- tor-relays - lists.torproject.org

Fwd: Re: Multi-core Support
by 12xBTM 02 Jun '15

02 Jun '15

-------- Forwarded Message -------- Subject: Re: [tor-relays] Multi-core Support Date: Tue, 02 Jun 2015 11:55:31 -0400 From: 12xBTM <12xBTM(a)gmail.com> To: Roman Mamedov <rm(a)romanrm.net> Some multicore support (at least 4 cores) should be a priority. Going beyond doesn't cater to many node operators at this time. Don't quote me on the numbers, but having decent 4-core support would let someone run a node with the same bandwidth on an Atom/i5 that currently runs on one thread of a Xeon. Or, if someone has a Xeon, such as a collocation center, would let them fully utilize the processor they are paying for, which would be a good morale boost for node operators. But, honestly, the very minimum that can be done to improve the situation (which I know is being worked on as of 0.2.7) is improving a 2-thread program, to further utilize 2 threads of a cpu. That way, we can get by with 2 processes on one 4-thread CPU, instead of being tempted to jumped to 4 processes. On 2.6.15 11:31, Roman Mamedov wrote: > On Tue, 02 Jun 2015 11:13:13 -0400 > 12xBTM <12xbtm(a)gmail.com> wrote: > >> Improving multi-core support can allow users to saturate high bandwidth >> connections with cheaper processors, less setup, and just more efficient >> deployment of high-capacity nodes in general. Improving multi-core >> support should be a major priority. > Sure but I doubt anyone contests that it's better to have multicore support, > than to not have it. However that work doesn't get automatically done. > > One quick and simple stop-gap alternative that I suggested some time ago would > be to stop ignoring more than two relays per IP address. > > With the IPv4 shortage and abundance of multi-core CPUs, raising that limit to > let's say 4, would at least allow many people to run a Tor process per core on > the same single IPv4 that they have (utilizing up to four cores, not just two). > > Considering that Tor is already somewhat multi-threaded (each process can use > up to "120-130%" CPU), that might be just enough in most circumstances, since > true 6-8-core CPUs are rare, and what's seen more often beyond 4 cores is > either Intel HT or AMD's "light" core technologies. > > Of course the management (and memory) overhead of multiple processes is still > there, so proper multi-core scaling is the ideal final goal. >

1 0

Re: [tor-relays] Multi-core Support
by teor 02 Jun '15

02 Jun '15

> Thomas White: > Have there been any updated ETAs concerning the development/support > of multi-core for the core tor workloads? If not, is there anything > in particular that I could do to speed the process up? Scaling the > capabilities of the Tor process would be a huge relief and help for > my upcoming project so I am keen to push it through should it be > possible to bring up the priority list. t T > > On 1.6.15 9:11, Tor-Admin wrote: > I have to agree with that, multicore support is really important and > should be on the top of the priority list. > > On Tue, 02 Jun 2015 11:13:13 -0400 > 12xBTM <12xbtm(a)gmail.com> wrote: > Improving multi-core support can allow users to saturate high bandwidth > connections with cheaper processors, less setup, and just more efficient > deployment of high-capacity nodes in general. Improving multi-core > support should be a major priority. > > Date: Tue, 2 Jun 2015 20:31:56 +0500 > From: Roman Mamedov <rm(a)romanrm.net> > Sure but I doubt anyone contests that it's better to have multicore support, > than to not have it. However that work doesn't get automatically done. The work is currently listed in Trac in: https://trac.torproject.org/projects/tor/ticket/1749 https://trac.torproject.org/projects/tor/ticket/7572 teor teor2345 at gmail dot com pgp 0xABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR D5BE4EC2 255D7585 F3874930 DB130265 7C9EBBC7

1 0

Re: [tor-relays] Multi-core Support
by teor 02 Jun '15

02 Jun '15

> Date: Tue, 2 Jun 2015 20:31:56 +0500 > From: Roman Mamedov <rm(a)romanrm.net> > > On Tue, 02 Jun 2015 11:13:13 -0400 > 12xBTM <12xbtm(a)gmail.com> wrote: > >> Improving multi-core support can allow users to saturate high bandwidth >> connections with cheaper processors, less setup, and just more efficient >> deployment of high-capacity nodes in general. Improving multi-core >> support should be a major priority. > > Sure but I doubt anyone contests that it's better to have multicore support, > than to not have it. However that work doesn't get automatically done. > > One quick and simple stop-gap alternative that I suggested some time ago would > be to stop ignoring more than two relays per IP address. > > With the IPv4 shortage and abundance of multi-core CPUs, raising that limit to > let's say 4, would at least allow many people to run a Tor process per core on > the same single IPv4 that they have (utilizing up to four cores, not just two). This was suggested in https://trac.torproject.org/projects/tor/ticket/13414 But the concern was that any increase to 2 relays per IP would make it much easier for sybil attacks. Perhaps we could try an increase to 3 or 4 per IP? teor teor2345 at gmail dot com pgp 0xABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR D5BE4EC2 255D7585 F3874930 DB130265 7C9EBBC7

1 0

Multi-core Support
by Thomas White 02 Jun '15

02 Jun '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Have there been any updated ETAs concerning the development/support of multi-core for the core tor workloads? If not, is there anything in particular that I could do to speed the process up? Scaling the capabilities of the Tor process would be a huge relief and help for my upcoming project so I am keen to push it through should it be possible to bring up the priority list. t T - -- Activist, anarchist and a bit of a dreamer. Keybase: https://keybase.io/thomaswhite PGP Keys: https://www.thecthulhu.com/pgp-keys/ Current Fingerprint: BA81 407C BD61 CD15 E5D9 ADA9 5FA2 426F F34E 0FD4 Master Fingerprint: DDEF AB9B 1962 5D09 4264 2558 1F23 39B7 EF10 09F0 Twitter: @CthulhuSec XMPP: thecthulhu at jabber.ccc.de XMPP-OTR: 77E6C8C6 95FDE863 1172A1E1 8C114C01 691398AC -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBAgAGBQJVbFLfAAoJEF+iQm/zTg/UxTgP/2iB0gqd1R/h7ME6Zq6DQubM elmg7rtquh9H0NfTJ6/l5y2Y5ipLLZiN9dda+NxAl3RMD0ge0lwawoS8JjVcTsOP p+umbSJi2cy5/d2YWJXqLukLH6KITdza+5d5BMGZvOV9MkQNuPBXpQj9m0QH8lti K4zWH9bNEDWp9w+EHJSz5FcqwvpWhEPYipYdnBUEUO4lfaUlOJOfdHyrktrjD70b jIsz+OaFn7RyV85yMbpfMBH4TvSrdbhpshUKqy5TOPGww2Uupsf2EbAK3jYyelFA ZhENY8c0h39WNtamPImxsrN4dvyrKNt9SXGlGPoVZVCYvNH0/8/2MEPtdr9xYt3+ ntarnmDFi5+nqUHlzYn8flJv7h4o01CCNaueirE3IQJr7RC5sYBIIY38+ejO0sXq 4iAXraB2YeOhRvOLDrMMdAQP+6811/1bgH4tSNHV1XxW4BQJAjPxi5KSLe/+13S1 MaVoBvpxURT2O/QFQN8SOKKv5IY0/i78jEOjQpKgdvXMRxlpgycEpMKSRupBntZR OGFof1Hu22IYH6SGwnTBPeM+6Y7VV5VnX2fbPtMEH02Lplok3RZPciAXWtkhQGBn PN1TxLOm6NUtkwc8hEPulHDBamLLKNbQqAbdNfd7G0Bia7KBPQ1WM37FFTHyqaPz 7L4JuvUJ6iHLFob2CQAj =1DfQ -----END PGP SIGNATURE-----

4 4

Re: [tor-relays] Auto-detect and enable IPv6 // Re: Please enable IPv6 on your relay!
by teor 02 Jun '15

02 Jun '15

> Date: Fri, 22 May 2015 19:29:43 +0500 > From: Roman Mamedov <rm(a)romanrm.net> > > On Fri, 22 May 2015 13:31:02 +0000 > Speak Freely <when2plus2is5(a)riseup.net> wrote: > > > Uhh, I would like to point out that it would be exceptionally stupid > > to have Tor autoconfigure IP addresses, regardless of whether it's > > IPv4 or IPv6. > > On IPv4 it currently does. There is zero rationale as to why IPv6 must be > different from IPv4 in this aspect. IP address autodetection is a useful feature for those servers which are dynamically assigned IP addresses. But it's not appropriate in every circumstance, which is why the ORPort and DirPort config options allow an IP address to be specified. It's only in the absence of a configured IP that autodetection is performed. Here are the enhancement requests in trac that need to be completed for IPv6 address autodetection: The enhancement request for Tor autodetecting IPv6 addresses is here: https://trac.torproject.org/projects/tor/ticket/5940 Since Tor normally autodetects its IPv4 address via its first directory request, this requires the directory authorities and/or fallback directories to be on IPv6 answering directory requests: Directory Authorities on IPv6 https://trac.torproject.org/projects/tor/ticket/6027 Fallback Directories on IPv6 https://trac.torproject.org/projects/tor/ticket/8374 Fallback Directories Initial Release on IPv4/IPv6 https://trac.torproject.org/projects/tor/ticket/15775 Clients/Relays will also need to query directory servers on both IPv4 and IPv6 to autoconfigure both addresses. Currently, directory requests are only made using the default IP protocol, or IPv4 (I'm not sure which). Once these client and server changes are in place, we then need to test clients to ensure they will bootstrap correctly: * When clients are on IPv4 only, mixed IPv4/IPv6, and IPv6 only; (3) Combined with: * On first run and subsequent runs; (2) Combined with: * When the directory authorities are available on IPv4 only, IPv4/IPv6, and IPv6 only; * When the directory authorities aren't available, and Fallback Directories are available on IPv4 only, IPv4/IPv6, and IPv6 only; (6) Combined with: * Using HTTP (DirPort) and Tunneled (ORPort) directory fetches. (2) 4 4/6 6 a4 Y Y f a4/6 Y Y Y a6 f Y Y f4 Y Y N f4/6 Y Y Y f6 N Y Y Y = Yes, Tor should bootstrap f = Tor should use other authorities or fallback directories with matching IP version(s) N = Tor should fail to bootstrap if it doesn't have access to any directories with matching IP version(s), and it doesn't have a recent consensus. Otherwise, it should find a directory with a matching IP version. This may involve a tunneled directory request if DirPorts are not available but ORPorts are, and Tor has enough information to tunnel over an ORPort (this might not apply in the first run case). That's a lot of different combinations that we need to test and ensure they work as intended. And I am concerned about the complexity of the "N" case. We'd appreciate any help on these IPv6 enhancements, particularly coding the server-side changes, as it's difficult to code and test the client-side changes without them. teor teor2345 at gmail dot com pgp 0xABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR D5BE4EC2 255D7585 F3874930 DB130265 7C9EBBC7

1 0

Re: [tor-relays] How to use our own TOR relay as entry node for local network hosts
by teor 02 Jun '15

02 Jun '15

> Date: Sun, 24 May 2015 08:47:20 +1000 > From: Zenaan Harkness <zen(a)freedbms.net> > >> 3. Disable the polipo proxy on the Tor relay in your network, you do >> not need that. Run a bridge instead of a relay. Make it a non public >> bride (PublishServerDescriptor 0) and run Tor Browser on all the >> computers in your network with UseBridges 1 and define the ip:port of >> your bridge and connect it directly, no proxy setting. This way other >> 'strangers' won't be able to use your bridge and you will also not >> need the Guard flag or uptime and bandwidth requirements. > > That last bit (UseBridges 1, configure bridge IP), looks like it does > the job needed here, no new Tor config options required. There are 3 different ways to set up your local bridge, each with their own pros and cons: 1. Configure a private bridge * Only your clients use this bridge * No cover traffic 2. Configure a bridge distributed by BridgeDB * Your clients and other clients may use your bridge as the first hop * BridgeDB doesn't distribute all bridges straight away, so you may or may not get cover traffic * You can't separately rate limit external and local traffic at the bridge itself - RelayBandwidthRate includes all bridge traffic 3. Configure the server as a relay, but configure the clients to connect to it as a bridge * If you configure a client with a mandatory guard relay using EntryNodes and StrictNodes, the relay must have and maintain the guard flag. But configuring clients with a relay server in a "bridge" config line avoids the need for a guard flag. * Your clients use this bridge, as do other clients as at least a middle hop, and a guard or exit hop depending on flags * You get the most cover traffic this way * You can't separately rate limit external and local traffic at the bridge itself - RelayBandwidthRate includes all relay and bridge traffic * This mode of operation is less common, and may reveal some bugs in Tor. In my experience it has worked fine for months with 0.2.5 - 0.2.7-alpha, but please report any issues on https://trac.torproject.org/projects/tor/ticket/1776 * As a precaution, if you ever reconfigure a relay Tor node as a bridge Tor node, please delete the keys so it appears as a new bridge in BridgeDB. teor teor2345 at gmail dot com pgp 0xABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR D5BE4EC2 255D7585 F3874930 DB130265 7C9EBBC7

