- tor-relays - lists.torproject.org

Hardware specs for Tor Relay
by yl 26 Mar '15

26 Mar '15

Hello, I clicked myself a cheap vserver 20 days ago and it runs Tor since then. I mainly did this to play a bit with the relay, try around and so. I took over another relay a while ago, an exit, I don't want to try around on that. It runs well, I got about 4,4 TB data up AND down since then, I have it running with 20-40Mb/s on a 100Mb/s connection (according to the hoster 100Mb/s), it runs as a non exit. CPU load it pretty high all the time according to arm it's about 80-100%, but with htop I can see that only one core of the CPU is busy, the others are not. I figured that the CPU is so busy because the vserver doesn't have AES-NI, which I confirmed by some command I run (forgot the command). So I thought I might wanna move that relay to another server, maybe at the same hoster to get higher data transfer. What hardware specs do you have and is my assumption correct with the AES-NI being one part of the bottleneck? Thanks yl

2 1

Re: [tor-relays] Hardware specs for Tor Relay
by Sebastian Urbach 26 Mar '15

26 Mar '15

On March 26, 2015 8:59:45 PM yl <tor(a)yl.ms> wrote: Hi, > Hello, > I clicked myself a cheap vserver 20 days ago and it runs Tor since then. > I mainly did this to play a bit with the relay, try around and so. I > took over another relay a while ago, an exit, I don't want to try around > on that. > > It runs well, I got about 4,4 TB data up AND down since then, I have it > running with 20-40Mb/s on a 100Mb/s connection (according to the hoster > 100Mb/s), it runs as a non exit. CPU load it pretty high all the time > according to arm it's about 80-100%, but with htop I can see that only > one core of the CPU is busy, the others are not. > > I figured that the CPU is so busy because the vserver doesn't have > AES-NI, which I confirmed by some command I run (forgot the command). Did you ask them if you can get it ? I had a VPS a while ago and they said "we disabled that for compatibility reasons" but if you want it we will turn it on. And they did it for free :-) > > So I thought I might wanna move that relay to another server, maybe at > the same hoster to get higher data transfer. > > What hardware specs do you have and is my assumption correct with the > AES-NI being one part of the bottleneck? It is the no. 1 bottleneck from my experience. I still hope that we are going to see the crypto-multithreading feature at some point in the future. -- Sincerely yours / Sincères salutations / M.f.G. Sebastian Urbach ----------------------------------------- Religion is fundamentally opposed to everything I hold in veneration - courage, clear thinking, honesty, fairness, and, above all, love of the truth. ----------------------------------------- Henry Louis Mencken (1880 - 1956), American journalist, essayist, magazine editor, satirist and critic.

1 0

missing tor-0.2.5.11 package for armhf wheezy
by jensm1 26 Mar '15

26 Mar '15

Hi there, I'm running a relay on my NAS at home and just realised that it's still running on 0.2.5.10. So I went and checked the deb.torproject.org repository for wheezy and found that the tor package hasn't been updated for the armhf-architecture (for the other archs it's fine). Funny enough, the tor-geoipdb package has been updated to 0.2.5.11 which broke it for me, since it depends on tor 0.2.5.11. I hope that's the right place for this, otherwise please point me to where it belongs, thanks!

1 0

Undiagnosable Crashes in Relays
by skyhighatrist 25 Mar '15

25 Mar '15

Hello List, I am wondering if anyone has had their relay randomly crash in the past week or so. Three of mine (I run 6, nonexits) have fallen over. One of them ~5 days ago, one of them ~4 days ago, and one of them earlier today . The logs indicate everything was operating normally, and the only reason I noticed they had crashed was when I was checking what bandwidth globe.torproject was measuring for them it said some were down. The affected relays are as follows: AC9803701F9EE18194D40B38E47CE4C68CF2F567 73067CD4ADD8A294BDA913DF45B63190A52B5F9F D76252B1A6E9F01FC6772CFFB651056A2B54F92B I have no idea why they all fell over, the last thing in the logs was the usual "current status" output with some traffic measuring, seemingly immediately afterwards, the process killed itself for no reason. All of the affected relays are on DigitalOcean droplets. I intend to launch more on EC2 in the near future, however, would like to know if anyone else has experienced relay instability issues over the past few days incase its something nasty like a denial of service attempt or something. Nothing on the boxes indicates any kind of compromise, just the usual bruteforce activity from the usual actors. I have decided to start writing a "Shitty Monitoring System" to copy logs down to my local box every hour or so and HUP tor at the same time as a kind of countermeasure incase its simply a resource use issue or something, however, would love to know if anyone else has been having similar issues lately. Regards, .d

5 8

Public Tor Socks port
by yl 25 Mar '15

25 Mar '15

Hello, I wonder what is the reason not to offer the socks port publicly to users as an entrance point to the tor network? Assume you run a tor exit or relay on a public server and you enable the socks port and listen on 0.0.0.0 or so and accept all incomming connections. Then you post the socks port publicly. What are the reasons not to do so? Thanks yl

3 3

Tor-Tshirts
by Nchinda Nchinda 24 Mar '15

24 Mar '15

Is there still someone at Tor Weather managing tshirt distribution? I've been running a two fairly large relays for a couple months, although I also wouldn't mind paying for an official tor shirt. My email to Tor Weather went unanswered. https://atlas.torproject.org/#details/C1CFB375BED9D7506569E07B01753BC67EE87… https://atlas.torproject.org/#details/CAB78BF9BD73536DCB55E5BC98D5F3AAB45CF… Nchinda^2 -0.1743*kg^6 m^4 mol s^-14 Computer Scientist the light flares at this node

7 9

Help finding relay bottleneck
by James Murphy 23 Mar '15

23 Mar '15

I'm running the relay https://globe.torproject.org/#/relay/18EAAF7CB6C2ABE8583841D305C06A509F8C1C… and am getting substantially lower rates than expected after almost 3 months. I'm on a 1Gbps down/1Gbps up line but my middle relay is just barely creeping upwards of 5Mbps. This is NOT a problem of less bandwidth after receiving the guard flag, and I have read the lifecycle of a new relay documentation. I cannot find the bottleneck in my setup and was wondering if there are any good tools I could use to find where it is. I've read https://www.torservers.net/wiki/setup/server and https://wiki.archlinux.org/index.php/tor for tips on speeding things up, but nothing has proven successful. Things I have considered: CPU usage: hovers around 5-10%, using NumCPUs 2 Mem usage: 195 MB (10%), using DisableAllSwap 1 Using AvoidDiskWrites 1 to avoid SSD stress Rate/Burst limits at 20MB (160mbps) Using dd if=/dev/urandom of=rand bs=64M count=16 iflag=fullblock to create a 1GB file I test copying this file to/from another machine on my LAN using scp 100% 1024MB 28.4MB/s 00:36 to copy to the relay (307 Mbps) 100% 1024MB 53.9MB/s 00:19 to download from the relay (431.2 Mbps) Okay so not full 1Gbps speeds, but still an order of magnitude higher than the 5Mbps my relay is using, so the problem doesn't look like it is the router or gigabit switch on my LAN. I've also raised the maximum number of open file descriptors for the debian-tor user. In /etc/security/limits.conf I added debian-tor soft nofile 65000 debian-tor hard nofile 65000 I'm not sure if this worked because (even after reboot) sudo -u debian-tor bash ulimit -Hn returns 4096. I would say that is the problem, but looking in /proc/torPID/fd and doing ls -l | wc -l returns 1591, so I'm not hitting the limit of 4096. In any case, if you know why my limits.conf doesn't appear to have taken effect, let me know. I've also added other optimizations from the torservers wiki. My /etc/sysctl.conf is http://paste.debian.net/162765/ Thanks for the help, James Murphy

5 7

Ideas for the further development of TorServers
by Jens Kubieziel 23 Mar '15

23 Mar '15

Hi, during our relay operators meeting in Valencia as well as in IRC/XMPP we were discussing the future way of TorServers. Some of you had some good ideas and I started to put them into a list. TorServers will try to apply for funding this year as our current funding will expire or has expired. So we plan to integrate some or all of the ideas into our application and help you as relay operators. The current version of the list is at <URL:https://pad.systemli.org/p/ukMTrpwf6Yzv>. I'll add some more text in the next days. Feel free to add some comments, ideas, wishes etc. -- Jens Kubieziel http://www.kubieziel.de Ich würde gern leben wie ein armer Mann mit einem Haufen Geld. Pablo Picasso

2 2

Re: [tor-relays] Tor Cloud/AWS relay set up but no Tor installed
by SiNA Rabbani 22 Mar '15

22 Mar '15

Hi allicoder, The images on Tor Cloud website have not been updated for a while. The project is lacking someone that can keep it up to date. I tried to take on the responsibility but so far I have failed to dedicate the necessary time. Sorry for the bad experience. As far as the specific problem with the Cloud image itself, there is a script that is supposed to install the relay on first boot. See /etc/rc.local. You can also find that script here: https://gitweb.torproject.org/tor-cloud.git/plain/ec2-prep.sh There are a couple of issues with the script itself that I noticed immediately: 1) the harcoded pgp key is expired 2) the debian experimental repository is returning a 404 W: Failed to fetch http://deb.torproject.org/torproject.org/dists/experimental-precise/main/bi… 404 Not Found [IP: 38.229.72.16 80] If you wish to do some trouble-shooting, try to get these commands to run without any errors: sudo apt-get -y update sudo apt-get -y upgrade sudo bash /etc/ec2-prep.sh bridge Finally, now that you have a running image and ssh access, you can just follow the Tor relay installations here: https://www.torproject.org/docs/debian.html.en I apologize for the inconvenience and thank you for running a relay. All the best, Sina "Be the change that you wish to see in the world." - Mahatma Gandhi ----- On Mar 21, 2015, at 11:10 PM, aredocilla(a)gmail.com wrote: > Hello, > > I've been trying to set up a tor relay on AWS using the free tier using the > instructions in various places (e.g. https://cloud.torproject.org/, > https://www.fak3r.com/2012/08/11/howto-run-a-tor-node-in-the-cloud-for-free/) > But sshing in from my PC shows clearly that not only is tor not running, it's > not even installed! > > ubuntu@ip-172-31-28-207:~$ aptitude show tor > Package: tor > State: not installed > Version: 0.2.5.11-1~precise+1 > Priority: optional > Section: net > ... > > ubuntu@ip-172-31-28-207:~$ ps -ely | grep tor > ubuntu@ip-172-31-28-207:~$ ls /var/log > alternatives.log auth.log btmp dist-upgrade dmesg.0 dmesg.2.gz > fsck landscape mail.err news udev unattended-upgrades wtmp > apt boot.log cloud-init.log dmesg dmesg.1.gz dpkg.log > kern.log lastlog mail.log syslog ufw.log upstart > > Has something changed, and the images no longer include tor on start-up (I made > sure I followed the gist of the cloud.torproject.org steps, given that the > interface has changed significantly; even went to the previous page from the > linked one to check that the AMI thing mentioned tor)? I've noticed various > people have posted online saying it's not safe to run Tor on cloud services - > has the image been deleted because of this? I wanted to try it anyway because > the main torproject website still says in several places that running a relay > on AWS is A Good Thing. > > Or did I just do something wrong? > > Best wishes, > allicoder. > > -- > PGP key available on request > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

