- tor-relays - lists.torproject.org

IP address change
by balbea16 24 Oct '16

24 Oct '16

Hi There My ISP changes my IP address about every 24 hours. It takes 10 minutes until my tor server recognises this, and an hour until all usual connections are reestablished. How can I speed this up? Does it help to use a DNS? To pay for a static address is not an option. Any ideas? Thank you. Mike

2 1

numtcpsock prevents relay from working properly.
by Nils Erik Flick 24 Oct '16

24 Oct '16

Hi, I am experiencing trouble with a new VPS relay. https://atlas.torproject.org/#details/41F07731207742860D43AC426FBAE2F3947BD… It spontaneously acquired an advertised bandwidth of 2.67MB/s but then started to sputter. Failing because we have 1314 connections already ... Specifically, looking at /proc/user_beancounters numtcpsock is the culprit, which is limited to 1360 (some other processes are using the remaining sockets). This artificial limit causes new connections to fail even though send/receive buffers or CPU usage are well below critical. The value can't be changed from inside the OpenVZ container. That's a pity because traffic appears to be unmetered and a lot of potential is wasted this way. I understand that there is currently no way to limit this inside the Tor process because every relay needs to be ready to connect to every other relay at any time. So I tried to get its consensus weight down. Gradually lowering the MaxAdvertisedBandwidth to 300k caused it to briefly acquire the "Stable" flag and run into trouble again. That's no better than a home connection. Worse, in fact, because the problem persists. I'm curious, is this a common experience? Asking customer service would mean explicitly drawing attention to the fact that I'm trying to use the cheap plan to run Tor nodes. That's completely against my instincts. On the other hand they *did* offer a free-form box in the registration form. Has anyone tried and if so, to any avail? Is there a workaround I'm missing? iptables can be configured freely, but I don't see how that would help. At this point I'll probably call it a day, try elsewhere and set this one up as a bridge instead. Frankly I was a bit surprised that technical snags like this aren't generally mentioned in relay setup guides or FAQs. For all I know, it may be common knowledge among expert sysadmins that OpenVZ should be shunned or whatever, but to someone with little prior experience as a user of commercial hosting, some of these limitations come as a surprise. In a bout of post factum searching, I only found this discussion https://serverfault.com/questions/698845/debian-limit-number-of-tcp-sockets… IMHO this kind of knowledge should be spread more "pro-actively", which is why I'm posting this on a public list. Peace, Erik

2 3

Linux kernel vulnerability
by I 24 Oct '16

24 Oct '16

Dirty COW (CVE-2016-5195) is a privilege escalation vulnerability in the Linux Kernel http://dirtycow.ninja/

9 14

CentOS 7 Packages
by Alice . 23 Oct '16

23 Oct '16

Hi, I have one relay on CentOS 6 and one on CentOS 7. The one running CentOS 7 hasn't had the 0.2.8.8 update yet and so is still running 0.2.8.7. The one running CentOS 6 has had the latest update. Is there a problem with getting CentOS 7 packages out? How much of a problem is this? Both now and in the future? Thanks Alice

2 1

Recommendation for DUMB COMPUTING devices for Tor Relays
by Dan Michaels 21 Oct '16

21 Oct '16

The Tor Project website recommends various security setups for people running Tor relays. Such as, don't run a web browser on the same machine as your Tor relay, otherwise the browser could get hacked, and then if Tor relays are hacked, it compromises the entire concept of Tor. In the age of FBI mass hacking, the FBI will attempt to hack all Tor relays, and thus, they can trace traffic throughout the entire proxy chain. According to NSA documents, all it takes is "one page load" to infect a browser, because they re-direct you to a fake website that hosts browser exploits, known as QUANTUM INSERT. The FBI will use this to take over all Tor relays that are running web browsers. So, I have a suggestion that I would like Tor Project to recommend. Tor Project needs to tell people.. use DUMB COMPUTING devices for running Tor relays. If your computer gets hacked, it can be deeply exploited in the firmware, such as BIOS, GPU, WiFi chip, etc. There are devices on the market, such as Raspberry Pi, or similar, which have NO WRITABLE FIRMWARE. This is known as being "stateless". It does not "hold state" across reboots. All firmware/drivers are stored on the SD card on the Raspberry Pi, and only loaded in on boot time. No component on the entire Pi holds state. NONE. There will likely be other similar devices. Therefore, it is truly possible to wipe a dumb computing device completely clean. If you try to wipe a regular laptop or desktop, you may have all this deeply infected firmware, such as BIOS, so you keep getting re-infected upon startup. Some people say, once deeply infected, it's near-impossible to clean it out, and you should just throw away your entire laptop and start again. Everyone running a Tor relay should be told to use a DUMB COMPUTING DEVICE. Another advantage is that these devices are often very cheap. Raspberry Pi is very cheap to buy. Other devices may be even cheaper. The instructions should be as follows... (1) Wipe your device clean, i.e. wipe clean the SD card which holds the OS + all firmware/drivers. (2) Then, re-install the OS clean, install Tor, and set up the relay. (3) Tor should be installed from the command line or from a previously-downloaded version on USB stick. Do not install Tor using the web browser, otherwise you could get infected. (4) Do not run anything else on the machine, other than the Tor relay. Using other programs, especially the web browser, could compromise the entire machine. And that's it. Tor Project should send out a message telling all people running Tor relays to follow these instructions. Let me know what you think.

