- tor-relays - lists.torproject.org

Protecting your domain's reputation
by JusticeRage 19 Aug '14

19 Aug '14

Hello everyone! I am the operator of a somewhat recent exit node with SMTP allowed, and I have found out something worth sharing. Let me know if this is already known. As suggested by the Tor documentation, I set a reverse DNS which makes clear that my exit node belongs to the Tor network (tor-exit-readme.manalyzer.org) This week-end, I started to recieve weird e-mail delivery failure notifications, and even a line from a guy kindly asking me to stop sending him mail. The thing is, I was actually lucky to recieve all those, and I wouldn't have if I didn't have a catch-all address set for the whole domain. Looking at the source of the rejected e-mails, I found out that someone was forging e-mails which look like they come from my domain: Received: from tor-exit-readme.manalyzer.org (tor-exit-readme.manalyzer.org [95.130.11.147]) by smtp.craigslist.org (Haraka/2.5.0) with ESMTP id 66DDCADC-FEA4-4D62-8F08-2630AC1E0299.1 envelope-from <best_pharmacy5(a)manalyzer.org>; Mon, 18 Aug 2014 13:25:12 -0700 From: Levitra-Shop <best_pharmacy5(a)manalyzer.org> To: <rkdq8-4339052657(a)hous.craigslist.org> Subject: When It Comes Healthcare, Nothing Beats a Hometown Advantage, Rkdq8-4339052657 . (I got tons of these, all procedurally generated e-mail addresses.) The thing is, these e-mails don't just seem like they're coming from my domain: they ARE coming from my domain, since the machine sending them has a rDNS which belongs to it. From a mail server's perspective, they're actually very legitimate and probably won't be flagged as spam. I believe that someone is listing all the exit nodes which have a reverse DNS set up, and uses the domain to send out unwanted e-mail. This is a problem for operators for the following reasons: - The reputation of your domain is damaged, and legitimate e-mails sent from it may end up discarded - It strenghtens the idea that mail servers blindly reject everything that comes out of a Tor exit node The good news is, there is something you can do about it. This is exactly what Sender Policy Framework [1] was created for. Long story short, this is some information you can put in your DNS to indicate which machines are allowed to send e-mails for the domains, and which are not (hint: the exit node should not be listed in there). Here is a sample policy which says that only servers registered as MX in your DNS should send e-mails for the domain : tor-exit.domain.com. IN TXT "v=spf1 mx -all" If you need something more specific, I have found a nice wizard [2] which will help greatly. If you run an exit node and have a reverse DNS set up, I highly recommend you take ten minutes to look into this. Please note that this will NOT prevent Tor users from sending e-mail or restrain their freedom in any way; it will only prevent ill-intentioned people from spoofing your domain. I also think that there should be a note in the Tor documentation about this issue (I couldn't find anything regarding this). I hope this helps! [1] https://en.wikipedia.org/wiki/Sender_Policy_Framework [2] http://www.spfwizard.net/ -- JusticeRage

3 3

Web status page
by IceFish ThreeTwo 18 Aug '14

18 Aug '14

Is there a -- Sent from my iPhone

2 2

Include Tor Weather Link
by Spencer Rhodes 18 Aug '14

18 Aug '14

If another email goes out to operators of outdated Tor relays, I would suggest including some information and a link to the Tor Weather service, which has an option to notify via email if the software version is outdated. -- Sent from my phone.

2 1

Dynamic IP
by Tim 18 Aug '14

18 Aug '14

Tim Wilson-Brown E: twilsonb(a)mac.com > Date: Mon, 18 Aug 2014 05:04:31 +0200 > From: Sebastian Hahn <mail(a)sebastianhahn.net> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Dynamic IP > Message-ID: <CD0E96E4-2BFA-4FAA-BC19-C3320AC46F08(a)sebastianhahn.net> > Content-Type: text/plain; charset=us-ascii > > Hi Tim, > >> Sebastien, I run a relay on a machine that has an internal private IP, behind a NAT router with a public IP. >> >> In my experience, I need to specify the NAT router's public IP in the torrc, otherwise tor doesn't include it in the router descriptor it submits to the consensus. > > This shouldn't happen typically, Tor tries to learn its IP address by > looking at the traffic it receives. > >> If that process isn't working for me, is this a bug I should report? > > Likely. Can you try again, noting the kind of log messages Tor might > emit? > I apologise, Sebastien, it appears I was not waiting long enough for the router to connect to a directory, then use the headers to find its IP. I had always assumed that the first series of failures to find an IP (before any directories were contacted) was permanent. This is the debug log output from a secondary test router that I configured on the same IP: Aug 18 17:47:20.558 [info] {CONFIG} int resolve_my_address(int, const or_options_t *, uint32_t *, const char **, char **)(): Guessed local hostname 'REDACTED.local' resolves to a private IP address (192.168.REDACTED.REDACTED). Trying something else. Aug 18 17:47:20.558 [info] {CONFIG} int resolve_my_address(int, const or_options_t *, uint32_t *, const char **, char **)(): Interface IP address '192.168.REDACTED.REDACTED' is a private address too. Ignoring. Aug 18 17:47:20.558 [info] {CONFIG} int resolve_my_address(int, const or_options_t *, uint32_t *, const char **, char **)(): Address 'REDACTED.local' resolves to private IP address '192.168.REDACTED.REDACTED'. Tor servers that use the default DirAuthorities must have public IP addresses. Aug 18 17:47:20.558 [info] {CONFIG} int router_pick_published_address(const or_options_t *, uint32_t *)(): Could not determine our address locally. Checking if directory headers provide any hints. Aug 18 17:47:20.558 [info] {CONFIG} int router_pick_published_address(const or_options_t *, uint32_t *)(): Success: chose address '121.REDACTED.REDACTED.REDACTED'. Once the test router appears in the consensus, I'll make similar changes to the primary router (and it will pick them up on the next restart!) Tim

1 0

Close friend
by IceFish ThreeTwo 18 Aug '14

18 Aug '14

Hello. I'm not going to use the term "Framily", Sprint can...nsfw. Anyways, my close friend just set up a Tor node. I'm pretty sure I read somewhere that the Family option in torrc is used so that nodes administrated by the same person never make a circuit with each other, which somehow protects anonymity. Should my friend and I put each other's fingerprints in the Family field? Seems logical since we know each other and if the point of theFamily field is to protect anonymity. Thanks! Ice Fish -- Sent from my iPhone