Tor Cloud/AWS relay set up but no Tor installed
by aredocilla＠gmail.com 21 Mar '15

21 Mar '15

Hello, I've been trying to set up a tor relay on AWS using the free tier using the instructions in various places (e.g. https://cloud.torproject.org/, https://www.fak3r.com/2012/08/11/howto-run-a-tor-node-in-the-cloud-for-free/) But sshing in from my PC shows clearly that not only is tor not running, it's not even installed! ubuntu@ip-172-31-28-207:~$ aptitude show tor Package: tor State: not installed Version: 0.2.5.11-1~precise+1 Priority: optional Section: net ... ubuntu@ip-172-31-28-207:~$ ps -ely | grep tor ubuntu@ip-172-31-28-207:~$ ls /var/log alternatives.log auth.log btmp dist-upgrade dmesg.0 dmesg.2.gz fsck landscape mail.err news udev unattended-upgrades wtmp apt boot.log cloud-init.log dmesg dmesg.1.gz dpkg.log kern.log lastlog mail.log syslog ufw.log upstart Has something changed, and the images no longer include tor on start-up (I made sure I followed the gist of the cloud.torproject.org steps, given that the interface has changed significantly; even went to the previous page from the linked one to check that the AMI thing mentioned tor)? I've noticed various people have posted online saying it's not safe to run Tor on cloud services - has the image been deleted because of this? I wanted to try it anyway because the main torproject website still says in several places that running a relay on AWS is A Good Thing. Or did I just do something wrong? Best wishes, allicoder. -- PGP key available on request

1 0

Re: [tor-relays] IPv6 HiddenServicePort
by teor 21 Mar '15

21 Mar '15

> On Fri, 20 Mar 2015 17:24:11 -0400, Manas Bhatnagar <b.manas.88(a)gmail.com> wrote: > > Hello, > > Hi, I'm looking for some support with accessing a hidden service that is > listening on [::1]:11001 > I am able to connect to the listener locally but the hidden service > doesn't seem to work. any ideas? > The time on the machine is accurate and connections to other hidden > services succeeds. > > Thanks, > Manas I suspect we're going to need some more specific information about what's failing before we can help. It would also help to know how much experience you have configuring hidden services. I'm sorry if I've pitched this at the wrong level, but I just want to start by making sure we have the same setup in mind when we talk about hidden services: Direct Connection: Client connects to [::1]:11001 client -[TCP/IPv?]-> server Hidden Service Connection: Client connects to foo...abc.onion:12345 via a local tor client socks proxy, which connects to a tor hidden service over onion routing, which connects to [::1]:11001 client -[socks/TCP/IPv?]-> tor client ---[onion routing/TCP/IPv4]---> tor hidden service -[TCP/IPv6]-> server Does your configuration match this? Can you answer the following questions about what you see? (It might help to answer them in order, stopping when you find the first error.) Configuration: - Are you using a testing, a private, or the public Tor network? - How is the hidden service configured? (please send us the hidden service torrc) Alternative Configurations: - What happens when you have the server listen on IPv4 rather than IPv6, and change the hidden service to connect to IPv4? - Can you connect to: -- Other hidden services on the same (globally routable) IP? -- Other hidden services in the same tor instance? Observed Behaviour: - Does the hidden service bootstrap fully, without errors? (arm and logs will help here) - What error do you get when you try to connect to the hidden service? -- Does the tor client fail to find a descriptor or introduction point for the hidden service? -- Does the hidden service tor instance refuse connections? -- Does the server refuse connections? -- Is the server accepting the connection but failing to respond? -- (You'll need to look in the client and hidden service logs to find out.) That should be more than enough :-) teor teor2345 at gmail dot com pgp 0xABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR C3C57B23 349825DE 929A1DEF C3531C25 A32287ED

1 0

IPv6 HiddenServicePort
by Manas Bhatnagar 20 Mar '15

20 Mar '15

Hello, Hi, I'm looking for some support with accessing a hidden service that is listening on [::1]:11001 I am able to connect to the listener locally but the hidden service doesn't seem to work. any ideas? The time on the machine is accurate and connections to other hidden services succeeds. Thanks, Manas

1 0

misconfigured advertised bandwidth? (rohan & theoden)
by Nusenu 19 Mar '15

19 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, first off, thanks for running tor relays! While playing around with compass.torproject.org I noticed your relays (theoden and rohan) because according to their advertised/observed bandwidth they are the fastest in the entire network: adv bw: rohan: 363.32 MB/s theoden: 191.44 MB/s but the graphs show different values: rohan: ~20MB/s theoden: ~10MB/s So I'm curious how come that their advertised/observed bw is so much higher. Can you share some insights? thanks, Nusenu theoden https://atlas.torproject.org/#details/4EA0464A1B8D4231F176BA2FA1BCBF0A26F12… rohan https://atlas.torproject.org/#details/F528DED21EACD2E4E9301EC0AABD370EDCAD2… There is another relay that has similar characteristics but doesn't have your contactInfo, is this also one of your relays? kraken https://atlas.torproject.org/#details/8901B1D2D4C0D3398C3F8363247B5AABF3136… -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVCwtqAAoJEFv7XvVCELh0rkoP/joevoducupu6nJAwwmL+nLe 6DgEH9L9zppbucuhFck4B4R745LB+N9mQdNUViU0farKThPjcC0CiSaFuvf+ePso BtucGUBTRcvLlp6ns/Fnc6jJjjflzOs/4OX5a+vUal+CUrStDP1jDCX9QCvqdZZo gAMA668FkUucTdGb48NECtu7qe/riiu3A718jLrNWgXSQ1z7ABedLVRY1bBYMxdn 0WM+ysHerm0aF8qVyHJmKto8hxMOyEIxd3D9kgPj/B89vU1hu/R25xKaXkWZVf61 +b4KbQjsMW1fezaWjztMsXxW+uM2xQP7GHUDhDIdLrGC36tjq9oODJ8USYBtlnz1 LDB8hv5TWoDI7H+XngD6z5GgGBf7lW1ePrRKyxywoBZwdNXHgJzZcYQHh6kPs8Mx L3+48TcNhSutZvY1pgBsuJq08oWki/0XVOdZUQYEV5N4P5fvvvmjASK/p3qW1tGB gRw0p9KbtSOoeeW/e7rq/9ilxRbEZ/HAgp7sfKSHYEcFLK+TyYJkexPs0xKTPHtx pAU0ehpYGtT/H+XAWPPV4WrPlCd4V2Lm82Ibhx7QaBEmaXoBGWnF4vOewUX3gkKp GDSi5rRu0bXaDo18WlEZU5FiwUGKuSetASjlteIq4dSBKWszEF5uu29XIOYR7x/K zNzjzegm3jfe8rmBCaur =2SgD -----END PGP SIGNATURE-----

1 0

tor network "marked share" - tor relays grouped by contact
by Nusenu 18 Mar '15

18 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, I'm playing a bit with compass to add additional grouping functionality (#6675, ..). Group by based on MyFamily would be important but for now here a sample output of the poor version based on the contactInfo field. (json data from today) These files are hand-crafted since ContactInfo fields tend to be rather long.. https://raw.githubusercontent.com/nusenu/misc-files/master/tor-relays_by_co… https://raw.githubusercontent.com/nusenu/misc-files/master/tor-relays_by_co… Kudos to torpids (aka diversity master?) for running 35 relays in 30 unique /16 networks and 29 unique ASes! After seeing 'ipredator' and 'becks' CW vs. BW values I'd like to have sorting based on 'observed_bandwidth' rather than CW.. -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVChekAAoJEFv7XvVCELh0taUP/1rF3366BWuQkmP22jo2dPhL SfP0Bol5XYEJsYn2Ras2CEhDNLDTwuQ3VplS2KKjAuMqEHo9xlQaIU9/vR2kQOQg M/A+vtstif79R/Xt7IwQNK9Cn/o0ADMq3q81CmvcUkGc61v1bPnPeDIb53MWLUmK PP7NTh1vYREbM/wBy+UOQtQ/MNm/6SIy6oMWO8eUR6rrx1pLDdxkc6YwITgrwKeW 25il+WI7LOHJ0mP9Bw1m6XkDVAZOjYlJgY6P8FL6ZwgXKy+5sLEBjmDqlo3K2gj+ UpmMjYE4BJaZeYvbQcomRhj8Rhcv3HXFTi+5mgOU3OM3cPY1OCCQl1JmGmA64pEy sRWb+Qi00gba20IGw9OfXTJjnvve4Le8MKsC8XVR8lq5OJH0l0bkL9duS3ABF3Lo jnSfpPAGaEs8KxBmHQVkSNs2FwzbrCcbEE62ef3eC3cTwkXprjeoEhd169AEy7iE GOLVuubkIENPrW38iJ9Klsh633Nyo+/GjQLZbZlmrwgvA10LaKTGnekFe6qOWGP2 qLJckuNjNITpCHafhyWx/snjc4KnUg+adtEXdVvFnTG10Yu/LSbCVrHzbbhjtBoN 0xO4lgaTEocQLCoPX8Z9Mqsm1Dej3N7ypQtkEdyw7ykU2IGsIwDbwoUdve3Tbp51 8r6jPBzLkudrE9jWe7k0 =p2dX -----END PGP SIGNATURE-----

1 0

Meeting notes of the relay operators meeting in Valencia
by Jens Kubieziel 17 Mar '15

