- tor-relays - lists.torproject.org

Re: [tor-relays] tor relay + bridge
by tinychems＠ruggedinbox.com 02 Nov '15

02 Nov '15

Thank you for your reply. Regards!

1 0

tor relay + bridge
by tinychems＠ruggedinbox.com 02 Nov '15

02 Nov '15

Hi, I have a vps acc with 2 ips. I'd like to keep one free of tor, the other is tor only. Right now I run a relay - http://torstatus.blutmagie.de/router_detail.php?FP=e6277f0036890d4ff334c65e… Is it possible to run a bridge on the same server? I assume the same ip would be a problem, but I can get practically unlimited ipv6. Can I run one on only ipv4 and the other on only ipv6? Which do you suggest for each? Regards!

2 1

DirAuths are blocking my node on Amazon EC2. Why?
by Yousif Al Saif 02 Nov '15

02 Nov '15

Dear all, I have a Tor relay running on Amazon EC2 (IP range: 52.0.0.0/11) and for sometime I am receiving the messages: http status 400 ("Authdir is rejecting routers in this range.") response from dirserver 'X.X.X.X:80'. Please correct. The router disappeared from the Tor Directory and the consensus. Its a non-exit node and there seems to be some traffic going on. Was there a particular reason for the block or was this specific to my router only? Should I consider moving to a different provider or was I specifically targeted by the block and should not attempt moving somewhere else. My details: Nickname: Yankee2 IP: 52.25.145.191 Hash: CA631DB7F8E3E00A148D2D1D0BBD1B5710888D8E Best, Yousif

3 3

One of my nodes seems down by its tunnel quite a bit of traffic
by Eran Sandler 02 Nov '15

02 Nov '15

Hi all, I got a Tor Weather alert that my node is down: https://atlas.torproject.org/#details/98F44299592FC31FD3F2F8969D27374D00E96… Looking at it - it seems to have no flags at all (not sure why). It is tunnelling ~8-10Mb/sec so I assume its being used as a relay. Is there a way to understand why it has no flags? Eran

6 7

(no subject)
by 海洋 30 Oct '15

30 Oct '15

1 0

HoneyPot?
by Mirimir 29 Oct '15

29 Oct '15

Anyone know what HoneyPot was/is? https://atlas.torproject.org/#details/F77FD005BF74CD0B4C611389C3006452AEC60…

6 11

Re: [tor-relays] HoneyPot?
by Dhalgren Tor 29 Oct '15

29 Oct '15

Is the end of the month. Maybe they ran out of bandwidth and will be back 11/1. LeaseWeb over-limit rates are terrifying. BTW the exit policy includes 443.

2 1

(no subject)
by 海洋 29 Oct '15

29 Oct '15

8e10f0be03478ac378eb8562bd71e3757734fd75

1 0

Failure from drain-fd
by starlight.2015q3＠binnacle.cx 29 Oct '15

29 Oct '15

On 27 Oct 2015, at 15:42, Brian Walker <torrelay(a)outlook.com> wrote: > >I've updated Tor to the newest beta: >Tor v0.2.7.4-rc (git-f55d23e1e66e9b0f) running > on Windows 8 [server] > with Libevent 2.1.5-beta, > OpenSSL 1.0.2d and Zlib 1.2.8. > >I'm still experiencing errors: >Oct 27 01:22:29.000 [warn] Failure from drain_fd. . . >Oct 27 03:22:31.000 [warn] Failure from drain_fd. . . >Oct 27 05:22:33.000 [warn] Failure from drain_fd. . . > >Is there something else to try? Perhaps a debug-level log will shed some light. Message volume is too huge for anything but file logging. You can configure it in 'torrc' LogTimeGranularity=1 Log debug file logfile001 dynamically on a control channel: SETCONF LogTimeGranularity=1 Log="debug file logfile001" When done: SETCONF Log="notice syslog" LogTimeGranularity=1000 Never tried this on Windows. Perhaps 'syslog' does not apply. . .use whatever's in 'torrc'.

1 0

Unsubscribe
by OM Healing 28 Oct '15

28 Oct '15

On Tuesday, October 27, 2015, Eran Sandler <eran(a)sandler.co.il> wrote: > Hi all, > > I got a Tor Weather alert that my node is down: > > https://atlas.torproject.org/#details/98F44299592FC31FD3F2F8969D27374D00E96… > > Looking at it - it seems to have no flags at all (not sure why). > It is tunnelling ~8-10Mb/sec so I assume its being used as a relay. > > Is there a way to understand why it has no flags? > > Eran >

1 0

Free Domain for Tor Nodes
by Eran Sandler 28 Oct '15

28 Oct '15

Hi all, I recently bought torexitnode.net to make it abundantly clear in reverse DNS lookup that this is a Tor exit node. I've set both of my exit relays tor4thepeople1.torexitnode.net and tor4thepeople2.torexitnode.net to use it and I was wondering if it would be interesting for other Tor relay users to use it as well. If so, I'll write a small something that will allow adding new subdomains to it. So that you can always add and update subdomains on it. Once its running you can ask your service provider (if they don't provide an interface already) to make a reverse lookup on the IP to that address. What do you think? Is this something people would want to use? Thanks, Eran

11 15

Failure from drain-fd
by Brian Walker 27 Oct '15

27 Oct '15

Anybody know what this means? My logs are littered with it. Tor v2.6.9 with Libevent 2.0.21-stable, OpenSSL 1.0.1o and Zlib 1.2.8 on Windows Server 2012 R2. Aug 06 13:26:35.000 [warn] Failure from drain_fd [3892 similar message(s) suppressed in last 7200 seconds] Aug 06 15:26:37.000 [warn] Failure from drain_fd [3526 similar message(s) suppressed in last 7200 seconds] Thanks

3 6

debian tor package comes with multi-instance support as of 0.2.7.4-rc-1
by nusenu 27 Oct '15