4 4

Dynamic IP
by Tim 18 Aug '14

18 Aug '14

> On Sun, 17 Aug 2014 00:42:13 +0200, Sebastian Hahn <mail(a)sebastianhahn.net> wrote: > > Date: Sun, 17 Aug 2014 00:42:13 +0200 > From: Sebastian Hahn <mail(a)sebastianhahn.net> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Dynamic IP > Message-ID: <90ABDCE9-CC09-4892-9935-F7B7C78832E9(a)sebastianhahn.net> > Content-Type: text/plain; charset=us-ascii > > Hi Tim, > >> On 16 Aug 2014, at 23:53, Tim <t_ebay(a)icloud.com> wrote: >> I'm running a relay on a similarly "dynamic" IP. >> If the line goes down, I'm reallocated a new one. But otherwise the IP is stable. >> If I don't notice the change, I notice the traffic drop, then I update the torrc, and everything works again. > > I think you're a little confused. It's not necessary to specify your own > IP address in Tor's configuration file. The various "address" options are > purely optional. Or I am confused, and you mean something completely > different? > Sebastien, I run a relay on a machine that has an internal private IP, behind a NAT router with a public IP. In my experience, I need to specify the NAT router's public IP in the torrc, otherwise tor doesn't include it in the router descriptor it submits to the consensus. How does tor autodetect its public IP, when it is running on a separate machine with a private network IP, behind a NAT router with a public IP? If that process isn't working for me, is this a bug I should report? If tor doesn't currently autodetect public IPs on middleboxes (as opposed to the tor relay machine itself), is this a feature that could be implemented? Or do we wish to discourage this use case? (It would involve trusting an external server to report tor's public IP correctly - and making other assumptions like the middlebox having a single public IP.) Tim

2 1

Number of relays by version
by Jesse Victors 17 Aug '14

17 Aug '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA384 Hey guys, Today on Reddit I saw a post on /r/Tor that listed the number of relays by version, which was pretty cool. While OP apparently loaded the information into SQLite and selected the count, there's another way to do it: sudo cat /var/lib/tor/cached-microdesc-consensus | grep '^v ' | awk '{print $3}' | sort | uniq -c Which currently gives: 2 0.2.3.20-rc 5 0.2.3.22-rc 3 0.2.3.24-rc 579 0.2.3.25 1 0.2.4.10-alpha 2 0.2.4.11-alpha 5 0.2.4.15-rc 15 0.2.4.16-rc 23 0.2.4.17-rc 4 0.2.4.18-rc 12 0.2.4.19 271 0.2.4.20 351 0.2.4.21 998 0.2.4.22 3 0.2.4.22-dev 3209 0.2.4.23 7 0.2.4.23-dev 3 0.2.5.1-alpha-dev 9 0.2.5.2-alpha 22 0.2.5.3-alpha 5 0.2.5.3-alpha-dev 28 0.2.5.4-alpha 4 0.2.5.4-alpha-dev 47 0.2.5.5-alpha 232 0.2.5.6-alpha 29 0.2.6.0-alpha-dev I find the distribution interesting. 0.2.3 is dwindling, but for those 589 that remain, please be aware 0.2.4 is available, so be sure to update or change to the official Tor repos. Looks like 0.2.6.0 is the tip of the spear now. - -- Jesse V. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQF8BAEBCQBmBQJT8FBhXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQxMjgyMjhENjEyODQ1OTU1NzBCMjgwRkFB RDk3MzY0RkMyMEJFQzgwAAoJEK2XNk/CC+yAFCMIAMBzJko9CDSqfEyiPFZzNVy8 ZNlr4ZBekm9aLG2cJEVD2zN2wLc0mWb/ETFrbVNbauWIEvuNjchE0xZRXMUJBrFT L9ErUmNeGWEr77XXYAawoOI4PDPXOF4SIMQUdAel8OVCZ5g0UYARDlfIBgwVeq+o LnvSrDdv/hcwIxsrLxX+J/XqwXOIDnxhjMu6MnHG7YDXGameACbMl4OfOCgXVNT9 VV9YLATJq1nHr5F5I8xmDU5RVUsVRccn8POBHgTfZwDtwMy3N6U/wQqFY0XzslLH wY2veoPcuIoL8x1Sz81vK9Buc9oD/F06HzrZRW2WHg2Tw8yJYFizVyWpOlQ/xKs= =NIsd -----END PGP SIGNATURE-----

2 1

Re: [tor-relays] Dynamic IP
by Tim 16 Aug '14

16 Aug '14

I'm running a relay on a similarly "dynamic" IP. If the line goes down, I'm reallocated a new one. But otherwise the IP is stable. If I don't notice the change, I notice the traffic drop, then I update the torrc, and everything works again. Wouldn't it be great if there was an option for tor to do this automatically? But this would involve trusting google or similar to correctly report the external IP (and not get MITMed). I tried running a bridge, but it made almost no use of the available bandwidth. But if the IP were more dynamic, a bridge would be an excellent choice, as long as I could keep the config synced with the external IP. This would be the core use case for a tor "use dynamic external IP" option. (And the current "guess my IP" option doesn't work for me, as it's the internet-visible external IP I need, not the relay's internal network IP.) > On 17 Aug 2014, at 6:45, IceFish ThreeTwo <threehundredthirtytwofishes(a)gmail.com> wrote: > > Date: Sat, 16 Aug 2014 13:09:08 -0700 > From: IceFish ThreeTwo <threehundredthirtytwofishes(a)gmail.com> > To: "tor-relays(a)lists.torproject.org" > <tor-relays(a)lists.torproject.org> > Subject: Re: [tor-relays] Dynamic IP > > Alright thanks. Yeah it's a "dynamic" IP. I bet they just say that in case > they have to change it for some reason. > >> On Saturday, August 16, 2014, justaguy <justaguy(a)riseup.net> wrote: >> >> That's not a big deal, if it's once every 8 months. >> But every day, that would be a problem. >> If you keep running your relay for 8 months, and then an ip change, i >> think it will be back at normal speeds in like 5 minutes >> On 08/16/2014 10:04 PM, IceFish ThreeTwo wrote: >> >> Unfortunately my ISP only provides static IPs for their business accounts, >> which, even if in my price range, I can't get at my home because of zoning. >> My IP hasn't changed once since I got the service and I think I've kinda >> locked it in with my router. But if it does switch say once every 8 months, >> how big of a deal is that? >> >> On Saturday, August 16, 2014, justaguy <justaguy(a)riseup.net >> <javascript:_e(%7B%7D,'cvml','justaguy(a)riseup.net');>> wrote: >> >>> Yes, other relays don't like your relay changing ip's all the time. >>> You should try to get a static ip somehow, ask your isp :) >>> On 08/16/2014 10:00 PM, IceFish ThreeTwo wrote: >>> >>> I have a dynamic IP from my ISP. Is that going to cause issues with my >>> relay? >>> >>> -- >>> Sent from my iPhone >>> >>> >>> _______________________________________________ >>> tor-relays mailing listtor-relays@lists.torproject.orghttps://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >> >> -- >> Sent from my iPhone >> >> >> _______________________________________________ >> tor-relays mailing listtor-relays(a)lists.torproject.org <javascript:_e(%7B%7D,'cvml','tor-relays(a)lists.torproject.org');>https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > -- > Sent from my iPhone >