8 7

relay lost most of its consensus weight
by jensm1 19 Oct '16

19 Oct '16

Hi, I just realised that my relay 'itwasntme' lost most of its consensus weight yesterday morning. The relay is only three weeks old, but it was finally picking up some traffic, which now is gone again. What could be the cause for this? Is there a problem with my relay or configuration? Thanks for your help! https://atlas.torproject.org/#details/F46C312E279185364F46EA06C58F792528091…

4 11

assign_to_cpuworker failed. Ignoring.
by Felix 19 Oct '16

19 Oct '16

Thanks for picking up. > It would help us to know if it's just FreeBSD, or just LibreSSL. It's both LibreSSL on FreeBSD 10.1. Same setup worked fine since months through serveral versions of Tor (2.6.x and 2.7.x) and LibreSSL (2.2.x until today). > Maybe mention the bug number on tor-talk, so that poster can provide more details? Might be. -- Felix

2 1

Re: [tor-relays] You dont love me anymore :(
by Tristan 18 Oct '16

18 Oct '16

Like David said, they just had the wrong IP, and it happened to be yours. In a world where computers outnumber people, even a single incorrect digit can have unintended side effects. Glad you got it fixed so quickly! On Oct 18, 2016 1:36 PM, "Markus Koch" <niftybunny(a)googlemail.com> wrote: Just solved but thank you very much for helping me out. It was confusing without end because this server was up for 10 months and high traffic. Markus 2016-10-18 20:30 GMT+02:00 Tristan <supersluether(a)gmail.com>: > According to this page: > https://trac.torproject.org/projects/tor/wiki/doc/ReportingBadRelays > > Looks like you need to get in touch work bad-relays(a)lists.torproject.org > > What's strange is that the bad relay team should have contacted you before > making a decision. > > > On Oct 18, 2016 1:23 PM, "Markus Koch" <niftybunny(a)googlemail.com> wrote: >> >> Thank you very much. How do I dispute this? >> >> >> 2016-10-18 20:20 GMT+02:00 Tristan <supersluether(a)gmail.com>: >> > I don't know why or how, but you've got the BadExit flag from moria1: >> > https://consensus-health.torproject.org/consensus-health.html >> > >> > >> > On Oct 18, 2016 1:16 PM, "Markus Koch" <niftybunny(a)googlemail.com> >> > wrote: >> >> >> >> This is a guard/middle and should be good ... >> >> >> >> >> >> >> >> https://atlas.torproject.org/#details/B771AA877687F88E6F1CA5354756DF 6C8A7B6B24 >> >> >> >> and I have never ever seen this before. >> >> >> >> Markus >> >> >> >> >> >> 2016-10-18 20:13 GMT+02:00 Tristan <supersluether(a)gmail.com>: >> >> > I've seen 404s from time to time, but this is new. Did you get a bad >> >> > relay >> >> > flag somehow??? >> >> > >> >> > >> >> > On Oct 18, 2016 1:12 PM, "Markus Koch" <niftybunny(a)googlemail.com> >> >> > wrote: >> >> >> >> >> >> 20:08:18 [WARN] Received http status code 404 ("Not found") from >> >> >> server '86.59.21.38:80' while fetching >> >> >> "/tor/keys/fp-sk/14C131DFC5C6F93646BE72FA1401C02A- >> >> >> 8DF2E8B4-692049A2E7868BE9933107A39B1CE0C7CBF1BF65". >> >> >> 20:06:18 [WARN] Received http status code 404 ("Not found") from >> >> >> server '194.109.206.212:80' while fetching >> >> >> "/tor/keys/fp-sk/14C131DFC5C6F93646BE72FA1401- >> >> >> C02A8DF2E8B4-692049A2E7868BE9933107A39B1CE0C7CBF1BF65". >> >> >> 20:05:18 [WARN] http status 400 ("Authdir is rejecting routers in >> >> >> this range.") response from dirserver '171.25.193.9:443'. Please >> >> >> correct. >> >> >> 20:05:18 [WARN] http status 400 ("Authdir is rejecting routers in >> >> >> this range.") response from dirserver '154.35.175.225:80'. Please >> >> >> correct. >> >> >> 20:05:18 [WARN] http status 400 ("Authdir is rejecting routers in >> >> >> this range.") response from dirserver '131.188.40.189:80'. Please >> >> >> correct. >> >> >> 20:05:18 [WARN] http status 400 ("Authdir is rejecting routers in >> >> >> this range.") response from dirserver '86.59.21.38:80'. Please >> >> >> correct. >> >> >> >> >> >> This is my niftypika server. This is animal abuse! Seriously, WTF is >> >> >> going wrong? >> >> >> >> >> >> Markus >> >> >> _______________________________________________ >> >> >> tor-relays mailing list >> >> >> tor-relays(a)lists.torproject.org >> >> >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >> >> > >> >> > >> >> > _______________________________________________ >> >> > tor-relays mailing list >> >> > tor-relays(a)lists.torproject.org >> >> > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >> >> > >> >> _______________________________________________ >> >> tor-relays mailing list >> >> tor-relays(a)lists.torproject.org >> >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >> > >> > >> > _______________________________________________ >> > tor-relays mailing list >> > tor-relays(a)lists.torproject.org >> > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >> > >> _______________________________________________ >> tor-relays mailing list >> tor-relays(a)lists.torproject.org >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

2 1

You dont love me anymore :(
by Markus Koch 18 Oct '16

18 Oct '16

20:08:18 [WARN] Received http status code 404 ("Not found") from server '86.59.21.38:80' while fetching "/tor/keys/fp-sk/14C131DFC5C6F93646BE72FA1401C02A- 8DF2E8B4-692049A2E7868BE9933107A39B1CE0C7CBF1BF65". 20:06:18 [WARN] Received http status code 404 ("Not found") from server '194.109.206.212:80' while fetching "/tor/keys/fp-sk/14C131DFC5C6F93646BE72FA1401- C02A8DF2E8B4-692049A2E7868BE9933107A39B1CE0C7CBF1BF65". 20:05:18 [WARN] http status 400 ("Authdir is rejecting routers in this range.") response from dirserver '171.25.193.9:443'. Please correct. 20:05:18 [WARN] http status 400 ("Authdir is rejecting routers in this range.") response from dirserver '154.35.175.225:80'. Please correct. 20:05:18 [WARN] http status 400 ("Authdir is rejecting routers in this range.") response from dirserver '131.188.40.189:80'. Please correct. 20:05:18 [WARN] http status 400 ("Authdir is rejecting routers in this range.") response from dirserver '86.59.21.38:80'. Please correct. This is my niftypika server. This is animal abuse! Seriously, WTF is going wrong? Markus

4 9

Why do 40% of Tor exits uses 8.8.8.8 for DNS resolving ?
by Toralf Förster 18 Oct '16