27 Oct '15

Hi, the debian tor package maintainer implemented the multi-instance feature request [1][2][3]. Thanks Peter! If you want to learn more about it, have a look at tor-instance-create(8): https://gitweb.torproject.org/debian/tor.git/tree/debian/tor-instance-creat… Once tor 0.2.7.x stable is release I'll start playing with it and change ansible-relayor [4] to make use of that new functionality on debian systems by default - instead of implementing it via the ansible role itself (current behavior). We have quite good multi-instance support across multiple systems now (Fedora, CentOS, Debian, OpenBSD). FreeBSD is still somewhat of a hack - but it works as well. [1] https://lists.torproject.org/pipermail/tor-relays/2015-February/006472.html [2] https://trac.torproject.org/projects/tor/ticket/14995 [3] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=791393 [4] https://github.com/nusenu/ansible-relayor

3 2

Re: [tor-relays] too many circuit creation requests
by starlight.2015q3＠binnacle.cx 25 Oct '15

25 Oct '15

>[warn] Your computer is too slow. . . Raspberries are cute but seriously underpowered for crypto-intensive applications such as Tor. You can (any/all of) 1) ignore the warnings 2) restart the relay to send-off any hidden services that might be causing the overload 3) buy a dirt-cheap used laptop or mini-tower on eBay to run the relay 4) buy a Beagle Board if you enjoy fiddling with miniature computers --much more powerful device The configured limit is reasonable for the device.

5 10

Cheap VPS provider for an exit node
by Riccardo Mori 25 Oct '15

25 Oct '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi everyone, I have been running an exit Tor relay for 5 months with a PulseServers VPS and everything went fine until some days ago Kyle, the provider's owner, reduced the bandwidth to something above 10 Mbit/s. Adding the fact that he is an OVH reseller I am now searching a new VPS provider. Unfortunately I can't afford a 50$/month VPS so I am looking for something that has more than 5TB of monthly traffic with a reasonable price and preferably that it's not using OVH AS. What are you using? Is there anybody that can give me a hint? Thanks! Riccardo Mori -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWKmXTAAoJEE1LNuolWAxgnMAP/iWqUu0QpftVf8fzWNrs+UuJ bIpXdyYfjHTIcfk6cEZDNsJ+A3eNSYp2wt99QLLawiY95Jb7TNdzKBaiYCHtELHi R9iybldSH5snzpIDZE35SOSi+gleu334Yx0wSguVp4apxXKeaw4KMNC7nKXbWraH ijarl4LVBrkgoqs+l77DA/QtrmrY3zYQv1eRt6hHh3ah+XlW8HUMV1ipDblUtkot NH5sCe6FMg7fS0G33ZJprOq4a76jvmFJ89nfqyhZJjvey7ukuidYQLN+gFM5NWVs Pe3EYzv0tvOWZEnU+rPLEeF5iUQrTLPNlNhGirCQ74Mj9UMrVtKx7b9VoRedSua2 kx131c3VCCqc8CvheH6eztAt7WDE1GyA0JAGRCleTdhDxUdDdHZWgyrHp78aDvN7 6fYS0z4HFUyB/xTY7z3jP6z4IgxkeWv1McQXlyKQhn4ZSTRs9Z5ySpiKSi+L/Uar 145U4x6biuE5ZjkoTwJFNyLUdgduG+LPHfckyGHr0qsTm9TG+9FkEoVx02pijkVV zJRTuPPlOgOwabsFchj5Gzc+B3B1yZbNdjjFYMTyPv+LXP9MoFzC4Ytd2LyzLdCz TfOcvfbiWU2BK8GbzxD6Q5+nayZ20zFPQvvW7y6XKweiUZCkXmIFKWyDtZ0egCr5 fXY92u9AUOYgraHGOhps =7i7O -----END PGP SIGNATURE-----

3 3

too many circuit creation requests
by trshck_tor＠riseup.net 24 Oct '15

24 Oct '15

Hi all, I set up a new tor relay named trshck using a raspberry pi a few days ago. All was going fine until early today, when a lot of warning have started appearing in the log file: "[warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy." I've looked up this message and found some comments but nothing clear about how to solve the issue. I think this can be related with the recent acquisition of the HSDir flag. The relay is not configured to be an exit node. The number of open circuits has greatly increase in the last few hours: "Circuit handshake stats since last time: 4860/4984 TAP, 228464/229242 NTor." MaxAdvertisedBandwidth is not set, only: "RelayBandwidthRate 200 KB RelayBandwidthBurst 300 KB" What do you advice me to do? Regards, Joan Terrassa Hacklab

3 2

ntpd problems explanation
by I 23 Oct '15

23 Oct '15

2 2

Re: [tor-relays] Tor node break-in attempts
by starlight.2015q3＠binnacle.cx 22 Oct '15

22 Oct '15

> > Attack counts are in the 100,000s. > This sort of thing posses no threat and is quite stupid as previously observed. Is mainly annoying for the mess it makes of /var/log/security. If you don't want to change the SSH port (best solution IMO), here's an 'iptables' rule that will fix it (adjust/rearrange as needed/desired). These lines assume they will go in /etc/sysconfig/iptables. You can run them manually by prefixing with the 'ipbables' command. I wrote this without looking at the default 'iptables' file for any distro and if you are using one, revise accordingly or rename the original and start from scratch. -N input_eth0 -A INPUT -i eth0 -j input_eth0 -A input_eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT -A input_eth0 -p tcp --dport 22 -d x.x.x.x -m recent --update --seconds 600 --hitcount 3 --name SSH_ATTACK -j DROP -A input_eth0 -p tcp --dport 22 -d x.x.x.x -m recent --set --name SSH_ATTACK -j ACCEPT ========== Because we all make mistakes, you should *TEST* the rule by KEEPING A LIVE CONNECTION active and logging in a second time or you may lock yourself out of your server. Use iptables -nvL to display the counters and look for the lock-out effect after 'hitcount' attempts. Also look in cat /proc/net/xt_recent/SSH_ATTACK for the login tries and lock-out. You can clear an IP with echo "-x.x.x.x" >>/proc/net/xt_recent/SSH_ATTACK ========== If you want a bigger hash table and more history than the default, you can create /etc/modprobe.d/xt_recent.conf and put something like options xt_recent ip_list_tot=16384 ip_pkt_list_tot=255 in it. ========== Some documentation at http://linux.die.net/man/8/iptables