2 1

Getting things right
by Graeme Briggs-White 16 Aug '14

16 Aug '14

I have a rooted Samsung S3 with CM 11 4.4.4 nightly build and would like to know exactly how to get the best for everyone involved on the network. My problem seems to be ram capacity and have tried every which way to improve that. Nothing seems to work as it has under 1 Gig of ram. How do I configure this for the best and not piss other users off. My binary skills are none too great but I'm willing to learn and am open to harsh comments to get me on my way. I'm quite a newbee at this and open to criticism.....

3 13

Dynamic IP
by IceFish ThreeTwo 16 Aug '14

16 Aug '14

I have a dynamic IP from my ISP. Is that going to cause issues with my relay? -- Sent from my iPhone

3 5

Re: [tor-relays] tor-relays Digest, Vol 43, Issue 15
by Spencer Rhodes 16 Aug '14

16 Aug '14

Hi Matt, Thanks for the quick reply. The servers did not show because I had commented out the Nickname line in /etc/tor/torrc after seeing a notice in arm that it was redundant (presumably because it is identical to the hostname). Apparently, not redundant after all as it is necessary for proper listing on the torstatus servers… So, I browsed to your suggested URL and verified that for my server which does show the Directory flags, it returns a bunch of data: http://99.28.48.185/tor/status-vote/current/consensus, but for the server which is now lacking the flags, nothing is returned: http://80.240.141.246/tor/status-vote/current/consensus. As far as I know, these servers are identically configured apart from the nicknames, fingerprints, and bandwidth. And as I said, initially both servers showed Directory flags. I am running on Debian, and so tried "service for restart” without effect. Hate to have to reinstall to get Directory services up again… Best regards, Spencer On Aug 13, 2014, at 1:28 PM, tor-relays-request(a)lists.torproject.org wrote: > > > From: Matthew Finkel <matthew.finkel(a)gmail.com> > Subject: Re: [tor-relays] Directory Server Issue > Date: August 13, 2014 at 12:08:58 PM EDT > To: tor-relays(a)lists.torproject.org > Reply-To: tor-relays(a)lists.torproject.org > > > On Wed, Aug 13, 2014 at 10:32:45AM -0400, Spencer Rhodes wrote: >> Hi, >> >> I have a server (triratna) which I recently put up, which operates on ports 80 and 443, and which initially showed a Directory Server flag. After several days of operation, however, the directory flag disappeared from both the torstatus listing and from the arm display on the console. >> >> I would like to know if there is a way to verify that directory services are in fact working, and if so, determine why the server is not flagged properly. I found some old postings to the effect that one could browse to server://tor or server://tor/status/all, but this does not seem to be true any more. > > Hi Spencer, > > This should still work. Try using > http://<ip address>:<DirPort>/tor/status-vote/current/consensus > to fetch the current consensus. You can also fetch individual relay > descriptors using a similar URI. > > If you provide your relay fingerprint someone may be able to help > further. I tried looking up the name you gave, but I couldn't find > it in either Globe[0] nor Atlas[1]. > > Thanks for running a relay! > > - Matt > > > [0] https://globe.torproject.org/#/search/query=triratna > [1] https://atlas.torproject.org/#search/triratna > >

1 1

Re: [tor-relays] Advertised Bandwidth
by Mike Patton 15 Aug '14

15 Aug '14

Hey there, The advertised bandwidth will increase gradually. Well mine did. M. On 16/08/2014 10:28 am, IceFish ThreeTwo <threehundredthirtytwofishes(a)gmail.com> wrote: > > Hello! > > I'm unclear as to what the "Advertised Bandwidth" is on Atlas. My node has it's bandwidth set to 700Kb/s, however on Atlas the Advertised Bandwidth is around 7Kb/s. I'm on day three of running this relay and I have read the Early Lifecycle blog post, but I'm still confused as to why the Advertised Bandwidth is a hundredth of what I have it set to. > > Thank you! > Ice Fish > > > -- > Sent from my iPhone

3 2

Advertised Bandwidth
by IceFish ThreeTwo 15 Aug '14

15 Aug '14

Hello! I'm unclear as to what the "Advertised Bandwidth" is on Atlas. My node has it's bandwidth set to 700Kb/s, however on Atlas the Advertised Bandwidth is around 7Kb/s. I'm on day three of running this relay and I have read the Early Lifecycle blog post, but I'm still confused as to why the Advertised Bandwidth is a hundredth of what I have it set to. Thank you! Ice Fish -- Sent from my iPhone

1 0

Exit node dropped to near zero weight
by Bill Winslow 15 Aug '14

15 Aug '14

Hi everyone, https://globe.torproject.org/#/relay/5B06042B4911171026059FB694215B97D10E47… I've been running an exit node for a few days now, and around 8 hours ago my consensus weight and exit probability dropped to essentially zero, after dropping substantially several hours previously. Why is that? Nothing in my logs suggests anything unusual -- but then again, I'm very new to this and thus wouldn't know where else to look or what to think about this. http://pastebin.com/mfkbPK9L Thanks for your time.