17 Mar '15

Hi, below you find my notes for the relay operators meeting we had in Valencia. Those just some short notes. If you have any questions or remarks, please don't hesitate. * Introduction Several Tor relay operators met at Tor Developer meeting in Valencia, Spain. At our meeting we had operators from the following countries: - Germany - Netherlands - France - Spain - India - Costa Rica This document gives a short overview what we discussed. If you have any questions or comments don't hesitate. * DDoS attacks: One questions which was raised is what to do against DDoS attacks. Several ISPs complained about DDoS attacks against Tor relays. There were also shutdowns of servers. It was suggested to employ DDoS mitigation tools. Other operators suggested to don't do anything. It is better to educate the ISP about Tor. Do you have any experiences with this topic? * Abuse TorServers has templates for different cases of abuse. See [[https://www.torservers.net/wiki/abuse/templates]] The Tor Project offers also some advice in their wiki. See [[https://trac.torproject.org/projects/tor/wiki/doc/TorAbuseTemplates]] Furthermore several organisations developed their own templates. Someone at the meeting offered to review others templates. As a general advice one should start with thanking the person and acknowledge what they do. TODO: We should rephrase some of the templates and generate some hice, good example documents. * Bridges The current alpha release of Tor Browser Bundle 4.5 comes with support for obfs4. Currently there are only few bridges which use obfs4 and everyone is asked to enable the new protocol. Obfs3 doesn't really work in China and obfs4 is the current best bet. If you have any questions about obfs4 you should have a look at the documentation or write an email to Yawning (<yawning(a)torproject.org>). Some links: - How to run an obfs4 bridge: https://tor.stackexchange.com/q/6370/88 - Debian package: https://packages.debian.org/search?keywords=obfs4proxy - Post at tor-relays: https://lists.torproject.org/pipermail/tor-relays/2014-September/005372.html * Tor relays in Japan It is legal to run relays in Japan, but practically it depends on ISP. So if you know a person in Japan, encourage them to run a Tor relay. It was said that relays from SE asia went online for some time and slowed down the overall network. Jens talked to Mike Perry who couldn't remember such incident and also couldn't believe that this is true. * Relays in India There are some relays in India, some of them probably in universities and some very slow. A home connection is 60/60MB/s and capped at 8GB/80GB per month. I couldn't really understand what the correct numbers were. * How to make nodes faster Someone had a 10Gig which link was not used. It was recommended to use multiple processes; one process per core. So also hints at https://blog.torproject.org/blog/lifecycle-of-a-new-relay * Tor wheather Several peopel work on Tor weather. The status is not clear. However there is some need for a working version. * ARM devices We found out that several organisation have utilised some ARM device. Juris from Torservers runs a Bananapi at a data center and gets 30-40MB/s. DFRI has a router which they give away to interested persons. Jacob Appelbaum made a combination of Relay and Router. Merlijn suggested that Hardkernel has some faster ones which fit for exit relays. We want to work more closely together to create some neat device. * Stats on exits Someone asked if it is OK to run statistics on exit relays. As long as the tools only monitor the amount of traffic this is OK. Looking into exit traffic or even messing with the traffic would instantly qualify you as a bad exit. * Legal issues + Germany has no data retention law in place + data retention in the Netherlands: court case said illegal, try to make a law + France: https://netzpolitik.org/2015/franzoesischer-patriot-act-ueberwachungsmassna… (yes, data retention since 2011) + article 12 of ecommerce directive + Costa Rica has no data retention law * World Hosting Days + Who is interested to go there? * TODO - Work on templates - How many DMCA notices do you get? Can you give Jens some monthly numbers together with the exit probability of your relays? An EFF person wanted to collect some numbers. Jens will relay those numbers. - run obfs4 bridges -- Jens Kubieziel http://www.kubieziel.de

2 2

Tor-node/relay: System installation vs. TorBrowser
by Lars Edman ＠ LinuxSuSE 17 Mar '15

17 Mar '15

Hi! I was referred to you from help(a)rt.torproject.org. when asking them if they discouraged from using tor as a client or node/relay with tor in a system installation. By "system installation" I mean installation of tor, libevent, libgeoip (and ev vidalia) together with openssl. I found they today absolutely discouraged from the use of such a "system installation" when using tor as a client. When it came to using tor as a node/relay or running a server they referred the question to you. My reason for asking is that I have been running a "system installed" tor node in my Slackware server for 3 years now. subsequently updating/grading them. It has served well and I monitor the log continously for warnings or errors correcting the when they very rarely occur (usually by updating/_grading). My reason for using a system installation for node/server use is that I've found it easier to configure the way I wanted than the BrowserBundle. Do you consider this kind of installation insecure? Best regards Larse

6 5

List of longest lived Exits and Relays
by grarpamp 17 Mar '15

17 Mar '15

Is there a list somewhere (preferably on metrics) of exits and relays sorted by longest period of service (years) on the same IP? Preferably this would subset by exit policy... whether open, or using some published, named, and adopted "standard" exit policy. Such as "reduced" (whatever that means, each version should be reflected in the name "reduced-N").

2 1

connection problems
by Malte Ketelsen 17 Mar '15

17 Mar '15

Hey, I have connection problems with my relay. Can someone tell whats this mean: Mar 16 23:59:12.000 [debug] TLS error: unexpected close while reading (SSL negotiation finished successfully) Mar 16 23:59:12.000 [debug] channel_close_for_error(): Closing channel 0x7fe72b1a41c0 due to lower-layer error Mar 16 23:59:12.000 [debug] channel_change_state(): Changing state of channel 0x7fe72b1a41c0 (global ID 79) from "closing" to "channel error" I get a lot of these news.

1 0

Tor server received reload signal
by cmar433＠yandex.com 17 Mar '15

17 Mar '15

Hi all, its normal situation ? every day on 2:49:02 AM my server received HUP signal. I checked all possible logs but i have no idea why. https://globe.torproject.org/#/relay/9DCF76179FCF47224D235ECD4A6165FED22ECE… Thank in advance for proposal :-) Cmar

2 2

Many inbound and outbound connections but no circuits
by mattia 16 Mar '15

16 Mar '15

Hello, I've been running a relay for some weeks. It has now earned the stable flag. Despite this I always have more than 500 inbound and outbound connections but no circuits at all. Is this normal?

2 3

keeping tor relays operational
by Larry Brandt 15 Mar '15

15 Mar '15

Sorry if this question has been answered dozens of times before. I have a middle relay that has been operational since last summer. I wish to make some alterations to my torrc file and make these changes operationally active without stopping and restarting tor. Is this possible? I experience a bit of down time whenever I up bandwidth, change contact info, etc. I'm also disapointed when ubuntu sends updates that require a server restart. What is the best method to handle this on a stand-alone server? LB

5 5

IP Address change detected wrongly (Our IP Address has changed)
by Sasikantha babu 14 Mar '15

14 Mar '15

Hi all, Today on my relay I observed the below messages 2 hours back. Tor reported address change from IP_IN_INDIA to IP_IN_FRANCE from SRC_1. The next second SRC_2 reported address change from IP_IN_FRANCE to IP_IN_INDIA . How could it be possible?. Is this a normal behavior?. Mar 10 08:06:52 NoNameForHost Tor[27279]: Our IP Address has changed from <MY_IP_INDIA> to <IP_IN_FRANCE>; rebuilding descriptor (source: SOURCE_IP_1__). Mar 10 08:06:53 NoNameForHost Tor[27279]: Our IP Address has changed from <IP_IN_FRANCE> to <MY_IP_INDIA>; rebuilding descriptor (source: SOURCE_IP_2__). PS: I'm not posting IP addresses but If you somebody wants the IP address too I will post them. Thanks

3 4

Using /dev/hwrng
by Imse Vimse 14 Mar '15

14 Mar '15

Hello. Would enabling the hardware random number generator on a relay node be usefull in terms of increased performance? If so, is it enough to activate /dev/hwrnd or is some configuration and/or recompilation required? Regards

2 2

PGP-Key for Debian Repo
by Sven Reissmann 12 Mar '15

12 Mar '15

Hi, I'm not able to fetch the pgp key for the debian repo, as described here: https://www.torproject.org/docs/debian.html.en $ gpg --keyserver keys.gnupg.net --recv 886DDD89 gpg: requesting key 886DDD89 from hkp server keys.gnupg.net ?: keys.gnupg.net: Host not found gpgkeys: HTTP fetch error 7: couldn't connect: Success gpg: no valid OpenPGP data found. gpg: Total number processed: 0 Is there a problem on my side? Could anyone check this and give me feedback please? Regards, Sven. -- PGP Key: https://0x80.io/pub/files/key.asc PGP Key Fingerprint: 2DF2 79CD 48DD 4D38 F0B6 7557 2E68 D557 49AA 1D99 Note: I'll be transitioning away from this key in the near future.

4 5

Legal situation of tor in Europe
by oneofthem＠riseup.net 12 Mar '15

12 Mar '15

Hi, Can someone point me to an overview of the different legal situations for running tor relays in European countries? I'm especially interested how the situation differs per country. Best, John

15 25

How to troubleshoot obfs4 bridge?
by Tim Sammut 12 Mar '15

12 Mar '15

Hi. I've configured my bridge to support obfs3 and obfs4 transports using the debian obfs4proxy package from http://deb.torproject.org/torproject.org. Connecting to the bridge using TBB 4.5a4 works for obfs3 but not obfs4. TBB produces this error: [warn] Proxy Client: unable to connect to x.x.x.x:41980 ("server rejected connection") The bridge line I am supplying to TBB looks like: bridge obfs4 x.x.x.x:41980 On the bridge side, it looks like the bridge is listening for obfs3 and obfs4 via the following log entries: Tor[21544]: Registered server transport 'obfs3' at '[::]:51161' Tor[21544]: Registered server transport 'obfs4' at '[::]:41980' The relevant parts of my bridge config are: ORPort 443 ExtORPort auto BridgeRelay 1 ServerTransportPlugin obfs3,obfs4 exec /usr/bin/obfs4proxy Should this be working? How can I troubleshoot this? Thanks! hope you are well tim -- Tim Sammut ~ @t1msammut ~ tim(a)teamsammut.com

2 1

Keeping your obfsproxy up to date
by Linus Nordberg 12 Mar '15

12 Mar '15

Hi list, I just found out that my obfsproxy relays didn't obfsproxy any more. I was apparently running a pretty old version, installed from source. How do you people keep your obfsproxies (and pyptlib) up to date? Are there packages? Is there a list or some other channel where new versions are announced that I'm not paying attention to? Thanks, Linus

2 2

Tor RPM packages now come with multi-instance support (since v0.2.6.4-rc) -- please test them
by Nusenu 11 Mar '15