1 0

IPv6 adress valid?
by tor-server-creator＠use.startmail.com 01 Jun '15

01 Jun '15

hi, is that IPv6 adress valid for example "becks" [2a01:4f8:162:7345::2]? how do i know if IPv6 is correct and reachable? thanks

4 3

[warn] Problem bootstrapping. Stuck at 10%: Finishing handshake with directory server.
by Martin Ekendahl 29 May '15

29 May '15

This morning I rebooted my relay after some patching. I was running 2.6.7 on Ubuntu 14.04.2 LTS from. The server is always a bit slow rebooting but when it came back up always check the Tor relay and now I see an excessive amount of these errors: May 29 12:20:36.000 [warn] Problem bootstrapping. Stuck at 10%: Finishing handshake with directory server. (DONE; DONE; count 906; recommendation warn; host CC23B32FA040945FF49D94AC3D4334429CB4E2CD at 62.75.241.71:1110) May 29 12:20:36.000 [warn] 905 connections have failed: May 29 12:20:36.000 [warn] 849 connections died in state connect()ing with SSL state (No SSL object) May 29 12:20:36.000 [warn] 42 connections died in state handshaking (TLS) with SSL state unknown state in HANDSHAKE May 29 12:20:36.000 [warn] 8 connections died in state handshaking (Tor, v3 handshake) with SSL state SSL negotiation finished successfully in OPEN May 29 12:20:36.000 [warn] 2 connections died in state handshaking (TLS) with SSL state SSL negotiation finished successfully in OPEN May 29 12:20:36.000 [warn] 2 connections died in state handshaking (TLS) with SSL state SSLv3 read server hello B in HANDSHAKE May 29 12:20:36.000 [warn] 1 connections died in state handshaking (TLS) with SSL state SSLv3 read finished A in HANDSHAKE May 29 12:20:36.000 [warn] 1 connections died in state handshaking (Tor, v3 handshake) with SSL state SSL negotiation finished successfully in CLOSED I still see about 7000 inbound connections and 3000 outbound, I'm not sure what my connection average is, but the current bandwidth being used is below average (from the reboot). There have been a couple DDOS alerts from my ISP the past couple days, something I never used to get. I can confirm via my dashboard nothing has been mitigated so I assume no filtering is going on, and traffic is still coming and going, but for some reason there are a lot of connections not being made it appears from the logs, and these only started appearing after I restarted my server/relay. Any ideas what would be causing all these issues?

1 0

Get bridge
by Victor Victoe 28 May '15

28 May '15

2 1

Re: [tor-relays] Leaseweb exit relay notice
by tor＠t-3.net 25 May '15

25 May '15

On 05/25/2015 08:17 PM, Rejo Zenger wrote: > ++ 25/05/15 12:48 -0400 - tor(a)t-3.net: >> >> A lot of trouble would be prevented for exit node operators if, when they >> brought their relays up for the first time, they ensured that the exit policy >> rejected port 25. Even if they desire to run as unrestricted a relay as >> possible, in my experience, that one really should be rejected. It is the > > Some (or most or even all) of the Leaseweb nodes didn't forward port 25. > So, alltough you advice is a good one, it's not applicable to some (or > most or even all) of the nodes that are discussed in this thread. > I'd be curious to know what this checker says about the IP address that ultimately got this ISPs attention: http://mxtoolbox.com/blacklists.aspx I run 2 fast exits with only ports 25 and 465 rejected. I find that the IPs are in some expected lists that target Tor, plus barracuda and spamhaus-zen. But not a gigantic pile of RBLs like was being described. No sorbs, no spamcop, no uceprotect. Nothing like a real spamming box. Doing nothing on email ports but still ending up on a meaningful number of RBLs doesn't sound right. Maybe all it took to piss the ISP off was for one of them to do it.

2 1

Re: [tor-relays] Leaseweb exit relay notice
by tor＠t-3.net 25 May '15

25 May '15

On 05/22/2015 12:19 AM, Speak Freely wrote: > The problem is compounded by the fact each BL company is racing it's way > to the bottom, adding each others finds to their own lists. SpamHaus has > OVER 1 *BILLION* addresses listed. > > I lost several relays (11) from OVH because DanTor recorded my relays, > then CBL recorded DanTor, then SpamHaus Zen recorded CBL, which allowed > OVH to claim "100% of your IPs are blacklisted on multiple lists" when > in reality it was from a guy in the UK who publishes all Tor relays - > guard, middle, exit - that caused this whole problem for me. Not one > single complaint from anyone against any of my relays. > > > Matt > Speak Freely > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays A lot of trouble would be prevented for exit node operators if, when they brought their relays up for the first time, they ensured that the exit policy rejected port 25. Even if they desire to run as unrestricted a relay as possible, in my experience, that one really should be rejected. It is the port which email servers tend to use to deliver mail to one another, and some bad/old clients might try to use it as well. In theory, open-relay port 25 is just about sending email. It can send email on behalf of anyone in the world. Big deal, right? But in practice, open-relay port 25 is all about spam. Has been for years and years. It's always been abused by awful spammers wherever it may be found. It's never been used as some great tool for anonymity or email freedom. As far as Tor exits go specifically, there is someone out there who is apparently watching Tor for when exits appear that are willing to send on port 25. They very quickly begin dumping spam out of any such relays, should they appear. I know this because I briefly turned on relay for port 25, and the spammers found it fast. They immediately transformed it into a spam-vomiting heap of crap. Traffic graphs on it skyrocketed (although within the configured maximums). The new mail in the admin mailbox for the netblock clearly reflected what the box was doing. I closed that port off fast, and problem solved. In addition to port 25, relay operators who want to be extra careful of their relationship with their ISP may also wish to reject ports 465 and 587. Doing that would more-completely lock the Tor exit away from the tricks spammers use. By blocking off the email portion of the relay (especially port 25), the machine doesn't spew spam, and therefore doesn't get noticed by those who are trying to stop spam. This is good for the relay because the 'net is more accepting of it (IP reputation lists, RBLs, etc), and good for the exit relay operator's working relationship with the hosting ISP. Reputable ISPs tend to dislike spam, and if a billion spam complaints flood in for your relay, it's not going to help your cause. People who are trying to do anonymous email have means to do so which do not include dumping anything directly to port 25. And if a direct push from Tor to 465 or 587 is wanted, it can always go to the relays which don't perceive any ISP-related risk from it.

2 1

[Fwd: Re: a line "enable IPv6 on your relay"]
by tor-server-creator＠use.startmail.com 25 May '15

25 May '15

sorry, i confused something. "relay should show in the consensus as an "a" line." does not mean a "a" is required in torrc. i got confued cause of the headline "1.1 Ordinary relays" stupid me, pardon -------------------------- Original-Nachricht -------------------------- Betreff: Re: [tor-relays] a line "enable IPv6 on your relay" Von: yl <tor(a)yl.ms> Datum: Sonntag, 24. Mai 2015 19:54 An: tor-relays(a)lists.torproject.org Am 24.05.2015 um 19:25 schrieb tor-server-creator(a)use.startmail.com: > shouldnt there be a "a" in the first line? how important ist the > letter > a? i guess some operators just added the lines without "a" like > above. > additional: how many ipv6 relays are up NOW? and are there plans to > include a button into torbrowser to enable/disable ipv6? Not sure where the a should be put, so maybe someone can just past a sample config with the IPv6 enabled, I think from that we can substitute easily. One question also, is this for relay servers or ONLY for exit enabled servers? yl _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 1

a line "enable IPv6 on your relay"
by tor-server-creator＠use.startmail.com 24 May '15

24 May '15

hi, about that following lines in the mail from Moritz Bartl. [tor-relays] Please enable IPv6 on your relay! > In short, you add: > ORPort [IPv6::address]:port > IPv6Exit 1 > ExitPolicy reject6 *:* shouldnt there be a "a" in the first line? how important ist the letter a? i guess some operators just added the lines without "a" like above. additional: how many ipv6 relays are up NOW? and are there plans to include a button into torbrowser to enable/disable ipv6? thanks

2 1

Complaint being on a tor dnsbl..
by 0x23 23 May '15

23 May '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hey guys, Today I got a complaint from my vServer hoster that has received an abuse email The company who accused the usage of my system is called sectoor http://www.sectoor.de/tor Here's the abuse message: More Information About Sectoor Listing on the Sectoor TOR DNSBL indicates that this IP address is a tor node or a subnet (/24) containing a tor node. This listing *does not* indicate that your IP address has been blacklisted by Sectoor, as this list also contains subnets that contain a tor node. The subnet listing is not designed to block connections, but rather for use as a scoring mechanism. Your IP will only be blacklisted if it is the tor node itself and listed by Sectoor Exitnodes. Sectoor TOR DNSBL lists every IP address which is known to run a tor server and allow their clients to connect to one of the following ports: * Port 25 * Port 194 * Port 465 * Port 587 * Port 994 * Port 6657 * Ports 6660-6670 * Port 6697 * Ports 7000-7005 * Port 7070 * Ports 8000-8004 * Port 9000 * Port 9001 * Port 9998 * Port 9999 More information about SECTOOR can be found at their website: http://www.sectoor.de/tor.php *Reason for listing - **TOR Server Network detected (TOR Node on ip xxxxxxxxxxx) - see http://www.sectoor.de/tor.php for more information.* What would you reply on that accusation? I tried to convey that this isn't true and that this company only tries to alienate me as a customer cause there also running vServer offers. For now I reject using these ports..:-( Regards - -- -----BEGIN PGP SIGNATURE----- Version: APG v1.1.1 iQIzBAEBCgAdBQJVYGegFhwweDIzIDxydXNoMjNAZ214Lm5ldD4ACgkQF7zsyb8G Yjgxwg//c4+j6BNmr7wzyxuH3C0T3iQMrF9gK5vfdU2nyRBSV4Hqbb8zIIc1+eQy 9XMqD+tZ0uUKtT6Q+Ket1y6zqCvX1fX4NpEMN6DWMyyRCnDa1m/AOU04PQpr6VIS TzZc93BYCv+Sw8Rdt24XyRRJ9u05vehY4fkjX4qgiGp9zZDgkpZsO06qzDa4zBXb 5oHRMlO2Q2ePYAsl53E78JUMD7+rphBdUmogGU0xpEWysBSFMGCMqQt6g5+zwqtB HABL95S85UKj1mZ3vj0kbi3/jMJYG0vL5+zqBvzUFIU5NlOrz0DFKG/O8uG8h6gA avyxzdpwtBIox/FYkNG2TWeJ00RscKJ/1u33WATwOTL0x5VkIehP9Njl7pnz4cO4 4SkpV7SSGAhqPVnVPvEcYLPBGuqZAyNV/0r0GZZUdQEC0J8+BsQgf77vr5vC4yTz P2/Fj5BVzhT2UxpNtRfFnhGu+KNmXbyiVJ17jDxNfeEl7uuDRgFCMc+Vg0fvl2LY mAOZuTwUyxbl+6Gyeob66RdSmhNERr8vGvGCv1TKvFuwry2hrQI5HFRiQpssGsHX k19Z4S999jBe8fdz4EevYMMwI1phWnT3eOoSJDc4jKkClrrYgTXqU1w0riMcyPGP wMo4gHv2Ie9dBki4VC4JXDGXCqehp9dyNjKwmEp5UTzPwO45bZE= =K+EM -----END PGP SIGNATURE-----

3 2

Auto-detect and enable IPv6 // Re: Please enable IPv6 on your relay!
by Roman Mamedov 22 May '15

22 May '15

Hello, > We still have a depressingly low number of relays that support IPv6 > (currently only ~120 of ~1900 relays). If your host supports IPv6, > please enable it, especially if you run an exit! This has to be done > explicitly. If you (supposedly) care so much, then can you please make it automatic? There is no need to explicitly put the ____IPv4____ address into the torrc. And there is no need to explicitly put the IPv6 address into the config file of virtually any other IPv4+IPv6 supporting software I can think of: web, mail, NTP, XMPP servers, those are all capable of automatically figuring out which IPs the host has. Can't think of any reason of why this has to be otherwise in Tor, aside from perhaps a certain lack of understanding of best IPv6 implementation practices from the Tor developers side and/or nobody simply giving much thought to this yet. I currently run 15 Tor relays, 14 of those IIRC are IPv6 capable. But since you did not bother to make enabling IPv6 in Tor anywhere near user-friendly [1], I am simply not going to bother pecking the IPs into each torrc individually. [ One of the practical reasons being that I sometimes need to migrate the Tor 'identity' (torrc + /var/lib/tor/*) between machines and providers with v4/v6 addresses obviously changing. ] Aside from migrations between providers, the requirement to specify the IP is also impractical in many other situations, e.g. my ISP at home provides only a __dynamic__ IPv6 subnet which changes to a different one with each new PPPoE session. [1] Ideally there should be no 'enabling' at all!!! IPv6 should be active by default, IF the relay has determined it is able to make a successful IPv6 connection with a dir-authority -- oh and also that's how you can discover the actual working IPv6 address to use; or at least with a simple "IPv6Relay 1, but certainly with no requirement of specifying the IP address in the config file. -- With respect, Roman