2 2

Re: [tor-relays] OnionTip.com distributes Bitcoin donations to all BTC addresses set in ContactInfo
by Mike Patton 14 Aug '14

14 Aug '14

On 14 Aug 2014 08:34, Ed Carter <ecarter9(a)riseup.net> wrote: > > > Tim Semeijn schreef op 10/08/14 17:33: > >> On 8/10/14, 4:32 PM, ban(a)unseen.is wrote: > >>> Hi, > >>> > >>> apparently this hasn't been discussed here yet. About a month ago, > >>> Donncha O'Cearbhaill build https://oniontip.com/ during the Dublin > >>> Bitcoin Hackathon. It is a webapp which automatically extracts all > >>> Bitcoin addresses set in the ContactInfo variable of the torrc and > >>> distributes Bitcoin donations based on the consensus weight. > >>> > >>> There are already 100+ relays listed which represent around 5% of > >>> the total consensus weight. In just a few weeks they distributed > >>> around 125 US$. > >>> > >>> There are many other theoretical ways to provide compensation to > >>> tor relay operators (see > >>> https://blog.torproject.org/blog/tor-incentives-research-roundup-goldstar-p…) > >>> > >>> > >> but I really like this very simple and practical approach. > >>> > >>> Thoughts? _______________________________________________ > >>> tor-relays mailing list tor-relays(a)lists.torproject.org > >>> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > >>> > >> > >> I myself added a bitcoin address to the ContactInfo variable of my > >> nodes when I saw a tweet about this initiative. It is a nice way to > >> offer a way to donate to multiple node running volunteers instead of > >> donating to a specific person or organization. > >> > >> My nodes take up 20% of the current donations based on consensus so it > >> would be nice if more relay operators take part in this project to > >> make it resemble the current Tor network better. > > > > I really like this and I've added an address to my exits (4.2% of total > > exit consensus). However, for this to really kick off I'd recommend > > adding visibility on how many donations were received and how it was > > distributed across relays. There should be safeguards to prevent > > oniontip.com from taking a part of the money, etc. > > > > Tom > > > > _______________________________________________ > > tor-relays mailing list > > tor-relays(a)lists.torproject.org > > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > > Agreed, this is pretty awesome. It allows independent relay operators to > receive donations no matter where they are in the world whether or not > they are affiliated with any group. > > The donations are transparent, since the money can be followed on the > Bitcoin blockchain to ensure that your donation made it to the individual > addresses of the relay operators. > > > > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays I like it! I've already made AUD $0.05!!! ;) M.

7 6

OnionTip.com distributes Bitcoin donations to all BTC addresses set in ContactInfo
by ban＠unseen.is 13 Aug '14

13 Aug '14

Hi, apparently this hasn't been discussed here yet. About a month ago, Donncha O'Cearbhaill build https://oniontip.com/ during the Dublin Bitcoin Hackathon. It is a webapp which automatically extracts all Bitcoin addresses set in the ContactInfo variable of the torrc and distributes Bitcoin donations based on the consensus weight. There are already 100+ relays listed which represent around 5% of the total consensus weight. In just a few weeks they distributed around 125 US$. There are many other theoretical ways to provide compensation to tor relay operators (see https://blog.torproject.org/blog/tor-incentives-research-roundup-goldstar-p…) but I really like this very simple and practical approach. Thoughts?

6 7

Re: [tor-relays] Contacting Apple About a Block IP Address
by Jesse Victors 13 Aug '14

13 Aug '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA384 I don't know about that. The number of site that ban all Tor nodes (exits and non-exits alike) is relatively low compared to the number of websites that don't. The banning happens when trigger-happy sysadmins think that 1) IP address == user, and 2) that banning all Tor nodes stops only spammers. Neither are true, but like Thomas said they probably just downloaded a list and banned all the nodes and didn't think about the 2.4 million Tor users. I've run relays from my own IP address with very little problems to speak of. Certainly you don't want to run an exit on your IP, that's a different story. Christopher, from another machine/IP, send a message to the admins of that forum and explain. Be polite, explain what error message you are seeing, and ask if your IP could be unbanned so that you can access their discussion forum as part of your work. You could also explain that Tor is an anonymity layer on top of TCP, and as your machine simply passes encrypted data through the Tor network and not out of it, it poses no risk of spam or abuse from anyone using Tor. If you feel that it's necessary, concisely explain what Tor is, pulling from descriptions on torproject.org. I think if your reasonable and work with them, you have a good chance of resolving this. If not, use a different IP for accessing the Apple forum. You can use an SSH tunnel, VPN, or a proxy if you need to. - -- Jesse V. On 08/13/2014 04:00 AM, tor-relays-request(a)lists.torproject.org wrote: > Don't run a relay from your own IP address. Pretty standard advice > there sorry regardless if it's an exit or non-exit. I guess the people > at Apple simply downloaded every Tor server IP and put no effort into > reading the differences between types of relay because to be fair, > they aren't paid to give a damn as long as it stops problems. > > You could pop an email off to their customer support, but honestly I > wouldn't get your hopes up with Apple. > > -T -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQF8BAEBCQBmBQJT651rXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQxMjgyMjhENjEyODQ1OTU1NzBCMjgwRkFB RDk3MzY0RkMyMEJFQzgwAAoJEK2XNk/CC+yAv9AH/0escYcwLAbUgbNRKCCQ0yY5 ugYHBnveTv6FIEPzDwPC/ZiinyQcc6IiYl+Qm6XfwavmHKkbMjDR2/OCjh53Mcop HIP9QcBQ/81ZdJCp9YH21FPnKozkzAAI3JNgVR0/0cRp/dd8EsARIN4lEWuHCXkE CfpCUuFNDHcv7OY3kgnd81byT034ZnoZFlJX3MJmVvpYmv+w/BIsUzd3jTEi2R6y /+ExKwbKc3d0LzHubv3E1Y54B1mIwF+5MbLn7jUYjv55/IDKvuBYTmInj50ygv7o AoRr+c0drDdoXahG14ltNtB9mbzMPmlStsWJ8q5AYSmqS8TJzcsXSNyT1y6QpPU= =XjfD -----END PGP SIGNATURE-----

4 3

Directory Server Issue
by Spencer Rhodes 13 Aug '14

13 Aug '14

Hi, I have a server (triratna) which I recently put up, which operates on ports 80 and 443, and which initially showed a Directory Server flag. After several days of operation, however, the directory flag disappeared from both the torstatus listing and from the arm display on the console. I would like to know if there is a way to verify that directory services are in fact working, and if so, determine why the server is not flagged properly. I found some old postings to the effect that one could browse to server://tor or server://tor/status/all, but this does not seem to be true any more. Thanks, Spencer Rhodes -- Spencer Rhodes, Esq. 126 East Jefferson Street, Orlando, Florida USA 32801-1830 t: +1.321.332.0407 | f: +1.321.332.0409 | m: +1.407.796.8282

