- tor-relays - lists.torproject.org

Any t-shirts being sent?
by I 23 Apr '15

23 Apr '15

2 1

Delete keys on reboot
by CJ Barlow 23 Apr '15

23 Apr '15

The Tor Relay Security document suggests deleting keys upon reboot to prevent one-time key theft. I have tried to do this in Raspbian via cron but have been unsuccessful. The cronjob I have running is: @reboot rm -f /var/lib/tor/keys/* && echo "keys gone!" > /home/[me]/reboot.txt 2>&1 I have the echo as a debugger. When I changed /var/lib/tor/keys/* to /home/[me]/test/* the job runs successfully. When changing it back to /var/lib/tor/keys/* it does not. Is this something I should resolve? If so, is there something with my cronjob that's preventing it from working?

4 6

Re: [tor-relays] tor-relays Digest, Vol 51, Issue 27
by Rekha Tokas 23 Apr '15

23 Apr '15

Can I get the list of those sites which are blocking tor traffic to view or edit their page? On 23 Apr 2015 17:30, <tor-relays-request(a)lists.torproject.org> wrote: > Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > > > Today's Topics: > > 1. Re: Subpoena received (Jan GUTH) > 2. Re: Subpoena received (Jan GUTH) > 3. Re: Subpoena received (Brian Kroll) > 4. Re: Subpoena received (renke(a)mobtm.com) > 5. Re: Quantum Insert detection for everyone (tor(a)t-3.net) > 6. Re: Subpoena received (Moritz Bartl) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 23 Apr 2015 10:15:32 +0200 > From: Jan GUTH <prometheus(a)enn.lu> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Subpoena received > Message-ID: <5538AA24.3040802(a)enn.lu> > Content-Type: text/plain; charset=utf-8 > > On 20/04/15 16:32, Tyler Durden wrote: > > Hi > > I just wanted to let you know that Washington sent us a subpoena > > regarding one of our exit nodes in Romania. They want to know the real > > IP behind the Tor Network. I mailed them what Tor is and why I can't > > help them in identifying this person. Nevertheless I will give you the > > link to the full subpoena. Maybe you guys find it interesting. I will > > forward the subpoena to our lawyer as well. > > > > > > > https://mega.co.nz/#!ilIjlZSb!-deirKharWaDtp_UMxhev58E14zeouyoWUbzxeWPvEQ > > Good morning list, > > I just called up Alistar and explained the entire situation. They IT > guys know what Tor is and their company is strongly interested in > continuing supporting Tor. They are a partner company now of Voxility, > and the apparently while moving some clients, someone did forget to tell > them that they'll get a client running Tor exit nodes. > > They are simply overchallenged with this request as it is the very first > one they have ever received. > > The good news is, that they will _not_ shutdown our server, nor take any > logs, which are non-existant. The counterpart we need to contribute is a > letter by our lawyer and favorably a letter from EFF or some other > bigger organization guaranteeing Tor is what it is and we as client do > not try to fool them. > > This is a request from the administration level of the company, not the > tech guys - as always. > > So, I'll get in touch with our lawyer & with EFF. Is there anyone else > within EU, whom could certify them what Tor is and what it is capable of > and what not? Moritz? > > Cheers, > J. > > -- > Jan GUTH > International Coordinator > > Fr?nn vun der ?nn A.S.B.L. (NGO) > e. info(a)enn.lu (GPG: 0x02225522) > t. +352?691?71?77?44 > w. http://enn.lu/ > > > ------------------------------ > > Message: 2 > Date: Thu, 23 Apr 2015 10:20:10 +0200 > From: Jan GUTH <prometheus(a)enn.lu> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Subpoena received > Message-ID: <5538AB3A.2050701(a)enn.lu> > Content-Type: text/plain; charset=utf-8 > > On 20/04/15 16:32, Tyler Durden wrote: > > Hi > > I just wanted to let you know that Washington sent us a subpoena > > regarding one of our exit nodes in Romania. They want to know the real > > IP behind the Tor Network. I mailed them what Tor is and why I can't > > help them in identifying this person. Nevertheless I will give you the > > link to the full subpoena. Maybe you guys find it interesting. I will > > forward the subpoena to our lawyer as well. > > > > > > > https://mega.co.nz/#!ilIjlZSb!-deirKharWaDtp_UMxhev58E14zeouyoWUbzxeWPvEQ > > Good morning list, > > I just called up Alistar and explained the entire situation. They IT > guys know what Tor is and their company is strongly interested in > continuing supporting Tor. They are a partner company now of Voxility, > and the apparently while moving some clients, someone did forget to tell > them that they'll get a client running Tor exit nodes. > > They are simply overchallenged with this request as it is the very first > one they have ever received. > > The good news is, that they will _not_ shutdown our server, nor take any > logs, which are non-existant. The counterpart we need to contribute is a > letter by our lawyer and favorably a letter from EFF or some other > bigger organization guaranteeing Tor is what it is and we as client do > not try to fool them. > > This is a request from the administration level of the company, not the > tech guys - as always. > > So, I'll get in touch with our lawyer & with EFF. Is there anyone else > within EU, whom could certify them what Tor is and what it is capable of > and what not? Moritz? > > Cheers, > J. > > -- > Jan GUTH > International Coordinator > > Fr?nn vun der ?nn A.S.B.L. (NGO) > e. info(a)enn.lu (GPG: 0x02225522) > t. +352?691?71?77?44 > w. http://enn.lu/ > > > ------------------------------ > > Message: 3 > Date: Thu, 23 Apr 2015 08:29:45 +0000 > From: Brian Kroll <brian(a)fiberoverethernet.com> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Subpoena received > Message-ID: <5538AD79.3060902(a)fiberoverethernet.com> > Content-Type: text/plain; charset=windows-1252 > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA512 > > > Zack Weinberg: > > On Mon, Apr 20, 2015 at 10:32 AM, Tyler Durden <virii(a)enn.lu> > > wrote: > >> I just wanted to let you know that Washington sent us a subpoena > >> regarding one of our exit nodes in Romania > > > > Just FYI, "Washington" doesn't appear to have anything to do with > > this. The subpoena is on the letterhead of an office of Cook > > County, Illinois, which is the locality containing the city of > > Chicago. Per > > http://www.cookcountyil.gov/office-of-the-independent-inspector-general/ > > > > > this office investigates misconduct by county officials. > > > > This matters because, first, this is probably a tiny little outfit > > with little or no clue about either the Internet or international > > law. > > As a resident of Cook Country I can safely say it's not a small > locality, but I'm sure their knowledge about international law is > quite low. > > > They *should have* hired an international lawyer when they saw > > they'd need to talk to someone operating out of Romania and/or > > Luxembourg, but it doesn't surprise me in the slightest that they > > didn't. > > > And they've probably never even heard of Tor before. > > I know the Chicago Police claim they don't know what Tor is. > > http://www.muckrock.com/foi/chicago-169/chicago-police-use-of-tor-15392/ > > > Second, the incident which triggered the investigation, whatever it > > is, is probably quite minor. (This is backed up by their asking > > for one IP address active at a single point in time.) It would > > have been booted up to the state or federal level if it were any > > kind of serious. For both those reasons, I would rate the odds of > > them actually bothering to jump through all the necessary legal > > hoops to get a court order binding on a foreign national as slim to > > none. > > > ATB > //Brian > -----BEGIN PGP SIGNATURE----- > > iQIcBAEBCgAGBQJVOK1xAAoJEFjBjkteF9VaV2EP/3OrGZqHMdqWccR0Qkrt80rc > vw9RgIAtnhUfZVLlt8Y/RNhpSUOwrBf2gFxcc48zN3/Llad1ybF1PDFQym516ntK > RLRmGDf945qRxTsApXCN9WjRD0iMqyfQuq/NddTYKCMeMZadYW9MoUNe3md8wwKg > feeYNpCRmrTTh1Q7gRKYa4dRS6jLrNqNv5o/pL3jp5OlX8nLz+LyJxNVopZ2khAq > T4B51NOD0D5rLJ8cEQf528dmAM6QipUvtY3r5mVqb7VRO5NJuAxsRCnql6qTi68h > FIeLRZh44miY/vOS//dPlSFyb/h3ECVGCMH3ngtaJ5LLkAUXXWc8XYiEeDFyUrxg > O5/pUy9uo4ZRz9UXU7ZEpsttw2Gs1GDc7bRRrL4aHp8OGr+85p493aBqyixmr16d > Wz2lUdVioVBO5sj7rG+QXSc5b4Wp1/jKOWszKUNjX02AMnpe21idQrS0qn9kzSNP > Gsi8XyFP/08m+n2weTZ9W000uznjMCKWvWlOfJtTyo9oB23cZ7g/4Rs1j4wQR4W4 > 8/iuQFwjx3OipdxjzP4g3HwYLYeFT5DECVEzWtqx2LaIMI6ObTjDOnyO/PDIqzWA > YSK8hUqCKI6SqJE5l1kP4bzDsbQaY13nxoK0uVbW35h01FpHRIjyIXrFJorTqjrT > 8c3B2zNha+ogBOljvYtJ > =uUdm > -----END PGP SIGNATURE----- > > > ------------------------------ > > Message: 4 > Date: Thu, 23 Apr 2015 11:47:17 +0200 (CEST) > From: renke(a)mobtm.com > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Subpoena received > Message-ID: <20150423094717.382558A02B7(a)dd1818.kasserver.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Hi, > > > The counterpart we need to contribute is a > > letter by our lawyer and favorably a letter from EFF or some other > > bigger organization guaranteeing Tor is what it is and we as client do > > not try to fool them. > > as the US government sponsored (parts of) the Tor development - what about > giving them US military research papers about the Tor network? > > http://www.dtic.mil/dtic/tr/fulltext/u2/a465464.pdf is one of them, > co-authored by a Navy researcher and performed by the Naval Research > Laboratory. > > Not itself sufficient, but done by a bigger organisation w/o triggering > anarchist/commie/hacker/terroristsupporting/publicenemy bias reactions. > > Renke > > > ------------------------------ > > Message: 5 > Date: Thu, 23 Apr 2015 07:39:07 -0400 > From: tor(a)t-3.net > To: <tor-relays(a)lists.torproject.org> > Subject: Re: [tor-relays] Quantum Insert detection for everyone > Message-ID: <5538d9db.9d8.3c445700.6bd5299c(a)t-3.net> > Content-Type: text/plain; charset=us-ascii; format=flowed > > > On 04/23/2015 01:56 AM, David Stainton wrote: > > > It is possible to add a "prevention" mechanism to HoneyBadger; an > > event based firewall ruleset generator made to block TCP injection > > attacks as they are happening... yes. This is possible. I could > write > > that if there was interest from enough people. > > Gief. > > > > > > ------------------------------ > > Message: 6 > Date: Thu, 23 Apr 2015 13:57:32 +0200 > From: Moritz Bartl <moritz(a)torservers.net> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Subpoena received > Message-ID: <5538DE2C.3030200(a)torservers.net> > Content-Type: text/plain; charset=utf-8 > > On 04/23/2015 10:20 AM, Jan GUTH wrote: > > So, I'll get in touch with our lawyer & with EFF. Is there anyone else > > within EU, whom could certify them what Tor is and what it is capable of > > and what not? Moritz? > > Depends on what convinces them. :-) Sounds like it may make sense to get > a generic letter signed by all our partner organizations (which includes > Reporters without Borders, Institute of War & Peace Reporting, > Article19, and potentially other Human Rights Orgs) in the long run. > > I'm happy to write something as Torservers.net, in a way representing > all the current partner orgs. Then, we can send the letter around and > get it co-signed by all the partner orgs and other orgs. > > -- > Moritz Bartl > https://www.torservers.net/ > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > ------------------------------ > > End of tor-relays Digest, Vol 51, Issue 27 > ****************************************** >