1 0

Tor node break-in attempts
by Larry Brandt 22 Oct '15

22 Oct '15

Hello, I need some advise on a situation new to me. I operate a VPS exit node in Romania, a VPS guard node in the Czech Republic, a middle node and bridge in the US. All are SSH public key authentication protocol 2. Over the last 5 weeks all of these servers have been under attack by IPs in the range 43.229.52.00 to 43.229.55.255. Maybe 24 different IP addresses. I have contacted the operator in Hong Kong on four different occasions but I've received no relief from the attempted attacks nor have they communicated back to me--as I have requested. Attack counts are in the 100,000s. I have no personal information stored on any of these servers--only public info via Tor is available. And then, how the hell did they get the address of my bridge? I see break-in attempts all the time but never at this volume. The break-in attempts have been thwarted to date and will probably remain so. But I find the situation disconcerting and irritating. Should I ignore these efforts? Should I send abuse reports to someone? Who? Any sage advice out there? Did I give away any secure info just now? lol LB

3 2

Re: [tor-relays] Optimizing TOR Relay
by Volker Mink 22 Oct '15

22 Oct '15

Here we go. Thats the input i needed. Regarding to >> https://atlas.torproject.org/#details/E20FF09A9A800B16C1C7C16E8C0DF95F46F64… my advertised Bandwith is 681.33 KB/s , which is little more than 5MBps. So its kinda "maxed out" . > On 22 Oct 2015, at 01:42, 12xBTM <12xbtm(a)gmail.com> wrote: > > Here's your problem: > >> On 21.10.15 8:20, Volker Mink wrote: >> Upstream 5 MBps Tor bandwidth usage is more or less symmetric upstream / downstream. So you'll only ever get 5Mbps or less of tor traffic out of this connection. Tim

1 0

Re: [tor-relays] Optimizing TOR Relay
by Volker Mink 21 Oct '15

21 Oct '15

Its a Pi1, model B with 512MB RAM. RelayBandwidthRate 10000 KB # Throttle traffic to 1000KB/s (800Kbps) RelayBandwidthBurst 20000 KB # But allow bursts up to 2000KB/s (1600Kbps) MaxAdvertisedBandwidth 10000 KB (anything to change here?) I have a 60MBit Internet Connection at home with a static IP-Adress. Downstream about 65MBps, Upstream 5 MBps. Message: 1 Date: Tue, 20 Oct 2015 20:10:44 -0400 From: 12xBTM <12xbtm(a)gmail.com> To: tor-relays(a)lists.torproject.org Subject: Re: [tor-relays] Optimizing TOR Relay Message-ID: <5626D804.7070306(a)gmail.com> Content-Type: text/plain; charset=windows-1252 If this is a raspberry pi 2, set in Torrc: "NumCPUs 4" What is your advertised bandwidth? I can personally say that a RPi2 has no trouble moving 20Mbps, which would run you a ~50Mbps connection to get that kind of utilization. If you're talking about a RPi1, you don't have enough bandwidth dedicated to get the usage you want. On 20.10.15 8:08, Volker Mink wrote: > -now without HTML- > > Hi Folks. > > Some Stats: > fingerprint: E20FF09A9A800B16C1C7C16E8C0DF95F46F649B0 > cpu: 0.0% tor, 12.3% arm mem: 149 MB (34.4%) pid: 2200 > cpu: 20.0% tor, 10.2% arm mem: 149 MB (34.4%) pid: 2200 > > load average: 0,30, 0,36, 0,33 > %Cpu(s): 18,0 us, 3,1 sy, 0,0 ni, 75,3 id, 0,2 wa, 0,0 hi, 3,5 si, 0,0 st > KiB Mem: 445044 total, 349348 used, 95696 free, 79872 buffers > KiB Swap: 102396 total, 0 used, 102396 free, 119044 cached > > 2200 debian-t 20 0 168m 149m 42m R 23,4 34,5 940:35.09 tor > > This looks like my raspberry is more on idle than serving the TOR network. How can i improve this? > Bandwith limit is more than my internet connection can cover. > > Starting another tor-process? How to manage this? > Editing some Lines in the torrc-file to speed it up? > > Help is appreciated. > Kind regards, > volker > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >

4 3

webiron requesting to block several /24 subnet
by Dhalgren Tor 21 Oct '15

21 Oct '15

>snake oil service like webiron A most excellent characterization! As a sales maneuver WebIron has been grandstanding for months saying that Tor operators are "unwilling to cleanup" when they know full-well that tor operators can not / should not filter traffic due to minor brute- force login attempts. For contrast, Fail2ban in 2012 was modified to silently block login attacks without spamming Tor operators in a reasonable gesture of politeness. SSH brute-force attacks have been a fact-of-life for 20 years. Hardly anyone thinks it worth the effort to spam abuse@ desks over it when a simple rate-limit does the job nicely. WebIron has become so obnoxious that Spamhaus placed their domain on the Domain Block List last Friday http://www.spamhaus.org/query/dbl?domain=webiron.com and in addition, the IP of their reporting system appears on the Spamhaus snow-shoe list and thereby on the big-bazooka Zen DNSBL. http://multirbl.valli.org/lookup/23.239.20.29.html Spamhaus is highly conservative, highly respected and only lists egregious unrepentant abusers. The only reason to comply is in deference to the overworked abuse-desk of your ISP if they do not have an automated system for dealing with this nonsense.