2 1

Contacting Apple About a Block IP Address
by Christopher Burg 13 Aug '14

13 Aug '14

Hey fellow relay operators, While searching for a solution to a problem I've been having I learned that my IP has been blocked from accessing discussions.apple.com. The message that I get is the same message I get whenever I attempt to access a website known to block IP addresses operating Tor relays. I am running a non-exit relay, which I'm assuming is the reason I'm now blocked from access the site. Has anybody else run into this problem and, if so, have you been able to get your IP address unblocked by Apple? If you have managed to get your IP unblocked what steps did you take? Unfortunately due to my work I am in a position where I have to access Apple's discussion forums from time to time. Thanks, Christopher Burg

3 2

multisig link
by jason＠icetor.is 10 Aug '14

10 Aug '14

sorry meant to include relevant link to multisignature documentation https://github.com/bitcoin/bips/blob/master/bip-0010.mediawiki -J

1 0

Tor relay giving a OR_CONN_CLOSED error‏
by Richard Dennis 09 Aug '14

09 Aug '14

Hi guys, I created a tor relay set up using a raspberry pi called Goblin500, it has now been up for a while and i have the fast, valid, running and v2dir flag i have been working on some code that can be found at: https://github.com/richarddennis/Masters-Project to connect to various nodes in tor and create a stream, i am able to connect no problem to various nodes such as TorLand1, orion etc no problem, however when i try to create a circuit containing Goblin500, there is a significant delay and when i do receive anything it is only get a destroy cell containing the error code 8 - OR_CONN_CLOSED the node is in the consensus : r Goblin500 IspSUjBIQ/LJ0k18VbKIO6mS1oo yT+H3s9/UYm7p+BmNjnfYUmGHFw 2014-08-09 16:03:43 82.26.108.68 9001 9030s Fast Running V2Dir Validv Tor 0.2.4.23w Bandwidth=20 Unmeasured=1p reject 1-65535my torrc file is SocksPort 0/var/log/tor/debug.logRunAsDaemon 1ControlPort 9051CookieAuthentication 0ORPort 9001Nickname Goblin500DirPort 9030ExitPolicy reject *:* what is causing the error and more importantly how can it be solved there are no errors in the/var/log/tor/notices.log file Thanks Rich

1 0

New router, new IP address
by Rick 08 Aug '14

08 Aug '14

So I saw the Craigslist post in tor-talk and checked to find that I'm at full speed with them. Since I'm an exit relay (residential, US, 15 months) and have been experiencing the CL Dial-Up Retro for a few months, I was surprised. It turns out that I have a new IP address so for the moment I'm a shiny new exit. Two days ago I installed a new router. Nothing special: $45 Linksys but selected specifically for use with DD-WRT. ROM burn and set-up was done completely offline. It took maybe a minute to do the router hot swap and all went well. IP address change never crossed my mind. After all, I was down for four days back in the winter (ice storm) and hoping for a new address when we came back up. No luck. Is this normal? Or at least not unusual? It seems a bit spooky to me. I thought the address was tied to the cable modem (ISP's equipment) and they couldn't care less about my LAN. :-\ Thanks Rick

2 1

tor bridges
by Patrick Kelley 06 Aug '14

06 Aug '14

2 1

Exit Nodes under DDoS attacks
by Tyler Durden 04 Aug '14

04 Aug '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi I just wanted to know from others how often your nodes are being DDoSed? Because this month one of our nodes has been targeted twice. Because DDoS sucks and most providers aren't very happen when this happens often. Greetings virii - enn.lu -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iF4EAREIAAYFAlPfgjcACgkQzowS8yos8Rt1LQD/Rj2zZJpdmCyQhCmG3enWL6Z5 J0tbnnG2FS1GelACY74BAKIYRK8EVUt/pYfuuRzlBWWI84kuzcOmOiehqm6iyVjS =/ay4 -----END PGP SIGNATURE-----

6 6

Re: [tor-relays] Exit Nodes under DDOS attacks
by tor＠t-3.net 04 Aug '14

04 Aug '14

We never had our exit nodes become the targets of DDOS attacks HOWEVER, we occasionally see abuse complaints due to someone abusing Tor to DDOS attack other targets. Perhaps that's what you're seeing?

3 2

Running an AWS bridge on eu-west-1?
by tor-question＠puti.de 04 Aug '14

04 Aug '14

2 2

Learn Linux free for beginners
by I 02 Aug '14

02 Aug '14

A free online course from The Linux Foundation for beginners begins today. https://www.edx.org/

3 2

'relay early' attack detection at the infrastructure level
by Nusenu 02 Aug '14

02 Aug '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 [moved to tor-relays] Hi relay ops, please consider having a regular look at your logs after upgrading to the latest tor releases to spot relay_early attacks (even if the attack origin is not directly attributable from a relays point of view). searching your logs for 'Received an inbound RELAY_EARLY cell' should do it. https://gitweb.torproject.org/tor.git/commitdiff/68a2e4ca4baa595cc4595a511d… >>> It doesn't have to decrypt the stream to see it, because >>> whether a cell is relay or relay_early is a property of the >>> (per hop) link, not a property of the (end-to-end) stream. >> >> Does a patched relay also create a log entry as soon as it >> "kills" the circuit or is logging only happening on tor instances >> acting as clients? > > The patched relay also does a log message, yes. > > But the relay can only see its immediate neighbor in the circuit, > so it will only log that. Whether the attacking relay is that > (adjacent) one, or one farther on the circuit, isn't something your > relay can learn. -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJT3Bt6AAoJEDcK3SCCSvoensYQAJnuXhPNbhdJF7C6P9L8elG7 elPinCK6vmTbRXCoQam5j1VeL9C3FCBv415s811hfZxA37K17VdiKoS1NXB2kzkW 7WvL5/lH8culr83GTxrca0m7i2x6n0gCPOVPUWI3Go5bzwlsEidZsj7V14h2lfXH Ew8ZavvL0SLnRYJTvcjzqrWf3L8LsfYou6R2Y7yn085rGaGtUyVkQM44G9Zy3TVY 3lS4XqkZekXmmKjP06JjWdFMFdkaQhItbcdn3fF131ptlZlM5hFUaEpZHbpLLcjz fgJOt36jlkfILKRvxGyzcI118wmgrFVJFz9d7fuLVOdekK49aWxKh9Yh2aAekQEn Z3uF/eskL+Txptrc7iEKuWQZVlEkA8WVaQ70F1ADD/irln6ShJ17zrKqJ0qtaYlU V+CNfj/v2R6AgRhbVsNRdq8SWhDz4Nk4WgdYoUvxzgM1jmkAhQamlkC4f6JCqVQE /O0qeuXr/Z02pBwshcZlqKnBmPtuilSZwmlstIEfPAX9Tg6S1a0B/ycp3ByyJHJP QUNKwJ/cHtLpdPmIh2XUOT/5Kf10qmrLP5amYdRtBh304GoeHir3N/zfPmxdLfy7 Spb8W4p2C1HITzRlb9J97OGdKOR/2OOziZHOWZimF5O3fsrzsXQZe3Wlwbt5AxtY LJ5aXCUjNJ/TXe93nSQH =3FwX -----END PGP SIGNATURE-----