2 2

Leaseweb exit relay notice
by blaatenator 21 May '15

21 May '15

Hi all, FYI: Yesterday I got the notice below from Leaseweb. I picked them because Leaseweb is mentioned in the Good/Bad ISP <https://trac.torproject.org/projects/tor/wiki/doc/GoodBadISPs> post. Apparently a blacklist named SECTOOR added a whole IP block of Leaseweb to block my Exit relay. Since this list is used by some bigger corporations, it got some other customers in trouble and they asked me to restrict the mentioned ports. I understand the reasoning and can't blame them for asking my I guess (and since most relevant ports are not mentioned I guess it is not too bad), but I found it a bit weird that a whole subnet is being listed. On 05/20/2015 03:20 PM, Lesley Koomen wrote:> Dear sir, madam, > > It appears you are hosting a TOR node on your LeaseWeb IP address. > This has resulted in the block of a (part) LeaseWeb IP subnet. (/24) > As the subnet is added on the SECTOOR blacklist > (http://www.sectoor.de/tor.php) this is affecting customers in the same > range as yourself. > > The SECTOOR blacklist is e.g. implemented by Hotmail, Live and Gmail. > This results in other customers not being able to longer use the mail > services of these companies. > Sectoor TOR DNSBL lists every IP address which is known to run a tor > server and allow their clients to connect to one of the following ports: > > * Port 25 > * Port 194 > * Port 465 > * Port 587 > * Port 994 > * Port 6657 > * Ports 6660-6670 > * Port 6697 > * Ports 7000-7005 > * Port 7070 > * Ports 8000-8004 > * Port 9000 > * Port 9001 > * Port 9998 > * Port 9999 > > > Therefore, we kindly, yet urgently ask you to disable the connection to > the mentioned ports within 24 hours. Failure to comply and respond > (confirm) to this warning, will result in a block of your involved IP > address(es). > > Thank you for your co-operation and understanding. > > > > Kind regards, > > Lesley Koomen > Team Manager Abuse Prevention

8 10

HOWTO: deliver tor-exit-notice_DE.html over ipv6 port 80 too
by Toralf Förster 21 May '15

21 May '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 B/c ipv6 of Tor implements currently no DirPort I copied+pasted together the following solution to deliver a Tor exit notice over HTTP port of ipv6 too : The python snippet runs under a non-privileged user w/o login shell : $ cat ipv6-httpd.py import socket from BaseHTTPServer import HTTPServer from SimpleHTTPServer import SimpleHTTPRequestHandler class MyHandler(SimpleHTTPRequestHandler): def do_GET(self): return SimpleHTTPRequestHandler.do_GET(self) class HTTPServerV6(HTTPServer): address_family = socket.AF_INET6 def main(): server = HTTPServerV6(('::', 8181), MyHandler) server.serve_forever() if __name__ == '__main__': main() The ip6table rules to redirect fort 80 from outside to the local non-privileged port : from=80 to=8181 $IPT -t nat -A PREROUTING -i enp3s0 -p tcp -m tcp --destination-port $from -j REDIRECT --to-ports $to $IPT -A INPUT -p tcp -m tcp --destination-port $to -j ACCEPT And finally the script to start it during boot : $> cat /home/simplehttp/ipv6-httpd.sh #!/bin/sh # d=$(mktemp -d /tmp/XXXXXX) &&\ cd $d &&\ cp /etc/tor/tor-exit-notice_DE.html ./index.html &&\ nice python ~/ipv6-httpd.py 1>./log 2>&1 :-) - -- Toralf pgp key: 7B1A 07F4 EC82 0F90 D4C2 8936 872A E508 0076 E94E -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAlVeC48ACgkQxOrN3gB26U59HwD8CwnBIpZOkq8tN01ciWsZQh7c FO42AGmkkhCI/CbucnYA/j3zSq1wJzuHgMdWZUbQCQvHt+KEYkobdNkcHqkK3mWE =FA7E -----END PGP SIGNATURE-----

1 1

[warn] Tried to establish rendezvous on non-OR or non-edge circuit.
by Cmar433 21 May '15

21 May '15

Hi people .. i yesterday started IPV6 but now i see in log following messages periodically part of my torrc below. I only add ipv6 lines. Any idea ? or its normal ? Thanks Cmar ORPort 37.157.192.208:443 ORPort [2a02:2b88:2:1::3a62:1]:9050 ## If you want to listen on a port other than the one advertised in ## ORPort (e.g. to advertise 443 but bind to 9090), you can do it as ## follows. You'll need to do ipchains or other port forwarding ## yourself to make this work. #ORPort 443 NoListen #ORPort 127.0.0.1:9090 NoAdvertise ## The IP address or full DNS name for incoming connections to your ## relay. Leave commented out and Tor will guess. Address 37.157.192.208 ## If you have multiple network interfaces, you can specify one for ## outgoing traffic to use. OutboundBindAddress 37.157.192.208 info from log: May 19 22:42:03.000 [notice] Average packaged cell fullness: 99.082% May 19 22:42:03.000 [notice] TLS write overhead: 3% May 19 22:42:03.000 [notice] Circuit handshake stats since last time: 118791/118793 TAP, 161141/161141 NTor. May 19 23:13:45.000 [warn] Tried to establish rendezvous on non-OR or non-edge circuit. May 20 03:08:03.000 [warn] Tried to establish rendezvous on non-OR or non-edge circuit. May 20 03:33:54.000 [warn] Tried to establish rendezvous on non-OR or non-edge circuit. May 20 04:42:03.000 [notice] Heartbeat: Tor's uptime is 18:00 hours, with 4375 circuits open. I've sent 211.07 GB and received 203.24 GB.

3 2

BWauth kookiness
by starlight.2015q2＠binnacle.cx 20 May '15

20 May '15

Some possible fallout related to the earlier discussion [tor-relays] amount of unmeasured relays continuously rising since 2 weeks https://lists.torproject.org/pipermail/tor-relays/2015-May/007003.html My relay Binnacle 4F0DB7E687FC7C0AE55C8F243DA8B0EB27FBF1F2 has 9375 Kbyte (75 Mbit) of unfuzzy (no ISP traffic shaping) bandwidth, but in the last few days the BWAuths' opinion went from # gabelmoo # tor26 # moria1 # longclaw bw1-w Bandwidth=7382 Measured=7100 *bw2-w Bandwidth=7382 Measured=9330 bw3-w Bandwidth=7382 Measured=13700 GuardFraction=69 bw4-w Bandwidth=7382 Measured=23700 to bw1-w Bandwidth=9375 Measured=17100 bw3-w Bandwidth=9375 Measured=77900 GuardFraction=75 *bw4-w Bandwidth=9375 Measured=23000 * selected for consensus While it's flattering to be promoted to double the actual capacity, with the potential to go 8x, I suspect it's may not a great idea in the grand scheme of things. And to think at one time I was feeling short-changed. . . FYI BWauths Regards

2 2

Tor Consensus Weight Stuck at 20 (Even on Relay with "Stable" Flag)
by Neel Chauhan 19 May '15

19 May '15

Hi, I have a Tor relay (https://atlas.torproject.org/#details/342587A287603040A49BB364D72EAC0B6BC3D…) running from a FreeBSD server at my house on with a 5 megabit upstream connection. I have seen that lately, Tor's "Consensus Weight" value on this relay has not been going anywhere above (or below) 20. My relay has gotten the "Stable" flag, but yet didn't see it's consensus weight value rise. I decided to look at https://consensus-health.torproject.org/, and saw that two of the four bandwidth consensus servers, namely tor26 (86.59.21.38) and longclaw (199.254.238.52) don't seem to be calculating any consensus value for Tor relays in the last few days. Has anyone else been having this problem? And if the Tor consensus operators are reading this, (approximately) when would this problem get resolved? Thanks, Neel Chauhan

8 17

Tor relay/btc node script
by torelay 18 May '15

18 May '15

I've written my first script. It is to automate the process of setting up a tor relay/bridge (published or not) and a bitcoin full node (with hidden service url and/or clearnet ip) on a fresh debian os. The script is at https://github.com/mktx-code/relay-node. To write it I used a combination of the sky-ip tuts and random github codes for syntax and structuring. Please give me any comments criticisms. Appreciated.

2 1

Re: [tor-relays] Windows Tor Server Guide
by Ben Serebin 18 May '15

18 May '15

Hi there... 1st post (I figured after years of donating to EFF, I should run a tor relay). I've searched and read many posts on tor-relays and the best Windows Tor Server Guide I found was this below one by Rafael Rodriguez. A few questions, and apologies if they seem silly, but there is scant info out there for us Windows admins. - is a web server needed? - the below email post had the slashes stripped from the path entries which makes it tricky to follow (talk about an annoying mail-list process). Overall, throw all the files in a single dir? - before I load it as a service, once all files and config the "torrc" can I just launch the tor.exe and then test it's working? - is this the only way to run a relay on Windows? Hoping there's a special approach to simplify the process (now I know why there aren't more of them). Thanks, -Ben Rafael Rodriguez rafaelr at icctek.com Wed Nov 5 00:47:46 UTC 2014 Previous message: [tor-relays] Windows Tor Server Guide Next message: [tor-relays] Windows Tor Server Guide Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] Hi, here is it. Please, feel free to contribute to it. RUNNING A TOR SERVER IN WINDOWS - Download latest Tor Browser Bundle. - Install to c:tor - Create a temporary folder on your Desktop and name it "server". - Copy all files from C:TorBrowserTorBrowserDataTor to the "server" folder on the Desktop. - Browse to C:TorBrowserTorBrowserTor; delete the folder "PluggableTransports" and it content. - Copy all files from C:TorBrowserTorBrowserTor to the "server" folder on the Desktop. - Browse to C:Tor and delete everything inside that folder. C:Tor should be completely empty at this point. - Move all files from the "server" folder on your Desktop to C:Tor - Browse to C:Tor and create a new folder named "datadir". - Create a new text file in C:Tor named "notices" (I myself use notices.log but we want to keep it simple for users who may not know how to change the file extension from .txt to .log) - EDIT C:TORTORRC FILE: (this could be the torrc-defaults file and all its comments). Note that the sample below is just for references. Each user needs to define her/his own parameters based on their own needs and that's impossible for me to cover in a single file for everyone. Hence, each parameter should be included in the torrc-defaults with due comments to be used as reference. Also, noted that I'm using IPv4 geoip by default. Users using IPv6 should define geoip6 in their torrc file. Then again, I cannot use a single sample file for all deployments. The defaults file should be used as reference once again. DATADIRECTORY .DATADIR LOG NOTICE FILE .NOTICES.TXT GEOIPFILE .GEOIP AvoidDiskWrites 1 SocksPort 0 ORPort 9001 DirPort 9030 ExitPolicy reject *:* Nickname RelayBandwidthRate RelayBandwidthBurst Up until this point, all I've written is nothing more than using the default Tor Bundle to create a "Server" package. All steps above could be made easier for users if a "Tor Windows Server" package was available for download on the Tor Project or somewhere else. I refuse the idea of creating such package myself to distribute it since many packages could start floating on the net and bad intentioned people could bundle them with arbitrary code, viruses and so on. A Windows Installer package can be built for distribution though. Next, I will address the two main things we need to run tor as a Windows service (server): 1- Install Tor as Windows Service. 2- Security (Isolating the Tor service). INSTALL TOR AS WINDOWS SERVICE I personally use nssm [2] (Non-Sucking Service Manager) myself to register the service but feel free to use default Windows tools for registering Tor service if you believe so. Anyways, irrespective the tool used to register the Tor service, we just need the following: Service: C:Tortor.exe Name: TorServer Parameters: -f C:Tortorrc Start the TorServer service and everything should just work at this point. The datadir directory will be populated with tor files once started and the notices.txt file will also reflect so. SECURITY (Quick explanation - We can go into details later) - Create a Standard user account and name it Tor with a strong password. - Policies: 1- Deny access to this computer from the network 2- Deny log on locally 3- Deny log on through Remote Desktop Services - NTFS Permissions for Tor windows user account: 1- Read/Write permissions to datadir folder 2- Read/Write permissions to notices.txt or (notices.log) file - Open Services, Start -> Run -> type "services.msc" without quotes, press enter and your Services window will pop up. Scroll down and find the TorServer service and double click it. Move to the LOG ON tab and set the "Log on as: This account: .TOR. Enter the strong password for the Tor user account in the password field and apply changes. Restart the service and now Tor will be running in its own isolated/limited account in Windows.