18 Oct '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Reading [1] I do wonder about that. Why do Tor exit relay operators avoid installing a local resolver - or at least simple a cache as shown in [2] ? Adding different nameserver= lines to /etc/resolv.conf than 8.8.8.8 shouldn't be a big thing, or ? [1] https://nymity.ch/tor-dns/tor-dns.pdf [2] https://zwiebeltoralf.de/torserver.html - -- Toralf PGP: C4EACDDE 0076E94E, OTR: 420E74C8 30246EE7 -----BEGIN PGP SIGNATURE----- iHYEAREIAB4FAlgDW9QXHHRvcmFsZi5mb2Vyc3RlckBnbXguZGUACgkQxOrN3gB2 6U7l0AD9GolbdbnFmmDVACsdosxGC+bkD7czticuu0jTSQ5ObhYA/3aq74/N23bp D0mOLzfUmmDpiI2KXOSLvG/n8vrAgYlV =y46I -----END PGP SIGNATURE-----

11 25

Re: [tor-relays] Smallest, cheapest, lightest computer for tor relay
by Neel Chauhan 18 Oct '16

18 Oct '16

>Yes it does make a real big difference. Get the Pi 3, the 1st Pi is an order of magnitude slower. If you don't want to spend your money on a RPI 3, you can also look at a used RPI 2. If you are willing to have a computer that is a bit larger, you can also use a smaller desktop PC, like a Mac Mini, or a SFF Dell or HP. I have a Raspberry Pi 2, but use a homebuilt Pentium 4 desktop on a 60/25 cable connection (Optimum Online), and a Dell Optiplex 755 (Core 2 Duo) on a 50/50 FTTH connection (Verizon FiOS). I don't use the RPI because I want my Tor nodes to use FreeBSD instead of Linux, and am not sure if RPI has the best FreeBSD support (I'm even a FreeBSD contributor, but my laptop which I typed this from unfortunately runs Arch). The disadvantage of the PC approach is space and higher power consumption, but the advantage is that you can use *BSD and Windows, and can possibly take advantage of faster speeds. But if you are fine with Linux, and, the RPI 2/3 is a good choice. There are also other SBC computers like the BeagleBone. SBC computers are great if they have ADSL/Cable, but if they have fiber to the home (Verizon FiOS, Google Fiber, etc.), a used desktop (or a higher end SBC) may be better (in my opinion) as they usually have a faster upstream and a desktop may take better advantage of the speed. My atlas entries are below (for the two nodes from my two homes, not my exits): https://atlas.torproject.org/#details/AED76373324653A0522DF30550BA31902B2CF… https://atlas.torproject.org/#details/D5B8C38539C509380767D4DE20DE84CF84EE8… Thanks, Neel Chauhan === https://www.neelc.org/

7 8

Tor Relay Operators Meetup at hack.lu - 19.10. 16:00
by Tyler Durden 17 Oct '16

17 Oct '16

Hi We are present at this years hack.lu together with a booth with the Chaos Computer Club Luxembourg. Should you guys happen to be around just come by and talk to us. ( We do have Mate, Mate Schnapps and Flora Power :P ) Tor Relay Operators Meet-Up Where: FVDE & C3L booth at the main hall Date: 19th of October 2016 Time: 16h00 Greetings -- Sam Grüneisen - President Frënn vun der Ënn A.S.B.L. enn.lu

1 0

I think I my relay is broken
by Tamara West 17 Oct '16

17 Oct '16

SocksPort 0 RunAsDaemon 1 ORPort 443 Nickname saverig ContactInfo sinister(dot)hama(at)googlemail(dot)com [tor-relay.co] DirPort 80 ExitPolicy reject *:* DisableDebuggerAttachment 0 ControlPort 9051 CookieAuthentication 1 There is no IP listed unless I located the incorrect file. /etc/tor/torrc 207.172.253.216 is my public address I do have the port forwarded. The whole point was so that anyone who couldn't reach tor normally and had to use 443, 80 could do so with my setup. I've noticed some weirdness with RCN though. Some IPs block and allow access differently and as far as I can tell no one seems to know why. I already had an issue with my streaming box not seeing my server. Also I know I've had a site hosted on my computer before. Without really knowing why getting a new IP resolved the issue.

1 0

I think I my relay is broken
by Tamara West 17 Oct '16

17 Oct '16

Earlier today I installed my relay and thought everything was good. Now looking at the arm I no longer think so. (1) Events (TOR/ARM NOTICE - ERR): x 23:07:41 [ARM_NOTICE] Unable to prepopulate bandwidth information (insuffic- x ient uptime) x 23:07:41 [ARM_WARN] The torrc differs from what tor's using. You can issue a x sighup to reload the torrc values by pressing x. qj - torrc value differs on line: 3 (2) Events (TOR/ARM NOTICE - ERR): x 23:13:17 [WARN] Your server (207.172.253.216:80) has not managed to confirm x that its DirPort is reachable. Relays do not publish descriptors until x their ORPort and DirPort are reachable. Please check your firewalls, x ports, address, /etc/hosts file, etc. qj 23:07:41 [ARM_NOTICE] Unable to prepopulate bandwidth information (insuffic- If I hit x twice to reload the values it only seems to refresh for the moment but when I restart it's back to the errors. Anyhelp would be greatly appreciated.

3 2

Smallest, cheapest, lightest computer for tor relay
by Tamara West 16 Oct '16

16 Oct '16

I've got a few family members across the country who have broadband they are not using for more than email and social. I wanted to go about setting up a relay at each house can can be run with minimum amount of power and attention. I was considering something like RaspPi or Compute Stick. Main questions (1) anyone else use these or something similar? (2) recommend of strong alternatives suggested? (3) is there something smaller, lighter and cheaper that will do the job? (*) did I maybe miss something obvious that needs attention? Thank you.

6 7

OffTopic: onionoo.torproject.org as HS?
by Ralph Wetzel 16 Oct '16

16 Oct '16

7 7

postfix
by ken＠kenbaker.co.uk 16 Oct '16

16 Oct '16

Do people have an an opinion on running postfix on an exit node? I was thinking if I set up a .forward, I might be able to intercept a few abuse complaints before my provider sees them. Thoughts? Cheers, K.