4 5

More attack traffic against Tor detected on exit relay
by tor＠t-3.net 01 Aug '14

01 Aug '14

IPTables rule involved: -A INPUT -p tcp -m string --hex-string "|00002800390038008800870035008400160013000a00330032009a009900450044002f00960041000500ff020100000400230000|" --algo kmp -j LOG --log-prefix "IPTables-GFC-new " -A INPUT -p tcp -m string --hex-string "|00002800390038008800870035008400160013000a00330032009a009900450044002f00960041000500ff020100000400230000|" --algo kmp -j DROP Logs generated Wednesday from hits against these rules: Jul 30 13:44:38 Libero2-vserver kernel: IPTables-GFC-new IN=eth0 OUT= MAC=00:16:3e:21:6d:34:00:21:d8:25:c0:20:08:00 SRC=1.50.250.198 DST=64.113.44.206 LEN=147 TOS=0x08 PREC=0x20 TTL=44 ID=21838 DF PROTO=TCP SPT=13717 DPT=9001 WINDOW=46 RES=0x00 ACK PSH FIN URGP=0 Jul 30 13:44:59 Libero2-vserver kernel: IPTables-GFC-new IN=eth0 OUT= MAC=00:16:3e:21:6d:34:00:21:d8:25:c0:20:08:00 SRC=175.152.3.46 DST=64.113.44.206 LEN=147 TOS=0x00 PREC=0x00 TTL=50 ID=21839 DF PROTO=TCP SPT=49229 DPT=9001 WINDOW=46 RES=0x00 ACK PSH FIN URGP=0 Jul 30 13:45:41 Libero2-vserver kernel: IPTables-GFC-new IN=eth0 OUT= MAC=00:16:3e:21:6d:34:00:21:d8:25:c0:20:08:00 SRC=124.90.49.99 DST=64.113.44.206 LEN=147 TOS=0x00 PREC=0x00 TTL=49 ID=21840 DF PROTO=TCP SPT=10200 DPT=9001 WINDOW=46 RES=0x00 ACK PSH FIN URGP=0

2 1

don't worry (to much) if your relay is loosing the guard flag
by Nusenu 31 Jul '14

31 Jul '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 I guess it makes sense to make this change a bit more visible on the tor-relays mailing list since relay ops will notice the change eventually and not everyone is reading changelogs closely. A lot of relays will loose their guard flag (and probably see less traffic?) once enough dir auths [1] upgraded to 0.2.5.6-alpha. For the background see the changelog [2]: >> o Minor features: - Authorities now assign the Guard flag to the >> fastest 25% of the network (it used to be the fastest 50%). Also >> raise the consensus weight that guarantees the Guard flag from >> 250 to 2000. For the current network, this results in about 1100 >> guards, down from 2500. This step paves the way for moving the >> number of entry guards down to 1 (proposal 236) while still >> providing reasonable expected performance for most users. >> Implements ticket 12690. It will be interesting to follow the metrics graphs during that transition. I.e. will the guard bw history go down or will the remaining relays handle the same amount of traffic without any difference? (and similar questions) https://metrics.torproject.org/bandwidth.html#bandwidth-flags [1] https://consensus-health.torproject.org/#authorityversions [2] https://lists.torproject.org/pipermail/tor-talk/2014-July/034180.html -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJT2rO6AAoJEDcK3SCCSvoeh4sP/iH6DKlOLtCo1ZoBYKsZx+EJ jir+Lk4urwU+3MeM5Ikbb/XTCXY9Y3RCX8tTG65tn+NoLKNJP/fUGuz8A87Vrc48 ismcoSPrjpgX358VMLy7gO9i1tZGLGDd6qNuh0hLws1Z1JVMBACQKv6ZJrSuaoy6 gM/+htBawyRy8KC9Lsw4C6RZsu8b5Kintn9D6MmcWwVIDY8voB3wyypeZZLWaFzI N9sfyT9M4GC+i2CyWsYNdXB/x6z+IEsq0FE0XMdaLr0W17vh8pef0X3XH06h+MUf GsqK86MkjiYfQ0KfMkA/XfYCA3AWTdMSn63L40cDtLqBEHILlvpY/awWX0G78cnU D6cyhRs/R9rUlzvxMxtEF2mMrhvMAkWhz3JrqoEh0o6eOOF9QsOB700rovNsNufw tCYw/PfDD8PVj/J38jcidxo4VBtLcIrdnSInFuLezyZtvKvlCgzMomu8fOdSLxgf gXmKLY6MzduQFAqgYOg5eu33zMSqiTckC2mWPJXWiJ8m5uRbgw57I+7DjTalB4lD KTBTbtjLf+jbZOYn+E8bmoi8hQFPfhjkMMaqSIXeooqDa2xTbYlmEgPy4VmW5rLf cJd1rM2irw9yMKIYMMcI/aLG5uWZJ5pYAw0zWNA1aBzp33mgJ1yFbdhk9BMA+3/G rqNAV1pSC4brVzn4nF++ =02Sf -----END PGP SIGNATURE-----