2 3

Job for tor.service failed.
by tor-server-creator＠use.startmail.com 14 May '15

14 May '15

hi there. 0.2.5.12 on debian jessie: "service tor reload" causes message: "Job for tor.service failed. See 'systemctl status tor.service' and 'journalctl -xn' for details." it says something like "failed to start LSB"? any advice for me please? cheers

3 3

Authdir is rejecting routers in this range
by Tim Semeijn 12 May '15

12 May '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In my venture to find more ISPs to house Tor Exit nodes I have recently set up a node in Switzerland (Private Layer - 179.43.160.41). When running Tor 6 out of 9 Authdirs are rejecting the node: - ---- May 12 20:31:02.000 [warn] http status 400 ("Authdir is rejecting routers in this range.") response from dirserver '86.59.21.38:80'. Please correct. May 12 20:31:02.000 [warn] http status 400 ("Authdir is rejecting routers in this range.") response from dirserver '131.188.40.189:80'. Please correct. May 12 20:31:02.000 [warn] http status 400 ("Authdir is rejecting routers in this range.") response from dirserver '171.25.193.9:443'. Please correct. May 12 20:31:02.000 [warn] http status 400 ("Authdir is rejecting routers in this range.") response from dirserver '208.83.223.34:443'. Please correct. May 12 20:31:02.000 [warn] http status 400 ("Authdir is rejecting routers in this range.") response from dirserver '199.254.238.52:80'. Please correct. May 12 20:32:04.000 [warn] http status 400 ("Authdir is rejecting routers in this range.") response from dirserver '154.35.175.225:80'. Please correct. - ---- I looked through the mailing lists and blog posts to find out if this range was mentioned somewhere to see why it gets rejected but I could not find anything. Can anyone shed some light on why this range would be blocked and if there is any chance it will get accepted again in the near future? Best regards, - -- Tim Semeijn Babylon Network pgp 0x5B8A4DDF -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBAgAGBQJVUloCAAoJEIZioqpbik3fc/UQAKWstydq4S2OjRko7jhd1oXS kcde4a39nk1lvB/YtHCZJtHVkyypnLbdjmvPlcVSIk3Qqaj/40lu05caWThq5ZgI y90SEnumUHaWslYtKVUAFmgQAXv7lkAs6Svf3ZxZ9PT+NQMpWhyrrlmJ2hakF01Q /z46NU9YhL2dqCXG/w75gmrP87aYZ/2jOMIEZxi4ZIp6OlJXIGoaI8lCQrYWFstH zuC1JDnPwgGhqnB//JBKilrwEalk/kXZDodWpHvllUDqywvn1OOn/Do2JRETqxuV czVy7Ez/s19fk1ltWZyblDS6xsT0gYowH3c0zYovY/s0G1Y7KD50Jr1MEVpiv19/ 9NBHErEUEec8C+h6UoiSXoDKg5Q999uEtMJNJ0/AzlvyWN3+eXtNc/XmBpxzbIGR gQ+w30vyQNwXJFZkpq0wGIXSbXWpsgKYyxNRnokCNFx/AQpjGFUBauXDj5EcpzXJ m3on4LHH9IYbek3EKjhivJ2MjK5lRfjtINtoBx8nanliOY21Pf9js+bAxDFhorhZ wFdijEVGvoUlu/SWOlEuaQlNSBoVXxqBQQo/MVSgJpMUNRngshQslg9qI42Bd5Pn pxJ44X161/PUdChWc6hQ01dAXLNFR07+1OT/9vnSRBaaHFsstU3gI99hFZ1chhps BK+QwwxupISJchliUZZ1 =nWDs -----END PGP SIGNATURE-----

2 1

Port configuration on non-exit relay
by aredocilla＠gmail.com 12 May '15

12 May '15

Hi all, I'm running a non-exit on Amazon EC2. I followed the (out-of-date) docs online (which are no longer online!), which instructed me to open the following inbound ports in the security policy: 52176, 40872, 22, 443. Obviously 22 is for SSH, and 443 seems to be the standard choice for ORPort. What are the other two for? They don't seem to be used; should I disable them? The other thing is: I've enabled obfsproxy with obfs3 and obfs4 bound to different ports on 0.0.0.0: ServerTransportListenAddr obfs3 0.0.0.0:587 ServerTransportListenAddr obfs4 0.0.0.0:80 Is that optimal? Presumably also: - I should add additional lines for listening on [::] on the same ports to enable ipv6 obfsproxy connections; - I should also open these ports in the security policy? Best wishes, allicoder -- PGP key available on request

1 0

Hivelocity is not longer serving my needs.
by Geo Rift 11 May '15

11 May '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I've had my exit relay running on a spare Hivelocity server that I had for 17 days now. Even after a reduced exit policy I continued to receive abuse reports. They have now asked that I stop running a tor relay on the server. I'm looking for a decent provider that can suit my needs of running a fast exit node. Does anyone have any recommendations? Thanks, Tim -----BEGIN PGP SIGNATURE----- Version: Mailvelope v0.13.1 Comment: https://www.mailvelope.com wsFcBAEBCAAQBQJVUM1qCRC8Tq5FO2jmKgAA9aAP/3rWozZ63GiGG28/UsWT Ap4ygekHqXvKPzpbUJz7mwxgk0AzCydgaLKaYHvl4jgEgXuwAXSCfSyZS27E jOd72A6Qk36dtsVSgzBbFFyiT3f30mAZIBc+KCyhZ6fEQ5Rb5v0mJWz1nlyA BfvYjTF6eZgLaLcyPt8RPJoITyV6df+RUbaUAstoqql+cZn7Wnoj9P6rbM3h aSPFD2llWQorGxgRX7vJzuytJqZEIvhLoI/eakClyTKrNi2AosCn2rzKwB4C oTv4wmlbbZnhSXvT8jdqBXzQl1va2XPaSErXTfkREzQ6Pg+LEG1lr+AGTFAE JRMx5MN79YQtX86XnxZsCHxqLD8mqz1Kw2/lr6rNWWcxZH+tmXfKqpmCr6/b 9Jjttd2qUQctOQZEYYoMSsIx1s269km1X6WB4tvYrx8NuBaqsFUuoEndeEpD AvF2mlL5mhUjGxE4q9UERGm7KTVLf1MfqPNdpWjpepxy2eATjaOyo+tnswIZ vM1h7x/Ky2KQG9240k1U6vfiqaRV82FNRvIhbrKgCtiZ3+CrqLNx4UXwcMVt tqGqC86xX5ip4W+iyuVOOApV86V6U047ovPmiRV9XRv+44v8UFgGZA58Zobg sCsFluaLICo857y4WPsiHjXwA5IHy9hI1kVAyJB2Qo9yIApGGlL9RhVhFDBI B4Nm =L3ny -----END PGP SIGNATURE-----

4 3

Re: [tor-relays] RelayBandwidthRate vs AccountingMax
by teor 11 May '15

11 May '15

> Date: Sun, 10 May 2015 23:13:18 +0100 > From: Christopher Baines <mail(a)cbaines.net> > > I run this relay [1], and currently use the following config: > 1: > https://atlas.torproject.org/#details/91F4DFA04743755C8551A12F8C4065F79786B… > > RelayBandwidthRate 1.7 MB > RelayBandwidthBurst 20 MB > > This keeps it from using more than ~3TB of bandwidth in a month. > However, I wonder if this is beneficial for the network, over using the > AccountingMax instead? If you use "AccountingMax 3TB" and "AccountingStart month 1 00:00" (or whenever your rollover date is), the relay will go at full speed, use all the quota you specify, then hibernate for the rest of the month. The next month, it will calculate the maximum start date that it could start at to use all the bandwidth at a similar rate to last month, then wake at a random interval between the start of the month and the calculated date. Note that the AccountingMax quota will make the relay hibernate when either the download or the upload individually hit the quota. If you want the sum of both, use "AccountingRule sum". If you use RelayBandwidthRate, the relay will go at partial speed, and may not use all the quota if there are any quiet periods. Personally, I'd rather have faster relays for part of the month, but others favour stable relays for the entire month. It may also depend on whether your relay is one or more of: * a guard, where stability would be a priority, * a middle (that is, not guard or exit), where there is plenty of bandwidth, and therefore speed would be a priority, and/or * an exit, where speed would again be a priority… as far as I can work it out, anyway. Both stable relays and fast relays are a valuable contribution, please contribute what you think the Tor network needs most. teor teor2345 at gmail dot com pgp 0xABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR D5BE4EC2 255D7585 F3874930 DB130265 7C9EBBC7

1 0

RelayBandwidthRate vs AccountingMax
by Christopher Baines 10 May '15

10 May '15

I run this relay [1], and currently use the following config: RelayBandwidthRate 1.7 MB RelayBandwidthBurst 20 MB This keeps it from using more than ~3TB of bandwidth in a month. However, I wonder if this is beneficial for the network, over using the AccountingMax instead? Thanks, Chris 1: https://atlas.torproject.org/#details/91F4DFA04743755C8551A12F8C4065F79786B…

1 0

descriptions still valid?
by tor-server-creator＠use.startmail.com 10 May '15

10 May '15

dear relayoperators, i wonder if descriptions on http://www.torservers.net/wiki/setup/server are still valid for debian jessie dist? particular chmod 700 ~/.ssh and wget https://www.torservers.net/misc/config/sshd_config thanks for helping out. cheers

2 1

send me somerelays and bridges for vidalia
by Sh.F.M 08 May '15

08 May '15

1 0

Re: [tor-relays] T-shirts and Confirming Relay Control
by Tim 05 May '15

05 May '15

Being fairly new to the tor project I can see where he is getting at with the difficulty of helping out. I can deffinantly see having a single person to contact to try and find things to do would be important. While I agree that volunteers should not be babysat there should be someone that has a bunch of tasks to pass off to those who is interested. I would be more than willing to dedicate time to do something like this, I think it could be seriously useful to newer people in the community. In my mind a volunteer coordinator would not babysit but provide things that may be suited for a particular skill set. Then a little later down the line touch base with person to see if they encountered any issues. Side note: getting a little off track here. Would there be a better place for a discussion like this? Tim <div>-------- Original message --------</div><div>From: Matthew Finkel <matthew.finkel(a)gmail.com> </div><div>Date:06/05/2015 02:14 (GMT+08:00) </div><div>To: tor-relays(a)lists.torproject.org </div><div>Subject: Re: [tor-relays] T-shirts and Confirming Relay Control </div><div> </div>On Tue, May 05, 2015 at 01:57:04PM +0000, Speak Freely wrote: > Matthew Finkel, > > It's kind of disingenuous to suggest "If you want to work on something, > then please come work on it, we really are overloaded." > I'm really sorry you interpretted it in that way. It actually was a genuine request for more help. > You have to let us work on it, for us to work on it. Do you understand > the problem? Sure, that is a problem, but what is the problem? It seems this dilemma is reoccurring and not getting solved. Someone says they are willing to help work on something, possibly someone else says "great! we need your help!" then nothing happens. Was it an empty offer or did the offer die because no one followed up with the person? Having a volunteer coordinator might help - I hope it would help - but what's the best way to organize that? Is it the responsibly of some people associated with The Tor Project to follow up on every offer they receive or is it the responsibility of the person who made the offer to follow up and get involved? Maybe both? > > To The Inner Circle (The Tor Project People), > > I am at the very least the third person to mention in this thread that > we have offered to help. No one responded to my offers. I'm pretty sure > at least some of their offers were ignored as well, though I can't be > bothered to double check. :( I don't know. Obviously, not receiving a response sucks. I completely understand that. Tor's work and day-to-day coordination is heavily based around IRC, so the mailing lists are not great places for offering help. This whole situation seems to be less about an inner circle existing, and more about a disconnection between the announcements and discussions on the mailing lists and what happens on IRC. I don't know of a good way to bridge this gap, though. > > I get that you're busy. However, Matthew's attitude to Seth is, in my > most humble of opinions, unwarranted. > We're all busy, it's difficult balancing everything. I'm sorry if my response was unwarranted, and maybe I shouldn't have responded because it was off-topic, in any case. It's frustrating trying to do something and improve a situation, and instead of receiving helpful feedback the thread receives complaints about how Tor is crappy with how it handles volunteers. Maybe this is partially due to miscommunication but I'm at a loss for what to do. > You've got several people who out of their own free will, decided to > offer our additional help, above and beyond what we already do. > > I wonder, how would you feel, if after offering free assistance to a > community that then goes completely, totally, and utterly UNANSWERED, > only to have those very people that we offered to assist, bitch that > they are busy and want our help. How would you feel? > Angry? A little schadenfreude? Or numb? > > I'm a husband, a father, and a business owner. I'm a busy guy, yet I > still offered to help. I can't express how pissed off I am about this, > without going into a obscenity-laced tirade about how your house isn't > in order. > > When I offer assistance to someone, or in Tor's case several people, I > damn well expect a response. "Yes" or "no", "thanks" or "fuck off", > "please" or "tomorrow", "join us!" or "maybe next time". > > Deafening silence is in no way a mechanism that encourages support from > the broader community, but from my perspective that's all you've given. > Thanks. Obviously you're correct, silence is not an answer and not what you deserve as a result of offering your assistance. I don't know why this happened or the context of the offer but, to be blunt, Tor doesn't babysit volunteers. If you want to work on something, then, you must actually follow through and work on it. I learned this personally. A volunteer coordinator would be a great person for helping volunteers become more integrated into the community and work on projects but it is ultimately the person volunteering who decides how, when, and if they help. Tor wants your help, but becoming an active volunteer is your decision. > > Here's a suggestion to The Inner Circle > - Have a volunteer coordinator that actually responds to people. > > This way, when the next person offers to help, they might actually get a > good g*d d@mn f@cking response! > Yes, this sounds like a good idea. Who wants to volunteer to be the volunteer coordinator? Again, that is a genuine question. No one has stepped up to do it. If we had one, at least they would respond to most offers. > > Seeing as how I'm a nobody and my offers aren't worth acknowledging, > please continue to do whatever you'd like, with *all* the success it > brings. Don't forget to smile. > Being a nobody or being a somebody is irrelevant. I'm a nobody too, but I'm trying to do something. I sincerely hope you and the rest of the community will help me and Tor, as a whole, create a better community/network/world. Let's continue this discussion in a new thread. Thanks, Matt _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