1 0

Optimizing TOR Relay
by Volker Mink 20 Oct '15

20 Oct '15

-now without HTML- Hi Folks. Some Stats: fingerprint: E20FF09A9A800B16C1C7C16E8C0DF95F46F649B0 cpu: 0.0% tor, 12.3% arm mem: 149 MB (34.4%) pid: 2200 cpu: 20.0% tor, 10.2% arm mem: 149 MB (34.4%) pid: 2200 load average: 0,30, 0,36, 0,33 %Cpu(s): 18,0 us, 3,1 sy, 0,0 ni, 75,3 id, 0,2 wa, 0,0 hi, 3,5 si, 0,0 st KiB Mem: 445044 total, 349348 used, 95696 free, 79872 buffers KiB Swap: 102396 total, 0 used, 102396 free, 119044 cached 2200 debian-t 20 0 168m 149m 42m R 23,4 34,5 940:35.09 tor This looks like my raspberry is more on idle than serving the TOR network. How can i improve this? Bandwith limit is more than my internet connection can cover. Starting another tor-process? How to manage this? Editing some Lines in the torrc-file to speed it up? Help is appreciated. Kind regards, volker

3 2

Re: [tor-relays] Exit policy reject fails
by spiros_spiros＠freemail.gr 20 Oct '15

20 Oct '15

Hi Josef, I think you must put any reject entries above the accept because the rules read from top to bottom. Also, I don't know if this make any difference at all, but I also put port in my torrc like this : ExitPolicy reject 195.113.0.0/16:* #comment here S On 19 Oct 2015, at 22:03, Josef Stautner <hello(a)veloc1ty.de> wrote: Hello @all, I have a probleme with an reject rule which seems to fail. Due to an message from WebIron against my exit relay I wanted to block a subnet. My exit policy looks like this: ExitPolicy accept *:53 # DNS ExitPolicy accept *:80 # HTTP ExitPolicy accept *:8080 # HTTP 2 ExitPolicy accept *:443 # HTTPS ExitPolicy reject 5.133.182.0/24 # WebIron report ExitPolicy reject *:* After I added the reject rule I reloaded tor and thought the case is done. But WebIron keeps sending me messages because of "ongoing attacks" against a host in that subnet. Of course I trusted the reject rule and ignored them. After the 6th mail I got suspicious and added an iptables ACCEPT rule in my OUTPUT chain to have a look if there is really a traffic flow. I just received another mail and checked the packet counter: Chain OUTPUT (policy ACCEPT 116M packets, 159G bytes) num pkts bytes target prot opt in out source destination 2 142 8304 ACCEPT all -- * * 31.220.45.6/32 5.133.182.0/24 /* WebIron Block check */ There is traffic flowing from my relay IP 31.220.45.6 to the subnet. Can somebody please hint me what I'm doing wrong? Link to the relay in case you need more information: https://atlas.torproject.org/#details/29E3D95332812F81F67FF31B3B1B842683D1C… Thanks in advance, ~Josef _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

3 2

Optimizing TOR-Relay
by Volker Mink 20 Oct '15

20 Oct '15

1 0

Exit policy reject fails
by Josef Stautner 19 Oct '15

19 Oct '15

Hello @all, I have a probleme with an reject rule which seems to fail. Due to an message from WebIron against my exit relay I wanted to block a subnet. My exit policy looks like this: ExitPolicy accept *:53 # DNS ExitPolicy accept *:80 # HTTP ExitPolicy accept *:8080 # HTTP 2 ExitPolicy accept *:443 # HTTPS ExitPolicy reject 5.133.182.0/24 # WebIron report ExitPolicy reject *:* After I added the reject rule I reloaded tor and thought the case is done. But WebIron keeps sending me messages because of "ongoing attacks" against a host in that subnet. Of course I trusted the reject rule and ignored them. After the 6th mail I got suspicious and added an iptables ACCEPT rule in my OUTPUT chain to have a look if there is really a traffic flow. I just received another mail and checked the packet counter: Chain OUTPUT (policy ACCEPT 116M packets, 159G bytes) num pkts bytes target prot opt in out source destination 2 142 8304 ACCEPT all -- * * 31.220.45.6/32 5.133.182.0/24 /* WebIron Block check */ There is traffic flowing from my relay IP 31.220.45.6 to the subnet. Can somebody please hint me what I'm doing wrong? Link to the relay in case you need more information: https://atlas.torproject.org/#details/29E3D95332812F81F67FF31B3B1B842683D1C… Thanks in advance, ~Josef

2 2

TCP: too many orphaned sockets
by fatal 19 Oct '15

19 Oct '15

Hello, I had to move my exit relay to another VPS due to the provider getting annoyed by the abuse mails. The new VPS has exactly the same software setup but only 512 instead of 1024 Mb RAM. Traffic was/is around 45 Mbit/s on both. On the new VPS I get the following message (from time to time lots of them): "kernel: [XXXXXX.XXXXXX] TCP: too many orphaned sockets" which I've never seen on the old VPS. Memory consumption is as follows: total used free shared buffers cached Mem: 492560 465600 26960 348 9852 74476 -/+ buffers/cache: 381272 111288 Swap: 1998844 40956 1957888 I'm unsure if I should limit the maxbandwidth in torrc or try to tune the kernel settings (like /proc/sys/net/ipv4/tcp_max_orphans /proc/sys/net/ipv4/tcp_mem) and which of them? Ordering 1024 Gb of RAM would double the cost and could be an option after I got more experience with the new provider and abuse mails. Thanks for any advice!

3 3

Re: [tor-relays] Tools for managing multiple relays
by starlight.2015q3＠binnacle.cx 19 Oct '15

