnerable to CVE-2016-8860 - update your relay!
by Alan 26 Oct '16

26 Oct '16

Thanks for the update, my main relay was vulnerable but i've patched it now to 0.2.8.9. My Raspberry Pi is running 0.2.5.12 -- is that ok? > just a reminder since most of the tor network (including some of the biggest operators) still runs vulnerable relays > > https://blog.torproject.org/blog/tor-0289-released-important-fixes > > > Since 2/3 directory authorities removed most vulnerable versions from their 'recommended versions' you should see a log entry if you run outdated versions (except if you run 0.2.5.12). > > > It is not possible to reliable determine the exact CW fraction > affected[1] due to the fact that patches were released that didn't increase tor's version number. > Therefore it is also possible that you get log entries even if you run a patched version (IMHO this hasn't been handled in the most professional way). > > > Update instructions > > Debian/Ubuntu > ============== > > make sure you use the Torproject repository: > https://www.torproject.org/docs/debian.html.en > > (you can also use the debian repository but the Torproject's repo will provide you with the latest releases) > > > aptitude update && aptitude install tor > > > CentOS/RHEL/Fedora > =================== > > yum install --enablerepo=epel-testing tor > > > FreeBSD > ============ > > pkg update > pkg upgrade > > OpenBSD > =========== > > pkg_add -u tor > > > Windows > ======== > > No updated binaries available for this platform yet. > > > > > [1] as of 2016-10-25 18:00 (onionoo data) > conservative estimate > ---------------------- > (counts only 0.2.8.9 and 0.2.9.4-alpha as patched) > 31% CW fraction patched > > optimistic estimate > ------------------- > (additionally assumes every non-Windows running 0.2.4.27, 0.2.5.12, 0.2.6.10, 0.2.7.6 that restarted since 2016-10-17 is patched): > 43% CW fraction patched > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >

2 1

33C3 Voucher
by pa011 26 Oct '16

26 Oct '16

Anybody holding a Voucher for 33C3 in Hamburg at the End of December? More than happy to get hold of it :-) Paul

2 1

Research project - comparing abuse complaints on Tor exits to those of regular ISPs
by dguthrie＠posteo.net 24 Oct '16

24 Oct '16

Hi folks, I am looking to research what proportion of Tor traffic across a Tor exit is "legitimate"/regular internet traffic, by comparing abuse complaints on Tor exits to those of regular ISPs. I think this is an interesting project because it is illegal to analyse traffic on the exit node without amounting to a wiretap, so this is a good way to get some idea about what traffic is comparable to regular internet traffic. I am aware that some people on this list run small ISPs. I am asking a favour that you might be able to send me a sample of abuse complaints over several months, or at least and some idea of how many complaints you recieved. I would need to know what type of complaint they were (torrenting vs more serious complaints), and the volume of traffic that passed through your network. My public key is posted below. Thank you, Duncan Guthrie 4096R/16BD5A5D 425A BEE8 24BB 7665 7FDC F7B6 8767 0301 16BD 5A5D

6 6

Re: [tor-relays] IP address change
by balbea16 24 Oct '16

24 Oct '16

Hi TimTNX for your fast response. I'm afaid, that I have to stay with my current ISP. However, from time to time he keeps my IP address unchanged for up to 4 days. Mike -------- Ursprüngliche Nachricht -------- Von: teor <teor2345(a)gmail.com> Datum: 24.10.16 14:34 (GMT+01:00) An: tor-relays(a)lists.torproject.org Betreff: Re: [tor-relays] IP address change > On 24 Oct. 2016, at 23:12, balbea16 <balbea16(a)gmx.de> wrote: > > Hi There > My ISP changes my IP address about every 24 hours. It takes 10 minutes until my tor server recognises this, and an hour until all usual connections are reestablished. How can I speed this up? The tor directory authorities vote on relays every hour. There is no way to speed this up. > Does it help to use a DNS? No, Tor uses your IP address. > To pay for a static address is not an option. > Any ideas? Thank you. Mike I'm sorry, this is just how Tor is designed. But you are still contributing to the network. You could try renting a cheap server in a data centre. Most of them offer static IP addresses. Tim T -- Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ricochet:ekmygaiu4rzgsk6n xmpp: teor at torproject dot org ------------------------------------------------------------------------------ _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0