HW-Accelerated OpenSSL & Tor not playing nicely.
by 12xBTM 05 May '15

05 May '15

Probably (and hopefully) a very obvious fix for those that aren't newbies to Linux, but I'm trying to get Hardware-Accelerated OpenSSL to work with Tor on Jessie. I've gotten the Hardware-Accelerated OpenSSL part done, but the Tor part is giving me problems. I am able to successfully compile Tor by itself, and I'm able to successfully utilize OpenSSL by itself, but getting them to work together isn't working. So, I'll give a run-down of what I've done, and where I'm stuck: Info: Linux beaglebone 3.14.39-ti-r61 #1 SMP PREEMPT Fri Apr 24 18:32:15 UTC 2015 armv7l GNU/Linux Debian 8 Console Tor 2.6.7 Information Sources: https://superuser.com/questions/881404/beaglebone-black-openssl-crypto-acce… and http://datko.net/2013/10/28/tor_cryptodev/ Step 1: Getting OpenSSL to become Hardware-Accelerated sudo apt-get install linux-image-3.14.39-ti-r61 sudo apt-get install linux-headers-3.14.39-ti-r61 wget http://download.gna.org/cryptodev-linux/cryptodev-linux-1.7.tar.gz tar zxf cryptodev-linux-1.7.tar.gz cd cryptodev-linux-1.7/ sudo make sudo make install sudo depmod -a sudo modprobe cryptodev lsmod sudo sh -c 'echo cryptodev>>/etc/modules' cd ~ wget https://www.openssl.org/source/openssl-1.0.2a.tar.gz tar zxf openssl-1.0.2a.tar.gz cd openssl-1.0.2a/ ls ./config -DHAVE_CRYPTODEV -DUSE_CRYPTDEV_DIGESTS shared sudo make sudo make install Step 2: Test OpenSSL: /usr/local/ssl/bin/openssl speed -evp aes-128-cbc Results confirm hardware acceleration is functional Step 3: Making Tor use OpenSSL Added to /etc/apt/sources.list : deb http://deb.torproject.org/torproject.org jessie main deb-src http://deb.torproject.org/torproject.org jessie main deb http://deb.torproject.org/torproject.org tor-experimental-0.2.6.x-jessie main deb-src http://deb.torproject.org/torproject.org tor-experimental-0.2.6.x-jessie main Fixed the key nonsense sudo apt-get update sudo apt-get install build-essential fakeroot devscripts sudo apt-get build-dep tor mkdir ~/debian-packages; cd ~/debian-packages sudo apt-get source tor cd tor-* And it's here where I believe the problem lies: sudo nano debian/rules Add the two lines as shown on the "guide" such that mine reads: override_dh_auto_configure: ! [ -e debian/micro-revision.i ] || cp debian/micro-revision.i src/or/micro-revision.i dh_auto_configure -- \ $(confflags) \ --enable-static-openssl \ --with-openssl-dir=/usr/local/ssl \ --prefix=/usr \ --mandir=\$${prefix}/share/man \ --infodir=\$${prefix}/share/info \ --localstatedir=/var \ --sysconfdir=/etc \ --disable-silent-rules \ --enable-gcc-warnings-advisory sudo debuild -rfakeroot -uc -us Error message after 35m: 15/359 TESTS FAILED. (0 skipped) Makefile:6429: recipe for target 'test' failed make[1]: *** [test] Error 1 make[1]: Leaving directory '/home/debian/debian-packages/tor-0.2.6.7/build' dh_auto_test: make -j1 test returned exit code 2 debian/rules:16: recipe for target 'build' failed make: *** [build] Error 2 dpkg-buildpackage: error: debian/rules build gave error exit status 2 debuild: fatal error at line 1376: dpkg-buildpackage -rfakeroot -D -us -uc failed My thoughts: I noticed on the Tor FAQ here: https://www.torproject.org/docs/faq.html.en#RelayMemory That adding the malloc flag it done using the ./configure option, while I used nano. If that's the problem, how do I use configure for adding the other flags such as OPenSSL dir and static openssl. Also, I noticed that the path I add to the configure is not quite the same as the path used to test openssl's functionality. Also, the tor confflag mentions static openssl, but the openssl ./configure talked about being shared. Also, does the ordering other confflags matter? Is it asking for a static openssl prior to learning the directory of the correct library? I'm just trying to brainstorm why I'm getting this one error. Looking at the test log, looks like there's some kind of error in the self-test of the cryptographic engine, yet it works in OpenSSL by itself? Any help would be appreciated, thanks. Super long test log: onion_handshake: cryptodev_digest_update: illegal inputs FAIL ../src/test/test.c:84: assert(! onion_skin_TAP_create(pk, &c_dh, c_buf)) [onion_handshake FAILED] bad_onion_handshake: cryptodev_digest_update: illegal inputs cryptodev_digest_update: illegal inputs cryptodev_digest_update: illegal inputs cryptodev_digest_update: illegal inputs FAIL ../src/test/test.c:158: assert(! onion_skin_TAP_create(pk, &c_dh, c_buf)) [bad_onion_handshake FAILED] onion_queues: OK ntor_handshake: OK circuit_timeout: OK rend_fns: OK geoip: OK geoip_with_pt: [forking] OK stats: [forking] OK accounting/bwlimits: [forking] OK addr/basic: OK addr/ip6_helpers: OK addr/parse: OK addr/virtaddr: OK addr/localname: OK addr/dup_ip: OK addr/sockaddr_to_str: OK addr/is_loopback: OK addr/make_null: OK address/get_if_addrs_ifaddrs: [forking] OK address/ifaddrs_to_smartlist: OK address/get_if_addrs_ioctl: [forking] OK address/ifreq_to_smartlist: OK buffer/basic: [forking] OK buffer/copy: [forking] OK buffer/pullup: [forking] OK buffer/ext_or_cmd: [forking] OK buffer/allocation_tracking: [forking] OK buffer/time_tracking: [forking] OK buffer/zlib: [forking] OK buffer/zlib_fin_with_nil: [forking] OK buffer/zlib_fin_at_chunk_end: [forking] OK cellfmt/relay_header: OK cellfmt/begin_cells: OK cellfmt/connected_cells: OK cellfmt/create_cells: OK cellfmt/created_cells: OK cellfmt/extend_cells: OK cellfmt/extended_cells: OK cellfmt/resolved_cells: OK cellfmt/is_destroy: OK cellqueue/basic: [forking] OK cellqueue/circ_n_cells: [forking] OK channel/dumpstats: [forking] OK channel/flush: [forking] OK channel/flushmux: [forking] OK channel/incoming: [forking] OK channel/lifecycle: [forking] OK channel/lifecycle_2: [forking] OK channel/multi: [forking] OK channel/queue_impossible: [forking] OK channel/queue_size: [forking] OK channel/write: [forking] OK channeltls/create: [forking] OK channeltls/num_bytes_queued: [forking] OK channeltls/overhead_estimate: [forking] OK checkdir/perms: [forking] OK circuitlist/maps: [forking] OK circuitlist/rend_token_maps: [forking] OK circuitlist/pick_circid: [forking] OK circuitmux/destroy_cell_queue: [forking] OK config/resolve_my_address: [forking] OK config/addressmap: OK config/parse_bridge_line: OK config/parse_transport_options_line: OK config/parse_transport_plugin_line: [forking] OK config/check_or_create_data_subdir: [forking] OK config/write_to_data_subdir: [forking] OK config/fix_my_family: OK container/smartlist_basic: OK container/smartlist_strings: OK container/smartlist_overlap: OK container/smartlist_digests: OK container/smartlist_join: OK container/smartlist_ints_eq: OK container/bitarray: OK container/digestset: OK container/strmap: OK container/pqueue: OK container/order_functions: OK container/di_map: OK container/fp_pair_map: OK control/bucket_note_empty: OK control/bucket_millis_empty: OK control/sum_up_cell_stats: OK control/append_cell_stats: OK control/format_cell_stats: OK crypto/formats: OK crypto/rng: OK crypto/aes_AES: [forking] OK crypto/aes_EVP: [forking] OK crypto/sha: OK crypto/pk: cryptodev_digest_update: illegal inputs FAIL ../src/test/test_crypto.c:427: assert(128 OP_EQ crypto_pk_public_encrypt(pk2, data1, sizeof(data1), "Hello whirled.", 15, PK_PKCS1_OAEP_PADDING)): 128 vs -1 [pk FAILED] crypto/pk_fingerprints: [forking] OK crypto/digests: OK crypto/dh: OK crypto/aes_iv_AES: [forking] OK crypto/aes_iv_EVP: [forking] OK crypto/base32_decode: OK crypto/kdf_TAP: OK crypto/hkdf_sha256: OK crypto/curve25519_impl: OK crypto/curve25519_impl_hibit: OK crypto/curve25519_wrappers: OK crypto/curve25519_encode: OK crypto/curve25519_persist: OK crypto/ed25519_simple: OK crypto/ed25519_test_vectors: OK crypto/ed25519_encode: OK crypto/ed25519_convert: OK crypto/ed25519_blinding: OK crypto/ed25519_testvectors: OK crypto/siphash: OK dir/nicknames: [forking] OK dir/formats: [forking] OK dir/routerparse_bad: OK dir/extrainfo_parsing: OK dir/parse_router_list: [forking] OK dir/load_routers: [forking] OK dir/load_extrainfo: [forking] OK dir/versions: [forking] OK dir/fp_pairs: [forking] OK dir/split_fps: OK dir/measured_bw_kb: [forking] OK dir/measured_bw_kb_cache: [forking] OK dir/param_voting: [forking] OK dir/v3_networkstatus: [forking] OK dir/random_weighted: OK dir/scale_bw: OK dir/clip_unmeasured_bw_kb: [forking] OK dir/clip_unmeasured_bw_kb_alt: [forking] OK dir/fmt_control_ns: OK dir/http_handling: OK dir/purpose_needs_anonymity: OK dir/fetch_type: OK dir/packages: OK dir/md/cache: [forking] OK dir/md/broken_cache: [forking] OK dir/md/generate: OK dir/md/parse: OK dir/md/reject_cache: [forking] OK entryconn/rewrite_basic: [forking] OK entryconn/rewrite_bad_dotexit: [forking] OK entryconn/rewrite_automap_ipv4: [forking] OK entryconn/rewrite_automap_ipv6: [forking] OK entryconn/rewrite_cached_dns_ipv4: [forking] OK entryconn/rewrite_cached_dns_ipv6: [forking] OK entryconn/rewrite_unmapped_virtual: [forking] OK entryconn/rewrite_mapaddress: [forking] OK entryconn/rewrite_reject_internal_reverse: [forking] OK entryconn/rewrite_automap_exit: [forking] OK entryconn/rewrite_mapaddress_exit: [forking] OK entryconn/rewrite_mapaddress_automap_onion: [forking] OK entryconn/rewrite_mapaddress_automap_onion2: [forking] OK entryconn/rewrite_mapaddress_automap_onion3: [forking] OK entryconn/rewrite_mapaddress_automap_onion4: [forking] OK entrynodes/entry_is_time_to_retry: [forking] OK entrynodes/choose_random_entry_no_guards: [forking] OK entrynodes/choose_random_entry_one_possibleguard: [forking] OK entrynodes/populate_live_entry_guards_1guard: [forking] OK entrynodes/populate_live_entry_guards_3guards: [forking] OK entrynodes/entry_guards_parse_state_simple: [forking] OK entrynodes/entry_guards_parse_state_pathbias: [forking] OK entrynodes/entry_guards_set_from_config: [forking] OK entrynodes/entry_is_live: [forking] OK guardfraction/parse_guardfraction_file_bad: [forking] OK guardfraction/parse_guardfraction_file_good: [forking] OK guardfraction/parse_guardfraction_consensus: [forking] OK guardfraction/get_guardfraction_bandwidth: [forking] OK guardfraction/should_apply_guardfraction: [forking] OK extorport/id_map: [forking] OK extorport/write_command: [forking] OK extorport/init_auth: [forking] OK extorport/cookie_auth: [forking] OK extorport/cookie_auth_testvec: [forking] OK extorport/handshake: [forking] OK hs/hs_desc_event: [forking] OK hs/pick_tor2web_rendezvous_node: [forking] OK hs/pick_bad_tor2web_rendezvous_node: [forking] OK introduce/early_parse_v0: cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0) [early_parse_v0 FAILED] introduce/early_parse_v1: cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0) [early_parse_v1 FAILED] introduce/early_parse_v2: cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0) [early_parse_v2 FAILED] introduce/early_parse_v3: cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0)cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0) [early_parse_v3 FAILED] introduce/decrypt_v0: cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0) [decrypt_v0 FAILED] introduce/decrypt_v1: cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0) [decrypt_v1 FAILED] introduce/decrypt_v2: cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0) [decrypt_v2 FAILED] introduce/decrypt_v3: cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0)cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0) [decrypt_v3 FAILED] introduce/late_parse_v0: cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0) [late_parse_v0 FAILED] introduce/late_parse_v1: cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0) [late_parse_v1 FAILED] introduce/late_parse_v2: cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0) [late_parse_v2 FAILED] introduce/late_parse_v3: cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0)cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0) [late_parse_v3 FAILED] nodelist/node_get_verbose_nickname_by_id_null_node: [forking] OK nodelist/node_get_verbose_nickname_not_named: [forking] OK oom/circbuf: [forking] OK oom/streambuf: [forking] OK options/validate: [forking] OK policy/router_dump_exit_policy_to_string: OK policy/general: OK pt/parsing: OK pt/protocol: OK pt/get_transport_options: [forking] OK pt/get_extrainfo_string: [forking] OK pt/configure_proxy: [forking] OK pt/get_pt_proxy_uri: [forking] OK relay/append_cell_to_circuit_queue: [forking] OK relaycell/resolved: [forking] OK replaycache/alloc: OK replaycache/badalloc: OK replaycache/free_null: OK replaycache/miss: OK replaycache/hit: OK replaycache/age: OK replaycache/elapsed: OK replaycache/noexpire: OK replaycache/scrub: OK replaycache/future: OK replaycache/realtime: OK routerkeys/write_fingerprint: [forking] OK routerlist/initiate_descriptor_downloads: OK routerlist/launch_descriptor_downloads: OK routerset/routerset_new: [forking] OK routerset/routerset_get_countryname: [forking] OK routerset/routerset_is_list: [forking] OK routerset/routerset_needs_geoip: [forking] OK routerset/routerset_is_empty: [forking] OK routerset/routerset_contains__null_set_or_null_set_list: [forking] OK routerset/routerset_contains__set_and_nickname: [forking] OK routerset/routerset_contains__set_and_null_nickname: [forking] OK routerset/routerset_contains__set_and_no_nickname: [forking] OK routerset/routerset_contains__set_and_digest: [forking] OK routerset/routerset_contains__set_and_no_digest: [forking] OK routerset/routerset_contains__set_and_null_digest: [forking] OK routerset/routerset_contains__set_and_addr: [forking] OK routerset/routerset_contains__set_and_no_addr: [forking] OK routerset/routerset_contains__set_and_null_addr: [forking] OK routerset/routerset_contains__countries_no_geoip: [forking] OK routerset/routerset_contains__countries_geoip: [forking] OK routerset/routerset_add_unknown_ccs__only_flag_and_no_ccs: [forking] OK routerset/routerset_add_unknown_ccs__creates_set: [forking] OK routerset/routerset_add_unknown_ccs__add_unknown: [forking] OK routerset/routerset_add_unknown_ccs__add_a1: [forking] OK routerset/routerset_contains_extendinfo: [forking] OK routerset/routerset_contains_router: [forking] OK routerset/routerset_contains_routerstatus: [forking] OK routerset/routerset_contains_node__none: [forking] OK routerset/routerset_contains_node__routerinfo: [forking] OK routerset/routerset_contains_node__routerstatus: [forking] OK routerset/routerset_get_all_nodes__no_routerset: [forking] OK routerset/routerset_get_all_nodes__list_with_no_nodes: [forking] OK routerset/routerset_get_all_nodes__list_flag_not_running: [forking] OK routerset/routerset_get_all_nodes__list: [forking] OK routerset/routerset_get_all_nodes__nodelist_with_no_nodes: [forking] OK routerset/routerset_get_all_nodes__nodelist_flag_not_running: [forking] OK routerset/routerset_refresh_counties__geoip_not_loaded: [forking] OK routerset/routerset_refresh_counties__no_countries: [forking] OK routerset/routerset_refresh_counties__one_valid_country: [forking] OK routerset/routerset_refresh_counties__one_invalid_country: [forking] OK routerset/routerset_union__source_bad: [forking] OK routerset/routerset_union__one: [forking] OK routerset/routerset_parse__malformed: [forking] OK routerset/routerset_parse__valid_hexdigest: [forking] OK routerset/routerset_parse__valid_nickname: [forking] OK routerset/routerset_parse__get_countryname: [forking] OK routerset/routerset_parse__policy: [forking] OK routerset/routerset_subtract_nodes: [forking] OK routerset/routerset_subtract_nodes__null_routerset: [forking] OK routerset/routerset_to_string: [forking] OK routerset/routerset_equal__empty_empty: [forking] OK routerset/routerset_equal__empty_not_empty: [forking] OK routerset/routerset_equal__differing_lengths: [forking] OK routerset/routerset_equal__unequal: [forking] OK routerset/routerset_equal__equal: [forking] OK routerset/routerset_free__null_routerset: [forking] OK routerset/routerset_free: [forking] OK scheduler/channel_states: [forking] OK scheduler/compare_channels: [forking] OK scheduler/initfree: [forking] OK scheduler/loop: [forking] OK scheduler/queue_heuristic: [forking] OK socks/4_unsupported_commands: [forking] OK socks/4_supported_commands: [forking] OK socks/5_unsupported_commands: [forking] OK socks/5_supported_commands: [forking] OK socks/5_no_authenticate: [forking] OK socks/5_auth_before_negotiation: [forking] OK socks/5_authenticate: [forking] OK socks/5_authenticate_with_data: [forking] OK socks/5_malformed_commands: [forking] OK status/count_circuits: [forking] OK status/secs_to_uptime: [forking] OK status/bytes_to_usage: [forking] OK status/log_heartbeat__fails: [forking] OK status/log_heartbeat__simple: [forking] OK status/log_heartbeat__not_in_consensus: [forking] OK status/log_heartbeat__calls_log_accounting: [forking] OK status/log_heartbeat__packaged_cell_fullness: [forking] OK status/log_heartbeat__tls_write_overhead: [forking] OK util/time: OK util/parse_http_time: OK util/config_line: OK util/config_line_quotes: OK util/config_line_comment_character: OK util/config_line_escaped_content: OK util/expand_filename: OK util/escape_string_socks: OK util/string_is_key_value: OK util/strmisc: OK util/pow2: OK util/gzip: OK util/datadir: OK util/memarea: OK util/control_formats: OK util/mmap: OK util/sscanf: OK util/format_time_interval: OK util/path_is_relative: OK util/strtok: OK util/di_ops: OK util/round_to_next_multiple_of: OK util/laplace: OK util/strclear: OK util/find_str_at_start_of_line: OK util/string_is_C_identifier: OK util/asprintf: OK util/listdir: OK util/parent_dir: OK util/ftruncate: OK util/exit_status: OK util/fgets_eagain: OK util/format_hex_number: OK util/format_dec_number: OK util/join_win_cmdline: OK util/split_lines: OK util/n_bits_set: OK util/eat_whitespace: OK util/sl_new_from_text_lines: OK util/envnames: OK util/make_environment: OK util/set_env_var_in_sl: OK util/read_file_eof_tiny_limit: OK util/read_file_eof_one_loop_a: OK util/read_file_eof_one_loop_b: OK util/read_file_eof_two_loops: OK util/read_file_eof_two_loops_b: OK util/read_file_eof_zero_bytes: OK util/write_chunks_to_file: OK util/mathlog: OK util/weak_random: OK util/socket: [forking] OK util/socketpair: [forking] OK util/socketpair_ersatz: [forking] OK util/max_mem: OK util/hostname_validation: OK util/ipv4_validation: OK util/logging/sigsafe_err_fds: [forking] OK util/logging/sigsafe_err: [forking] OK util/thread/basic: [forking] OK util/thread/conditionvar: [forking] OK util/thread/conditionvar_timeout: [forking] OK