19 Oct '15

>None of the above :) > >I run these three relays[1][2][3]. > >ccrelaycc [1] has acquired the guard flag in the >last few days (don't know when, last time I >checked it did not have it). This relay is rated near the boundary of minimum Guard rating and goes in and out of the state. >A thing that is bothering me is that ccrelaycc and >inara ([1] and [2] respectively) are both on >DigitalOcean, they are in two different regions >(AMS and SIN) *but*, notwithstanding that they >have an identical configuration, ccrelaycc has >been experiencing 2 TB traffic per month in the >last 3 or 4 months while inara has barely reached >100 GB per month over same period (I use vnstat >and arm for these stats), that is a 20x >difference. I would like to understand this >difference. With a VPS a tremendous number of variables are at work. How heavily loaded is the physical server with other VPS clients? What kind of NICs are present? What type of server, etc? Is not surprising at all that the QOS varies wildly. >It should be noted that both are the smallest VPS >available on DigitalOCean and that comes with 1 TB >of traffic per month but it seems that >DigitalOcean is liberal about using more bandwidth >(I have read a similar comment on this list about >DO). > >jaine is much more recent and it is on Aruba.it in >Italy. I expect that they are much less liberal >about using more bandwidth than what is allotted >so I set lower limits for the RelayBandwidhtRate >parameter. > >For ccrelaycc and inara I have set: >--- >RelayBandwidthRate 1600 KB >RelayBandwidthBurst 3200 KB >--- >and for jaine: >--- >RelayBandwidthRate 800 KB >RelayBandwidthBurst 1600 KB If you have the ability to use 'tc' instead of BandwidthRate (per posts earlier this month) you should do that. RelayBandwidth* are not intended for limiting bandwidth in dedicated relays. Replace them with BandwidthRate and BandwidthBurst if you can't use 'tc'. >--- >What I see in the end are three quite different >behaviors. Given that jaine is at the beginning of >its lifecycle I would give it some more time >before drawing any conclusions, but I would really >like to understand why ccrelaycc and inara are >behaving so differently. I would appreciate any >input on this. Per above, huge number of variables easily explain it. On top of the variability of the VPS, the networks could have dramatically different quality, reachability, loading and congestion. You can look at the individual BWauth ratings for a more complete picture. Found https://collector.torproject.org/recent/relay-descriptors/votes/ where # gabelmoo ED03BB6... Erlangen, Bavaria-DE # maatuska 49015F7... Belgium # Faravahar EFCBE72... ? # longclaw 23D15D9... Seattle, WA-US # moria1 D586D18... Cambridge, MA-US here's Blutmagie (actual bandwidth) _gfs_ ccrelaycc NL 942 98 4.27 L 95.85.8.226 443 80 95.85.8.226 __fs_ jaine IT 216 13 4.27 L 5.249.145.164 443 80 ... .aruba.it __fs_ inara SG 38 98 4.27 L 128.199.148.243 443 80 128.199.148.243 and rueckgr.at (max self-measure / advertised) _gfsh ccrelaycc NL 1987 __fsh jaine IT 999 __fsh inara GB 823 Suggest installing and running 0.2.6.10 in instead of 0.2.4.27. The Aruba dedicated Atom server discussed earlier could make a nice relay, or perhaps the next-up one for 20 euros. Perhaps try running the existing Aruba node as an exit for a month first to see how they respond. With the "reduced" exit policy the worst-case is a pile of automated complaints about WordPress brute-force login attacks. Very minor but how they respond will be telling. The exit policy can be turned off if they freak. LeaseWeb has 49 euro 100TB servers available in the Netherlands--killer exit boxes that will rate high and pull 15000 per Blutmagie. OVH has good offerings as well, including the Kimsufi subsidiary. Despite 'tor-relays' claims to the contrary, Kimsufi apparently will tolerate (at least one) exit nodes: e_fs_ Kiss208 FR 703 10 6.10 L 5.135.152.208 443 444 ks3296627.kimsufi.com e_fsh Kiss208 FR 1503 The above has been an exit for 14 months. Here's the fastest Kimsufi though this is probably a Pentium or Xeon: _gfs_ Unnamed FR 9865 61 6.10 L 91.121.82.25 443 80 ks26969.kimsufi.com _gfsh Unnamed FR 10947 ===== But an Aruba exit is perhaps a more diverse addition.

5 4

Re: [tor-relays] Tools for managing multiple relays
by starlight.2015q3＠binnacle.cx 15 Oct '15

15 Oct '15

On Thu, Oct 15, 2015 at 20:20:13 -0000, nusenu <nusenu(a)openmailbox.org> wrote: >>> LeaseWeb has 49 euro 100TB servers available >>> in the Netherlands--killer exit boxes that will >>> rate high and pull 15000 per Blutmagie. OVH has >>> good offerings as well >> >>Please consider diversity when adding relays. >> >>OVH (AS) and NL (CC) are among the worst places >>to add relays from a (simplified) diversity >>point of view. Problem is costs in Asia are like ten times costs in Europe. US is double or triple. Other locales still cost more. So is it better to run a 100TB server for $60/month in Germany or the Netherlands where privacy is a major priority, or a 1TB VPS in Singapore for $25/month? Both are presumed easily collectable by five-eyes agencies. The former provides substantial incremental usability while the cost/benefit of the latter is far less compelling. Russia, Ukraine, etc might be better in theory except they surveille too, are less constrained by law and harbor obviously dubious actors (not saying don't consider it). That many independent operators contribute is terrific for diversity in itself --perhaps the most important factor. Choices are not simple.

2 1

Re: [tor-relays] Tools for managing multiple relays
by starlight.2015q3＠binnacle.cx 15 Oct '15

15 Oct '15

_gfs_ ccrelaycc NL 942 98 4.27 L 95.85.8.226 443 80 95.85.8.226 __fs_ jaine IT 216 13 4.27 L 5.249.145.164 443 80 ... .aruba.it __fs_ inara SG 38 98 4.27 L 128.199.148.243 443 80 128.199.148.243 One likely contributor to the relatively high rating of 'ccrelaycc' is residence in the Netherlands. Central Europe Internet is the best in the world for affordable high-quality high-capacity bandwidth. This is why so many fast relays are found in the region. ----- Pulled the BWauth ratings for you. The median value is selected for the consensus weight. Results look sane. ccrelaycc 2015-10-15 17:00:00 gablemoo--w Bandwidth=1638 Measured=2930 Faravahar-w Bandwidth=1638 Measured=3010 longclaw--w Bandwidth=1638 Measured=3410 median moria1----w Bandwidth=1638 Measured=3490 maatuska--w Bandwidth=1638 Measured=3580 jaine 2015-10-15 17:00:00 maatuska--w Bandwidth=819 Measured=505 Faravahar-w Bandwidth=819 Measured=543 gablemoo--w Bandwidth=819 Measured=544 median longclaw--w Bandwidth=819 Measured=740 moria1----w Bandwidth=819 Measured=767 inara 2015-10-15 17:00:00 gablemoo--w Bandwidth=843 Measured=235 longclaw--w Bandwidth=843 Measured=330 maatuska--w Bandwidth=843 Measured=336 median moria1----w Bandwidth=843 Measured=336 Faravahar-w Bandwidth=843 Measured=1580