1 0

Re: [tor-relays] Quantum Insert detection for everyone
by tor＠t-3.net 23 Apr '15

23 Apr '15

On 04/23/2015 01:56 AM, David Stainton wrote: > It is possible to add a "prevention" mechanism to HoneyBadger; an > event based firewall ruleset generator made to block TCP injection > attacks as they are happening... yes. This is possible. I could write > that if there was interest from enough people. Gief.

1 0

Quantum Insert detection for everyone
by David Stainton 22 Apr '15

22 Apr '15

Greetings, Did you all see this Wired article about Quantum Insert detection? https://www.wired.com/2015/04/researchers-uncover-method-detect-nsa-quantum… These TCP injection attacks are used by various entities around the world (not just NSA!) to target individuals for surveillance or perhaps to add their computers to a botnet for other purposes. If you do not use a VPN or Tor you can run "Quantum Insert" detection on your computer and detect when you receive an attack attempt. However be advised that proper sandboxing is important here because intrusion detection and protocol anylsis tools are notoriously insecure and get pwned all the time. If you are a Tor exit relay operator you have the options of running detection software; However you should not publish the results publicly without mixing in some noise or your published data might make it possible for some adversaries to deanonymize Tor users. If your country has strict telecommunications laws then it might only be legal for you to perform this type of detection if you do not perform logging. For the past several months... in my free time I've been slowly developing a very comprehensive TCP injection attack detection tool called HoneyBadger: https://github.com/david415/HoneyBadger Quantum Insert is a NSA codeword for "TCP injection attack", however either of these terms are too vague. During my research I was able to classify 4 different types of TCP injection attack. When I say that HoneytBadger is comprehensive what I mean is that Honeybadger can detect ALL of these types of TCP injection attack types... I describe them briefly here: https://honeybadger.readthedocs.org/en/latest/ Here's the Fox-IT blog post about their Quantum Insert detection software: http://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-insert/ I am going to work on writing a much more comprehensive blog post; it will be filled with gory technical details AND it will include information on how to use HoneyBadger. HoneyBadger has optional (off by default) full-take logging which could enable you to capture a zero-day payload from a TCP attack; you should then responsibly disclose to the software vendor or contact a malware analyst to help out! Sincerely, David Stainton

2 4

ARM stopped working
by Jeffrey Hathaway 22 Apr '15

22 Apr '15

Hello Everyone, I noticed ARM stopped working for me. Has anyone seen this before? Traceback (most recent call last): File "/usr/share/arm/starter.py", line 578, in <module> cli.controller.startTorMonitor(time.time() - initTime) File "/usr/share/arm/cli/controller.py", line 700, in startTorMonitor curses.wrapper(drawTorMonitor, startTime) File "/usr/lib/python2.7/curses/wrapper.py", line 43, in wrapper return func(stdscr, *args, **kwds) File "/usr/share/arm/cli/controller.py", line 720, in drawTorMonitor initController(stdscr, startTime) File "/usr/share/arm/cli/controller.py", line 86, in initController firstPagePanels.append(cli.logPanel.LogPanel(stdscr, expandedEvents, config)) File "/usr/share/arm/cli/logPanel.py", line 652, in __init__ self.reprepopulateEvents() File "/usr/share/arm/cli/logPanel.py", line 696, in reprepopulateEvents torEventBacklog = getLogFileEntries(setRunlevels, readLimit, addLimit, self._config) File "/usr/share/arm/cli/logPanel.py", line 313, in getLogFileEntries eventTimeComp = list(time.strptime(timestamp, "%Y %b %d %H:%M:%S")) File "/usr/lib/python2.7/_strptime.py", line 467, in _strptime_time return _strptime(data_string, format)[0] File "/usr/lib/python2.7/_strptime.py", line 325, in _strptime (data_string, format)) ValueError: time data '2012 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00Apr 22 15:23:48' does not match format '%Y %b %d %H:%M:%S'

3 2

Re: [tor-relays] [tor-talk] Quantum Insert detection for everyone
by Mike Perry 22 Apr '15

22 Apr '15

I'm being a jerk and cross-posting to tor-relays, because I want to make sure that relay operators are aware of the differences in the Snort vs HoneyBadger approach. Chris Dagdigian: > > I run a US-based exit node and would be interested in a way to run > this software without compromising the users exiting my node. > Looking forward to your additional writeups - especially anything > geared towards exit nodes and quantum insert detection. I too look forward to David's writeup! For what it's worth, I think HoneyBadger is likely to be safer for exits, more comprehensive, more accurate, less noisy, and more high performance than a Snort-based solution. HoneyBadger is focused only on this particular attack and is written in golang, whereas Snort has tons of rules for everything and is written in C. This means that HoneyBadger will have a much smaller vulnerability surface and should be much harder to directly exploit than Snort. Since we're talking about detecting and capturing attacks from well funded state/world-class adversaries here (wow, what a world), vulnerability surface minimization and general memory safety are top priority. Snort is also vulnerable to tailored attacks designed to flood its logs and/or avoid detection. Snort is particularly susceptible to missing stateful attacks designed to subvert its stateless rule-based approach to detection. Several types of TCP injection attacks that rely on TCP reassembly will likely fall into this category (type 4 in: https://honeybadger.readthedocs.org/en/latest/#tcp-injection-attacks) HoneyBadger also appears to have better logging options than the Snort rules. David has been in contact with malware researchers who were quite insistent that to properly analyze 0day, a single evilpacket is very likely to be insufficient -- context is essential, especially if the attacker wants to obfuscate the attack or otherwise avoid exploit extraction. Hence the need to provide optional full-take and rolling logging options that make it easier to extract the full TCP stream of a tampered connection, as well as related concurrent traffic (such as a stream from a related HTTP redirect to an ephemeral URL). I've been talking with David about ways to place these logs on a ramdisk or an ephemerally encrypted partition, so that when detailed logs are needed, they can be handled as safely as possible. > >David Stainton <mailto:dstainton415@gmail.com> > >April 22, 2015 at 2:41 PM > >Greetings, > > > >Did you all see this Wired article about Quantum Insert detection? > > > >https://www.wired.com/2015/04/researchers-uncover-method-detect-nsa-quantum… > > > >These TCP injection attacks are used by various entities around the > >world (not just NSA!) to target individuals for surveillance or > >perhaps to add their computers to a botnet for other purposes. > > > >If you do not use a VPN or Tor you can run "Quantum Insert" detection > >on your computer and detect when you receive an attack attempt. > >However be advised that proper sandboxing is important here because > >intrusion detection and protocol anylsis tools are notoriously > >insecure and get pwned all the time. > > > >If you are a Tor exit relay operator you have the options of running > >detection software; However you should not publish the results > >publicly without mixing in some noise or your published data might > >make it possible for some adversaries to deanonymize Tor users. If > >your country has strict telecommunications laws then it might only be > >legal for you to perform this type of detection if you do not perform > >logging. > > > >For the past several months... in my free time I've been slowly > >developing a very comprehensive TCP injection attack detection tool > >called HoneyBadger: > > > >https://github.com/david415/HoneyBadger > > > >Quantum Insert is a NSA codeword for "TCP injection attack", however > >either of these terms are too vague. During my research I was able to > >classify 4 different types of TCP injection attack. When I say that > >HoneytBadger is comprehensive what I mean is that Honeybadger can > >detect ALL of these types of TCP injection attack types... I describe > >them briefly here: > > > >https://honeybadger.readthedocs.org/en/latest/ > > > >Here's the Fox-IT blog post about their Quantum Insert detection software: > >http://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-insert/ > > > >I am going to work on writing a much more comprehensive blog post; it > >will be filled with gory technical details AND it will include > >information on how to use HoneyBadger. HoneyBadger has optional (off > >by default) full-take logging which could enable you to capture a > >zero-day payload from a TCP attack; you should then responsibly > >disclose to the software vendor or contact a malware analyst to help > >out! > > > > > >Sincerely, > > > >David Stainton -- Mike Perry

1 0

Wj%#qpkkn
by Vitalie 22 Apr '15

22 Apr '15

XaLloukkkl Zp Eeddpprriioxzlal Pzjmmp --whmllpq,ukInviato dal l cellulare Andropf K-9 Mail.