3 8

T-shirts and Confirming Relay Control
by Matthew Finkel 05 May '15

05 May '15

Hi Ops, We recently began responding to t-shirt requests again. Sorry for the long silence. There's been a lot happening around here but not enough time or people to do everything, so the t-shirt requests simply remained untouched. But, despite the overload, t-shirts are important because they are a small token of our thanks and appreciation for making the network what it is today. We responded to around 70 t-shirt requests from relay operators in April, which comprised all requests for which we could verify (within reason) the request came from the person who controlled the qualifying relay. We still have another 20 requests where the requestor is not obviously the owner of the relay. Currently the content of a relay's Contact field is used, but this does not always provide enough (or any) information. For this case, we need an authentication mechanism which proves control of the relay but is something relay operators won't mind running. My currently plan is to ask relay operators to sign the fingerprint file which tor creates. The major disadvantage of this method is that it must be run as root (or a user with access to tor's data directory). The following process is the current plan, but does anyone have a better idea? Does it seem logical? ------------------------------------------------------------ When we receive a t-shirt request from someone who isn't obviously in control of the relay, we ask them to sign their fingerprint file with a unique salt. Assuming the path to their data dir is /var/lib/tor, we ask them to run: $ (echo -n "salt "; cat /var/lib/tor/fingerprint) | openssl sha256 \ -binary | openssl pkeyutl -inkey /var/lib/tor/keys/secret_id_key \ -sign -pkeyopt digest:sha256 -pkeyopt rsa_padding_mode:pss \ -pkeyopt rsa_pss_saltlen:32 | openssl base64 > signed_fingerprint They send us both /var/lib/tor/fingerprint and signed_fingerprint. When we receive them, we confirm the fingerprint in the fingerprint file matches the qualifying relay. Then we retrieve the relay's public key from its descriptor and convert it into pkcs#8 format using: $ openssl rsa -pubin -in pubkey_pkcs1 -RSAPublicKey_in -out pubkey and then we verify the sig using following commands: $ (echo -n "salt "; cat fingerprint) | openssl sha256 -binary | \ openssl pkeyutl -pubin -verify -inkey pubkey -sigfile \ $(OUT=/tmp/signed_fingerprint_bin; base64 -d signed_fingerprint > \ ${OUT}; echo ${OUT}) -pkeyopt digest:sha256 -pkeyopt \ rsa_padding_mode:pss -pkeyopt rsa_pss_saltlen:32; rm \ /tmp/signed_fingerprint_bin; This should yield "Signature Verified Successfully". ------------------------------------------------------------ Another disadvantage of this is PSS wasn't implemented in openssl's apps until 1.0.1. I wonder how many relays are running on servers which are still using openssl 0.9.8 (and 1.0.0?). For these servers we can fallback on pkcs#1 v1.5 signatures. ------------------------------------------------------------ The signature can be created using a command similar to the one above: $ (echo -n "salt "; cat /var/lib/tor/fingerprint) | openssl dgst \ -sha256 | openssl rsautl -inkey /var/lib/tor/keys/secret_id_key \ -sign | openssl base64 > signed_fingerprint Again, they provide /var/lib/tor/fingerprint and signed_fingerprint, and we verify using: $ test "$(openssl base64 -d -in signed_fingerprint | openssl rsautl \ -pubin -verify -inkey pubkey)" = "$((echo -n "salt "; cat \ fingerprint) | openssl dgst -sha256)"; echo $? In addition, again, we confirm the fingerprint in the fingerprint file matches the fingerprint of the qualifying relay. ------------------------------------------------------------ Originally I used a few bashisms which made these simpler, but for this I suspect portability is important. Sorry this is a bit long. Thanks, Matt

11 19

Enabling obfs4 and obfs3 on 80 and 443
by R-one 05 May '15

05 May '15

I have recently set up a bridge and was reading some old emails on the list. I found some instructions from s7r on setting up obfs4 and obfs3: > Sample torrc entry for enabling obfs4 and obfs3: > ExtORPort auto > ServerTransportPlugin obfs3,obfs4 exec /usr/bin/obfs4proxy > ServerTransportListenAddr obfs3 [::]:port > ServerTransportListenAddr obfs4 [::]:port > > To make the bridge even better, you can bind obfs3 and obfs4 to lower > ports (< 1024), if you have them free, such as obfs3 on 80 and obfs4 > on 443 (for example). This seemed like a good idea (I am not running a web server). I am running tor 0.2.4.27, which does not seem to support ExtORPort. From some other recommended bridge setup I had previously set ORPort to 443. I tried changing my config to: ORPort auto ServerTransportListenAddr obfs3 0.0.0.0:80 ServerTransportListenAddr obfs4 0.0.0.0:443 (and doing the capabilities stuff, of course). This didn't work -- obfs4 complained that 443 was in use (is that because I had previously set it for ORPort?). So, for now, I have set obfs4 to a random high port. I will admit to being pretty confused about the recommended bridge setting for ORPort and the obfs ports (and what ExtORPort does differently). Does anyone have a recommendation for what I should do? Do I need to upgrade to tor 0.2.5?

2 1

Tor Relays Network Survey
by Zoe White 04 May '15

04 May '15

Hello everyone, I am doing a research project called “Understanding Anonymous Network” conducted at the University of Illinois at Urbana-Champaign. The purpose of this project is to investigate what motivates people to participate in Tor project and to run the relay nodes. We also want to know what obstacles may hinder people to run relay(s). Our aim is to increase people’s participation in Tor network through understanding motivation. Your participation will help us have a better understanding about this issue. This survey will take approximately 15 minutes of your time. If you run Tor nodes and are willing to participate in this research project, please click the following link and start the survey! *https://uiuc.qualtrics.com/SE/?SID=SV_9GkkX5zGEkjQhx3* <https://uiuc.qualtrics.com/SE/?SID=SV_9GkkX5zGEkjQhx3> Thank you very much!!