2 1

Re: [tor-relays] new tor exit relays - callipr..
by nusenu 14 Oct '16

14 Oct '16

> Thanks for bringing this to my attention. Looks like we had the MyFamily > option set with relay fingerprints, not nicknames. Fixing this right now. Fingerprints are the preferred method, don't use nicknames.

1 0

RPi Relay Maximum Speed
by Manny 13 Oct '16

13 Oct '16

Hello everyone I tried the Internet of things to get an answer, but either I'm too stupid to find it or it isnt there (haha, good joke) Sorry if this was asked a 100 times before... I have a 1gbit symmetric connection at home and would like to donate 100mbit with my raspberry pi 3 model b. Since it has a 100mbit Network Interface, I'm limited to that anyways. What Settings do I Need in my torcc to get the Maximum Speed? At the Moment I entered 12 Mbytes - which Shows up at 96 mb/s in Arm - is that correct and my understanding of things is just the opposite? Max Speed, I think, should be 12.7mb/s for a 100mbit Connection? Sorry for bothering and thanks for the pointers. Oh and since I'm bugging you anyways - would it be useful to add ORPort [IPv6] as well? (same port as for 4 i guess?)

9 14

new tor exit relays - callipr.. (was: [OrNetRadar] Contact: "Rishab Nithyanand <mass dot tor dot" (8))
by nusenu 13 Oct '16

13 Oct '16

Hi Rishab, thanks for adding new exit relays to the network. If you put them in a proper MyFamily setting you can see how well they perform compared to other relay groups: https://raw.githubusercontent.com/ornetstats/stats/master/o/main_exit_opera… ornetradar(a)riseup.net: > 2016-10-07 > ----------------------------------------------------------------------------------------------------------------------- > Up|Ext|JoinTime| IP | AS | CC | ORp | Dirp | OS | Version | Nickname | eFamlen > ----------------------------------------------------------------------------------------------------------------------- > 1 | 1 | 14:06:45 | 46.166.148.145 | NFOrce Entertai | nl | 8083 | 9033 | Linux | 0.2.7.6 | calliprsmallclean04 | 1 > 1 | 1 | 14:07:03 | 46.166.148.143 | NFOrce Entertai | nl | 8081 | 0 | Linux | 0.2.7.6 | calliprbigclean02 | 1 > 1 | 1 | 14:06:58 | 46.166.148.142 | NFOrce Entertai | nl | 8080 | 0 | Linux | 0.2.7.6 | calliprbignasty01 | 1 > 1 | 1 | 20:04:48 | 46.166.148.155 | NFOrce Entertai | nl | 8083 | 9033 | Linux | 0.2.7.6 | calliprsmallclean08 | 1 > 1 | 1 | 20:04:43 | 46.166.148.154 | NFOrce Entertai | nl | 8082 | 9032 | Linux | 0.2.7.6 | calliprsmallnasty07 | 1 > 1 | 1 | 20:04:27 | 46.166.148.152 | NFOrce Entertai | nl | 8080 | 0 | Linux | 0.2.7.6 | calliprbignasty05 | 1 > 1 | 1 | 14:07:09 | 46.166.148.144 | NFOrce Entertai | nl | 8082 | 9032 | Linux | 0.2.7.6 | calliprsmallnasty03 | 1 > 1 | 1 | 20:04:35 | 46.166.148.153 | NFOrce Entertai | nl | 8081 | 0 | Linux | 0.2.7.6 | calliprbigclean06 | 1 > Fingerprints: > 1C486B378AF54474F35CA3B1A00203BD659BDDB1,766AF475D17EEF41C056A6E3E555BD3B023641A6,C065FE07B0D3035B534E05243B9773E3ED1CCBD4,E591E57FDCDBE475017A0938D8603C1783FB48BD,A9699FFAC625DB75118745E6D169A819047006F4,2EF563C70D1B407FB70DDEDA74FF9658D0B31503,339238AD6B44F949CD6F1C59E2CD4249585B4A77,C62A865581FA1319D62C5B14434952A3D37BB57B >

1 0

monitoring the relay : zabbix?
by krishna e bera 13 Oct '16

13 Oct '16

How do you monitor the tor relay server and the relay itself, on a remote box? Zabbix seemed to have less overhead and simpler setup than nagios or icinga, so i started to set it up. Then i saw the note on https://www.torservers.net/wiki/setup/zabbix that they do not use it anymore, and i am wondering what is wrong with it.

4 4

Politically correct?
by torserver＠datakanja.de 13 Oct '16

13 Oct '16

Hello list members, for simple - political - reasons, i began contributing otherwise wasted bandwith to the tor network about half a year ago. And i am reading this list. Lately, there has been a discussion (Intrusion Prevention System Software - Snort or Suricata), that brought up some opinions about tor, more or less focused from a technical point-of-view. Interesting to me (the noob, that i am) was the belief, that tor was ok (as some seem to think). I am very much less optimistic: >From the information, i can gather on my own personal computer, i can see, that almost every operating system sends out greetings to servers in akamai's reach, a company that happens to have contracts with microsoft and whatnot. Reading about their business, i find every reason to believe, that the time to fight for anonymity on the net is long gone, that security - even from their perspective - needs more resources than any individual will ever be able to have at its disposal. Also, i am aware of the possibility to get tracked by the telecommunication provider anytime and without me noticing it. My conclusion has been, that i am maybe 30 years too late in my activity to support tor - as a simple relay -. And the companies that seem to have most control over the internet (like google, akamai, and others) are in the process to control more and more of it, and only for that reason are fighting against malware like viruses and bots, and of course also fighting tor (by using honeypots as well as intrusion into the community to get as much information as possible about the people trying to hide in anonymity). This seems to be so true to me, that i begin to feel _guilty of nourishing false hopes_, that any individual could feel safe by using tor, irrespective of where and how legitimate/needed their requests are originating from. Seriously, i am beginning to think, that tor may be somewhat outdated nowadays, basically operating on old assumptions, about how the net was organised merely a decade ago. And not taking into account the reality of today, where our little community may not be all too useful any longer. Hard to hide some disappointment, as i used to be a developer many years ago, and find that no one - apart from myself - refuses to cooperate in the process of accumulating data, which provides the basis for semi-automated analysis later, and help some authorities to excert power and control over the population living on this planet. As my son very correctly said (btw: on his mobile! ;-)) : "Today, life begins, where there is neither computer nor electricity, but meeting with friends." ...until the earth observing satelites will be able to discern individuals. :-( Can anyone get me out of this pessimistic viewpoint? If not, i am seriously reconsidering the futile attempt to engage into offering something to the net, that could lead to unveiling users activities opposed to what tor seems to promise. Sorry for thinking out loud, but seriously worried about my own simple-mindedness. The operator of "NewTorKidOnTheBlock"