1 0

tor daemon problem with obfsproxy
by Fereydoon Sepehri 31 Jul '14

31 Jul '14

Hi All, I install and configure tor to set up a obfs3 bridge. If I use command "tor", everything is fine and clients could connect to server buf if I use "service tor start", the connection will be refused. I checked the log file. the problem is: [warn] The communication stream of managed proxy '/usr/bin/obfsproxy' is > 'closed'. Most probably the managed proxy stopped running. This might be a > bug of the managed proxy, a bug of Tor, or a misconfiguration. Please > enable logging on your managed proxy and check the logs for errors. > Jul 31 20:55:56.000 [notice] Failed to terminate process with PID '28836' > ('No such process'). the question is why "tor" command could run the obfsproxy but "service tor start"could not. I change the permission of "obfsproxy" from "root" to "debian-tor" but it did not solve the problem. Best Regards Fereydoon

1 0

Re: [tor-relays] obfsproxy issue
by Mike Patton 31 Jul '14

31 Jul '14

On 01/08/2014 3:00 am, Fereydoon Sepehri <fereydoonsepehri(a)gmail.com> wrote: > > Dear All, > > I want to set up tor Bridge. the bridge is up and working normally. > I decided to use obfsproxy to set up obfs3 bridge. > > I installed Python, python-pip and obfsproxy. > the obfsproxy is in "/usr/bin/" directory. The "obfsproxy which" command did not show this directory but this: > -bash: /usr/local/bin/obfsproxy: No such file or directory > > could you please advise me on this issue. > > Best Regards > Fereydoon As a suggestion, perhaps take the error meager as instructive? Try putting obfsproxy in /use/local/bin instead of /use/bin. M.

2 1

obfsproxy issue
by Fereydoon Sepehri 31 Jul '14

31 Jul '14

Dear All, I want to set up tor Bridge. the bridge is up and working normally. I decided to use obfsproxy to set up obfs3 bridge. I installed Python, python-pip and obfsproxy. the obfsproxy is in "/usr/bin/" directory. The "obfsproxy which" command did not show this directory but this: -bash: /usr/local/bin/obfsproxy: No such file or directory could you please advise me on this issue. Best Regards Fereydoon

1 0

Auto Response
by bbzxrmy wowman 31 Jul '14

31 Jul '14

1 0

how sensitive is relay 'state' file?
by starlight.2014q3＠binnacle.cx 30 Jul '14

30 Jul '14

Can anyone comment on how sensitive the information in the relay 'state' is? In particular, if entry guards are recorded in the file should one be concerned about protecting the file via a) encrypting the file system where it resides b) making a point of not backing up the file I suppose it comes down to how likely it is that an adversary can use entry guard information for correlation attacks against past and present tor-client traffic originating from a targeted client-relay.

1 0

Finding relay Sybils / Groups [re: relay_early/blackhat]
by grarpamp 30 Jul '14

30 Jul '14

As a project then to production development, someone should go back through the entire history of descriptors and look for groups coming online... dates, IP's, contacts, tor/OS versions, nicknames, ISP's, geoip, numbers coming online over sliding timeframes, correlation to 'news events', etc. There may be more questionable relays to be found. We were talking about such influxes around july 4 09, ironically, or not.

2 1

German company Webtropia: Terminated contract without notice because of abuse
by tor＠t-3.net 30 Jul '14

30 Jul '14

You somewhat made a mistake here - you've got to have an exit policy that (minimally) rejects ports 25 and 465, or else your relay becomes a giant abuse tool for spammers, scammers, and phishers instead of what you intended it to be (which was a standard-functioning Tor relay). You might try telling your ISP that you made a mistake in your configuration which allowed spam email to go out, and you're willing to correct that error and move forward. ExitPolicy reject *:25 ExitPolicy reject *:465

4 3

0.2.4.23 availability on trusty armhf?
by trash eighty 30 Jul '14

30 Jul '14

I am running a pretty active relay, using Ubuntu Trusty on armhf. I see 0.2.4.23 for Intel architecture in the repositories, but not on Trusty/armhf. Didn't know if this was an oversight, or if it's still coming down the pipe. Thanks, Trash80

2 1

Re: [tor-relays] German company Webtropia: Terminated contract without notice because of abuse
by tor＠t-3.net 30 Jul '14

30 Jul '14

Let's not confuse two things, here. The customer wanting to host a Tor exit relay is a different service request than wanting to run a wide-open SMTP relay. No reputable ISP would agree to host an open SMTP relay and I'm sure this one did not knowingly do so. It would be unfortunate for ISPs to come under the incorrect impression that hosting Tor is equal to hosting open SMTP. ISPs which might have been Tor-friendly at the outset would do a 180 and unnecessarily adopt a No-Tor service policy. On 07/30/2014 03:39 PM, Lunar wrote: > tor(a)t-3.net: >> You somewhat made a mistake here - you've got to have an exit policy that >> (minimally) rejects ports 25 and 465, or else your relay becomes a giant >> abuse tool for spammers, scammers, and phishers instead of what you intended >> it to be (which was a standard-functioning Tor relay). > > Please don't blame the victim. If this ISP acted differently than what > they initially promised, then they are the problem. >

1 0

German company Webtropia: Terminated contract without notice because of abuse
by uf＠riseup.net 30 Jul '14

30 Jul '14

Hi all, I've been running two exit relays, [1] and [2], at the German company Webtropia [3] for the past two weeks. Things went quite nice and smoothly, the speed of the server was decent and the network great, pushing quite some terabyte. Before renting the server, I told them what I wanted to do, if the would forward abuse etc. They said there were fine with this and forwarding would be no problem, given that I would deal with such mails in a timely manner. So I decided to rent the server, maybe naive? Yesterday (29th) they stopped routing/switching traffic to the server, so it wasn't accessible anymore. They sent me a mail, the subject read "termination without notice", claiming they did this because I didn't pay the invoice. I replied that I doubt this and sent them the transaction details. Their reply claimed that my contract wasn't quited because of this, but instead of abuse: They wrote that they got "52 mails" the day before (28th) dealing with phishing mails, bittorent downloads, ddos, etc. I told them once again that this server is housing tor exit nodes, and I'm not responsible for the traffic. However, I asked if we could find an agreement and "meet in the middle": Closing some ports (25 for example) and forward the mails to me, so I would take care of these and they could lie back and think "not our department" (actually as spoken about beforehand). Sadly there wasn't any negotiation possible, the denied me (up until now at least) even a refund of the money I already paid (is this legal?). Just to inform you about this. Stay away of them - they don't keep their words. Cheers, uf [1] https://globe.torproject.org/#/relay/94CB5C820BF97391BFDCAF8DD1B3176A452E8F… [2] https://globe.torproject.org/#/relay/55A463CAB24AFB91073C6D6D7CC6CA741A1430… [3] https://www.webtropia.com/en/