11 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, Tor RPM packages (starting with version 0.2.6.4-rc) now come with multi-instance support [1]. This makes it easier for everyone running more than one tor instance on a system. A short mini how-to for relay ops that would like to use this: service tor stop 1) create the folder: /etc/tor/enabled 2) move all your *.torrc files in this folder (they have to have the .torrc file suffix) 3) create the file '/etc/default/tor' and place the following line in it: MULTI_INSTANCE="yes" 4) make sure you have tor RPM packages v0.2.6.4-rc or higher finally: service tor start will start one tor instance per exiting /etc/tor/*.torrc file (each file is checked using --verify-config first). Note: /etc/tor/torrc will be ignored in multi-instance mode. Maybe we can add documentation to comments in /etc/default/tor.. The init.d script supports "selective" commands: Lets say you only want to restart the instances that are defined in the following two torrc files: /etc/tor/enabled/tor22.torrc /etc/tor/enabled/tor443.torrc you can do that with: service tor restart tor22 tor443 Please consider testing the new packages if you run already multiple instances today. If your instances do not start for unknown reasons please run 'tail -f /var/log/audit/audit.log' while staring them and file a bug (include the log lines and whether it works in SELinux permissive mode). Thanks to Ondrej for merging this! now lets hope for the debian packages [1] before 0.2.6.x is released, Nusenu [1] https://trac.torproject.org/projects/tor/ticket/14996 [2] https://trac.torproject.org/projects/tor/ticket/14995 -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVALjtAAoJEFv7XvVCELh0Z5EP/1707hburFFHAFlls3KIY0t8 O3g7MDSgB+D0cgTOgwLCow+8+vtvLi4aUIH+ajCVeTRipQCHKtW/yczLVKDrGfnP GDicf7RzQbVwmgYyuKx2aL5d+1euybklWB49Wsq+t0A7Um5VC93BXIY6v3Psx8wS qHGLOEJVmpWP5/hOT4yJ9rjpjnMxUyQFfavD6Tj0+dJhkDRfK3dCmV2bUU7gUjb/ EaQoGbJPsG90OcW2Wel0HRAFQFnRNjPjOVc5E26FD2MKyTXr/d0Em4bR9uJJpHEn z79+I31zcaQu+lluKwkBfqoXOpotgA5uzXjBbstMXQd1LAoBTXdWWEg2dUkMK456 OCJ9KmHo7qXyanHThoSq0wHDDwHu3UCu4g6lOPZNFaCVDaVHGsyF/VbtqyvnzrYz 815wV8Kd/mv/yXumlJ3lSaNjAunAN/ocDTXxhGmDuTBYGiElw9KUlec8As0B8Dfe eo5d25rzTfsbOFcSo+vWj3wFP4D5IqvGoTR/jdVXVl2JgzM9eqD44CuZ3x12xXKS DbMCIdWogvuxNfaFd02JKQbAO9ZUZZvyT7hy5LKGZ1gXgi/eH/tyiBrKPGYDky14 2X87gQ3W3zaAwW0k2bX23WHBhvM0djFBRPDlldxZUdPmUzPh/bwPYRdwLk0Tj5mQ 4EC7l5KB9Sj3nrrkjXAw =kzZi -----END PGP SIGNATURE-----

2 3

Huge drop in consensus and bandwith usage
by mattia 10 Mar '15

10 Mar '15

Hi everyone! I've been running a relay ( 0D14A4498E7D1854696CC07548653EA4CD3CB2DA ) for more about 3 weeks now. Its lifecycle did not follow the path explained in the famous "Lifecycle of a relay" blog post - I think because the same fingerprint was previously used by the same server configured as a bridge. My network capacity should be around 10Mbps (20Mbps nominal) in download. While consensus and bandwith usage have been growing for the first days and then got stable (more than 200KB/s), since two days both values have been dropping extremely (https://globe.torproject.org/#/relay/0D14A4498E7D1854696CC07548653EA4CD3CB2…) The uptime is little because not knowing what to do I tried rebooting the system - it did not help. What could this be caused by? Thanks in advance Mattia

1 0

Yourserver.se - Your TOR exit node generates too many complaints
by Vinicius 10 Mar '15

10 Mar '15

Hello to All, I am currently running two tor exit relays[1] in providor yourserver.se, all of them with restrict exit policy, until now i didnt have any problem with those, except with their's automated system implemented, in use by yourserver.se, but was easy to solve, that happend some month's ago. Recently i receive a couple(2 actually) of complaints comming from Hetzner[2], complaining about port's scans comming from the tor exit relay, and i did reply all of those, but now the operator Michael is telling me that it received to much complaints and i should stop the exit or they will suspend, does someone have any other vps providor that can be recommended for sure that it doesn't do that. I dont mind if the price is more than 100% higher of the currently providor. Thank you. Sorry about my crappy english. [1] - https://atlas.torproject.org/#search/vinicius [2] - http://www.hetzner.de/ On 06/03/2015 04:07 AM, Yourserver.se wrote: > [1] Hello, > > Your TOR exit node generates too many complaints. > Please stop it or we will have to suspend that server. > > Thank you for understanding. > > Michael. > > Links: > ------ > [1] http://yourserver.se

2 5

relay behind reverse proxy
by efkin 10 Mar '15

10 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hello tor ^.^ i'm trying to setup a tor relay behind a nginx reverse proxy... i would like to know if it's correctly setup. i have this warn in the logs: [warn] Received http status code 404 ("Not found") from server '85.14.240.188:443' while fetching "/tor/keys/fp/27B6B5996C426270A5C95488AA5BCEB6BCC86956". but then in the same log little bit after: [notice] Tor has successfully opened a circuit. Looks like client functionality is working. last message is : Now checking whether ORPort X.X.X.X:9001 is reachable... (this may take up to 20 minutes -- look for log messages indicating success) thx for support. it's a great community! efkin -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQIcBAEBAgAGBQJU/YgvAAoJEL+Ak/R8rmeLwtwQAIaWSA0Q6df1kGEV3qpO3A71 NoGbnFfs0/0fjDfRIPdf7lSDZQslaCq1IggPbv5VBTpH4JoQrqQx7jzUizKeulC+ H75JLznVCTs0FBNn+YW3k/VZ1mpe4yN0RX321TynKZB7U5J6O9ZRA2c+oJqk8MCp oiyugu2KIUJqScaGR6FxxOsj9Ff1wM57E2LzDmsa69A2GMY11vCJ020qBzKh0+cX Q9/DmhHTJKyB23IjRb5YCFQ4+F1LG/htRVQ4iIUuMyY7UVY690hCZ3d7TbWHVe/z lcdm3gDsXGxkS6weECv9oA5JyLdhs9kskCRCwbF/fy3z154C5VzxiXa7I8MUyWyC iplCzwPynA94tbX4TO1CHYYuV9gjJDUDmR3MVE34BeNKv7bYH718B1noTI0zUSIW vwH0upIGNTmseC7adCrm7TFfnIOJAHzEflcCdJAfNXSuUHsYqSjAMV6yyPe67zv0 EFVfZDJ1ksdXs1ZtnX2sSIRwe3ujCduem8Hu7eVeggP4OFvMh63geiI5W0ftO35r ZJTASUO8LAjHyRkYDnibbVRX/xRN2ko3ORt5Wl4eNCjxG3qQea4m7tqDIba2Mq05 XTZ+F3w2NYoW6qekxH9/D+12Yd4KaUTyNseRuLaT7LSfdQ38l2eBeW/dfgbQfNgC +DANKk94I5db85HzzXoY =PZ5W -----END PGP SIGNATURE-----

2 6

Re: [tor-relays] Onion Tip Uptime?
by Sebastian Urbach 08 Mar '15

08 Mar '15

On March 8, 2015 3:13:29 PM Corey Wood <corky(a)corky.me.uk> wrote: Hi Corey, > Hi all, i've been noticing over the last few days oniontip.com has been > flaky. As I'm writing this the site is down again. Does anyone have > contact with some of the developers, because it's a really cool project > and I want to know what's going on Main dev is Donncha O'Cearbhaill and he is a member of this list. You can reach him here: donncha(a)donncha.is Donncha, if you need hardware / bandwidth then please just say so. I hereby volunteer :-) Im sure that most Ops want to see oniontip up and running. -- Sincerely yours / Sincères salutations / M.f.G. Sebastian Urbach ----------------------------------------- Religion is fundamentally opposed to everything I hold in veneration - courage, clear thinking, honesty, fairness, and, above all, love of the truth. ----------------------------------------- Henry Louis Mencken (1880 - 1956), American journalist, essayist, magazine editor, satirist and critic.

2 2

Consensus dropped after 0.2.6.3-alpha upgrade
by relayops＠mail2tor.com 08 Mar '15

08 Mar '15

Any ideas why? Slowly dropped after upgrading. https://atlas.torproject.org/#details/113FCC01A29B4600A8BAA1CB72E6AB1FD899A…

2 2

Onion Tip Uptime?
by Corey Wood 08 Mar '15

08 Mar '15

Hi all, i've been noticing over the last few days oniontip.com has been flaky. As I'm writing this the site is down again. Does anyone have contact with some of the developers, because it's a really cool project and I want to know what's going on. Corey Wood

1 0

multi tor instance support for startup scripts
by Nusenu 07 Mar '15

07 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 I just filed two tickets to add support for multiple tor instances to the official deb/rpm packages. I think this is useful for many relay operators (so they don't have to replace the init scripts themselves anymore). https://trac.torproject.org/projects/tor/ticket/14995 https://trac.torproject.org/projects/tor/ticket/14996 another ticket for tor alpha users: https://trac.torproject.org/projects/tor/ticket/14997 -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJU6zp8AAoJEFv7XvVCELh0mIQP/06x9Ag6N3bb+RxTyt41x8TV lEIcX9JzROZoCHS+bO17BavAHMFJiCRBbCahqT5XHMbE/aXaW0bKP7cjstZxZkxJ uGEXot8z8m3x5YVtb2a5taFwD0wjIJZJBTR0+kJ6waFvs/z7Zh04dRtvXMc9SXeJ gMCGVByIJlJQgdb3CVKgqWSlfiaYrblyY8r7YXu540Qm73yuDcVEVPvH+rudxMot hiDHD/AgC2mgfjzhJSiBCThAakWuBzm/xEDsnJxqQUQL27FYhbCGR49rTxx5rZqx X6+HaZXyvjEh/EkCbevpfNgo4WGAKdGrGTUCzTssPjT9CchqUMRrZAlTe/vpNZpR NuMnKT0z3DFQDO4qsUtplNzSBUmrGTanDqQOnGxMBwcBajx9pWFJsnozb7OBU1LR FL1RJAeZfC7TQUa0r/6/V9gbXrPSoZsI5rK3sSZSa8yLu/OUBRXk4gK36/NXO0at Fq1tM48PNIVolkU/hhb3iYFiyU3d2Qng79iGGzO7mo3/OPsqVKASie6USsiVSDmh nu2IzpXzHKO6+iI3pOn4t6UoEJG2oKmpirH1LhfNKmcJMsH8dLLYDsJWoSKjwfNG ereJB6/0b47sirXUHIPPAXhxEgCW0U26PfUlIvYEjLQ924FgIkjMKfilJJnJXI9O lA8Rpo6ziL6MTcMYkjRX =JmDz -----END PGP SIGNATURE-----

5 13

Re: [tor-relays] 0.2.5.10 / 0.2.6.x and ticket 9682
by Sebastian Urbach 07 Mar '15