1 0

onionoo backend seems to be down.
by jason＠icetor.is 21 Apr '15

21 Apr '15

Hello All, Anyone else notice onionoo and the tools that rely on it (globe.torproject.org atlas.torproject.org) seem to be down? -Jason

5 4

Re: [tor-relays] Undiagnosable Crashes in Relays
by teor 21 Apr '15

21 Apr '15

> Date: Wed, 25 Mar 2015 17:21:50 +0800 > From: Vincent Yu <v(a)v-yu.com> > > On Wed, Mar 25, 2015 at 4:26 PM, skyhighatrist <skyhighatrist(a)tfwno.gf> > wrote: >> I am wondering if anyone has had their relay randomly crash in the >> past >> week or so. Three of mine (I run 6, nonexits) have fallen over. One of >> them ~5 days ago, one of them ~4 days ago, and one of them earlier >> today >> . > > This also happened to my two relays about three weeks ago. They are: > > https://globe.torproject.org/#/relay/C309A31AD772FFDD0805C9FECB6D4748A7CBF6… > https://globe.torproject.org/#/relay/18BE989663CF3351F73D33C672BB1C985E0EA5… > > They are both middle/guard relays (about 200 Mbps each) on the 0.2.6 > branch and are on the same dedicated server. They went down at > different times, and as far as I can remember, there was nothing > notable in the Tor and system logs. No issues prior to this over the > past 12 months. I haven't had time to investigate this. > This also happened to my EC2 relay a few weeks ago, but I never had time to investigate. It's quite possible it was a bad nightly tor version, or some sort of misconfiguration on my end, but the timing matches. I didn't manage to get it to come back up in the limited time I had to try and fix it. https://globe.torproject.org/#/relay/425E55A8FA145ACFC01FA58CD4E6F46DD7762A… (No record, it's been down for a while.) teor teor2345 at gmail dot com pgp 0xABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR C3C57B23 349825DE 929A1DEF C3531C25 A32287ED

2 3

Tor and Freenode
by Markus Hitter 20 Apr '15

20 Apr '15

Hello all, after yesterday watching "State of the Onion", a speech held at 31C3 recently, I spontanuously decided to also run a Tor relay. After some back and forth it appears to be running fine on my OpenWRT based router. The only ORPort is 9001, which is also the only hole punched into the firewall, I hope I did this right. Today I wanted to continue at Freenode IRC, like I did for years, not even using an anonymous connection. But they wouldn't let me in: [12:02] * You are banned from this server- Your tor exit node must not allow connections to freenode (tor exit node (chat.freenode.net:8000)). Email tor-kline(a)freenode.net when corrected. (2015/1/24 09.41) I understand that my router and my PC share the same IP address to the remaining internet and IRC operators try to identify users by their IP address (which isn't possible). Reading up on the matter I found two texts: http://www.freenode.org/policy.shtml "The freenode network welcomes Tor users" http://www.freenode.org/irc_servers.shtml#tor "If you do want to be a Tor exit node and still use freenode, you will have to configure your exit policy to block all of the IRC ports we use, in addition to ports 80 and 443 as these are used for webchat." To me this sounds like "We welcome it, but please block all of its usage". They recommend to add a "reject *:*" rule, but that means the relay is no longer a relay, right? And blocking port 80 and 443 means Tor to become useless. As I can't find much on the matter by googling: is this actually a misalignment of Freenodes' statement to freedom as bad as it looks? If yes, what could I do about it? I'm a fairly experienced hobbyist hacker and admin, so I wouldn't fear writing some code. Cheers, Markus -- - - - - - - - - - - - - - - - - - - - Dipl. Ing. (FH) Markus Hitter http://www.jump-ing.de/

14 27

many hundreds connections to the same ip address + port
by Toralf Förster 19 Apr '15

19 Apr '15

Since few days (or since 0.2.6.7 ?) I do observe this behaviour at y exit node, eg. to port 81, 110, 636 and other non-http ports. Didn't saw this before - any hints ? -- Toralf pgp key: 7B1A 07F4 EC82 0F90 D4C2 8936 872A E508 0076 E94E -- "; the past is all dirty and cruel in the modern popular imagination, with the exception of the Romans, who are just cruel" Ian Mortimer, 2008, "The Time Traveller's Guide to Medieval England"

1 0

Re: [tor-relays] simple relay setup
by tor-server-creator＠use.startmail.com 18 Apr '15

18 Apr '15

thanks do i have to install something in first line to perform this gpg lines? you say "| apt-key add -" torproject.org says "| sudo apt-key add -" doesnt sudo matter cause im useing root? is it possible to just deactive login/ssh to be save or is it just better/necessary to deal with rsa key? will tor be utoupdated at new release with "apt-get -y upgrade" or how to manage automated actuality? On Saturday, April 18, 2015 3:46 PM, Julien ROBIN <julien.robin28(a)free.fr> wrote: > Hi ! > > You can try a mix between this (ultra simple), from > https://www.torproject.org/docs/debian.html.en : > > > > You need to add the following entry in /etc/apt/sources.list or a new > file in /etc/apt/sources.list.d/: > > deb http://deb.torproject.org/torproject.org wheezy main > deb-src http://deb.torproject.org/torproject.org wheezy main > > > gpg --keyserver keys.gnupg.net --recv 886DDD89 > gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add - > > apt-get update > apt-get install tor deb.torproject.org-keyring > > > > This will make your "apt-get" using the last table version of Tor > from the Tor Project servers, with signatures check making sure that > no one "car jacked" the server before you download from it ;) > > > > You will have to find a way to make your "apt-get update" and > "apt-get -y upgrade" automatic, may be "reboot" too (when kernel have > been updated for example, but here I cannot say precisely how to > know if you have to reboot !) > > > > > And a second link, that can give you a lot of tips also > > http://www.torservers.net/wiki/setup/server > > Including disabling password authentification, but if you want to > completely lock your server, a good way could be to make > "/etc/init.d/ssh" unable to run (you delete the "x" permission for > example) > > After the reboot, you will not be able to connect anymore using SSH > on your server, and you will have to use tools from your ISP if you > want to drive your server again ! > > Personnaly, I always do a minimalist installation in order to have > nothing else than OpenSSH listening (and Tor, of course !). Because > if others things that I don't know (rpc bind port 111 etc) are > listening I'm not sure that I have everything into control. > > > > > ----- Mail original ----- > De: tor-server-creator(a)use.startmail.com > À: tor-relays(a)lists.torproject.org > Envoyé: Samedi 18 Avril 2015 12:06:07 > Objet: [tor-relays] simple relay setup > > > I need some help. > My dedicated server is running debian and is new, set up by my > serverhoster. > > I want to run a TOR-Relay: > - It should always update to latest stable automatically. > - It should be save. > > > I will edit the torrc by myself. What i need is simple copy+paste > codeline for: > - isntall and run functional auto-update for tor (is it libevent?) > just simply @root user without user/pgp dealing stuff. pgp stuff is > confusing me! > - deactivate complete access (ssh disable?) to ensure savety (i have > to reinstall the system by serverhoster-website if change needet) i > want to lock out even myself. > > Is this a practical idea to most easy set-up and let run without > struggle? > Please help, thanks. > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

2 1

simple relay setup
by tor-server-creator＠use.startmail.com 18 Apr '15

18 Apr '15

I need some help. My dedicated server is running debian and is new, set up by my serverhoster. I want to run a TOR-Relay: - It should always update to latest stable automatically. - It should be save. I will edit the torrc by myself. What i need is simple copy+paste codeline for: - isntall and run functional auto-update for tor (is it libevent?) just simply @root user without user/pgp dealing stuff. pgp stuff is confusing me! - deactivate complete access (ssh disable?) to ensure savety (i have to reinstall the system by serverhoster-website if change needet) i want to lock out even myself. Is this a practical idea to most easy set-up and let run without struggle? Please help, thanks.

3 2

Hello Everyone
by Jeffrey Hathaway 17 Apr '15

17 Apr '15

Hey Everyone, I have been a big supporter of the Tor Project, and I have finally been able to work with my upstream providers and get an Exit bridge online. https://atlas.torproject.org/#details/DFBD4AD44C2EC14EA921C639859CE432A3554… Based on the exit policy, does anyone suggest any changes i should make to keep abuse to a minimum?

1 0

Re: [tor-relays] Installing obfs4 on Raspberry Pi bridge
by jchase 16 Apr '15

16 Apr '15

Hello, When I run either ./obfs4proxy or obfs4proxy.go I get: ./obfs4proxy: line 1: /bin: Is a directory ./obfs4proxy: line 2: syntax error near unexpected token `(' ./obfs4proxy: line 2: ` * Copyright (c) 2014-2015, Yawning Angel <yawning at torproject dot org>' Regards, J Chase >> Hello, >> Thanks to you I have tor 0.2.5.11 running on a Raspberry Pi2 and obfs4 >> installed from git. I have good news and bad news. >> The largest problem is that I get the warning "could not launch >> managed proxy executable at '/path/obfs4proxy'('Permission denied')" >> In the past this used to be a problem with apparmor, but apparmor >> isn't installed. Any idea where I can start looking for a solution? >> Here are a couple of details and small problems: >> I didn't install obfs4 directly (due to problems), but installed it to >> another laptop and copied it to the Pi2 using scp. > > Oh dear. What happens when you run the obfs4proxy executable in a > shell directly (on the pi2)? > > It should look something like: > $ ./obfs4proxy > 2015/04/12 20:13:02 [ERROR]: obfs4proxy - must be run as a managed > transport > > If not, what does 'file /path/obfs4proxy' say? > > Regards, >

2 1

Re: [tor-relays] Installing obfs4 on Raspberry Pi bridge
by jchase 12 Apr '15

12 Apr '15

Hello, Thanks to you I have tor 0.2.5.11 running on a Raspberry Pi2 and obfs4 installed from git. I have good news and bad news. The largest problem is that I get the warning "could not launch managed proxy executable at '/path/obfs4proxy'('Permission denied')" In the past this used to be a problem with apparmor, but apparmor isn't installed. Any idea where I can start looking for a solution? Here are a couple of details and small problems: I didn't install obfs4 directly (due to problems), but installed it to another laptop and copied it to the Pi2 using scp. I have ORPort somewhere above 9000. When I set it to auto, I got a late warning that the port chosen by tor was presenting problems, had I arranged port forwarding, etc.? ExtORPort is "auto" and I get no complaints (probably because obfs4 isn't working). And I have ServerTransportListenAddr obfs3 0.0.0.0:90xx because a lower port, like 80, with port forwarding, received a warning (and didn't work). One thing at a time... Like I asked, where can I look for answers to the obfs4proxy permission denied problem? If I get that fixed, I assume I can play around with the rest until I can use lower ports. Thanks, J Chase