4 6

Re: [tor-relays] T-shirts and Confirming Relay Control
by teor 04 May '15

04 May '15

> Date: Mon, 04 May 2015 13:06:51 +0200 > From: Markus Hitter <mah(a)jump-ing.de> … > > The more demanding part of this is to collect the addresses, especially the software to do so. An application which formats them ready for printing, calculates the stamp required, perhaps also prints some customs stickers depending on destination. Here volunteers can easily help and there's no need to hide such discussions, because such software doesn't require the real data, can be written/tested with dummy data instead. All the trusted person (you) has to do is to run this software on the real data and hit the "print" button. Your post office or shipping company might have software like this already - and if it's done using their software, getting the stamps and stickers right is their responsibility, not yours. Of course, this software might not be free, in either sense of the word. teor teor2345 at gmail dot com pgp 0xABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR D5BE4EC2 255D7585 F3874930 DB130265 7C9EBBC7

2 1

Determining geographical locations for a new exit relay would help most
by Seth 04 May '15

04 May '15

I'm standing up a new exit relay on the VULTR network. How would a person go about determining which location is in most need of additional exit relay capacity? Available locations: https://www.vultr.com/locations/ * Miami, Florida * Chicago, Illinois * New York / New Jersey * Dallas, Texas * Seattle, Washington * Atlanta, Georgia * Los Angeles, California * Silicon Valley, California * (AU) Sydney, Australia * (Asia) Tokyo, Japan * (EU) Amsterdam, NL * (EU) London, UK * (EU) Paris, France * (EU) Frankfurt, DE Also, curious to hear people's thoughts on any potential jurisdictional arbitrage benefits to be gleaned by choosing a location other than ones country of residence or citizenship. For the sake of argument, consider a VULTR account opened by U.S. citizen residing in the U.S. Choopa LLC (VULTR parent company) is also a US based company. http://start.cortera.com/company/research/k5o8lvm2j/choopa-llc/

4 12

Why can't I see authorities bandwith stats
by Dedalo 04 May '15

04 May '15

Hi, I was making some changes in my relay configuration and I made some queries in GLOBE and ATLAS and something happened. I noticed that all authorities are not showing bandwidth stats from the last week and I was wondering why. Regards, Dedalo. -- twitter: @SeguridadBlanca Github: Dedal0 Blog: https://blog.dedalo.in

2 1

Re: [tor-relays] T-shirts and Confirming Relay Control
by JovianMallard 04 May '15

04 May '15

Matt, Inspired by the options to confirm domain ownership with Google, Could you ask the relay operator to include a randomly generated (by you) token in their contact field? It may take a while to propagate and it requires action on the operator's part, but it's not difficult and I expect it provides the assurance you need. > On 05/03/2015 04:20 PM, Matthew Finkel wrote: >> On Sun, May 03, 2015 at 12:05:49PM -0700, Aaron Hopkins wrote: >>> On Sun, 3 May 2015, Matthew Finkel wrote: > >>> Or as Robert suggests, just send verification mail to the listed contact >>> address of the relay. If they don't list one on their config, find an >>> alternate verification mechanism like e-mailing whois contacts for the IP or >>> domain name, or refuse the request. >> >> I'd prefer not denying them a t-shirt because they don't want to publish >> an email address publically, but using whois seems like a stretch and >> usually ends at the hosting provider instead of the operator. >

2 1

Re: [tor-relays] T-shirts and Confirming Relay Control
by teor 03 May '15

03 May '15

> Date: Sun, 3 May 2015 17:44:39 +0000 > From: Matthew Finkel <Matthew.Finkel(a)gmail.com> > … > > Another disadvantage of this is PSS wasn't implemented in openssl's > apps until 1.0.1. I wonder how many relays are running on servers which > are still using openssl 0.9.8 (and 1.0.0?). For these servers we can > fallback on pkcs#1 v1.5 signatures. OS X still ships with OpenSSL 0.9.8 by default. But Darwin is such a small fraction of the network, and it's less likely that a Darwin server would push enough data to get a t-shirt unless it had an OpenSSL version with aes-ni. teor teor2345 at gmail dot com pgp 0xABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR D5BE4EC2 255D7585 F3874930 DB130265 7C9EBBC7

1 0

Drop in relay count
by Linus Nordberg 03 May '15

03 May '15

Hi, Looking at the graphs showing the number of relays in the network it seems like we've lost about 500 (-7%) relays since the beginning of this year. https://metrics.torproject.org/networksize.html?graph=networksize&start=201… https://metrics.torproject.org/networksize.html?graph=networksize&start=201… Looking at the graphs showing the total relay bandwidth of the network it seems like the advertised bandwidth has increased with about 25 Mbps (+23%). https://metrics.torproject.org/bandwidth.html?graph=bandwidth&start=2015-01… https://metrics.torproject.org/bandwidth.html?graph=bandwidth&start=2012-01… Seems a bit contradictory at first sight. A guess would be that a lower number of fast relays have replaced a higher number of slow ones but I haven't looked into it more. Anyone who's looked into this? And can back up their theory with some numbers. Thanks, Linus

4 5

Re: [tor-relays] tor-relays Digest, Vol 52, Issue 1
by aredocilla＠gmail.com 02 May '15

02 May '15

> Date: Sat, 2 May 2015 15:52:07 +0800 > From: Geo Rift <tim.cochrane.laptop(a)gmail.com> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Determining geographical locations for a new > exit relay would help most > Message-ID: > <CAO3ZnMfdf9Q6FUHXhZtYAy1orS607DA_SYDuQi08p9Z7YKJVgQ(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > I would love to see some more nodes in Australia. I'm located in Perth > and the speed of the network it horrible. Not usable for day to day > internet which is unfortunate, hopefully it will pick up soon. Unless you've been really messing with your configuration, you're likely to end up hopping out of your home country at least once per circuit anyway. And if the network is slow, you'd want your traffic to get out of there as soon as possible; no/little sense adding a relay in a slow network area. Exit relay positioning is more dependent on filtering and network diversity rather than geographical proximity; I can only see that being helpful for guard relays. That said, if we're low on Australian relays it'd be good to get more there. I believe both UK and Australia keep bouncing around ideas for legally-required net filtering; that's the only thing I'd keep in mind other than speed when choosing between them. -- PGP key available on request

1 0

Effectively donating bandwidth
by Curtis Gagliardi 29 Apr '15

29 Apr '15

I'm running a relay with the extra bandwidth on my VPS, but I'm unsure if it's optimally configured. I have 2.5TB of bandwidth I want to use every month. Given that, how do I configure my relay in the most helpful way? The docs mention dividing my bandwidth by 30 and setting an accounting max of 1 day. It also suggests "You might also consider rate limiting to spread your usefulness over more of the day". What not use an accouting period of a month and spread it out over the full month? Spreading it out feels like the right thing to do, but is it actually the most helpful? Maybe burning my bandwidth is faster bursts is more helpful. If spreading it over the month using a low bandwidth rate and a monthly accounting period is ideal, is there a better way to configure it than busting out a calculator and coverting TB/month to KB/s? How should I determine my BandwidthBurstRate? I understand what it is, but should it be defined in relation to my bandwidth rate? Thanks in advance, Curtis Gagliardi

2 2

Re: [tor-relays] running multiple bridges on one machine?
by teor 29 Apr '15

29 Apr '15

> On 29 Apr 2015, at 22:00 , tor-relays-request(a)lists.torproject.org wrote: > > Date: Tue, 28 Apr 2015 17:45:44 +0200 > From: yl <tor(a)yl.ms> > > Am 28.04.2015 um 03:30 schrieb syndikal: >> let's begin: is it possible to run 5 bridges on one low-end VPS? each >> bridge would be hosted on a different IP address from five different /24 >> IP blocks, so that's not an issue. would i have to use multiple Tor >> processes, and would 5 processes be too much for a 2-core VPS with >> 256mb memory? >> >> also, how much bandwidth does a bridge normally burn through per month? >> on said VPS, the economical choice is to provide 200gb bandwidth per >> month. if that is not sufficient, the offer isn't financially feasible. > > I run a tor relay on some Atom processor, the bottleneck is the missing > AES-NI I think, however on 100MBit/s it only makes 35MBit/s with one CPU > core being loaded 100% and the other 3 at ~10%. My relay makes a few > TB/month like that, so I guess it is still good to keep it running. yl, have you tried running a second tor instance on another pair of ports? (onion / directory) The second instance would be able to use another of the processors on your multiprocessor machine. (Unfortunately, tor multithreading only offloads some of the work.) There is currently a limit of two instances per IP address, but if you have 2 IP addresses, you could potentially run 4 instances, one instance per processor. teor teor2345 at gmail dot com pgp 0xABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR D5BE4EC2 255D7585 F3874930 DB130265 7C9EBBC7

1 0

running multiple bridges on one machine?
by syndikal 28 Apr '15

28 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 hello relay operators! i've asked this question on IRC once or twice, but it seems the right people aren't online/active when i am. i think i might be able to get a better audience to answer my questions here on the mailing lists. let's begin: is it possible to run 5 bridges on one low-end VPS? each bridge would be hosted on a different IP address from five different /24 IP blocks, so that's not an issue. would i have to use multiple Tor processes, and would 5 processes be too much for a 2-core VPS with 256mb memory? also, how much bandwidth does a bridge normally burn through per month? on said VPS, the economical choice is to provide 200gb bandwidth per month. if that is not sufficient, the offer isn't financially feasible. thanks for all you do! - -- @syndikal A9FF 2FE3 A171 FE53 AEC3 A0F9 72B5 44E0 4417 11B2 twitter.com/syndikal -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVPuKmAAoJEHK1ROBEFxGyfUQP/irH1HzKPCe+t9TFSMignsRq oX5tK6YfInQ7vmfdhpPyHodM6DneeC1uBVdY6+qyJ6g3Ef5JXblSua+2zqJe8mlI rlwL9ll+i4tYSquqpaht3dWU1xY/UoqnlwCSO8+xaCz0zYBmOafib1MHI8nCDblp Y1PXMVWs3nhaXP/ev8JS3y8HuVeVy03lRF8pAaxKJmFI5YZJpNqHO/gVXTwU0O6M OrlqPT/YPmN/cD00TrnT5k+dVEHIPzEt7vK20NlUfCTS7vLOZync+jwRBYPzS6es fFq7C/gTP3oxyx6RIGLXpHEtKmvUwQeC89GKrgrDfb0EynX7bZ+jcvzXBCq5TPFz rgz19ogAbDZ167FshkVhMc+twfhkaq1FN2ADIHF7iIFLd6z93Img3IVMk+i2nijy lb4CtfHFqhJKSxuAfUYVFHx5GnC2u37gOCKdF+ZOCtpOAyP7ozrSwVYLY+OjsPf2 7F9dq22x8QxOdSccyK4lrmyl0SZpliMDCIoJk4IvJT2elqStntwH/Ecur2I48mWv UvPcwUEbsUhZg/u3xDkuvhB5zcVYB01gqbFSr8N7nYgMgx9Ww7lVVMmj+2ADQS9e ttOHmck50ewjz/EVN/xbWcemdGyiNl1M0aPyoysWgn/8TZ12TLhAL1jgJxOJFE99 7K8kTak9an5FOf+RbpY6 =eeGb -----END PGP SIGNATURE-----

4 3

Re: [tor-relays] Tor Cloud/AWS relay set up but no Tor installed
by aredocilla＠gmail.com 27 Apr '15