3 2

OT: starlight vs. email threading
by nusenu 15 Oct '15

15 Oct '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 hi starlight, is there any chance we can talk you into setting the usual email headers for proper email threading? (decent MUAs take care of this by default) At times it is hard to follow the flow of a discussion if every email starts a new thread (what message was the reply to which email). thanks, nusenu -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVxfCpAAoJEFv7XvVCELh0wZwQAIZ+jOaNTwjYYwQLfl8gIK9j pE+GHGi4mV0R/FSsFAjfkJQzWp1AakaOMR7AeqxWjQmz4HWUyjm09TP+R+x6tfUw /9ilSiZn++p9F/+J++ukUa8ozoi1ogN4XTo/OnJo12udgAAZ/+p5NW4suMO9scId wuDA3JtvLeG7u80j6LEdb28vkS8+cx1OZ1ZExemOUzb/T6i/K+EZx5//lWqzpukJ MwAS/P5n54cyvlD1xn10EUcwazJ3o7cA1d4QthXekgKzl9+EsyZ70n8uJ+1r2tab YDpf84qKjjdOkLVppukZmLXeyznKrAAP1rcpVesSWdlQp9AVgd+XYYm+wBqrUhrL CuQs9qv6CmQKFpc5GlYX7L3fLKrXE1daKBNqIA0o0BJNMrq/PLti2ixwfXZU3GOj a4jDFnXtMFWzDD4Ut2fSR2+aRAjuhtUmWNexN2rF+8KecenfV5Bb09c3I11FygTf 2IWfCPoqSHtTPCq+sLt91T2Hh/zfSV0+ckjHIfaJPFig3KyivBI4B6fY2X2txSxT zRffuHqXknIwUMgFaCjNSl1qlqozTbpN2rVhx14V4KNK7GCFK2/gtZlFb1f64Dyy bTZ6IxWjLFX11hYVI0jPlTp3Usc5j0PkxprXD2IgvrEXzH89zm994jK36n8MK6w+ uctpM8RxpEsoBfQBnlib =RE3I -----END PGP SIGNATURE-----

3 3

Tools for managing multiple relays
by Cristian Consonni 15 Oct '15

15 Oct '15

Hi, I am currently running three small relays on two different services/ISPs. I have two somewhat unrelated questions: * given costant resource (i.e. euro/month) I can afford to run relays is it in general better to run one bigger relay or, say, two smaller ones. * are there any tools to manage multiple tor node? For example, if I want to check if there are security updates I have to login separately in each system and launch them manually. Is this the way I should do this or there are ways to monitor the status of all my nodes and maintaing them as a whole. Thanks in advance. Cristian

5 7

Re: [tor-relays] Tools for managing multiple relays
by starlight.2015q3＠binnacle.cx 15 Oct '15

15 Oct '15

>* given costant resource (i.e. euro/month) I can >afford to run relays is it in general better to >run one bigger relay or, say, two smaller ones. Based on a past thread, guessing you run __fs_ BV2 IT 344 71 6.10 L 5.249.159.209 9001 None ... .aruba.it __fs_ BV3 IT 344 73 6.10 L 5.249.159.198 9001 None ... .aruba.it __fs_ BV4 IT 312 73 6.10 L 5.249.149.153 9001 None ... .aruba.it __fs_ BV5 IT 224 71 6.10 L 89.46.70.98 9001 None ... .aruba.it which are too slow to be assigned the guard flag. If that's the case, probably the cost the VPSs could cover a small dedicated/bare-metal server which would be assigned a more than 10x higher weight than any one of the above and service many more users. Much more effective and efficient.

2 1

IP and SWIP for a Tor exit node
by Cristian Consonni 14 Oct '15

14 Oct '15

Hi, tl;dr: it is not clear to me what I should ask to my provider about SWIP, if this is something I can set up on my own and/or how I should ask for this to my provider. I have been running a couple of relays for some months (since the last EFF Tor challenge) and now I would like to operate an exit node. I also want to be careful and set up things properly for Minimal Harrasment (h/t to Mike Perry)[1]. I am planning to set up everything in Italy - I am Italian and I would like to do everything here - but looking in this list (at least since I am subscribed to it, it seems to me that there is not much information about running exit nodes from Italy. All the more reason to try it and document things properly. I have bought some credit on Aruba, which is a quite well known provider in Italy on the low-end/entry level (they used to make spots on television at prime time) and I also think one of the biggest in terms of sales and infrastructure. They are not listed on the list of good and bad ISPs[2] so, again, let's see and document (in all honesty, there is not much choice on the list as far as Italy is concerned). After all this premise, I have some questions: (1) In the guide it is advised to "Get a separate IP for the node. Do not route your own traffic via this IP". As I understand it, this is just saying that if one has a machine with some other content hosted on it (e.g. a website) it would be better to separate the exit node IP from the IP that serves the other uses of the machine. Is this interpretation correct? I am planning to use a small instance for now (1 GB RAM, single core, 2TB traffic/month) and use it exclusively for running the node. Does this advice still applies. What are additional IPs good for? My ISP sells additional (public) IPs for 3,60 euro/month, would it be worth or necessary purchasing such an additional service? (2) SWIP/RWHOIS + ARIN/RIPE This is quite unclear to me. all I know as of now, about SWIP/RWHOIS/ARIN/RIPE is what can be read from the relevant Wikipedia pages. How can I ask my provider about this? I have seen there is a template here[3], but it seems to me that this is not really applicable. That case is about a fairly large organisation, buying a fairly large service. I would like, if possible, some indications on what to request from your average Joe. I am not exactly comfortable on asking something based on a templatee I am not sure I fully understand about something I know very limitedly. Thanks in advance for your help. Cristian [1] https://blog.torproject.org/blog/tips-running-exit-node-minimal-harassment [2] https://trac.torproject.org/projects/tor/wiki/doc/GoodBadISPs [3] https://www.torservers.net/wiki/hoster/inquiry

2 2

LeaseWeb automated abuse notifications
by Dhalgren Tor 14 Oct '15

14 Oct '15

Any exit operators with relays at LeaseWeb who are not enjoying the new automated abuse-notice system requiring all complaints be acted upon, send a message directly to the above address. Have a solution.