2 1

Re: [tor-relays] Manual Relay Guide for OS X
by teor 12 Apr '15

12 Apr '15

Hi Zach, I had plans for updating the guide for OS X on the Tor wiki, but never got around to it. Thanks for making it happen! If you're interested in putting the StackExchange content on the website, the wiki link and the trac task with a sample LaunchDaemon plist for OS X are below: https://trac.torproject.org/projects/tor/wiki/doc/MacRunOnBoot https://trac.torproject.org/projects/tor/ticket/13412 > Date: Sat, 4 Apr 2015 16:36:26 -0700 > From: Zachary Alberico <fossuser(a)gmail.com> > > I ended up putting it up on stack exchange since it'll probably be > helpful there anyway. > > http://tor.stackexchange.com/questions/6567/how-do-i-manually-setup-a-relay… > > Thanks, > Zach > > On Fri, Apr 3, 2015 at 8:47 PM, Zachary Alberico <fossuser(a)gmail.com> wrote: >> Hi Tor-Relays, >> >> I wrote the following documentation after figuring out how to get my >> Tor relay working with a manual install. The goal is to give easy to >> follow and concise instructions that explain just enough to understand >> what you're doing. >> >> I'm trying to find out the best way to make this available - would it >> be possible to add it to the externally facing documentation? I'd >> also really appreciate it if someone looks it over and sees if I made >> any typos/forgot something. >> >> I can help with whatever needs to be done. >> >> Thanks, >> Zach >> >> ### >> Manually configuring a Tor Relay on OS X (Yosemite, Tor 0.2.5.11) >> >> This guide walks you through the process of configuring your very own >> tor relay explaining each step along the way. >> >> First install homebrew which will allow us to install the most recent >> version of Tor (http://brew.sh) >> The following command pasted into a terminal will download and install homebrew. >> {code} >> ruby -e "$(curl -fsSL >> https://raw.githubusercontent.com/Homebrew/install/master/install)" >> {code} >> >> Once that completes we'll use homebrew to install tor with the >> following command. >> {code} >> brew install tor >> {code} >> >> At this point tor should be installed and the homebrew command should >> have printed the following: >> {quote} >> You will find a sample `torrc` file in /usr/local/etc/tor. >> It is advisable to edit the sample `torrc` to suit your own security needs: >> https://www.torproject.org/docs/faq#torrc >> After editing the `torrc` you need to restart tor. >> >> To have launchd start tor at login: >> ln -svn /usr/local/opt/tor/*.plist ~/Library/LaunchAgents >> Then to load tor now: >> launchctl load ~/Library/LaunchAgents/homebrew.mxcl.tor.plist >> {quote} >> >> Notice that it mentions the location of the torrc file (we're going to >> edit that next). It also explains how to have tor run at startup and >> how to start it now. Before we go ahead and run those commands let's >> create the location logging is supposed to go since for some reason it >> doesn't already exist. >> These commands are creating directories. >> {code} >> mkdir /usr/local/Cellar/tor/0.2.5.11/var >> mkdir /usr/local/Cellar/tor/0.2.5.11/var/log >> mkdir /usr/local/Cellar/tor/0.2.5.11/var/log/tor >> {code} >> >> Similarly create the following for the DataDirectory if it doesn't >> already exist. >> {code} >> mkdir /usr/local/Cellar/tor/0.2.5.11/var/lib >> mkdir /usr/local/Cellar/tor/0.2.5.11/var/lib/tor >> {code} >> >> Next let's edit the torrc.sample file and save it as torrc. >> To open its location in a finder window use the following command: >> {code} >> open /usr/local/etc/tor >> {code} >> Then open the torrc.sample file in your chosen editor (text edit works fine). >> >> Read through the file and try to understand what each of the options >> are, at a minimum we're going to want to uncomment and use the >> following options. >> {code} >> #Sets the logging location >> Log notice file /usr/local/Cellar/tor/0.2.5.11/var/log/tor/notices.log >> >> #Sets the DataDirectory >> DataDirectory /usr/local/Cellar/tor/0.2.5.11/var/lib/tor >> >> #If you're only configuring this as a relay >> SocksPort 0 >> >> #Your main ORPort >> ORPort 9001 >> >> #Name of your relay >> Nickname supercoolrelay >> >> #Bandwidth limits >> RelayBandwidthRate 5000 KB >> RelayBandwidthBurst 10000 KB >> >> #Way for the tor project to conact you >> ContactInfo Random Person <a special email you should make just for >> this>@gmail.com >> >> #What port to advertise for directory connections >> DirPort 9030 >> >> #If you don't want to run an exit (if you're able to run an exit >> please use the file default!) >> ExitPolicy reject *:* # no exits allowed >> {code} >> >> Once you've uncommented/edited those lines save the file as torrc and exit. >> >> Now it's time for an oversimplified and possibly inaccurate lesson >> about Networking. >> You are probably sitting at a home network at a computer connected >> wirelessly or wired to a router which is connected to a modem which is >> connecting you to the outside Internet. >> >> Your entire network connection has one IPv4 address facing the outside >> world. Your router then uses NAT which stands for Network Address >> Translation to remap traffic to the unique IP addresses you have per >> device on your local intranet. When we configure 'port forwarding' >> we're telling your router to take the ports we need on your computer's >> local IP behind the router and forward them to the ports exposed to >> the real internet as part of this NAT process. In this case this >> allows the tor relay we've configured to receive incoming connections >> on the port we've specified. Unfortunately this process is different >> for every router, but in order to provide an example I'll show what >> the changes look like for an Apple Airport Extreme and hopefully >> you'll be able to translate them to your own router's settings. First >> though we need to know your computer's local IP. >> >> Open System Preferences >> Click Network >> Click Advanced >> Click TCP/IP >> In this window you should see "IPv4 Address: XX.X.X.X" >> >> That's the address we need. >> >> Next open Airport Utilty (this is to configure port forwarding on an >> Apple Airport Extreme router) >> Click on the Airport Extreme >> Click Edit on the tooltip that pops up >> Click Network >> Notice the Port Settings Box, Click + >> Add the following settings: >> Description: Tor Ports >> Public UDP Ports: 9001, 9030 >> Public TCP Ports: 9001, 9030 >> Private IP Address: XX.X.X.X (this is the IP we found in Network) >> Priave UDP Ports: 9001, 9030 >> Public TCP Ports: 9001, 9030 >> Click Save >> Click Update (note the router will reboot) >> >> Note: This example shows the default ports we configured in our torrc, >> if you need to or decide to use different ports you'd have to >> configure the forwarding differently. I think only the TCP settings >> matter here, but I ended up setting both while trying to get this to >> work. >> >> Now we can set tor to launch on startup as well as start it right now >> with these two commands. >> {code} >> ln -svn /usr/local/opt/tor/*.plist ~/Library/LaunchAgents >> launchctl load ~/Library/LaunchAgents/homebrew.mxcl.tor.plist >> {code} >> >> Note: If you make changes to torrc in the future you need to restart >> tor. You can restart tor with the following command. >> {code} >> pkill -sighup tor >> {code} >> >> Now let's check out the logs and verify things are working. This >> command will show the end of the log and any new lines as they appear. >> {code} >> tail -f /usr/local/Cellar/tor/0.2.5.11/var/log/tor/notices.log >> {code} >> >> In a few mintues you should see the following lines if things are working: >> 19:29:38 [NOTICE] Self-testing indicates your ORPort is reachable from >> the outside. Excellent. Publishing server descriptor. >> 19:29:36 [NOTICE] Self-testing indicates your DirPort is reachable >> from the outside. Excellent. >> >> If you see something like the following it's irrelevant: >> Apr 02 22:33:02.000 [notice] Have tried resolving or connecting to >> address '[scrubbed]' at 3 different places. Giving up. >> >> And if you see this it's not working (the X's here represent your >> public internet facing IPv4): >> Apr 03 17:10:41.000 [warn] Your server (XX.XXX.XXX.XXX:9001) has not >> managed to confirm that its ORPort is reachable. Please check your >> firewalls, ports, address, /etc/hosts file, etc. >> Apr 03 17:10:41.000 [warn] Your server (XX.XXX.XXX.XXX:9030) has not >> managed to confirm that its DirPort is reachable. Please check your >> firewalls, ports, address, /etc/hosts file, etc. >> >> If you're still having trouble try hopping on IRC. >> ### teor teor2345 at gmail dot com pgp 0xABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR C3C57B23 349825DE 929A1DEF C3531C25 A32287ED

1 0

help interpreting fault setting up exit
by I 11 Apr '15

11 Apr '15

3 4

Tor relay on Rapsberry Pi 2
by AVee 10 Apr '15

10 Apr '15

Hi, I happened to get my hands on a Raspberry Pi 2 and I was wondering if anyone already has any experience running Tor on the this. There is quite some info about running Tor on the original Raspberry Pi, and the performance seems to be a bit lacking. The Pi 2 however comes with higher clocked quad core Cortex-A7 which should bring an descend in increase in performance. So I'm curious about the throughput a Tor relay on the Pi 2 would achieve. Did anyone here try running Tor on a Raspberry Pi 2 already? And if not, is there any way to test the achievable throughput without joining actually adding the relay to the Tor network (and having to go through the full life cycle)? -- Regards, AVee

5 5

Relay from home
by Jannis Wiese 09 Apr '15

09 Apr '15

Hi operators, maybe this is a dumb question, but as I couldn’t find any real advise anywhere on the net: Does it make sense to start operating a non-exit relay from home for a longer term? I’m thinking about at least getting a T-Shirt (the more uptime, the better). However, my concerns are the daily disconnect and the dynamic IP. What do you think? Any first-hand tips are of course appreciated. Cheers, Jannis