6 5

Re: [tor-relays] TOR Services on Microsoft Azure
by Volker Mink 13 Oct '16

13 Oct '16

3 3

OBFS4 Bridge
by pvr6＠sigaint.org 13 Oct '16

13 Oct '16

Have been running an obfs3 bridge for a while. Since I was building a new Debian server wanted to add obfs4, but when I configure TBB to point to the obfs4 port [Z] I get "general SOCKS failure" in the TBB log. Changing it back to use obfs3 and port [Y] works fine. How can I fix it so obfs4 works too? Here are the relevant lines from torrc: --- ORPort [X] BridgeRelay 1 PublishServerDescriptor bridge ServerTransportPlugin obfs3 exec /usr/bin/obfs4proxy managed ServerTransportListenAddr obfs3 0.0.0.0:[Y] ServerTransportListenAddr obfs4 0.0.0.0:[Z] ExtORPort auto --- If I do netstat -pan, I see obfs4proxy is listening on both ports on all interfaces. I tried to add "--log-file logfile" after /usr/bin/obfs4proxy in torrc but then it wouldn't start the proxy at all. I'm not finding any other log messages showing a problem. Tor's log is clean, just shows it starting both proxy instances (which netstat confirms.) Obfs4proxy is the packaged version 0.0.6. Not sure where else to look or change. I'd like to get it working but have commented out the obfs4 line for now.

2 2

Running tor on OpenBSD with hardware acceleration
by Farid Joubbi 12 Oct '16

12 Oct '16

Hello, I have a relay running on OpenBSD. LibreSSL that comes with OpenBSD does not have support for hardware acceleration. I get this when I start tor: "[notice] We were built to run on a 64-bit CPU, with OpenSSL 1.0.1 or later, but with a version of OpenSSL that apparently lacks accelerated support for the NIST P-224 and P-256 groups. Building openssl with such support (using the enable-ec_nistp_64_gcc_128 option when configuring it) would make ECDH much faster." How do I enable support for hardware acceleration? My guess is that I have to compile and install OpenSSL, then compile Tor to use the new OpenSSL. Does anyone here have any experience with this on OpenBSD? Anything that I have missed and should be aware of? Thanks.

3 3

Moving multiple instances to another VPS
by pa011 12 Oct '16

12 Oct '16

I have to move a multiple instances Exit from one VPS to another. Apart from creating the same instances on the new machine with **tor-instance-create** I would then just copy the whole directory /var/lib/tor/keys to the new VPS - or should I copy all /var/lib/tor/ to not miss anything from the original one? Am I miss anything else? Thanks Paul

4 5

Re: [tor-relays] ISP, Abuses , Intrusion Prevention etc.
by Gareth Llewellyn 11 Oct '16

11 Oct '16

On 9 Oct 2016 11:36, "pa011" <pa011(a)web.de> wrote: > > - what forces drive ISP's to behave like they do with abuses? > - maybe Exit volunteers and here especially the big ones could ask some questions to their ISP to get more light on this I set up my own ISP (AS28715) so I could run Tor exits etc without any trouble. > > I do refer to my old questions -still unanswered: > > -is it just the more work for rather poor money handling(forwarding) > those abuses ? Yes. Every abuse ticket is a person answering that abuse ticket instead of helping a customer who is potentially paying for support. It's also that some of the abuse emails can be quite threatening (e.g. blacklisting the entire /24 or reporting the "crime" to local Police etc) some of the smaller ISPs can get intimidated by those threats. > - to whom else do ISP's have to report what they are doing with received > abuses? In the UK; No one. > - must ISP's answer to the origin of the abuse? No. But is polite to do so. > - who is getting a copy of all that conversation(if at all)? Depends on the ISPs policies / any applicable laws. (In the UK and at least as far as my ISP is concerned; no-one) > - can an ISP loose its license (with too many or badly handled abuses)? AFAIK; No. In the UK I guess one could appeal to Court if an ISP wasn't preventing its network from being used to your detriment but I'm not sure how far you'd get. > - are there any regulatory burdens for them - if so which ones? Yes. Lots depending on the country. > - are ISP's treated different in different parts of the world? Very much so.

7 6

new warn message: Duplicate rendezvous cookie in ESTABLISH_RENDEZVOUS.
by Toralf Förster 10 Oct '16

10 Oct '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Today I got this for the first since I run exits: Oct 06 08:23:03.000 [warn] Duplicate rendezvous cookie in ESTABLISH_RENDEZVOUS. Something I should worry about ? - -- Toralf PGP: C4EACDDE 0076E94E, OTR: 420E74C8 30246EE7 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAlf2Dz0ACgkQxOrN3gB26U5LMAD+POAhOITGeYh5CFdOwFxgfzMf 510EN+mxt+3nTAFXgrIA/1BUXnr1DXh61y5ttIxSoVGJb95r8FTrnKiDTZ23yBkV =vFhm -----END PGP SIGNATURE-----