1 0

new relay - not working right
by Bruce Ganton 14 Oct '15

14 Oct '15

Hi all, I have recently installed a new tor relay (non-exit) in a new vsp. For several days now its bandwidth, according to ARM, is in the bits/second and there seems to be some problem reading its own torrc file. Also, while it had four connections for a while, there are none now. Part of ARM quote: [ARM NOTICE] Read last day of bandwidth history from state file (-7502 seconds is missing) [ARM WARN] The torrc differs frm what tor's using. You an issue a sighup to reload the torrc values by pressing x. ..... and for good measure [ARM NOTICE] Tor is preventing system utiliites like netstat and lsof from working. This means arm can't provide you with connection information....... Sometimes I also get that the data directory is not configured but I have left this commented out in the torrc file, being satisfied to use the default. I do get a "normal running" flag on tor stats and a bandwidth of zero. While I am very familiar with Linux in general this install is on debian which is new for me. Any ideas on where I might start to sort this out would be appreciated. Bruce Ganton

2 5

SYN flooding on port 80. - how often does this ppear at exits usually ?
by Toralf Förster 12 Oct '15

12 Oct '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Recently I realized these log messages tor-relay ~ # zgrep SYN /var/log/kern* /var/log/kern.log:Oct 11 13:43:47 tor-relay kernel: [132045.057945] TCP: request_sock_TCP: Possible SYN flooding on port 80. Sending cookies. Check SNMP counters. /var/log/kern.log-20150927.gz:Sep 22 08:05:43 tor-relay kernel: [47670.548282] TCP: request_sock_TCP: Possible SYN flooding on port 80. Sending cookies. Check SNMP counters. /var/log/kern.log-20151005.gz:Sep 28 11:06:32 tor-relay kernel: [576607.272239] TCP: request_sock_TCP: Possible SYN flooding on port 80. Sending cookies. Check SNMP counters. /var/log/kern.log-20151005.gz:Oct 2 08:04:21 tor-relay kernel: [911078.601891] TCP: request_sock_TCP: Possible SYN flooding on port 80. Sending cookies. Check SNMP counters. /var/log/kern.log-20151011.gz:Oct 8 11:35:23 tor-relay kernel: [1441827.102566] TCP: request_sock_TCP: Possible SYN flooding on port 80. Sending cookies. Check SNMP counters. and do just wonder how often this is expected to appear in the mean a tor server and if there's something special to do in this case ? - -- Toralf, pgp key: 872AE508 0076E94E -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAlYbvOYACgkQxOrN3gB26U5VOwD/RNq50pluX2afABKTGmNwPQhH qxMGSdL+F1aB1Lf82WEA/j6W9U5QHybtseNlNDKcDmdAG4RlAwDMs6x2Fh4cjErE =dHy8 -----END PGP SIGNATURE-----

2 2

Re: [tor-relays] why are some exit IPs missing from Exit IP DB?
by starlight.2015q3＠binnacle.cx 11 Oct '15

11 Oct '15

At 22:57 10/11/2015 +1100, Tim Wilson-Brown - teor wrote: >>Such "non declared" exit IP addresses (OR IP != exit IP) are found by >>exiting through every single exit relay to detect its exit IP. >> >>Since exits can change their exit IP address at any time the exit list >>can never be 100% accurate by design. >> >><https://collector.torproject.org/formats.html#exit-lists>https://collector.torproject.org/formats.html#exit-lists > >Isn't this a bug in TorCheck? >It assumes that every relay has its ORPort IP as its Exit IP (OutboundBindAddress), and most likely also assumes that each exit only has one IP. I opened one a few days ago: #17297: TorCheck fails on new exit egress IP not in exit DB, confusing to user https://trac.torproject.org/projects/tor/ticket/17297

3 2

why are some exit IPs missing from Exit IP DB?
by starlight.2015q3＠binnacle.cx 11 Oct '15

11 Oct '15

Occasionally I run into a relay such as Bywadu 5A0DE94C95E2276B4BAC974A7D8FC6463C4FE8A4 OR ip 178.33.157.6 exit ip 31.7.58.37 Where the egress/exit IP source address is not found in the Exit DB, shows up negative on ExoneraTor. TorCheck in glaring unhappy RED spits >Something Went Wrong! >Tor is not working in this browser. >For assistance, please contact help(a)rt.torproject.org. Does anyone know why this happens? Many exit nodes have ips that differ from the OR ip and work fine. Don't see any bug reports on it. Does the operator have to submit these manually? I had the impression that TorCheck actually build the DB for ExoneraTor.