4 5

Consensus weight fraction dropping
by Tim Sammut 08 Apr '15

08 Apr '15

Hi. My relatively new, non-exit relay has seen its consensus weight fraction drop and a corresponding substantial drop in traffic. https://atlas.torproject.org/#details/83F56335F5E3615B8855EEC7AA5D6A0BAD010… It briefly had and then lost the guard flag, so I don't believe the drop as described in [1]. Is it being affected by the bwauth issues talked about in [2] and [3]? If so, is there a remedy? Thank you! [1] https://blog.torproject.org/blog/lifecycle-of-a-new-relay [2] http://tor.stackexchange.com/questions/4913/my-exit-node-suddenly-lost-all-… [3] https://lists.torproject.org/pipermail/tor-relays/2015-January/006055.html hope you are well t -- Tim Sammut ~ @t1msammut ~ tim(a)teamsammut.com

2 1

Notice
by emmanuel ogbokhun 08 Apr '15

08 Apr '15

Do you need a loan or investment?. Apply for your reliable loan today at 3% interest rate with EXPO 2020 special offer, kindly contact us if you have a reliable and lucrative business that requires financing. MAK Global Investment P.O. Box 471471 105B Salahuddin St Ras Al Khaimah United Arab Emirates mak.global(a)accountant.com

5 5

what I'm doing
by impex＠mail2tor.com 08 Apr '15

08 Apr '15

African business man receiving ilegale cars from europe and USA for seeling, and trading gold of Africa to Europe and USA, looking for people who can make best African fake money like (Franc CFA) doing an import-export of different product between Africa-Europe-America ask me what you want or propose me what you have for sell or trade best regard

2 1

Re: [tor-relays] strange consensus messages in log
by starlight.2015q2＠binnacle.cx 06 Apr '15

06 Apr '15

Generally openssl security fixes do not change API/ABIs. In this case I built the newer release without export ciphers, thought that seems an unlikely cause. Perhaps it was memory corruption. Relay is running on non-ECC CPU, though the system has never exhibited any problems related to memory corruption in the past. Network equipment unlikely--Intel server-grade NIC. Has been running fine since the restart so I'll have to let it go unless it comes back at a future date.

1 0

strange consensus messages in log
by starlight.2015q2＠binnacle.cx 06 Apr '15

06 Apr '15

Does anyone have any idea what this is about? Is it serious?

2 3

Re: [tor-relays] Unreachable ORPort - Potential ISP block?
by teor 06 Apr '15

06 Apr '15

> Date: Sun, 05 Apr 2015 17:27:38 -0400 > From: starlight.2015q2(a)binnacle.cx ... > > Can you connect locally with nc/netcat/ncat? > You should run 'netstat -nt' to check whether > you get ESTABLISHED since netcat won't > say anything if it's timing-out or > connected. > > As you are behind a NAT you need the > > Address > > configuration parameter in `torrc` to > tell outside systems the public IP. The Address configuration parameter is only necessary if tor can't auto-detect its own external IP. When tor downloads the directory, it uses the external IP that the authority / mirror supplies as its external IP. Does your tor instance download the directory, and correctly guess the external IP? teor teor2345 at gmail dot com pgp 0xABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR C3C57B23 349825DE 929A1DEF C3531C25 A32287ED

2 1

Unreachable ORPort - Potential ISP block?
by CJ Barlow 05 Apr '15

05 Apr '15

I'm attempting to run a Relay but I haven't been able to get it the ORPort to be confirm as reachable. I've tried lots of things but I'm hoping there is something I haven't thought of yet that can make this work! I've got a 50Mbps symmetrical connection (without data caps) that I would love to have the Tor network utilize. Hardware info: - Asus RT-N66U running DD-WRT - Raspberry Pi 2 running Raspbian - SanDisk MicroSDHC UHS-I 16GB Here are all the steps I've taken: - Formatted the MicroSDHC with Win32DiskImager. - Followed the Instructables Raspberry Pi Tor Relay configuration guide. - Port forwarded via NAT/QoS then Port Forwarding. Protocol is set to TCP, double-checked IP is what is assigned to Raspberry Pi 2 and enable box is checked. - ORPort set to 9001. Also changed ORPort to 443, did "sudo service tor reload" and changed the port in the forwarding section of my router. - Tried router DMZ for Raspberry Pi LAN IP. I would really like to get this to work, if possible. I can't run an Exit node on my connection but since my connection sits unused for most of the day it should be put to good relay use.

5 6

Re: [tor-relays] Unreachable ORPort - Potential ISP block?
by CJ Barlow 05 Apr '15

05 Apr '15

Just to update, I got it to work! :-) I added a Dynamic DNS to the router and once it was established I reloaded Tor. It immediately found the ORPort and then did the bandwidth self-test. ("Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor.") I haven't seen anything else in the log, yet.

1 0

Re: [tor-relays] Unreachable ORPort - Potential ISP block?
by starlight.2015q2＠binnacle.cx 05 Apr '15

05 Apr '15

At 13:56 4/5/2015 -0600, you wrote: TSLAGrin D0BA 2462 E224 2DE9 7F6F 7837 8F58 E63B AD51 88F8 Right answer, wrong question. Your relay is not yet published so it cannot be viewed in https://atlas.torproject.org Can you connect locally with nc/netcat/ncat? You should run 'netstat -nt' to check whether you get ESTABLISHED since netcat won't say anything if it's timing-out or connected. As you are behind a NAT you need the Address configuration parameter in `torrc` to tell outside systems the public IP.

1 0

Re: [tor-relays] Unreachable ORPort - Potential ISP block?
by CJ Barlow 05 Apr '15

05 Apr '15

Sorry I fat-fingered part of it. That should read: TSLAGrin D0BA 2462 E224 2DE9 7F6F 7837 8F*58 *E63B AD51 88F8

1 0

Re: [tor-relays] Unreachable ORPort - Potential ISP block?
by CJ Barlow 05 Apr '15

05 Apr '15

My relay fingerprint is: TSLAGrin D0BA 2462 E224 2DE9 7F6F 7837 8F25 E63B AD51 88F8

1 0

moira1 bwauth reporting double?
by starlight.2015q2＠binnacle.cx 05 Apr '15

05 Apr '15

I find it a bit odd that moria1 is reporting exactly double the bandwidth for the relay here: Binnacle 4F0DB7E687FC7C0AE55C8F243DA8B0EB27FBF1F2 gabelmoo Bandwidth=7385 Measured=5810 tor26 Bandwidth=7385 Measured=6090 moria1 Bandwidth=7385 Measured=18700 GuardFraction=47 longclaw Bandwidth=7385 Measured=6140 Actual bandwidth is 75 MBits or 9375 KBytes, so the other auth's look good. Anyone have any idea? Switched to VZ FiOS about a month ago and I also note that the measured rate has gone up considerably and the bwauths have gone from providing disparate measurements to being mostly in sync (aside from moria1). I wonder at the cause of improvement and suspect it's one of 1) ongoing "Bandwidth Authority Renovation" https://trac.torproject.org/projects/tor/ticket/13630 2) Verizon improving their core network --I've seen some big routing and ping latency changes in PingPlotter 3) sliding window average applied by the bwauth's to prevent rapid ascension of new and potentially evil relays Also I see dizum has a terrible view of the relay, not even observing it as "fast" and Faravahar thinks it not "stable". Please could anyone who has some specific information comment. Thanks