07 Mar '15

On March 6, 2015 11:32:01 PM Tom van der Woerdt <info(a)tvdw.eu> wrote: Hi Tom, > Sebastian Urbach schreef op 06/03/15 om 21:52: > > Dear list members, > > > > I hope that some of you compared 0.2.5.10 with 0.2.6.x regarding the > > performance (ticket 9682). How big/small is the difference in the wild ? > > I would appreciate it if someone with Linux / BSD could say a few words ;-) > > > > Hi Sebastian, > > As far as I can tell the change happened between 0.2.6.2 and 0.2.6.3 so > I'll describe the performance difference between those. You're right, got 0.2.5.10 stuck in my head because it's the last stable release ;-) The patch came up with 0.2.6.3, indeed. > > Just had a look on a server of mine that is bottlenecked by the CPU. I > noticed that there was indeed a big drop in CPU usage. However, there > was also a similar drop in network usage, most likely caused by the > restart. It took about a week to fully recover to normal levels. > > It is incredibly hard to tell from the data whether there was a big > performance difference as a direct result of the 0.2.6.2->0.2.6.3 > upgrade. It's definitely not going to be a 10% improvement, as far as I > can tell. Hard to tell pretty much says it all :-( Not much of a change. Now the multithread feature becomes the last hope :-) > > Despite my nodes all running with 'NumCPUs 2', none of the worker queues > seem to be doing much : > > $ ps H -o etime,time,args -u toranon | grep node2 > 3-01:46:17 1-20:35:33 /usr/bin/tor -f /etc/tor/torrc-node2 > 3-01:46:13 00:17:09 /usr/bin/tor -f /etc/tor/torrc-node2 > 3-01:46:13 00:17:09 /usr/bin/tor -f /etc/tor/torrc-node2 > > If those threads are what the patch addressed, I'm afraid it's not going > to have a massive impact. > > In case it's relevant: these measurements are taken from an exit relay > with two processes each doing ~150Mbit/s (x2 if you count up+down). > > Upgrade was done at 2015-02-24 21:26, relevant graphs : > * cpu: > http://www.imgdumper.nl/uploads8/54fa2a823bc62/54fa2a823434f-cpu.png > * network: > http://www.imgdumper.nl/uploads8/54fa2a8ce3db5/54fa2a8cdd05c-if_eth1.png Thanks gor your reply, domehow i expected it zo be more of a boost after reading Nick's text: https://blog.torproject.org/blog/coming-tor-026 -- Sincerely yours / Sincères salutations / M.f.G. Sebastian Urbach ----------------------------------------- Religion is fundamentally opposed to everything I hold in veneration - courage, clear thinking, honesty, fairness, and, above all, love of the truth. ----------------------------------------- Henry Louis Mencken (1880 - 1956), American journalist, essayist, magazine editor, satirist and critic.

2 1

0.2.5.10 / 0.2.6.x and ticket 9682
by Sebastian Urbach 06 Mar '15

06 Mar '15

Dear list members, I hope that some of you compared 0.2.5.10 with 0.2.6.x regarding the performance (ticket 9682). How big/small is the difference in the wild ? I would appreciate it if someone with Linux / BSD could say a few words ;-) -- Sincerely yours / Sincères salutations / M.f.G. Sebastian Urbach ----------------------------------------- Religion is fundamentally opposed to everything I hold in veneration - courage, clear thinking, honesty, fairness, and, above all, love of the truth. ----------------------------------------- Henry Louis Mencken (1880 - 1956), American journalist, essayist, magazine editor, satirist and critic.

2 1

Ports 443 and 80 are open, but 443 not Tor reachable
by oseump 06 Mar '15

06 Mar '15

Thank you very much for your suggestion which pointed me in the right direction. It was my router that was grabbing port 443. A very helpful page on the Draytek website explains how to forward TCP Port 443 - for SSL VPN models. I had asked Virgin Media about running Tor and no objection was raised. I was told they do not block any ports.. Again, many thanks.

5 4

Re: [tor-relays] New relay operator. Basic security practices?
by relay_acab＠openmailbox.org 04 Mar '15

04 Mar '15

> I wrote this recently: > > https://gist.github.com/plsql/49e642d5bce835df2946 > > Thanks so much for considering security! It's a very important and > often > neglected aspect of Tor relay operation. > > Let me know what you think of the document. > > Libertas I just started to look at it, but it seems to be EXACTLY what I was looking for. Thank you so much! +-- relayacab +--

1 0

Legal Troubles
by Thomas White 04 Mar '15

04 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hey all, I am just doing some planning for my own exits at the moment and researching the legal provisions and experience for a variety of jurisdictions. If anyone has any experience of raids as a result of running a Tor relay or other legal troubles, I'd appreciate it if you got in touch (privately preferably) for a quick chat. Of course any information supplied will be kept anonymous unless you are explicitly happy to make a statement openly about it. Sharing our experiences will certainly help us understand the climate much better. Regards, T - -- Activist, anarchist and a bit of a dreamer. Keybase: https://keybase.io/thomaswhite PGP Keys: https://www.thecthulhu.com/pgp-keys/ Current Fingerprint: BA81 407C BD61 CD15 E5D9 ADA9 5FA2 426F F34E 0FD4 Master Fingerprint: DDEF AB9B 1962 5D09 4264 2558 1F23 39B7 EF10 09F0 Twitter: @CthulhuSec XMPP: thecthulhu at jabber.ccc.de XMPP-OTR: 4321B19F A9A3462C FE64BAC7 294C8A7E A53CC966 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBAgAGBQJU9wF8AAoJEF+iQm/zTg/ULJcQAJsrVYjdBpXiIGKcN7fFuDzm RqttupBoTifsKpWfX46lgnSAquZQ6qDMqT2zBZ0fe7fni1vfp/E9bld8ryLTLvoK to47exo08HLj+9H6ZaVwirdRC94GHYOViCE/4BMm0VWEXrFww5ytAuCrukhIzK/Z QS/Lgu3tI/BubHS02hkI5sZNO9Ej9T4wlYREyRdldI7j4zBP/FhQCEfJY5g0U3gb AnW2Go+ItINuFLsccr9m/uCuIwBz6o/WNHgLp8B4wU2T9hvWNxc/h1P5Y9l5RrWx N9/wgCT1K8Dw8OjvdfUchzbcOQo8C+1aWbYPy0eK7v+5V8PyCrU4DGtvJRO36iNV TcpxXRFcsAjOGYOo1bMDF6g2sLj3T22zoS76BNTtq7F7i1JDkDHY3j2uXHG0Ex2j hPVFsjHDr4+qqfS98knW4bpLjEOnYZUMrvuSE5iQG1ngMqFV1mpWZVHbWQozL3cb ZXm9kxY9HeVCwyc4a2V+TWY2QvYIaVaMTaXyUfh8lOTshrnPV3KagLozaaAWHS/u KFEbDfF0iJFD6muvxbu0yVRsIcrkPryJDjlGcbxH3pKEntaZgXVK/MJB6X/TLNsI l2KC4OlCeW2sScNc9epiAy15HgNswWvKbwM6WjreNf+sbZ/7vvSrLcNXdzoRHBwt +evkDqeeobkhAWPMlBU+ =vv6k -----END PGP SIGNATURE-----

3 2

Ports 443 and 80 are open, but 443 not Tor reachable
by oseump 04 Mar '15

04 Mar '15

Hello everyone, this is my first post, and would be very grateful for help. My Tor relay (0.2.5.10 and now compiled from source) has had a checkered history since I installed it, first on an Efika MX in December (which proved unstable), and then on a Raspberry Pi model 2 (Linux 3.18.8-v7+) starting a couple or so weeks ago. In trying to follow recommendations, and wanting to be helpful to less fortunate souls, I changed from the usual ORPort 9001 and DirPort 9030 (which worked) to ports 443 and 80 respectively. I now know that this is a pathway to misery and sorrow. With ORPort 443 Tor could not confirm the port was reachable even though it was wide open to online port checkers and nmap -sT -O localhost shows ports 22/tcp, 80/tcp, 443/tcp to be open. And yet torstatus monitors show many relays displaying ports ORPOrt 443 and DirPort 80 running on Linux. Yesterday I swapped the ports and within a moment ORPort 80 was confirmed and server descriptor published. DirPort 443 fails to confirm it is reachable. sudo iptables -L -nv Chain INPUT (policy DROP 4328 packets, 200K bytes)  pkts bytes target     prot opt in     out     source               destination  144K   60M ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0   91861   23M ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80  4711 1087K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443 1497K  202M ACCEPT     all  --  *      *       192.168.1.0/24       0.0.0..0/0       0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8 1221K 1521M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)  pkts bytes target     prot opt in     out     source               destination Chain OUTPUT (policy ACCEPT 2929K packets, 1979M bytes)  pkts bytes target     prot opt in     out     source               destination So what is it about port 443 on my little RP 2 that Tor dislikes?

2 1

New relay operator. Basic security practices?
by relay_acab＠openmailbox.org 04 Mar '15

04 Mar '15

Hello all. I'm running a new relay, relayacab, at apexy in DE on a minimal Debian 7 OS. Is there a best practices guide for basic security setup? This is my first time operating a remote machine, running a relay, and having any public service to harden. So I'd really like to take this opportunity to do this the right way and continue on a productive path in supporting the tor network. Thanks! +-- relayacab +-- https://atlas.torproject.org/#details/18002B828F1E9237B616DE8C8968F4E6C7520…

3 2

Re: [tor-relays] New relay operator. Basic security practices?
by JusticeRage 04 Mar '15