4 7

Differene between OR connections and Circuits
by Josef Stautner 11 Oct '15

11 Oct '15

Hi @all, I've the following output of a USR1 signal against the tor daemon in my log: Oct 11 19:16:36.000 [notice] --------------- Dumping memory information: Oct 11 19:16:36.000 [notice] In buffers for *2021 connections*: 6103606 used/6770688 allocated Oct 11 19:16:36.000 [notice] For 2 OR listener connections: 0 used/0 allocated Oct 11 19:16:36.000 [notice] For *1269 OR connections*: 478155 used/573440 allocated Oct 11 19:16:36.000 [notice] For 742 Exit connections: 5625383 used/6189056 allocated Oct 11 19:16:36.000 [notice] For 1 Socks listener connections: 0 used/0 allocated Oct 11 19:16:36.000 [notice] For 1 Directory listener connections: 0 used/0 allocated Oct 11 19:16:36.000 [notice] For 1 Directory connections: 68 used/8192 allocated Oct 11 19:16:36.000 [notice] For 4 CPU worker connections: 0 used/0 allocated Oct 11 19:16:36.000 [notice] For 1 Control listener connections: 0 used/0 allocated Oct 11 19:16:36.000 [notice] In rephist: 567424 used by 3928 Tors. Oct 11 19:16:36.000 [notice] In 7136 live descriptors: 9860168 bytes. In 14728 old descriptors: 20229585 bytes. Oct 11 19:16:36.000 [notice] 3317 cells allocated on *1203 circuits*. 0 cells leaked. Oct 11 19:16:36.000 [notice] Our DNS cache has 455 entries. Oct 11 19:16:36.000 [notice] Our DNS cache size is approximately 184816 bytes. Oct 11 19:16:36.000 [notice] mallinfo() said: arena=119304192, ordblks=6628, smblks=100, hblks=1, hblkhd=1052672, usmblks=0, fsmblks=6192, uordblks=89103552, fordblks=30200640, keepcost=4846928 For my monitoring of the relay I thought having a look at the built circuits would be the right approach and indicates a "healthy" relay. But then I stumbled over the "Connections" vs. "OR connections" vs "circuits" (I bolded the values). Now I'm a little bit confused. What is the right approach to monitor the health of a (n exit) relay? Thanks in advance, ~Josef

1 0

Just wanted to publish a Tor Bridge,
by Yet Another Tor User 11 Oct '15

11 Oct '15

I have setup a Tor Bridge for everyone and I am unsure how it gets published so I will post the info here so it can get put into the consensus. The bridge is 173.246.106.35:443 I hope this bridge will help more users access the network. -- yetanothertoruser(a)riseup.net Bridges I run; * 173.246.106.35:443

2 1

Re: [tor-relays] Exit Node with Onion Pi
by starlight.2015q3＠binnacle.cx 09 Oct '15

09 Oct '15

At 12:21 10/9/2015 -0700, Green Dream wrote: ><http://www.newegg.com/Product/Product.aspx?Item=N82E16856501007>http://www.newegg.com/Product/Product.aspx?Item=N82E16856501007 . . . >If you want a box with AES-NI and a gigabit ethernet interface, cost starts jumping up to several hundred US dollars or more, so I find the lack of AES-NI to be an acceptable compromise for the value.Â The latest Atom SOCs have AES-NI. Might be possible to get the best of both. Everything released March 2014 and later: https://en.wikipedia.org/wiki/List_of_Intel_Atom_microprocessors

1 0

Exit Node with Onion Pi
by Alex Haesche 09 Oct '15

09 Oct '15

Hi all, I'm looking to start an exit node using this:https://learn.adafruit.com/onion-pi/overviewI have 100 Mbps symmetric uncapped internet. What do I need to do to prepare and run an exit node? What can you tell me so I can run this well?

9 10

(no subject)
by 刘东晨 08 Oct '15

08 Oct '15

5 4

Obfsproxy OSX help
by Geoff Down 08 Oct '15

08 Oct '15

Hi all, is anyone willing to talk me through getting Obfsproxy working on OSX10.4? I've got as far as Step 3 on https://www.torproject.org/projects/obfsproxy-instructions.html.en#instruct… but can't find the Obfsproxy binary; and since I have no idea what 'pip' does, even though it reports the 'package' as installed, I am at a loss. Regards, Geoff Down -- http://www.fastmail.com - Access your email from home and the web

2 5

how important is configuring DNSSEC root trust anchor for 'unbound' running on an exit node?
by Dhalgren Tor 03 Oct '15

03 Oct '15

Is it important to configure the DNSSEC trust-anchor for an instance of 'unbound' running on an exit node? I put a lot of work into setting up a new exit and want to take a break, but just noticed this item. 'unbound' was built from source rather than installed from a distribution, so this step must be performed manually. The relay resides in the high-quality German LeaseWeb network and the risk of DNS mischief appears low.

1 1

excessive bandwidth assigned bandwidth-limited exit relay
by Dhalgren Tor 03 Oct '15

03 Oct '15

Have a new exit running in an excellent network on a very fast server with AES-NI. Server plan is limited to100TB so have set a limit slightly above this (18000000 bytes/sec) thinking that bandwidth would run 80-90% of the maximum and average to just below the plan limit. After three days the assigned bandwidth for the relay is going up instead of moderating--looks like the measurement system has a problem in this case. Just dropped the limit to 16500000 to stay below 100TB with maximum load. A good number appears to be around 65000 to 70000, but 98000 was just assigned. What can be done to extract proper rating from measurement system? Tried setting TokenBucketRefillInterval to 10 milliseconds for more exact control but this has not helped. Should an IPTABLES packet-dropping limit be established? Can the rating system be fixed?

7 28

replace BandwidthRate with "traffic control" on busy routers
by Dhalgren Tor 03 Oct '15

03 Oct '15

Routers running at or near a BandwidthRate setting offer terrible latency and induce connection time-outs. Refuse all DIR-port requests with "HTTP/1.0 503 Directory busy, try again later ". 'tc' ingress filter is dramatically better for rate-limiting. For case and 'tc' example see final post https://lists.torproject.org/pipermail/tor-relays/2015-October/007901.html initial post https://lists.torproject.org/pipermail/tor-relays/2015-October/007863.html

1 0

Onionoo down?
by Geoff Down 03 Oct '15

03 Oct '15

A query using Globe stalls at the 'processing - please wait' stage, so I assume the problem is actually with Onionoo. GD -- http://www.fastmail.com - Same, same, but different...

4 4

how reliable is the advertised vs consumed bandwidth on tor metrics
by jensm1 02 Oct '15

02 Oct '15

I just stumbled over this (https://metrics.torproject.org/bandwidth-flags.html) graph at tor metrics, which shows advertised exit bandwidth to be around 40Gbit/s and consumed exit bandwidth around 20Gbit/s. This would mean that we have about twice as much exit bandwidth than we need, which I strongly doubt. So now I'm curious about what causes this disparity. Thanks!

2 1