1 0

Manual Relay Guide for OS X
by Zachary Alberico 04 Apr '15

04 Apr '15

Hi Tor-Relays, I wrote the following documentation after figuring out how to get my Tor relay working with a manual install. The goal is to give easy to follow and concise instructions that explain just enough to understand what you're doing. I'm trying to find out the best way to make this available - would it be possible to add it to the externally facing documentation? I'd also really appreciate it if someone looks it over and sees if I made any typos/forgot something. I can help with whatever needs to be done. Thanks, Zach ### Manually configuring a Tor Relay on OS X (Yosemite, Tor 0.2.5.11) This guide walks you through the process of configuring your very own tor relay explaining each step along the way. First install homebrew which will allow us to install the most recent version of Tor (http://brew.sh) The following command pasted into a terminal will download and install homebrew. {code} ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)" {code} Once that completes we'll use homebrew to install tor with the following command. {code} brew install tor {code} At this point tor should be installed and the homebrew command should have printed the following: {quote} You will find a sample `torrc` file in /usr/local/etc/tor. It is advisable to edit the sample `torrc` to suit your own security needs: https://www.torproject.org/docs/faq#torrc After editing the `torrc` you need to restart tor. To have launchd start tor at login: ln -svn /usr/local/opt/tor/*.plist ~/Library/LaunchAgents Then to load tor now: launchctl load ~/Library/LaunchAgents/homebrew.mxcl.tor.plist {quote} Notice that it mentions the location of the torrc file (we're going to edit that next). It also explains how to have tor run at startup and how to start it now. Before we go ahead and run those commands let's create the location logging is supposed to go since for some reason it doesn't already exist. These commands are creating directories. {code} mkdir /usr/local/Cellar/tor/0.2.5.11/var mkdir /usr/local/Cellar/tor/0.2.5.11/var/log mkdir /usr/local/Cellar/tor/0.2.5.11/var/log/tor {code} Similarly create the following for the DataDirectory if it doesn't already exist. {code} mkdir /usr/local/Cellar/tor/0.2.5.11/var/lib mkdir /usr/local/Cellar/tor/0.2.5.11/var/lib/tor {code} Next let's edit the torrc.sample file and save it as torrc. To open its location in a finder window use the following command: {code} open /usr/local/etc/tor {code} Then open the torrc.sample file in your chosen editor (text edit works fine). Read through the file and try to understand what each of the options are, at a minimum we're going to want to uncomment and use the following options. {code} #Sets the logging location Log notice file /usr/local/Cellar/tor/0.2.5.11/var/log/tor/notices.log #Sets the DataDirectory DataDirectory /usr/local/Cellar/tor/0.2.5.11/var/lib/tor #If you're only configuring this as a relay SocksPort 0 #Your main ORPort ORPort 9001 #Name of your relay Nickname supercoolrelay #Bandwidth limits RelayBandwidthRate 5000 KB RelayBandwidthBurst 10000 KB #Way for the tor project to conact you ContactInfo Random Person <a special email you should make just for this>@gmail.com #What port to advertise for directory connections DirPort 9030 #If you don't want to run an exit (if you're able to run an exit please use the file default!) ExitPolicy reject *:* # no exits allowed {code} Once you've uncommented/edited those lines save the file as torrc and exit. Now it's time for an oversimplified and possibly inaccurate lesson about Networking. You are probably sitting at a home network at a computer connected wirelessly or wired to a router which is connected to a modem which is connecting you to the outside Internet. Your entire network connection has one IPv4 address facing the outside world. Your router then uses NAT which stands for Network Address Translation to remap traffic to the unique IP addresses you have per device on your local intranet. When we configure 'port forwarding' we're telling your router to take the ports we need on your computer's local IP behind the router and forward them to the ports exposed to the real internet as part of this NAT process. In this case this allows the tor relay we've configured to receive incoming connections on the port we've specified. Unfortunately this process is different for every router, but in order to provide an example I'll show what the changes look like for an Apple Airport Extreme and hopefully you'll be able to translate them to your own router's settings. First though we need to know your computer's local IP. Open System Preferences Click Network Click Advanced Click TCP/IP In this window you should see "IPv4 Address: XX.X.X.X" That's the address we need. Next open Airport Utilty (this is to configure port forwarding on an Apple Airport Extreme router) Click on the Airport Extreme Click Edit on the tooltip that pops up Click Network Notice the Port Settings Box, Click + Add the following settings: Description: Tor Ports Public UDP Ports: 9001, 9030 Public TCP Ports: 9001, 9030 Private IP Address: XX.X.X.X (this is the IP we found in Network) Priave UDP Ports: 9001, 9030 Public TCP Ports: 9001, 9030 Click Save Click Update (note the router will reboot) Note: This example shows the default ports we configured in our torrc, if you need to or decide to use different ports you'd have to configure the forwarding differently. I think only the TCP settings matter here, but I ended up setting both while trying to get this to work. Now we can set tor to launch on startup as well as start it right now with these two commands. {code} ln -svn /usr/local/opt/tor/*.plist ~/Library/LaunchAgents launchctl load ~/Library/LaunchAgents/homebrew.mxcl.tor.plist {code} Note: If you make changes to torrc in the future you need to restart tor. You can restart tor with the following command. {code} pkill -sighup tor {code} Now let's check out the logs and verify things are working. This command will show the end of the log and any new lines as they appear. {code} tail -f /usr/local/Cellar/tor/0.2.5.11/var/log/tor/notices.log {code} In a few mintues you should see the following lines if things are working: 19:29:38 [NOTICE] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor. 19:29:36 [NOTICE] Self-testing indicates your DirPort is reachable from the outside. Excellent. If you see something like the following it's irrelevant: Apr 02 22:33:02.000 [notice] Have tried resolving or connecting to address '[scrubbed]' at 3 different places. Giving up. And if you see this it's not working (the X's here represent your public internet facing IPv4): Apr 03 17:10:41.000 [warn] Your server (XX.XXX.XXX.XXX:9001) has not managed to confirm that its ORPort is reachable. Please check your firewalls, ports, address, /etc/hosts file, etc. Apr 03 17:10:41.000 [warn] Your server (XX.XXX.XXX.XXX:9030) has not managed to confirm that its DirPort is reachable. Please check your firewalls, ports, address, /etc/hosts file, etc. If you're still having trouble try hopping on IRC. ###

1 1

send me somerelays and bridges for vidalia
by Sh.F.M 03 Apr '15

03 Apr '15

1 0

Re: [tor-relays] multi-instance Tor support for *BSD packages
by Nusenu 03 Apr '15

03 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi Pascal, thanks for your feedback. Pascal Stumpf: >> Multi-instance support isn't something that's provided by >> OpenBSD's rc.d(8) subsystem, and I doubt it ever will be. Too >> much complexity for something that's more of a crutch to work >> around few applications' limitations than something universally >> needed and useful. Ok, my take away here is that I won't be able to get any multi-instance support into OpenBSD's tor rc.d script. So I guess the next best option for ansible-relayor will indeed be to configure multiple services and copy the rc.d script of your package once per tor instance tor0,tor1,... plus one line per tor instance in /etc/rc.conf.local as described previously here: https://lists.torproject.org/pipermail/tor-relays/2015-March/006526.html >> Btw, aren't there locking problems with the files in >> DataDirectory? Or does every single tor instance need its own? >> And the ControlPort? One for each instance? How do you >> distinguish tor instances when doing syslog logging? ansible-relayor takes care of this and generates torrc files accordingly (separate datadir, separate logfiles, ...). regards, Nusenu -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVHuGbAAoJEFv7XvVCELh0nz0P/i0KffWajNLbBv0cHF5BB5V2 BgQAIDyy/UpSGXNkiUShOBvQIW1GhjvpX9UJeAVzBy2nJuAN8v+AEKp+9A7w4fLt qBxsgul0iaWSalrzlzGFu85QRrc31MV4MKUMW6HmBoINKwMZ71cbWqcmWwykzhOr VPjxrEzCcIw2FF42G2rd65ivWJVWueJLUlbN4KvhzP0clYbOMlgAZ4smstdIksbp pd13/AdA1aJGdCs+i4pXgd19Jq+7WG6Eqj7+YSEpk3LOxqiaVBAi0MhHH5J8be57 GKyI/9QI4yfgAYhtDyEZOVaslafgSAaMzniYYfmGDAPzZobKBbhwmXxtmnok7A30 4TMpUPiqYpVvhBu+NHqlhngYDvKJj/KoZb3lySyN5wMpi5gTtUIt1QxxQ6ofP0eW LuCQSJhinTuLehWx2Ib/gx+J2g+BqJeHkBZRt2BjL63RxHMiRJ3qy7Xd0mJlsh5t DPPPzovk6yaNRUNv7GDTTaq4vRSwJzfUikm9upUi+J37CJ1L3wo/xYqcqLHKWz/w 3NtoMi9mkJfjJ0Bx5ORDzeWJ6LtTKPmhQuWP+5PiK0CxEiu/ZVuReElKyz0Pnypa qrIji5vpu+w/ITw4E/IpMZYS/p/SZV+HYG/ffLUZNgJ6i6vHNqc7om6c+0Qp9qut Eax3QbcU8mCR+F8d2WmL =YcuY -----END PGP SIGNATURE-----

1 0

multi-instance Tor support for *BSD packages
by Nusenu 02 Apr '15

02 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Dear Tor package maintainers for FreeBSD and OpenBSD, I wrote/I'm writing an ansible [1] role for tor relay operators [2]. Besides supporting Linux I'm also aiming to supporting OpenBSD and FreeBSD. Tor does not scale well across multiple CPU cores, to work around this issue relay operators frequently choose to run multiple tor instances on a single host. To better support tor relay operators with this common task tor's official RPM packages recently got multi-instance support [5] and a ticket for the official debian package has been filed [6]. To better know how to proceed with my ansible role - where multi-instance support is a core feature - I'd like to know how you think about adding easy multi-instance support to your packages as well? One way to configure a BSD system to run multiple tor instances would be to defined multiple services tor0, tor1, ... [3], but that doesn't strike me as a particular clean solution [4]. What do you think about supporting multiple tor instances with a single rc.d script that starts one tor process per available *.torrc file in (/usr/local)/etc/tor/enabled/ ? looking forward to your comments, Nusenu [1] http://docs.ansible.com/ [2] https://github.com/nusenu/ansible-relayor [3] https://lists.torproject.org/pipermail/tor-relays/2015-March/006526.html [4] https://lists.torproject.org/pipermail/tor-relays/2015-March/006527.html [5] https://trac.torproject.org/projects/tor/ticket/14996 [6] https://trac.torproject.org/projects/tor/ticket/14995 -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVHZZ6AAoJEFv7XvVCELh04/IQAKZfuYvXUM4xkc3cS3GJciGg NsbkyL483NLM7un/gd0HNkUTzOVLMwI6gkzUERg5uYiwWD1ZHEnudrOk47N19FHR 7WjDTQQuKDfDBpMCBiAywFXsJKKnRk0Cg01+zmMlCmPZ5kEk1hyaE64sZNmjBLyQ 7ydLMV9/xy7h/qm7OfOjU9djoPQTbnd5Ky8+V15ZyTwr65IkWI6vX5KlIfhdTvHh sl3PlRppCE1aYPF5jbwSwpICOSd4diLWToFfOSDFRfvpc4FdMiJfIdAXj37FktMA RdI4MTJXRanLj7WVwKua8Gf2Za8my2t2mCTD3loFR1tRPE30uA1xul9eii+zp27n NBvSsSIhdVKcn1qK7lUfHIxa0v2ArzIjgBczHh6KzlS0U5Fd6LYqx+Y7sRSkjBlr nULJ2Bs+EqcjBF3OTjQFNG+dg/96QgIK+f7nVp/pvoGPKCDxiIdnuT7wlueguI9r Ys/7wCTOSTyrk7+q6IxYrliPReahTlK80HkMtba5m4JpBlGlikMtZcgVYeEuyeac fVfe/TcLjOkqFIomVpkhbtRDHJafu9Q5cMm/6eydXAH4y9GhM/Q6N+zEp4nXuSP3 /LzNFhwuFSabTwlnDx/5VpSXVYP+cmMoK9tWQjORNM//1zRONOea43eXeyhuwipo mTv/uEMpR9eDdPAJseod =ft3h -----END PGP SIGNATURE-----

1 0

Re: [tor-relays] Keep smiling only - i dont expect any answer
by Teófilo Couto 01 Apr '15

01 Apr '15

Same old, same old story, again and again... "They" operate badly developed, badly implemented "sites", full of well known vulns, but the issue, the "bad guy on set," is a tor relay... Typical... -------- Original Message -------- Subject: [tor-relays] Keep smiling only - i dont expect any answer Time (GMT): Apr 01 2015 14:02:00 From: cmar433(a)yandex.com To: tor-relays(a)lists.torproject.org nice abuse :) From: isac(a)kftc.or.kr To: abuse(a)wedos.com Date: 01.04.2015 08:42:07 Subject: [KF/ISAC] Warning! Unauthorized Access Trial! Dear Network Manager : I am a network security manager of Korea Financial Telecommunications and Clearings Institute(KFTC). My job is to protect Korean financial organizations from illegal intrusion attacks. We have received a report of unauthorized access trial originating from your site as shown below. -------------------------------------------------------------------------------- Date/Time(GMT+9): 2015-04-01 12:47:46 ~ 2015-04-01 12:47:46 Source IP : 37.157.192.208 Destination IP : 59.11.68.197 Attack Type : FCKeditor_Vul -------------------------------------------------------------------------------- We are seriously considering notifying these illegal attempts to the related authorities of both your and our countries and requesting proper legal actions. So, please take appropriate measures to identify and stop the attacker. And, please inform us of the results. (isac(a)kftc.or.kr) Thank you for your cooperation. p.s. : If you are not the correct person to deal with this incident, please forward this to the proper person and inform us for future convenience.