9 13

'No space left on device' glitch causing log failure
by Geoff Down 10 Oct '16

10 Oct '16

Hi all, these are the last entries in my log, but my bridge is still listed on Atlas and client functionality is fine. Latest stable version on OSX10.4. Needless to say, the disk is not full and 'tor' can write to that directory just fine now. Oct 05 22:52:09.000 [warn] Couldn't open "/Users/tor/tor/state.tmp" (/Users/tor/tor/state) for writing: No space left on device Oct 05 22:52:09.000 [warn] Unable to write state to file "/Users/tor/tor/state"; will try again later Oct 05 23:10:27.000 [warn] Couldn't open "/Users/tor/tor/cached-consensus.tmp" (/Users/tor/tor/cached-consensus) for writing: No space left on device Oct 05 23:11:32.000 [warn] Error writing to "/Users/tor/tor/cached-descriptors.new": No space left on device Oct 05 23:11:32.000 [warn] Unable to store router descriptor {more of the same until Oct 05 23:11:34.000} GD -- http://www.fastmail.com - Access all of your messages and folders wherever you are

4 4

tor relay and syslog logging
by Dr. Who 09 Oct '16

09 Oct '16

I'm trying to log locally (notice.log) and to a local syslog-ng server. It doesn't seem to work. I get no messages at all to my local syslog server. When I try to log some testlines manually (even as the tor system user) it seems to work. As I understood the configuration I can have multiple "Log " lines without problem, right? A test like: logger -p daemon.notice -t tortest Testing generates the expected lines in /var/log/messages What facility is used by tor when logging to syslog? I didn't find that information. System is a standard current debian 8.6 with tor Tor 0.2.8.8 (git-8d8a099454d994bd), the two Log-Lines are: Log notice file /var/log/tor/notices.log Log notice syslog Any idea what might be missing?

2 1

ISP, Abuses , Intrusion Prevention etc.
by pa011 09 Oct '16

09 Oct '16

My personal efforts over the last months as well as the recent discussion about Intrusion prevention showed, there are more and more ISP's not giving support any more for running Tor exits, either in not allowing new ones or even shutting down existing ones. Sure there are still chances to find new inexperienced ISP's, which in the willing to increase their customer base give allowance to run an Exit. But only a few weeks later their wish to get rid of you again increases with the same speed as the stack of abuses rises.Finally you are out again and on the back of their terms not even able to get your unused money back. Further doing it that way, is kind of leaving scorched earth behind you and not only yourself, but for Tor as a whole. So there are at least two questions: - what forces drive ISP's to behave like they do with abuses? - maybe Exit volunteers and here especially the big ones could ask some questions to their ISP to get more light on this I do refer to my old questions -still unanswered: -is it just the more work for rather poor money handling(forwarding) those abuses ? - to whom else do ISP's have to report what they are doing with received abuses? - must ISP's answer to the origin of the abuse? - who is getting a copy of all that conversation(if at all)? - can an ISP loose its license (with too many or badly handled abuses)? - are there any regulatory burdens for them - if so which ones? - are ISP's treated different in different parts of the world? - could there in the medium therm changes be made the way Tor operates to bring down the non linear increase of abuses Support terribly needed and appreciated! Paul

1 0

Intrusion Prevention System Software - Snort or Suricata
by pa011 09 Oct '16

09 Oct '16

One of my main ISP is going mad with the number of abuses he gets from my Exits (currently most on port 80). He asks me to install "Intrusion Prevention System Software" or shutting down the servers. He personally recommends Snort or Suricata. As far as I understand implementing such a software is not going together with Tor - am I right? Somebody having same or any experience? Thanks Paul

15 96

Relay uptime after restarting Tor service
by Zac 08 Oct '16

08 Oct '16

Hi, I run this relay: https://atlas.torproject.org/#details/02928855BFAD787F8B363F21860D1E7D156E0… and noticed that my uptime on Atlas is reset to zero when I need to restart the service, i.e. for updates or configuration changes. Is this expected behaviour, or should the uptime in fact be unaffected by such short down-times? Thanks, -- MrDetonia <mrdetonia(a)protonmail.com>

7 7

Digital Ocean - running Exit node locked
by pa011 07 Oct '16

07 Oct '16

Seems like even DO is not very much in favour of running Exits any more ? Anybody made the same experience - how to handle this please ? Thanks and Regards Paul "Hello -Although we do not specifically disallow TOR exit nodes, as the account holder you are responsible for all the traffic going through your droplet (including traffic that an exit node may generate). Also be aware that we do not allow some of the traffic types that come out of a typical TOR exit node (torrents, spam, SSH probes, hacking attempts, botnets, DDoS, etc). If you are unable to stop this sort of traffic, please reconsider running a TOR exit node as it may lead to your account suspension or termination. Please refer to our Terms of Service for greater detail on this issue: https://www.digitalocean.com/legal/terms/ Best, DigitalOcean Support "

2 2

Middle Relay changed to Exit Relay Bandwidth Change
by tmbates12 07 Oct '16

07 Oct '16

Recently I enable exits on my relay and traffic seemed to jump very high compared to the almost stagnant bandwidth increase wen it was just running as a guard middle relay. I was wondering if this was normal for the traffic to jump this much. Here's the Atlas link for my relay: https://atlas.torproject.org/#details/ABF5C38A93F2D7E77A226871AB0ADB052279B…

2 1

Dealing with OVH Abuse Complaints
by teor 05 Oct '16

05 Oct '16

Hi, Does anyone have experience running a long-lived Exit on OVH / So You Start? We've just received a threat to shut down our OVH Exit due to abuse complaints. We were responding to these automated reports (mainly SSH brute force) with template responses, offering to block the destination IP and port if the remote site wanted us to. We never received a reply. What does OVH expect its Exit operators to do with complaints? Should we have blocked each complaining IP address as soon as we received a complaint? Tim T -- Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ricochet:ekmygaiu4rzgsk6n xmpp: teor at torproject dot org

8 7

TOR Services on Microsoft Azure
by Volker Mink 04 Oct '16

04 Oct '16

Hi. I read some pages on the internet about TOR-servers on cloud-services like Microsoft Azure or Amazon AWS. Just gave it a try on Azure and it works like a charm! You can sign up for free and receive credits worth ~200$. With this credits you can safely run an unlimited VPS for about 4-5 month. https://atlas.torproject.org/#details/0534295ACFD5A84312183B41D3FB275E9ADD9E E2 i think im going to give Amazon AWS also a try J regards, volker

7 11

The Onion Box v3.0: Web Interface for your Tor relay
by Ralph Wetzel 04 Oct '16

04 Oct '16

5 10

Question about relay speed
by Sheesh 03 Oct '16

03 Oct '16

Hello! I'm running a non-exit relay on my VPS with small amount of traffic/month. That means my advertised bandwidth is ~500 KB/s. I got a new VPS where I want to let a relay run with several MB/s - My question now is: should I let the slower relay run (aka do 500 KB/s positively contribute to the TOR network?) or move my relay key to the new server and run this one only? Thanks in advance!