04 Mar '15

This email ( link to the blog post ) was powted a while ago on the Full Disclosure mailing list. Some of the advice only applies to Desktop computers, but I find it's still a very good read in the general case. -- Justicerage ???----- Original Message ----- ????From: "Joshua Rogers" <megamansec(a)gmail.com> To: fulldisclosure(a)seclists.org Sent: Saturday, June 14, 2014 7:22:14 PM Subject: [FD] Securing Ubuntu-Desktop From the Bad-Guys, and the Good-Guys. ?????Securing Ubuntu-Desktop From the Bad-Guys, and the Good-Guys. Securing your Ubuntu Desktop OS from intruders Recently I have become interested in securing my laptop from predators such as hackers, thieves, and law enforcement. To do this, I've explored various programs to run; and how to run them, without interrupting usability by the average user. In this blog we'll be running through vectors of attacks that one could use to gain access to your unencrypted data. Before starting, the following must be known: 1. The author of this article is currently running Ubuntu 14.04 LTS(Trusty), and all commands and patches work on it for the author. The author accepts no liability when it comes to these commands/patches being run by other users; this is purely informational. 2. It is assumed Full-Disk-Encryption is being used. 3. It is assumed your $HOME directory is encrypted using ecryptfs, with filenames encrypted. This can be checked using the command `ecryptfs-verify -h -e' 4. It is assumed you do not have the evil program called Java, or any of its counterparts like IcedTea, etc. installed. When you're told to run the program 'Nano', you can use vim,vi,emacs, etc. Nano is purely the text editor that I use. To exit out of Nano, you press control-x. FireWire attacks Firewire has for awhile been known to allow attackers to gain access to a computer's Physical memor[RAM], and enable the attacker to grab the encryption key used for devices that are mounted. The most obvious method of defeating this attack is by not compiling the kernel with any firewire modules included, but for the sake of this article, I'll include methods of mitigation. After all, some Ubuntu users probably wouldn't be able to compile their own kernel every update. To mitigate the risks with firewire, we will disable them in a blacklist file in modprobe.d. 1. Open up /etc/modprobe.d/blacklist-firewire.conf by running `sudo nano /etc/modprobe.d/blacklist-firewire.conf' 2. Remove the contents(or comment everything out) and replace it with the following: ? <http://blog.internot.info/2014/06/securing-ubuntu-desktop-from-bad-guys.htm…> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 |# Prevent automatic loading of firewire module(s).| |blacklist ohci1394| |blacklist sbp2| |blacklist dv1394| |blacklist raw1394| |blacklist video1394| |blacklist firewire-ohci| |blacklist firewire-sbp2| |blacklist firewire-core| |blacklist firewire-net| |blacklist firewire-serial| |# Prevent manual loading of firewire module(s).| |install ohchi1394 false| |install sbp2 false| |install dv1394 false| |install raw1394 false| |install video1394 false| |install firewire-ohci false| |install firewire-sbp2 false| |install firewire-core false| |install firewire-net false| |install firewire-serial false| This will 1. blacklist all the firewire modules from starting at boot, and 2. prevent loading of firewire through forceful techniques. After doing this, you *must* run `sudo update-initramfs -k all -u' for it to take effect on next boot. Hardening Firefox The abilities of web-browsers are not only astounding, but also extremely vulnerable. With 0-day exploits being found for nearly everything, the bad guys are always looking for ways to exploit your browser. Methods used to exploit browsers are usually split up into two parts: exploiting the actual browser, and exploiting addon(such as Adblock and Acrobat Reader). Using the method I describe should mitigate most, if not all techniques involved in the exploitation of Firefox, and addons used. Most services when installed create a user for themselves, where they cannot escape from without some sort of local root kernel exploit. Unlike services, firefox is normally run at the same permissions as the user running it, which entails an attacker to be able to gain the same permissions of the user. With access, an attacker could record the keystrokes of the user, and wait until they run 'sudo' to gain root access(or, god forbid, somebody has nopasswd enabled on their account.) By creating a user specifically for firefox, we lock it into its own folder where it [shouldn't be able to] escape. First off, we want to create our new user called 'firefox'. 1. Run 'sudo adduser --system --quiet --shell /bin/false --group --disabled-password --disabled-login firefox' in the terminal. The commandline(and all references to) 'firefox' is a link to /usr/bin/firefox, which is just a launcher script, so we can move that to something like 'firefox-start'. 2. Run `sudo mv /usr/bin/firefox /usr/bin/firefox-start' in the terminal. Now we want to recreate the firefox file, and make it execute as our 'firefox' user, with all of the parameters that it normally would. To do this, we must make a script to be run when using the command 'firefox'. We have two options here. We either make a very simple script to run Firefox as the 'firefox' user, or we use some X11 trickery. The problem with the first, is that an experienced hacker could control *all* X11 activity. Including logging keystrokes, injecting keystrokes, taking screenshots, etc. The problem with the second, is that extensions such as XRANDR will not work. Another highly problematic downside is that you cannot copy-and-paste from your browser into another application. You can copy-and-paste from other applications into the browser, but not the other way around. This makes it incredibly difficult if you want to copy, for example, a quote from Wikipedia into an email. Due to not having a solution to this, I've decided to show you how to do both. ----- Vulnerable Method This method gives the reader a very easy way of doing things, and is probably OK for the average user. Open up /usr/bin/firefox, which should now be an empty file, and place a script in it so it will run firefox was the user 'firefox'. 3[.1]. sudo nano /usr/bin/firefox And enter the script: ? <http://blog.internot.info/2014/06/securing-ubuntu-desktop-from-bad-guys.htm…> 1 2 |#!/bin/bash| |sudo -H -u firefox ||"/usr/bin/firefox-start"| |"$@"| The -H flag is used to tell the system that we want to set our home directory to /home/firefox/. -u is used to tell the system that we want to run the program as the user 'firefox', and the last two flags tell the system to run /usr/bin/firefox-start(the REAL firefox script) with the flags $@, which means it will run with whatever /usr/bin/firefox was run with. We need to allow the 'firefox' user to access X, so we go to "System -> Preferences -> Startup Applications" and add a new startup program. The name and comment is irrelevant, but the command should be this: ? <http://blog.internot.info/2014/06/securing-ubuntu-desktop-from-bad-guys.htm…> 1 |xhost +SI:localuser:firefox| ----- 'Paranoid' Method This method, as stated above, stops the user from copy-and-pasting from the browser into a different program. It is much more safe, and is considered secure. 3[.2]. Run `sudo nano /usr/bin/firefox', and put in.. ? <http://blog.internot.info/2014/06/securing-ubuntu-desktop-from-bad-guys.htm…> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |#!/bin/bash| |xa=||"/home/firefox/.Xauthority"| |exec| |newgrp firefox <<-EOF| | ||if| |[ -e ||"$xa"| |]; then| | ||if| |[ ! -r ||"$xa"| |]; then| | ||rm -f ||"$xa"| | ||elif [ ! -w ||"$xa"| |]; then| | ||mv ||"$xa"| |"$xa.tmp"| |&& cp ||"$xa.tmp"| |"$xa"| |&& rm -f ||"$xa.tmp"| |&& ||chmod| |660 ||"$xa"| | ||fi| | ||fi &&| | ||xauth -q -i -f ||"$xa"| |generate ||"$DISPLAY"| |. ||"untrusted"| |&& ||chmod| |g+rw ||"$xa"| |&&| | ||sudo -H -u firefox XAUTHORITY=||"$xa"| |"/usr/bin/firefox-start"| |"$@"| |EOF| This script will run every time you open up firefox. Now we need to make the file executable. [4]. Run `sudo chmod +x /usr/bin/firefox'. As you can see in the script, it relies on the usage of the 'newgrp' program being able to access the 'firefox' group. To do this, you must add yourself into the 'firefox' group. [5]. Run `sudo useradd -a -G firefox $USER'. This will add you into the group of 'firefox'. You will now need to reboot to make this come into effect. To allow changes to be made by groups, you must run a chmod command on the user folder. [6]. Run `chmod -R g+rwxs ~firefox' This allows anybody in the 'firefox' group is make changes in the /home/firefox/ directory. ----- Now you can run 'firefox', and it'll run the browser as the user 'firefox', not as your user. Yay! We got most likely the hardest part finished. Audio I, like many of you probably do, like to play music in my browser. Whether it be through HTML5, or Flash. But since our new user 'firefox' isn't part of the 'audio' group, we must add ourselves to it. [?]. Run `sudo usermod -a -G audio firefox' Now with another reboot(or logout), audio should be able to be played. Finally, due to multiple users using PULSE(your account, and then flash in the 'firefox' user), we have to set up 'firefox' to use a slave server, and your real user as the master. First of all, we want to copy the default pulseaudio settings to your home directory. [?]. Run `mkdir ~/.pulse/ ; cp /etc/pulse/default.pa ~/.pulse/' Now edit it. [?]. Run `nano ~/.pulse/default.pa' Add to the bottom of the file: "load-module module-native-protocol-tcp auth-ip-acl=127.0.0.1" and save. And that's it. Firefox will automatically use use that as a master server, thus becoming a slave. There are probably security implications to do with this, but they would be minor.(At most, listening to microphone, which I doubt anyways) Addons Although mostly un-important, it might interest some people to install some addons in Firefox to enhance your browsing privacy. These include: Adblock Edge <https://addons.mozilla.org/en-US/firefox/addon/adblock-edge/> - Basically AdBlock without the whitelisted ads. Removes ads & unwanted elements on webpages. Recommend using https://www.fanboy.co.nz/ <https://www.fanboy.co.nz/>in conjunction too. HTTPS-Everywhere <https://www.eff.org/https-everywhere> - Trys to use HTTPS/SSL on webpages known to work with them. BetterPrivacy <https://addons.mozilla.org/en-US/firefox/addon/betterprivacy/> - Handles long-term, non-HTTP cookies such as flash cookies.