2 1

(no subject)
by Franck Marcel 01 Apr '15

01 Apr '15

Re

3 2

New relay not recognised by weathermap
by Sharif Olorin 30 Mar '15

30 Mar '15

Hi all, I configured a new relay[0] yesterday, and recently tried to sign up for the Weathermap[1], wherein I get a "could not locate a Tor node with that fingerprint" error message. The node's definitely been up for more than an hour, and Atlas can see it[2]. Is this expected behaviour, or might it indicate an issue with my configuration? I've checked everything on the "potential problems" list - the node does exist, the fingerprint is correct, it's been up for more than an hour, hasn't been down for over a year, and running a recent (0.2.5.11) version of Tor. Thanks, Sharif [0] dendrocyte.wiredlaboratories.com.au/03B5C7B81CA56DF3CCC31FDA8032A7763B8B50B4 [1] https://weather.torproject.org/subscribe/ [2] https://atlas.torproject.org/#details/03B5C7B81CA56DF3CCC31FDA8032A7763B8B5… -- PGP: 6FB7 ED25 BFCF 3E22 72AE 6E8C 47D4 CE7F 6B9F DF57

2 4

New relay not recognised gy weathermap
by Sebastian Urbach 30 Mar '15

30 Mar '15

Sharuf, I completely forgot to welcome you and thank you for running a relay ! So, welcome and i hope you stay for quite a while :-) -- Sincerely yours / Sincères salutations / M.f.G. Sebastian Urbach ----------------------------------------- Religion is fundamentally opposed to everything I hold in veneration - courage, clear thinking, honesty, fairness, and, above all, love of the truth. ----------------------------------------- Henry Louis Mencken (1880 - 1956), American journalist, essayist, magazine editor, satirist and critic.

1 0

Re: [tor-relays] Installing obfs4 on Raspberry Pi bridge
by jchase 30 Mar '15

30 Mar '15

Thanks for your answer. Your instructions were good and explicit, but you hit on two of the problems I run into. I installed tor 0.2.5.11-1 from torproject.org and got two error messages that I couldn't solve. I would have to go back and re-install 0.2.5.11-1 to tell you what they were. In any case they weren't configuration problems. I had pretty much the same problem months ago when I installed a tor 0.2.5.x on Pi. Which leads me to want to use a raspbian repo. only I am unable to get /etc/apt/sources.list to recognize http://archive.raspbian.org/raspbian/pool/main/t/tor/ (or variations thereof) as a repository. And in my main raspian repo tor doesn't go any higher than 0.2.4.26 . So simply updating tor does not work. How do I add http://archive.raspbian.org/raspbian/pool/main/t/tor/ http://archive.raspbian.org/raspbian/pool/main/o/obfs4proxy/ http://archive.raspbian.org/raspbian/pool/main/libc/libcap2/ as one or more alternative repositories or force an install? Thanks, J. Chase tor-relays-request(a)lists.torproject.org: > Message: 4 > Date: Sun, 29 Mar 2015 00:19:14 +0200 > From: s7r <s7r(a)sky-ip.org> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Installing obfs4 on Raspberry Pi bridge > Message-ID: <551728E2.4030705(a)sky-ip.org> > Content-Type: text/plain; charset=windows-1252 > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA256 > > Hi, > > obfs4 will not run on 0.2.4.x , you need at least 0.2.5.x or 0.2.6.x > > First, upgrade your Tor. > > You can use torproject.org repositories. If you are running wheezy: > > 1. Add the repository: > # echo "deb http://deb.torproject.org/torproject.org wheezy main" >> > /etc/apt/sources.list > > 2. Add the signing key: > # gpg --keyserver keys.gnupg.net --recv 886DDD89; gpg --export > A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add ? > > 3. Install keyring: > # apt-get update && apt-get -y install deb.torproject.org-keyring > > Now upgrade your Tor, an apt-get -y install tor would upgrade to 0.2.5.1 > 1. > > You can install obfs4proxy from deb.torproject.org too: > > # echo "deb http://deb.torproject.org/torproject.org obfs4proxy main" >>> >> /etc/apt/sources.list > # apt-get update && apt-get -y install obfs4proxy > > Now, modify your torrc to enable the obfs4 transport. Make sure you > also add ExtORPort auto in torrc so it will report some useful > statistics. obfs4proxy also supports obfs3, and some users still use > that, so if you can be an obfs3 and obfs4 bridge at the same time > (requires just one more open port) it would be great. > > Sample torrc entry for enabling obfs4 and obfs3: > ExtORPort auto > ServerTransportPlugin obfs3,obfs4 exec /usr/bin/obfs4proxy > ServerTransportListenAddr obfs3 [::]:port > ServerTransportListenAddr obfs4 [::]:port > > To make the bridge even better, you can bind obfs3 and obfs4 to lower > ports (< 1024), if you have them free, such as obfs3 on 80 and obfs4 > on 443 (for example). This will help users behind really restrictive > firewalls who only allow connections on few ports. You can easily do > this with libcap2-bin package: > > # apt-get -y install libcap2-bin > # setcap 'cap_net_bind_service=+ep' /usr/bin/obfs4proxy > > To make this persistent after a reboot, edit the /etc/rc.local file > and add this line before 'exit 0': > setcap 'cap_net_bind_service=+ep' /usr/bin/obfs4proxy > > Hope this helps. If you don't want to use deb.torproject.org, > everything required is also included in raspbian main repo: > > http://archive.raspbian.org/raspbian/pool/main/t/tor/ > http://archive.raspbian.org/raspbian/pool/main/o/obfs4proxy/ > http://archive.raspbian.org/raspbian/pool/main/libc/libcap2/ > > If you want to use raspbian repo, simply ignore the lines where you > add deb.torproject.org to your sources.list file and just upgrade, > install the required packages and modify your torrc file. > > Thanks for running a bridge.

4 3

MY IP adress on blacklist and then in exit relay policy
by Cmar433 30 Mar '15

30 Mar '15

https://globe.torproject.org/#/relay/9DCF76179FCF47224D235ECD4A6165FED22ECE… So, i am running exit node. My provider send me an email .. "This IP is infected with, or is NATting for a machine infected with s_downloaderbot-mxb" Any idea what can i do with this problem ? Now i can see my IP in my server exit policy ... After my "delist action" is clean .. http://www.senderbase.org/lookup/ip/?search_string=37.157.192.208 I need just wait ? And all outgoing packet from my server still droped ? Thanks ..

5 7

Fwd: MY IP adress on blacklist and then in exit relay policy
by Zack Weinberg 30 Mar '15

30 Mar '15

On Mon, Mar 30, 2015 at 12:45 PM, Roger Dingledine <arma(a)mit.edu> wrote: > On Mon, Mar 30, 2015 at 12:23:21PM -0400, Zack Weinberg wrote: >> The only way your exit node's own IP address could be in the exit >> policy is if someone put it there. > > No, this is fine and normal. Tor relays automatically add themselves to > their exit policy by default. Thanks for the correction.

1 0

comparing tor patch levels on different OSes
by Nusenu 29 Mar '15

29 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 I wanted to know whether a particular OS tends to be more likely running outdated* tor releases than another. In case others are interested as well, here is the answer. OSX, OpenBSD and Windows are more likely running outdated tor releases than FreeBSD or Linux. Probably not really surprising.. A more detailed answer: (ordered from bad to better) | OS | outdated_fraction | outdated relays | outdated_cw_fraction | +--------+-------------------+-----------------+----------------------+ | Darwin | 24.6154 | 16 | 0.03 | | NetBSD | 22.2222 | 2 | 0.00 | | OpenBSD| 21.8750 | 14 | 0.05 | | Windows| 17.2189 | 291 | 0.01 | | FreeBSD| 9.1743 | 20 | 0.15 | | Linux | 8.8392 | 597 | 4.29 | (based on onionoo data from 2015-03-27) If you are missing an OS (like SunOS) in the list, than this means that it does not run any outdated release at all (outdated_fraction=0%). *) actually it is about whether the relay uses a recommended version as defined by dir auths https://consensus-health.torproject.org/#recommendedversions I "added" tor 0.2.7.x to the list to avoid flagging bleeding edge relays as outdated. -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVGKLtAAoJEFv7XvVCELh00SwQAJ9KR0DsZ/SaeAJTjbHg2rkU yD7vuyxnJuenoQKkm2IYRTUwKbqPMgLcHqVWGp6y84qMQQMlqLcUnpu11D/6KgGY N6TtpK7qmfploA64/34whQjFUf5mh8++9LjsdyrY3DkCv/6izz01t9KCwev0S40r Ik/2o3bE/v6Yhwrs1jL1kzm+ekTHHj21y6HOQVt9Bbe0Myfqo6jaqcd6Ilt2PDAX FoM5MqWNtrOLbWs5wYesZv6OTAvFGKx5GG0/6sNu/t5R9Z6yk/kkQNWVg87EGyaQ PNIwhXI7lnou4tuYgekqBM9TAY94im6EC789Q3uLj2q/nGzWNcjPpHU+1XCVtSeH dFnAZ/LeKVWMkUr2k08xNegsiN32QizPYW+2EMLpPml9cubTvP+4Y/YVx6Z1RNA+ eg1y6kd5l3ht97WOTTEXe6Wvl1AjHHpW5wGrd36+wpy40Ac9IlJqx2Qei4XrmWDN is9PUDqWCiMRQJCs9WVOKh0dgrdKve2/ipJB4i3O8viN/yzh9VXmzaJXqYa7Dkct CTW90uzVOQ/zM8usGkVJEgef9ICjxKqsPWQnhK68reHPbxZasOVTJ9EsCQZhPBeI MoslvWS/VvgFQ/Wvgj2zjS4LXieNbZMoPnX/SLC5dHyjs6WjGeOFgNslQJwcBNGe Q29d8/zH8q4tKBU5RpI5 =bbrP -----END PGP SIGNATURE-----