7 13

Re: [tor-relays] help #3
by teor 02 Oct '16

02 Oct '16

> On 30 Sep 2016, at 14:37, Markus Koch <niftybunny(a)googlemail.com> wrote: > > Installed with apt-get and started simply as a demon aka service tor start > Thank you for helping Have you tried: >>> sudo su debian-tor --shell /bin/bash --command "ulimit -Sn" >>> sudo su debian-tor --shell /bin/bash --command "ulimit -Hn" What are the file descriptor limits set to? How much RAM does the system have? What are the TCP buffer limits in the kernel? Here's some background: In Tor, there are the 4 C/Linux error return values that can trigger that message: EMFILE ENFILE ENOBUFS ENOMEM On my system, "man 2 intro" lists them as: Too many open files...the limit on the number of open files per process... Too many open files in system. Maximum number of file descrip- tors allowable on the system has been reached... No buffer space available. An operation on a socket or pipe was not performed because the system lacked sufficient buffer space or because a queue was full. Cannot allocate memory. The new process image required more memory than was allowed by the hardware or by system-imposed mem- ory management constraints… T > > Markus > > > > > > > 2016-09-30 23:33 GMT+02:00 teor <teor2345(a)gmail.com>: >> >>> On 30 Sep 2016, at 14:01, Green Dream <greendream848(a)gmail.com> wrote: >>> >>> Have you double-checked the ulimit was applied correctly? Including >>> making sure it's applied to the user account running Tor? Here's how I >>> do that on Ubuntu/Debian, assuming the user account is "debian-tor": >>> >>> sudo su debian-tor --shell /bin/bash --command "ulimit -Sn" >>> sudo su debian-tor --shell /bin/bash --command "ulimit -Hn" >>> >>> Those should return the actual hard and soft limits being applied to >>> the debian-tor user. In my case it returns 64000, but you'll just want >>> to make sure it's what you're expecting. >>> >>>> nothing works and now I am running out of ideas >>> >>> It would be easier for people to help if you elaborate a bit -- >>> perhaps the exact commands you've already tried and the log messages >>> (if there are any other error or warning messages besides the one you >>> already listed). >> >> The debian packages should set the appropriate file descriptors for you. >> How are you launching your tor services? >> >> T >> >> -- >> Tim Wilson-Brown (teor) >> >> teor2345 at gmail dot com >> PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B >> ricochet:ekmygaiu4rzgsk6n >> xmpp: teor at torproject dot org >> >> >> >> >> >> >> T -- Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ricochet:ekmygaiu4rzgsk6n xmpp: teor at torproject dot org

2 1

Help configuring a relay on OS X
by Surf Norway 01 Oct '16

01 Oct '16

A few years ago I tried setting up a relay as a way to contribute back to the community, I have fast symmetrical fiber and a Mac mini running as a light file server. I never was able to get it to work and gave up. I recently bumped up the RAM to max and put an SSD drive in, upgraded to 10.11 and thought I'd give another go at setting up a relay. I've installed Xcode and the command line tools, installed MacPorts and used that to install Tor. I configured the torrc file as best I could and expect that's probably the problem with my setup. When I start Tor (v0.2.8.8) it identifies the OS, reads the torrc file and grabs a chunk of memory for MaxMemInQueues. Then it opens OR listener but on an invalid IP (0.0.0.0), complains that it can't write to the log file (permission denied), and closes partially-constructed OR & directory options. Before I go and change the log file permissions, what user should I be running as when I start Tor as a relay? Ideally I want it to start with the system and run by default in the background and uncommented "RunAsDaemon 1" in the torrc file. The mini sits and serves files normally and isn't usually in use as a normal computer/console. When I run Tor myself it's from a different machine in order to use the Tor browser. All I want the mini to do is act as a relay, nothing more. Thanks for any help. Sorry for the newbie question, but guess what... Surf

2 1

help #3
by Markus Koch 30 Sep '16

30 Sep '16

me again ... I need the knowledge of the almighty tor operators. I set up three new and shiny tor exists and got a not so shiny error message: [WARN]Failing because we have 4063 connections already. Please read doc/TUNING for guidance It was already in this mailing list: http://archives.seul.org/tor/relays/Feb-2016/msg00060.html I "tuned" it with ulimit https://gitweb.torproject.org/tor.git/tree/doc/TUNING/ and nothing works and now I am running out of ideas and getting pissed. They exits are running a Debian 7 x64 minimal install with the newest tor version. Any ideas how to fix it? Markus

4 4

How to get rid of 'Family' entries?
by theonionbox＠gmx.com 30 Sep '16

30 Sep '16

2 1

Request for Tor abuse complaints
by Sadia Afroz 29 Sep '16

29 Sep '16

Dear exit operators, Can you please share the abuse complaints you received while running an exit? We are researchers from Univ. of California, Berkeley and Univ. of Massachusetts Amherst are interested in understanding what kind of abuse happens through Tor. Thanks to Moritz Bartl from Torservers.net <http://torservers.net/> we analyzed over 1GB of complaints received over 6 years. Here is our preliminary analysis of the complaints: http://www1.icsi.berkeley.edu/~sadia/tor_abuse_complaints.pdf <http://www1.icsi.berkeley.edu/~sadia/tor_abuse_complaints.pdf> We will appreciate if you can share the abuse complaints you received. It will be valuable for us to better understand the abuse of Tor and to find solutions to reduce abuse. Best, Sadia

9 17

Hide TOR exit on my external IP?
by Volker Mink 29 Sep '16

29 Sep '16

2 2

"Potentially dangerous relay groups"
by nusenu 28 Sep '16

28 Sep '16

pa011(a)web.de wrote: > there is that list of "potentially_dangerous_relaygroups" you published. > Could yo please emphasize a bit more on what brings a relay on that list, apart from incorrect given MyFamily which doesnt seem to be always the case. > I mean I see quite a few well respected names on that list ? to quote from https://github.com/ornetstats/stats (1) "dangerous" in the sense that a tor client might has a chance to use more than one of these relays in a single circuit (2) these relays are aggregated based on contact information (3) if their groupsize is bigger than their effective family size and they are operated in more than one /16 network block they are listed (4) this list might contain false-positives (contact information is not authenticated) Does that answer your question? I probably should also filter entries where two out of guard_prob, middle_prob and exit_prob are 0 since that means that (1) is never the case - iff onionoo is right about these probabilities.