(In options, make sure 'Always ask' is unchecked.) User Agent Switcher <https://addons.mozilla.org/en-US/firefox/addon/user-agent-switcher/> - Makes it possible for you to change your User-Agent to something else. Download http://techpatterns.com/downloads/firefox/useragentswitcher.xml and import it through the application in Firefox(Edit User-Agents). Smart Referer<https://www.blogger.com/> - Only sets referrer if staying on the same page. In the page "about:addons"(type it into your URL-bar), go to "Plugins", and make sure everything is set to "Ask to Activate". In the page "about:config"(type it into your URL-bar), set geo.enabled to false(double click on it if it's true), set network.dns.disablePrefetch to true, set network.websocket.enabled to false, MAC-Address Although not necessarily a security risk, your MAC Address may be used for tracking, and later identification. To do this, we use an interesting program called macchanger <https://github.com/alobbs/macchanger>. Macchanger, created by "Alvaro Lopez Ortega <https://github.com/alobbs>", is a program that quickly and easily spoofs your mac address. Although a new and updated version of macchanger exists on Github, we'll be using the repository's version. We actually need to install macchange. To do so: 1. Run `sudo apt-get install macchanger' Although originally I wanted to set up a script to change the mac address every time you connected to a wireless network, I encountered a problem. The default network manager in Ubuntu, NetworkManager, deprecated pre-up, and post-down. The developers have said that <https://bugs.launchpad.net/ubuntu/+source/network-manager/+bug/336736> they will not be bringing it back either. Interestingly, many of the commenters on the invalid bug-report page also inquire the removal, as they also were trying to use macchanger. By creating an init script, we can make the program 'macchanger' run on boot. 1. Run `sudo nano /etc/init.d/changemac', and insert the following: ? <http://blog.internot.info/2014/06/securing-ubuntu-desktop-from-bad-guys.htm…> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |#!/bin/bash| |# Disable the network devices| |ifconfig eth0 down| |ifconfig wlan0 down| |# Spoof the mac addresses| |/usr/bin/macchanger -a eth0| |/usr/bin/macchanger -a wlan0| |# Re-enable the devices| |ifconfig eth0 up| |ifconfig wlan0 up| |exit| |0| Make sure to make it executable(`sudo chmod +x /etc/init.d/changemac'). This script will, on boot, take down wlan0 and eth0, change their mac-addresses, and then bring them back up. If need be, edit eth0 and wlan0 for your respective names on your system. We now must actually the script run on boot. This can be done by running 'update-rc.d'. 2. Run `sudo update-rc.d changemac defaults 10' On each reboot, your mac address should change, without any implications in regard to connectivity. Anti-Viruses It's commonly said by in-experienced users of all distributions that Linux cannot get viruses(Mac users also say this). But in reality, they can get viruses, but it's rare. As described here <https://help.ubuntu.com/community/Linuxvirus>, many Linux Trojans/Viruses/Worms have been made, but with little success. Although there is little chance of actually getting one, it's considered a good gesture to others, for you to scan for viruses. -- "If you are going to trade files in a Windows world, you'll need to scan those files for viruses. You won't get infected, but you may help infect someone else." i.e; You may forward an email through your email that contains a windows virus. Some Windows viruses can also be run through Wine. We'll be using ClamAV, an open-source anti-virus program. We first have to install it. 1. Run `sudo apt-get install clamav clamtk clamav-daemon' Once finished installing, we must update our 'AntiVirus definitions'. 2. Run `sudo freshclam' This may take awhile. ClamAV can be run in three ways:Manually in the terminal, manually through a GUI, or as a daemon. I'm going to run it as a GUI. It can be run as a GUI by opening the terminal and typing running `clamtk'. When you open clamtk, you're showed options in regard to how you want to run ClamAV. It's very simple and needs no explanation. You can set up an automatic schedule for scanning in Advanced->Scheduler. Originally, I wanted to make it so that Firefox would scan all downloaded files using ClamAV. I found the addon Fireclam <https://addons.mozilla.org/en-US/firefox/addon/fireclam/> which is a Firefox mod that scans downloaded files through ClamAV, and gives you a warning if it returns anything. The problem with it, is that on download, Firefox freezes for 3-5 seconds while the scan is actually going on. This is a huge inconvenience and to me makes it unusable. I'm keeping it up here purely to show that it exists. ClamAV can also be set-up with Thunderbird. *Note: ClamAV does _not_ delete any files. That's up to you. It purely notifies you to the existence.** * DNSCrypt Something a lot of people don't realize is that DNS is completely unencrypted. We're going to add encryption which will prevent spying. To do this, we're going to use OpenDNS's <http://www.opendns.com/about/innovations/dnscrypt/>DNSCrypt <http://dnscrypt.org/>. So, we want to download the current version, dnscrypt-proxy-1.4.0 <http://download.dnscrypt.org/dnscrypt-proxy/dnscrypt-proxy-1.4.0.tar.bz2>. 1. Run `sudo add-apt-repository ppa:shnatsel/dnscrypt' 2. Run `sudo apt-get update' 3. Run `software-properties-gtk', go to "Other Software", and tick the source-code option for shnatsel/dnscrypt. Now we want to confirm that the ppa is actually secure. To do this.. 4. Run `sudo apt-get source --download-only dnscrypt-proxy' Generate a SHA256 signature for the source. 5. Run `sha256sum dnscrypt-proxy_1.4.0.orig.tar.bz2' Pull the official signature from the DNSCrypt website. 6. Run `dig +short +dnssec TXT dnscrypt-proxy-1.4.0.tar.bz2.download.dnscrypt.org' Now compare the results. If they're the same, you're ready to go. Now actually installing, and setting everything up. 7. Run `sudo apt-get install dnscrypt-proxy' 8. Run `nm-connection-editor', and edit your connection. Go to IPv4 Settings and select 'Automatic (DHCP) addresses only' for the "Method". In the DNS servers, set it to: 127.0.0.2 This will make it so that by default, 127.0.0.2 is used for DNS. Due to a bug(?) in apparmor, you must run the following commands: 9. Run `sudo apt-get install apparmor-utils ; sudo aa-complain /etc/apparmor.d/usr.sbin.dnscrypt-proxy' Now to setup dnscrypt, and make it start on startup. 10. Run `sudo nano /etc/init.d/dnscrypt' and put in: ? <http://blog.internot.info/2014/06/securing-ubuntu-desktop-from-bad-guys.htm…> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 |#!/bin/sh| |# This is ||for| |the file /etc/init.d/dnscrypt| |### BEGIN INIT INFO| |# Provides: dnscrypt| |# Required-Start: ||$all| |# Required-Stop: ||$all| |# Default-Start: 2 3 4 5| |# Default-Stop: 0 1 6| |# Short-Description: DNSCrypt ||for| |OpenDNS| |# Description: Launch the dnscrypt to communicate with OpenDNS| |### ||END| |INIT INFO| |DAEMON=||"/usr/sbin/dnscrypt-proxy"| |NAME=||"dnscrypt"| |dnscrypt_start()| |{| | ||echo| |"Starting dnscrypt"| | ||dnscrypt-proxy -u nobody -R opendns --local-port=53 --local-address=127.0.0.2 --daemonize | |}| |dnscrypt_stop()| |{| | ||echo| |"Stopping dnscrypt"| | ||start-stop-daemon --oknodo --stop --quiet --retry=0/3/KILL/3 --||exec| |"$DAEMON"| |> /dev/null| |}| |case| |"$1"| |in| | ||start)| | ||dnscrypt_start| | ||;;| | ||stop)| | ||dnscrypt_stop| | ||;;| | ||restart|force-reload)| | ||dnscrypt_stop| | ||dnscrypt_start| | ||;;| | ||*)| | ||echo| |"Usage: /etc/init.d/$NAME {start|stop|restart|force-reload}"| |>&2| | ||exit| |1| | ||;;| |esac| |exit| |0| 11. Run `sudo chmod +x /etc/init.d/dnscrypt', and `sudo update-rc.d dnscrypt defaults'. Finally, we must edit /etc/default/dnscrypt-proxy. 12. Run `sudo nano /etc/default/dnscrypt-proxy' Make sure that the "local-address" is set to "127.0.0.2:53", "resolvconf" is set to "on", and "user" is set to "nobody", And then reboot. Now you'll be resolving with encryption. You can confirm you're using it correctly by going to http://www.opendns.com/welcome/. You can also run `sudo tcpdump -i any -n -A 208.67.220.220', which will display the ASCII output of the packets going in/out of port 443(since it uses port 443, not 53). You can then run `dig debug.opendns.com' in another terminal, and you should see encrypted text through tcpdump. Make sure that /nonexistent exists, and is chowned to nobody:nogroup(`sudo sudo chown nobody:nogroup /nonexistent') *Evil-Maid Attacks*** I won't be covering prevention of evil-maid attacks in this post due to the limitation of what one can actually do to prevent against an evil-maid attack. However, one example of what you can do is moving the boot partition in Ubuntu to a secure USB stick. A guide on how to do this can be found here <http://newspaint.wordpress.com/2013/11/30/moving-linux-boot-partition-to-us…>. But in reality, if somebody is able to tamper with your computer while it's not in your possession, they could install a hardware keylogger <https://en.wikipedia.org/wiki/Hardware_keylogger> to get your encryption key. ColdBoot Attacks Again, I won't be covering much when it comes to coldboot attacks. Most computers these days use DDR3 ram, which as far as I can find, aren't vulnerable to coldboot attacks. I will however give recommendations to stop the theoretical attack. 1. Set an Administrator password for the BIOS. Although this wouldn't help if an attacker were to take the ram out of your system, and put it into theirs then dump it, it will delay how long it takes for the ram to be dumped. 2. Turn off Quickboot/Fastboot in your BIOS. Not all computers support this, but some do. By turning off Quickboot/Fastboot, your system will 'check' the memory on boot, thus overwriting everything. * * * * * * * * * * * * * * * * Unrelated * * *File Removal* As most readers will know, deleting files through usual methods(and the command `rm') only remove the "links" to the files contents on the harddrive. To remove files securely, you can use the program BleachBit <http://bleachbit.sourceforge.net/>. You can install it by running `sudo apt-get install bleachbit'. To securely delete a file, run `bleachbit -s file.txt'. It can also be used on directories. Once of the problems with 'secure file removal', is that it only 'securely'(?) deletes the current contents of files. If the file has been edited at all, then reminisce of it may still exist. <http://4.bp.blogspot.com/-V5DA2D3vF0o/U5w-W2eH8VI/AAAAAAAAAJk/ty-v0Wgzmcc/s…> Credit: BleachBit This diagram explains it well; using secure removal tools, only the green blocks would be removed. The red blocks are old versions of the files. To deal with this, and delete all un-used disk space, you can use BleachBit as a cleaner. To do this, you can run `sudo bleachbit -o -c system.free_disk_space'. *NOTE:* This will take a long time to use your harddrive. It creates a file with random data that fills up the harddrive, then deletes it. If you're using an SSD, *_DO NOT_* use this. Bleachbit can also be used for other things. you can view them by running `bleachbit --gui'. With all of these security measures implemented, I am confident that my computer is fairly secure from external, and remote hackers. It's much more of a hobbyist thing. If you really need good secure, use Tails <https://tails.boum.org/>. After all, one could always torture you for access. <https://xkcd.com/538/> I've personally done everything that is shown in this blog, as well as participate in 'good practise', such as shutting down my computer when I'm not using it. Full: Securing Ubuntu-Desktop From the Bad-Guys, and the Good-Guys. <http://blog.internot.info/2014/06/securing-ubuntu-desktop-from-bad-guys.html> _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/