1 0

Installing obfs4 on Raspberry Pi bridge
by jchase 29 Mar '15

29 Mar '15

Hello, I run a bridge on a Raspberry Pi running Debian Wheezy and tor 0.2.4.26 . I have obfs3 installed and would like to upgrade to obfs4. So far this has not been possible. If I understand it correctly, my best bet is to update to tor 0.2.6.x and then install obfs4. Let me know if I'm wrong. And if I'm right, what is the easiest way to do that? Thanks, J. Chase

3 2

Re: [tor-relays] Installing obfs4 on Raspberry Pi bridge
by Teófilo Couto 28 Mar '15

28 Mar '15

Interesting and useful tips s7r! Thanks for sharing. Props to all! undertuga -------- Original Message -------- Subject: Re: [tor-relays] Installing obfs4 on Raspberry Pi bridge Time (GMT): Mar 28 2015 22:20:09 From: s7r(a)sky-ip.org To: tor-relays(a)lists.torproject.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi, obfs4 will not run on 0.2.4.x , you need at least 0.2.5.x or 0.2.6.x First, upgrade your Tor. You can use torproject.org repositories. If you are running wheezy: 1. Add the repository: # echo "deb http://deb.torproject.org/torproject.org wheezy main" >> /etc/apt/sources.list 2. Add the signing key: # gpg --keyserver keys.gnupg.net --recv 886DDD89; gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add â 3. Install keyring: # apt-get update && apt-get -y install deb.torproject.org-keyring Now upgrade your Tor, an apt-get -y install tor would upgrade to 0.2.5.1 1. You can install obfs4proxy from deb.torproject.org too: # echo "deb http://deb.torproject.org/torproject.org obfs4proxy main" >> /etc/apt/sources.list # apt-get update && apt-get -y install obfs4proxy Now, modify your torrc to enable the obfs4 transport. Make sure you also add ExtORPort auto in torrc so it will report some useful statistics. obfs4proxy also supports obfs3, and some users still use that, so if you can be an obfs3 and obfs4 bridge at the same time (requires just one more open port) it would be great. Sample torrc entry for enabling obfs4 and obfs3: ExtORPort auto ServerTransportPlugin obfs3,obfs4 exec /usr/bin/obfs4proxy ServerTransportListenAddr obfs3 [::]:port ServerTransportListenAddr obfs4 [::]:port To make the bridge even better, you can bind obfs3 and obfs4 to lower ports (< 1024), if you have them free, such as obfs3 on 80 and obfs4 on 443 (for example). This will help users behind really restrictive firewalls who only allow connections on few ports. You can easily do this with libcap2-bin package: # apt-get -y install libcap2-bin # setcap 'cap_net_bind_service=+ep' /usr/bin/obfs4proxy To make this persistent after a reboot, edit the /etc/rc.local file and add this line before 'exit 0': setcap 'cap_net_bind_service=+ep' /usr/bin/obfs4proxy Hope this helps. If you don't want to use deb.torproject.org, everything required is also included in raspbian main repo: http://archive.raspbian.org/raspbian/pool/main/t/tor/ http://archive.raspbian.org/raspbian/pool/main/o/obfs4proxy/ http://archive.raspbian.org/raspbian/pool/main/libc/libcap2/ If you want to use raspbian repo, simply ignore the lines where you add deb.torproject.org to your sources.list file and just upgrade, install the required packages and modify your torrc file. Thanks for running a bridge. On 3/28/2015 11:47 PM, jchase wrote: > Hello, I run a bridge on a Raspberry Pi running Debian Wheezy and > tor 0.2.4.26 . I have obfs3 installed and would like to upgrade to > obfs4. So far this has not been possible. If I understand it > correctly, my best bet is to update to tor 0.2.6.x and then > install obfs4. Let me know if I'm wrong. And if I'm right, what is > the easiest way to do that? Thanks, J. Chase > _______________________________________________ tor-relays mailing > list tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) iQEcBAEBCAAGBQJVFyjiAAoJEIN/pSyBJlsRd+MH/36/4abGF4/h/4YZuf1TG2sf 0jJLaGt8Tg3c7038+7TbVwj884hvnA/gYaJTr8sPH8+2yuIqyxBfBu5IYNCaTCgT 7beR6KY4tJv1IgoReHUsn/4PLZ6K9vsnFTu08oQwjjolGcdx4BlAbHcsm0pZaGWA yAZlG1GKHGdn77bRHGi9F1ZKthRbMEQmXNV7abZPAbqjVFrTngOo68lDhIv46orP YPAhXx1v08cXZjfS0jcuwwaqhJPfxfP3nJSCNcJPG47ng81/eLWr5JgU3neyPhiN frZa2LCngPEeNlY5bjmaPrm/McmOM2Onrx9rXDEpezrCtAyQeGett2W1u/k+HI8= =VpQT -----END PGP SIGNATURE----- _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

Re: [tor-relays] Globe works fine
by eliaz 28 Mar '15

28 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 > On 3/28/2015 6:41:50 AM, JT Allison (tor(a)arlen.io) wrote: >> That's a mirror. The actual globe site at >> https://globe.torproject.org > works just fine. > > You should contact the owner of that mirror, perhaps whois the > domain and email them. Thanks! Did it. - eliaz -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJVFt3hAAoJEDqas5IE3vgrfGEH/3swR1YRr0v1SKTrQpHF4Z5U 97001YSgUkNUQmq58Wu9rLhmund8he1r04HaZ6gYGFsC8SxPsRu16ZY5WL+5k0m4 C625Y5PTG3x/vQC5eSPaOFfNspTxEh5VLDbmNdZJz3p6QezK20KEgG116g0q9qKr vRWUih40L2Frs9Dfb2feLWEZ24Qa+bt7cf7Vu1/ay+66m671HfaXEfZVW0FAlOuV EVDVOPYQqZ70wwItBkQ20nIwFf7W2bUruZFep1AcBNNvRmaJubVEN3Z7qhp73Qzq bEy57gxeFh+nehcdEb4A7Ej7eg4DhrNfzp8GXjvNe0nscCEAxwwhkwM0vL2vCmA= =ffZ3 -----END PGP SIGNATURE-----

2 1

Globe offline
by eliaz 28 Mar '15

28 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Account suspended? Atlas isn't running so hot either. rats... - eliaz -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJVFl2RAAoJEDqas5IE3vgrpEkIAJhliXOS7VqXN36WkgEceHa+ h61MIFmulErgzlEcLJ71cJlgS9kEpPYlqVdNiOl6xEybjzwgOBfUP8Rg7wtVk7uc CgPr746XE2ld0B3Q4Hs+ZNRDPbrqXoOTCOxAf+1wqE1wQ0wmU3L0+5nhr9qtaTII f6BQKWj3gwoKk+mkc+2xSZKAgmSZm83hY/IEvmEsrdOgfEUiDbdsHVnm/ZmYkR8q FY5QRYbyV3RxNQHsgEXIrIB2CimC0y7ZdgGPN40dbsWT9ZJAjj0b7hhEkCaAnEUp 9SMD1DxA5Qa/I4hNkKTWAkreRoDUGWGC3MoUJ7AYTHMfULPHLmCi+gDxrzzIHgA= =cZB/ -----END PGP SIGNATURE-----

3 4

Monitoring my bridge I
by eliaz 27 Mar '15

27 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Since March 24 globe has been showing no bandwidth usage for my bridge. At the same time I'm measuring non-zero bandwidth locally. These local measurements run about Received ~ 10 x Sent bits. The bridge is connected to live circuits as per atlas. I've had erratic traffic since the powers that be have decreed that bridges be locked into a small number of entry nodes for long periods. when Received ~ Sent & I see traffic, interspersed with periods where Received >> Sent & no traffic. I don't *think* globe is an error, since I'm not reading any client traffic, only pokes from entry nodes. Here is my configuration, which worked fine previously: BridgeRelay 1 ## fteproxy configuration ClientTransportPlugin fte exec TorBrowser\Tor\PluggableTransports \fteproxy --managed # obfsproxy configuration ClientTransportPlugin obfs2,obfs3,scramblesuit exec TorBrowser\Tor \PluggableTransports\obfsproxy managed ## It doesn't seem to matter whether I enable the above portable transports or not. ContactInfo xxx at xxx gpg xxx DataDirectory C:\xxx\tor\TBB installed\Tor Browser\Browser\TorBrowser\Data\Tor DirPort 0 DirReqStatistics 0 ExitPolicy reject *:* GeoIPFile C:\xxx\tor\TBB installed\Tor Browser\Browser\TorBrowser\Data\Tor\geoip GeoIPv6File C:\xxx\tor\TBB installed\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6 Nickname xxx ORPort 443 RelayBandwidthBurst 196608 RelayBandwidthRate 98304 NumCPUs 2 SafeLogging 0 Maybe someone can see if the problem lies in this torrc, Or somewhere else. Or is this behavior just par for the course? Thanks - eliaz -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJVFZ+bAAoJEDqas5IE3vgrYuAH/2+xr8RRHnI7lds5BFvRHC5A S8J6thDyEBGMV40YiEL1l7KHidPVcrEN/a1JjC+x000X1nooESkObkpnjdGrGVTJ Ofx73v36azB0lIIHaSjiSBQx4LqNwk6h7tfVYOAZXD3Ryc9Es1GAiPpnENRUmkMk G+CeLXCwCAt2RLhC3T/olb9tM0VfuQ2LhEk9Fykx2hTlg4gO8YUJa3WA2bkJQ730 0B9Cbp5C7lfU9pYqNGjtbAVyZX5SSo4PWXGrbmV3yfX+Sz/9e75CZHZAF9B03Qai oLSz8XpkP3KfhR9JZ0xKqjPZ1xqj5oQdj2pnXw0nzN++f6crj92XnyO/+vFbTPs= =hdI4 -----END PGP SIGNATURE-----

1 0