12 23

log message: [WARN] Failing because we have X connections already.
by David S 27 Sep '16

27 Sep '16

greetings! i setup a new tor exit server and am seeing this in the log messages: 18:25:01 [WARN] Failing because we have 1352 connections already. Please read doc/TUNING for guidance. [11430 similar message(s) suppressed in last 21600 seconds] any ideas why? this is happening on a shared VPS, running ubuntu 16.04 and tor v0.2.8.8. i'm starting to think it's some limitation by the VPS provider. uname -a shows a old kernel (possibly centos 6): Linux km14133-25 2.6.32-042stab113.21 #1 SMP Wed Mar 23 11:05:25 MSK 2016 x86_64 x86_64 x86_64 GNU/Linux i've made sure tor has enough "max open files" available via limits.conf: # cat /proc/$(pgrep tor)/limits|grep "open files" Max open files 65536 65536 files i'm starting to scratch my head. maybe i should do some intense debugging on this box.. cheers, david

3 3

Strange difference between rx and tx traffic
by pa011 27 Sep '16

27 Sep '16

On one of my recently started Exits I do see a rather huge and increasing difference between in and out traffic that I don see on any other Exit so far. The rise doesn’t seem to be linear.. Any explanation for that - or can it just be on the back of a not fixed repetitive warning? Sep 27 06:42:46.000 [warn] eventdns: All nameservers have failed Sep 27 06:42:46.000 [notice] eventdns: Nameserver 8.8.8.8:53 is back up Thanks Paul eth0 / daily day rx | tx | total | avg. rate ------------------------+-------------+-------------+--------------- 11.09.2016 539,96 MiB | 88,50 MiB | 628,47 MiB | 59,59 kbit/s 12.09.2016 1,47 GiB | 1,06 GiB | 2,53 GiB | 245,60 kbit/s 13.09.2016 10,03 GiB | 9,86 GiB | 19,89 GiB | 1,93 Mbit/s 14.09.2016 17,35 GiB | 16,69 GiB | 34,04 GiB | 3,30 Mbit/s 15.09.2016 53,11 GiB | 51,59 GiB | 104,70 GiB | 10,17 Mbit/s 16.09.2016 99,08 GiB | 96,87 GiB | 195,96 GiB | 19,03 Mbit/s 17.09.2016 144,45 GiB | 140,66 GiB | 285,12 GiB | 27,68 Mbit/s 18.09.2016 190,05 GiB | 184,50 GiB | 374,55 GiB | 36,36 Mbit/s 19.09.2016 231,95 GiB | 223,90 GiB | 455,86 GiB | 44,26 Mbit/s 20.09.2016 291,30 GiB | 282,25 GiB | 573,55 GiB | 55,69 Mbit/s 21.09.2016 343,19 GiB | 332,33 GiB | 675,52 GiB | 65,59 Mbit/s 22.09.2016 347,57 GiB | 329,66 GiB | 677,22 GiB | 65,75 Mbit/s 23.09.2016 388,91 GiB | 373,21 GiB | 762,13 GiB | 74,00 Mbit/s 24.09.2016 381,35 GiB | 361,64 GiB | 742,99 GiB | 72,14 Mbit/s 25.09.2016 391,60 GiB | 364,34 GiB | 755,94 GiB | 73,39 Mbit/s 26.09.2016 374,59 GiB | 337,81 GiB | 712,40 GiB | 69,17 Mbit/s 27.09.2016 144,06 GiB | 131,67 GiB | 275,73 GiB | 70,89 Mbit/s ------------------------+-------------+-------------+--------------- estimated 382,03 GiB | 349,18 GiB | 731,21 GiB |

4 5

Re: [tor-relays] [OrNetRadar] niftybunny Digital Ocean 2016-09-22
by nusenu 27 Sep '16

27 Sep '16

Hi Markus, according to your contactinfo observed on the tor network, you run 21 relays, please consider fixing your MyFamily setting, especially because you run non-exit and exits. thanks, nusenu https://raw.githubusercontent.com/ornetstats/stats/master/o/potentially_dan… ornetradar(a)riseup.net wrote: > 2016-09-22 > ----------------------------------------------------------------------------------------------------------------------- > Up|Ext|JoinTime| IP | CC | ORp | Dirp |Version | ContactInfo | Nickname | eFamlen > ----------------------------------------------------------------------------------------------------------------------- > 1 | 0 |14:51:30| 188.166.63.113 | nl | 443 | 80 |0.2.8.7 | niftybunny(a)googlemail.com | cairospinymouse | 1 > 1 | 0 |15:07:01| 95.85.45.159 | nl | 443 | 80 |0.2.8.7 | niftybunny(a)googlemail.com | mullahspinymouse | 1 > 1 | 0 |15:24:30| 138.197.129.153 | ca | 443 | 80 |0.2.8.7 | niftybunny(a)googlemail.com | capespinymouse | 1

2 1

New openssl releases
by Nick Mathewson 26 Sep '16

26 Sep '16

Just a reminder: if you're operating a relay, you should make sure that your operating system is giving you updates for openssl, and you are applying them. There was an update today about bugs in Thursday's OpenSSL releases. For the security advisory, see here: https://www.openssl.org/news/secadv/20160926.txt best wishes, -- Nick

1 0