1 0

are relays susceptible to the latest OpenSSL "freak" attack
by starlight.2015q1＠binnacle.cx 04 Mar '15

04 Mar '15

Cipher-downgrade CVE-2015-0204 fixed in OpenSSL 1.0.1k. usual sensational write-up courtesy of El-Reg http://theregister.co.uk/security For operators who don't obsess over "non-critical" OpenSSL releases, is it time to catch up?

2 1

7 relays gone because of spammers
by Speak Freely 03 Mar '15

03 Mar '15

Hello fellow relay runners, This morning OVH decided to kill 7 of my relays due to spamming, and block all access to all services. I ran the Reduced Exit policy for all of my relays. Due to heightened concerns about this affecting other unrelated services I have with OVH, I had to shut down the other 3 relays. They may eventually re-appear as middle-relays. This has cost me hundreds of dollars, as I foolishly decided to prepay on an annual basis. None of the servers were older than 2 months. Some were only a few weeks old. The Abuse department's rationale is as follows: "Your account was suspended because 100% of your IPs are blacklisted on multiples lists for Spam and other malicious activities. This case is closed and this decision is final." ---------------------------------------------------------------------- When I first contacted OVH regarding running Tor relays, this was the response that I received from them, which does not mesh with what just happened. "Good morning Matt, I'm very glad to here from you. It is very flattering to hear that you are very satisfied by our service at OVH! We do take our network speed and hardware performance very seriously here. We are proud of our infrastructure that we have built over the years. I do understand your concerns about setting up a Tor relay on one of our VPS. In a simple form, yes you can. We do let our customers use our VPS as Tor relays. We have no problem in letting you this. However, your are allowed to use Tor but it will be at your own risk. Rest assure that, in case of an abuse, we will not terminate your account without notice. In fact we may not even terminate your VPS. You will receive a warning from our Abuse department giving you a choice to resolve the abuse case. Like you said, we are in a world where free speech is constantly under attack and we are committed to help as much as possible to protect this fundamental right that we all have. We will absolutely not in any case share our customers information or data to authorities without a warrant. For any other questions or concerns, feel free to contact us at any time. We are available 24/7. Good luck with that privacy project of yours and keep on supporting the cause of free speech! Thank you for contacting OVH and have a wonderful day! Colin K. Customer Advocate" ---------------------------------------------------------------------- Not that it matters anymore, but each relay was dedicated to one of the victims of the Charlie Hebdo attack. https://atlas.torproject.org/#search/4charlie ---------------------------------------------------------------------- Eventually I will get back at this... But for now, my money is gone, and all my hard work is lost. ---------------------------------------------------------------------- So... I know I'm new. And it's possible this has happened (many times) before, but... You've been warned. Speak Freely

20 28

relayor: automation for relay operators (ansible)
by Nusenu 02 Mar '15

02 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, computers are better at doing repeatable things over and over again so let them take care of boring tasks. Based on David's ansible-tor [1] I created an ansible role to make relay operations more convenient (see the initial commit message for a longer list of changes). https://github.com/nusenu/relayor Core features: - - configure multipe tor instances on a server automatically generates two instances per available IP address (Memory auto detection is not implemented yet) - - take care of MyFamily automatically - - user configurable Nickname prefix - - easy Exit/Non-Exit setting (boolean) - - alpha vs. stable releases (boolean) Supported platforms: - Debian - CentOS - OpenBSD Everything is still fresh, so I would NOT recommend to use this on production relays. Testing and review is appreciated. There is still a crucial piece missing (init scripts), but I hope tor packagers are willing to incorporate multi-init support patches (see issues). I also have parts that adds monitoring (munin+vnstat+webserver) but that will go into a separate role. If you have never heard of ansible, it speaks to your servers using SSH and does not require an agent or a central management server - just run it from you client machine. http://www.ansible.com/resources (not entirely torbrowser friendly) http://docs.ansible.com If you are planing to run this role over tor when connecting to your servers, make sure you have the following set in your ~/.ansible.cfg: ssh_args = -o ControlMaster=auto -o ControlPersist=60s This ansible role is not about bridges or hidden services, but I'd like to add "management HSes" (SSH and monitoring) in the future. Nusenu [1] https://github.com/david415/ansible-tor -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJU8OdxAAoJEFv7XvVCELh0Aw0P/AiiprSbE5apWUtrCoyrO5GN MKRfwpvy/BGrKjOjBZAtIs+8+AMaRQXV54CUIG0QlewnVgWRUyXA635OIAY43hFR BY/In1IiSXcqKyjaTsM4No/Nh+tvdj2rt+MoYvrMTVQVl8i+CYQKt4ypHjRN1cGS OIdP/AWi9tt/eAl+IgUNf4/pud94UbruDfGHtDQ4xGeReNdo64Q92c2QicFOdwNc fIqrhb/aWydfgQehmjSAXM9i9WfBi5vMSh7D5lUxheqhEmjSiV1bw8mvQML+kXse nwv7AZj0MkoBYqTd0t3h1JJwPXt0Vjfi3ZZNPlOTx6gZmPfbgrezya+TrWHQy65M rw6B3E3L5UDjkJ1k3cyJWvtpUSyYCqzcUDIq6+gQxZhGH0pWQhutxqdt5C5S+qn7 9hWJcDUyjeSFwxRfhLphiSrPQEue6Eox+EWzcSh4YQh8hol/P8Ev5C4P/yavWF0m w0jGbQoVIwz0jMhZwW9w6KxmaZO68/3aEfWUXjLFg/DCp/nLXqR1kHxuiLgO/sd6 QumoOjxqu9KwV9crQX86dl9oMFFvUb7l1WqidMVZIR81WQkDIVWoypvxCnG2QhDo Z4Nily3qg3I3nW+QLTIY8XjUkVMLV/1kky9ETDb2Vvz0uR2H5tyZR6I9hQ4FaGHt Xjm7kZ9JgRZjixqyAhTz =/jyQ -----END PGP SIGNATURE-----

2 3

Re: [tor-relays] tor exit node, low bandwidth
by Volker Mink 27 Feb '15

27 Feb '15

2 1

Re: [tor-relays] tor exit node, low bandwidth
by Volker Mink 27 Feb '15

27 Feb '15

Fingerprint is E20FF09A9A800B16C1C7C16E8C0DF95F46F649B0 And its running for about 6-7 weeks now. Any ideas? ------------------------------ Message: 2 Date: Fri, 20 Feb 2015 14:16:41 +0100 From: Sebastian Urbach <sebastian(a)urbach.org> To: <tor-relays(a)lists.torproject.org> Subject: Re: [tor-relays] (no subject) Message-ID: <14ba721fef0.27ae.e04ee758f2dadc1889b5b423dda555f9(a)urbach.org> Content-Type: text/plain; charset="iso-8859-1"; format=flowed Hi, >I have these settings in my torrc-file >RelayBandwidthRate 10000 KB? # Throttle traffic to >1000KB/s (800Kbps) >RelayBandwidthBurst 20000 KB # But allow bursts up >to 2000KB/s >(1600Kbps) MaxAdvertisedBandwidth 10000 KB ? >I have a decent cable-based internet-connection at >home and want to >share lots of bandwith. ?> >Unfortunately my exit node only does about 220kb/sec ?>avg: 219.2 Kb/sec, total: 18.4 GB?????? avg: 224.7 Kb/>sec, total: 18.5 GB ?> >What do i have to change to speed this up? Thank you for running a Relay. Please provide your fingerprint if you want other people to look into this matter. -- Sincerely yours / Sinc?res salutations / M.f.G. Sebastian Urbach ----------------------------------------- Religion is fundamentally opposed to everything I hold in veneration - courage, clear thinking, honesty, fairness, and, above all, love of the truth. ----------------------------------------- Henry Louis Mencken (1880 - 1956), American journalist, essayist, magazine editor, satirist and critic. On February 20, 2015 1:36:43 PM "Volker Mink" <volker.mink(a)gmx.de> wrote: > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > ------------------------------ Message: 3 Date: Fri, 20 Feb 2015 09:25:33 -0500 From: Speak Freely <when2plus2is5(a)riseup.net> To: tor-relays(a)lists.torproject.org Subject: Re: [tor-relays] (no subject) Message-ID: <e9992411d4355c951426baf31003cd52(a)riseup.net> Content-Type: text/plain; charset=US-ASCII; format=flowed Hi! Welcome to the club! Doing some quick math based your avg speed and your total transfer, it looks like you've been running an exit relay for about a day. It takes some time to build consensus within the network, others can explain it better and in more detail.Don't worry, it takes some time for the network to give you much love, but it will! Take a look at one of my newest relays on atlas to see the ramp-up time. It's only been up for a couple of days. https://atlas.torproject.org/#details/E0FE2E053843F09480EFF75F0A27D095F96FFF 82 Here's an another relay, that shows once love starts, it stays. This one has been up for over a month... One of my first. https://atlas.torproject.org/#details/BDE26705D49CB8AC3297953BCC2070FED9C611 53 Don't forget to provide the fingerprint for others to investigate. :) Matt -- Speak Freely ***

2 1

guard-failing message
by eliaz 27 Feb '15

27 Feb '15

My bridge's log showed: Feb 24 02:25:45.940 [Warning] Your Guard < guard name and fp > is failing a very large amount of circuits. Most likely this means the Tor network is overloaded, but it could also mean an attack against you or potentially the guard itself. Success counts are 129/259. Use counts are 38/38. 242 circuits completed, 0 were unusable, 113 collapsed, and 5 timed out. For reference, your timeout cutoff is 60 seconds. Globe showed no 3-day chart for the guard. For my bridge, the chart showed a lot of traffic, the peaks or less than a KB. This pattern has been going on for a few days. The bridge usage display shows the usual traffic, but more anemic the past several days. To be on the safe side I did the following: * shut down the bridge, * reset my gateway address, * restarted the bridge after about 1/2 hour. Have I overreacted? - eliaz

1 0

Same relay (identity key) on two IPs
by catchthemall 26 Feb '15

26 Feb '15

Hi all, tl;dr: Due to a config error my relay [1] was running on two different IPs at the same time for about half a day. Now the traffic has dropped. I just wanted to make sure that it is not flagged as malicious or something ... Additionally I am curious about the policy in such a case. What happens if a relay shows up in the network with the same identity key but on different IP addresses? long-version (kinda funny): I am using webtropia [2] as a service provide which is, as far I can tell, is a good choice for running a relay. Some time ago I decided to change the hosting plan and switch to another offer at the same provider. For that reason I let my old contract run out until they notified me that my server will be shut down and deleted. After receiving this notification I checked that indeed my relay server was no longer reachable. Some time passed by until I had time to setup my old relay (same identiy key) on the new server. Done so I launched it and was happy to enjoy the increased bandwidth. What I missed was that in the meantime the old server was reactivated by the hosting provider without notifying me and as a result was running at the same time as the new one for about half a day. After I recognised this, I tried to ssh to the old server - which still worked perfectly and indeed confirmed that everything was as I left it. I shut down the relay running on the old server and wrote an e-mail to the hosting provider checking if they are going to charge me the reactivation and why the hell reactivated it. Up until now I only got an response that my old server was "shut down" and that the "hard disk was deleted on the 29.01.2015" ... .. I thought well ... since I can still ssh to that server I kinda doubt that this is the case. So since I still had ssh access to the "shut down server" I decided to setup another relay on the "deleted hard disk" of this machine until they believe me that there exists a small possibility that this thing is still running ... The "ghost" relay [2] is running fine up until now. [1] https://atlas.torproject.org/#details/5A9B5923F4937C3ED76B0AD4CF1030C11FCAF… [2] http://www.webtropia.com/index.php [3] https://atlas.torproject.org/#details/23C31DBBEB898145D6E090D6DD8C06D72E55F…

3 5