27 Apr '15

Hi there, After a long month of not having time for this, I've got it working thanks to Sina's help. I've attached patches to the ec2-prep.sh script that should make it work again (nothing extensive, basically just what Sina pointed out plus something about ExtORPort I saw it complaining about in the log. Bridge is now up. :) Best wishes, allicoder On Sun, Mar 22, 2015 at 10:51:42AM +0000, tor-relays-request(a)lists.torproject.org wrote: > Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > > > Today's Topics: > > 1. Re: IPv6 HiddenServicePort (teor) > 2. Tor Cloud/AWS relay set up but no Tor installed > (aredocilla(a)gmail.com) > 3. Re: Tor Cloud/AWS relay set up but no Tor installed (SiNA Rabbani) > 4. Tor-Tshirts (Nchinda Nchinda) > 5. Re: Tor-Tshirts (Roger Dingledine) > > Message: 2 > Date: Sun, 22 Mar 2015 03:10:53 +0000 > From: aredocilla(a)gmail.com > To: tor-relays(a)lists.torproject.org > Subject: [tor-relays] Tor Cloud/AWS relay set up but no Tor installed > Message-ID: <20150322031053.GB5948@MadHatter> > Content-Type: text/plain; charset=us-ascii > > Hello, > > I've been trying to set up a tor relay on AWS using the free tier using the > instructions in various places (e.g. https://cloud.torproject.org/, > https://www.fak3r.com/2012/08/11/howto-run-a-tor-node-in-the-cloud-for-free/) > But sshing in from my PC shows clearly that not only is tor not running, it's > not even installed! > > ubuntu@ip-172-31-28-207:~$ aptitude show tor > Package: tor > State: not installed > Version: 0.2.5.11-1~precise+1 > Priority: optional > Section: net > ... > > ubuntu@ip-172-31-28-207:~$ ps -ely | grep tor > ubuntu@ip-172-31-28-207:~$ ls /var/log > alternatives.log auth.log btmp dist-upgrade dmesg.0 dmesg.2.gz fsck landscape mail.err news udev unattended-upgrades wtmp > apt boot.log cloud-init.log dmesg dmesg.1.gz dpkg.log kern.log lastlog mail.log syslog ufw.log upstart > > Has something changed, and the images no longer include tor on start-up (I made > sure I followed the gist of the cloud.torproject.org steps, given that the > interface has changed significantly; even went to the previous page from the > linked one to check that the AMI thing mentioned tor)? I've noticed various > people have posted online saying it's not safe to run Tor on cloud services - > has the image been deleted because of this? I wanted to try it anyway because > the main torproject website still says in several places that running a relay > on AWS is A Good Thing. > > Or did I just do something wrong? > > Best wishes, > allicoder. > > -- > PGP key available on request > > > ------------------------------ > > Message: 3 > Date: Sun, 22 Mar 2015 04:52:34 +0000 (UTC) > From: SiNA Rabbani <sina(a)redteam.net> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Tor Cloud/AWS relay set up but no Tor > installed > Message-ID: > <1101716784.98280.1426999954497.JavaMail.zimbra(a)redteam.net> > Content-Type: text/plain; charset=utf-8 > > Hi allicoder, > > The images on Tor Cloud website have not been updated for a while. The project is lacking someone > that can keep it up to date. I tried to take on the responsibility but so far I have failed to dedicate > the necessary time. Sorry for the bad experience. > > As far as the specific problem with the Cloud image itself, there is a script that is supposed to install the relay > on first boot. See /etc/rc.local. > > You can also find that script here: https://gitweb.torproject.org/tor-cloud.git/plain/ec2-prep.sh > > There are a couple of issues with the script itself that I noticed immediately: > 1) the harcoded pgp key is expired > 2) the debian experimental repository is returning a 404 > W: Failed to fetch http://deb.torproject.org/torproject.org/dists/experimental-precise/main/bi… 404 Not Found [IP: 38.229.72.16 80] > > If you wish to do some trouble-shooting, try to get these commands to run without any errors: > sudo apt-get -y update > sudo apt-get -y upgrade > sudo bash /etc/ec2-prep.sh bridge > > Finally, now that you have a running image and ssh access, you can just follow the Tor relay installations here: > https://www.torproject.org/docs/debian.html.en > > I apologize for the inconvenience and thank you for running a relay. > > All the best, > Sina > > > > > "Be the change that you wish to see in the world." - Mahatma Gandhi > > ----- On Mar 21, 2015, at 11:10 PM, aredocilla(a)gmail.com wrote: > > > Hello, > > > > I've been trying to set up a tor relay on AWS using the free tier using the > > instructions in various places (e.g. https://cloud.torproject.org/, > > https://www.fak3r.com/2012/08/11/howto-run-a-tor-node-in-the-cloud-for-free/) > > But sshing in from my PC shows clearly that not only is tor not running, it's > > not even installed! > > > > ubuntu@ip-172-31-28-207:~$ aptitude show tor > > Package: tor > > State: not installed > > Version: 0.2.5.11-1~precise+1 > > Priority: optional > > Section: net > > ... > > > > ubuntu@ip-172-31-28-207:~$ ps -ely | grep tor > > ubuntu@ip-172-31-28-207:~$ ls /var/log > > alternatives.log auth.log btmp dist-upgrade dmesg.0 dmesg.2.gz > > fsck landscape mail.err news udev unattended-upgrades wtmp > > apt boot.log cloud-init.log dmesg dmesg.1.gz dpkg.log > > kern.log lastlog mail.log syslog ufw.log upstart > > > > Has something changed, and the images no longer include tor on start-up (I made > > sure I followed the gist of the cloud.torproject.org steps, given that the > > interface has changed significantly; even went to the previous page from the > > linked one to check that the AMI thing mentioned tor)? I've noticed various > > people have posted online saying it's not safe to run Tor on cloud services - > > has the image been deleted because of this? I wanted to try it anyway because > > the main torproject website still says in several places that running a relay > > on AWS is A Good Thing. > > > > Or did I just do something wrong? > > > > Best wishes, > > allicoder. > > > > -- > > PGP key available on request > > _______________________________________________ > > tor-relays mailing list > > tor-relays(a)lists.torproject.org > > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > ------------------------------ > > End of tor-relays Digest, Vol 50, Issue 31 > ****************************************** -- PGP key available on request

1 0

Installing obfs4 on Raspberry Pi bridge
by jchase 25 Apr '15

25 Apr '15

Hello, Thanks, everyone, for all the help. Obfs4proxy is up and running on a Pi2. Although the information on the subject is scattered across several issues on this list, I hope others can use it to build some bridges! http://www.zipplet.co.uk/index.php/content/raspberrypi_golang was a useful page on getting go 1.2 or higher installed on a Pi2. Thanks again, J Chase > Message: 1 > Date: Thu, 23 Apr 2015 20:42:42 +0000 > From: Yawning Angel <yawning(a)schwanenlied.me> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Installing obfs4 on Raspberry Pi bridge > Message-ID: <20150423204242.65bed2f9(a)schwanenlied.me> > Content-Type: text/plain; charset="us-ascii" > > On Thu, 23 Apr 2015 19:53:55 +0000 > jchase <jchase(a)riseup.net> wrote: >> Hello, >> When I run >> >> $ go get git.torproject.org/pluggable-transports/obfs4.git/obfs4proxy >> $ sudo cp $GOPATH/bin/obfs4proxy /usr/local/bin >> >> on a laptop running linuxmint/ubuntu it produces a nice binary >> executable. Unfortunately it doesn't work to copy it to the Pi2, >> because it's not an ARM binary. >> When I run the same script on the Pi2 I get the following error >> messages: >> >> go get git.torproject.org/pluggable-transports/obfs4.git/obfs4proxy >> # git.torproject.org/pluggable-transports/obfs4.git/common/ntor >> /usr/lib/go/src/pkg/git.torproject.org/pluggable-transports/obfs4.git/common/ntor/ntor.go:272: >> undefined: sha256.Sum256 >> >> [snip] >> >> Any idea how I can get it cleanly on a Pi2? > > This is covered in the README.md: >> * Go 1.2.0 or later. Prior versions of Go (Eg: 1.0.2) are missing >> certain important parts of the runtime library like a SHA256 >> implementation. > > Go 1.2 was released on December 1, 2013, so I'm not particularly > inclined to support older versions, especially since it means > re-implementing parts of the standard runtime library. > > Regards, >

1 0

Subpoena received
by Tyler Durden 24 Apr '15

24 Apr '15

Hi I just wanted to let you know that Washington sent us a subpoena regarding one of our exit nodes in Romania. They want to know the real IP behind the Tor Network. I mailed them what Tor is and why I can't help them in identifying this person. Nevertheless I will give you the link to the full subpoena. Maybe you guys find it interesting. I will forward the subpoena to our lawyer as well. https://mega.co.nz/#!ilIjlZSb!-deirKharWaDtp_UMxhev58E14zeouyoWUbzxeWPvEQ Greetings -- Sam Grüneisen - President Frënn vun der Ënn A.S.B.L. enn.lu

16 28

Relay Consensus Weight
by Marco Morgia 24 Apr '15

24 Apr '15

Hello, on friday my realay's Consensus Weight felt down suddenly to 20 and the its bandwidth is not used anymore (https://atlas.torproject.org/#details/94212674A2C6AEBF77354D959D464E49BC878…) I don't understand why, as nothing is changed in its configuration. And, I don't know if it's related, but I noticed that the tor network has slow down in the last days and some times it's very difficult to use it. Thanks for your help, Marco ____________________________________________________________ Receive Notifications of Incoming Messages Easily monitor multiple email accounts & access them with a click. Visit http://www.inbox.com/notifier and check it out!

3 11

Re: [tor-relays] Installing obfs4 on Raspberry Pi bridge
by jchase 23 Apr '15

23 Apr '15

Hello, When I run $ go get git.torproject.org/pluggable-transports/obfs4.git/obfs4proxy $ sudo cp $GOPATH/bin/obfs4proxy /usr/local/bin on a laptop running linuxmint/ubuntu it produces a nice binary executable. Unfortunately it doesn't work to copy it to the Pi2, because it's not an ARM binary. When I run the same script on the Pi2 I get the following error messages: go get git.torproject.org/pluggable-transports/obfs4.git/obfs4proxy # git.torproject.org/pluggable-transports/obfs4.git/common/ntor /usr/lib/go/src/pkg/git.torproject.org/pluggable-transports/obfs4.git/common/ntor/ntor.go:272: undefined: sha256.Sum256 /usr/lib/go/src/pkg/git.torproject.org/pluggable-transports/obfs4.git/common/ntor/ntor.go:369: undefined: hmac.Equal # git.torproject.org/pluggable-transports/obfs4.git/common/log /usr/lib/go/src/pkg/git.torproject.org/pluggable-transports/obfs4.git/common/log/log.go:131: function ends without a return statement # git.torproject.org/pluggable-transports/obfs4.git/transports/obfs3 /usr/lib/go/src/pkg/git.torproject.org/pluggable-transports/obfs4.git/transports/obfs3/obfs3.go:278: function ends without a return statement # git.torproject.org/pluggable-transports/obfs4.git/transports/scramblesuit /usr/lib/go/src/pkg/git.torproject.org/pluggable-transports/obfs4.git/transports/scramblesuit/conn.go:322: undefined: hmac.Equal /usr/lib/go/src/pkg/git.torproject.org/pluggable-transports/obfs4.git/transports/scramblesuit/handshake_uniformdh.go:143: undefined: hmac.Equal /usr/lib/go/src/pkg/git.torproject.org/pluggable-transports/obfs4.git/transports/scramblesuit/handshake_uniformdh.go:152: undefined: sha256.Sum256 and the script exits Any idea how I can get it cleanly on a Pi2? Thanks, J. Chase tor-relays-request(a)lists.torproject.org: > Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > > > Today's Topics: > > 1. Re: Installing obfs4 on Raspberry Pi bridge (jchase) > 2. Re: Installing obfs4 on Raspberry Pi bridge (Yawning Angel) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 12 Apr 2015 17:43:55 +0000 > From: jchase <jchase(a)riseup.net> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Installing obfs4 on Raspberry Pi bridge > Message-ID: <552AAEDB.4020007(a)riseup.net> > Content-Type: text/plain; charset=windows-1252 > > Hello, > Thanks to you I have tor 0.2.5.11 running on a Raspberry Pi2 and obfs4 > installed from git. I have good news and bad news. > The largest problem is that I get the warning "could not launch managed > proxy executable at '/path/obfs4proxy'('Permission denied')" In the past > this used to be a problem with apparmor, but apparmor isn't installed. > Any idea where I can start looking for a solution? > Here are a couple of details and small problems: > I didn't install obfs4 directly (due to problems), but installed it to > another laptop and copied it to the Pi2 using scp. > I have ORPort somewhere above 9000. When I set it to auto, I got a late > warning that the port chosen by tor was presenting problems, had I > arranged port forwarding, etc.? ExtORPort is "auto" and I get no > complaints (probably because obfs4 isn't working). > And I have ServerTransportListenAddr obfs3 0.0.0.0:90xx because a lower > port, like 80, with port forwarding, received a warning (and didn't work). > One thing at a time... Like I asked, where can I look for answers to the > obfs4proxy permission denied problem? If I get that fixed, I assume I > can play around with the rest until I can use lower ports. > Thanks, > J Chase > > > ------------------------------ > > Message: 2 > Date: Sun, 12 Apr 2015 20:14:33 +0000 > From: Yawning Angel <yawning(a)schwanenlied.me> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Installing obfs4 on Raspberry Pi bridge > Message-ID: <20150412201433.6c42f28d(a)schwanenlied.me> > Content-Type: text/plain; charset="us-ascii" > > On Sun, 12 Apr 2015 17:43:55 +0000 > jchase <jchase(a)riseup.net> wrote: >> Hello, >> Thanks to you I have tor 0.2.5.11 running on a Raspberry Pi2 and obfs4 >> installed from git. I have good news and bad news. >> The largest problem is that I get the warning "could not launch >> managed proxy executable at '/path/obfs4proxy'('Permission denied')" >> In the past this used to be a problem with apparmor, but apparmor >> isn't installed. Any idea where I can start looking for a solution? >> Here are a couple of details and small problems: >> I didn't install obfs4 directly (due to problems), but installed it to >> another laptop and copied it to the Pi2 using scp. > > Oh dear. What happens when you run the obfs4proxy executable in a > shell directly (on the pi2)? > > It should look something like: > $ ./obfs4proxy > 2015/04/12 20:13:02 [ERROR]: obfs4proxy - must be run as a managed > transport > > If not, what does 'file /path/obfs4proxy' say? > > Regards, >

2 1