2 1

Re: [tor-relays] German company Webtropia: Terminated contract without notice because of abuse
by tor＠t-3.net 30 Jul '14

30 Jul '14

IMO, even relaying SMTP-like for the email which typically requires auth first isn't a great idea if there is any concern about an upstream getting abuse complaints about a relay (such as a leased box). A frequent way that spammers get their garbage out these days is to compromise a user account, I say this as a mail server admin who has to deal with the mess regularly. Oftentimes they guess the PW via dictionary attacks, but sometimes they keylog the user's box to get the email login. If the spammer has compromised an account and is forced to use webmail to dump the spam instead of an SMTP-like means, your relay doesn't show up in the email headers in the same way and may even be obfuscated. The differences are good things if you want to minimize abuse complaints of this sort. Also the SMTP-like sending seems to get more spam out the door faster than something which must use webmail instead. On 07/30/2014 03:08 PM, krishna e bera wrote: > On 14-07-30 05:11 AM, tor(a)t-3.net wrote: >> >> You somewhat made a mistake here - you've got to have an exit policy >> that (minimally) rejects ports 25 and 465, or else your relay becomes a >> giant abuse tool for spammers, scammers, and phishers instead of what >> you intended it to be (which was a standard-functioning Tor relay). >> >> You might try telling your ISP that you made a mistake in your >> configuration which allowed spam email to go out, and you're willing to >> correct that error and move forward. >> >> >> ExitPolicy reject *:25 >> ExitPolicy reject *:465 > > Most SMTP servers i have seen listening on port 465 and 587 require > authentication, so it shouldnt be necessary to block those ports. Can > anyone name some that dont need authentication to send email? > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

Re: [tor-relays] Relay not on Atlas or Globe?
by Mike Patton 30 Jul '14

30 Jul '14

Yes is there now. Very strange. I restarted it today because of a Tor update and a few hours later it was fine. M. On 30/07/2014 9:48 pm, Neuman1812 <neuman1812(a)gmail.com> wrote: > > Its there... > > https://atlas.torproject.org/#details/527ACFA6E729CF1CF3203444BA7E5E6CA6CE7… > > > On 07/29/2014 07:58 PM, Michael Patton wrote: >> >> Hello all, >> >> I have started a new exit relay recently (NetFreedomTest3 - 527ACFA6E729CF1CF3203444BA7E5E6CA6CE7F89) and it has been up over 5 days now. It has started seeing some decent traffic lately too. However I can't find the relay in Atlas or Globe? >> >> Any ideas? >> >> M. >> >> >> _______________________________________________ >> >> tor-relays mailing list >> >> tor-relays(a)lists.torproject.org >> >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >> >

1 0

Relay not on Atlas or Globe?
by Michael Patton 30 Jul '14

30 Jul '14

Hello all, I have started a new exit relay recently (NetFreedomTest3 - 527ACFA6E729CF1CF3203444BA7E5E6CA6CE7F89) and it has been up over 5 days now. It has started seeing some decent traffic lately too. However I can't find the relay in Atlas or Globe? Any ideas? M.

2 1

Possible tor usage by Dragonfly aka Energetic Bear
by manuel＠myops.de 29 Jul '14

29 Jul '14

Hi, today I received a registered mail by the BKA, the german federal police, alerting me that some stuff related to the Dragonfly aka Energetic Bear backdoor Oldrea/Havex could be traced back to one of my ips. The ip in questions is the one with which I run my tor exit node. I phoned the BKA and asked if they would be aware that Dragonfly uses the tor network to connect to their C&C servers. At least the BKA-person at the phone wasn't aware. Just thought to let you know. Regards, M.

3 2

providers with AES-NI?
by Michael Ball 25 Jul '14

25 Jul '14

hey folks does anyone here know of any decent (and somewhat cheap) dedicated server providers that offer AES-NI crypto acceleration? the only decent and affordable one i've found so far is this from online.net: http://www.online.net/en/dedicated-server/dedibox-xc the bandwidth seems a bit low for the price... i assume what you're paying for is the processor and the memory. hit me up with all the providers you guys know of. thanks. michael ball

4 3

Speed of my relay not correct on global list
by B00ze/Empire 23 Jul '14

23 Jul '14

Good day. I hope this is the correct mailing list for this. I run a small relay, alias "Empire64" (I tried an exit once, but my IP was then banned at several places, so back to only a relay) on Win Xp. It is very small (bandwidth 80k, burst 160k) but it used to be smaller (64k). Back when it was 64k, I still had a lot of traffic, and in Vidalia's "View the network" list of relays, I was listed as a 64k node. Now that I have increased bandwidth and would like to increase it more depending on how much traffic this creates, I see that no one uses my relay, I have practically no traffic. I think this is because in the "View the network" list, I am listed as a 10k node! I know that Tor has changed since I ran the relay at 64k. If I understand correctly, the Tor network now TESTS for bandwidth before accepting the declared bandwidth in the torRC file. Well obviously, this testing is not working for me. I have "attached" a screenshot of one of the rare times when I do have traffic - as you can see, my node DOES run @ 80k. But, see the other "attached" pic, I am showing in the list as a 10k node. Also, the Atlas shows me as UNNAMMED, I don't understand why, I am the only one with that alias... Tor80k screenshot: <https://unsee.cc/sumipoge/> (it needs javascript) Tor10k screenshot: <https://unsee.cc/deguzoba/> Can you guys help me with this? I'd like to contribute to the network but its not working for me now, and besides, the more traffic goes through me, the better it hides my own traffic; I want more :-) My uptime (from the Atlas): 22 days 3 hours 23 minutes and 16 seconds Fingerprint: E1DFC86060848E0FDCC7B0F072FA9EBAC639DA66 Platform: Tor 0.2.4.21 on Windows XP (updated to 2.4.22 just now) Thank you. Best Regards, -- ' _\|/_ Sylvain / B00ze64(a)hotmail.com ' (o o) Member-+-David-Suzuki-Foundation-+-Planetary-Society- oO-( )-Oo Pentium of Borg: Division's futile; You will be approximated.

9 12

Re: [tor-relays] [tor-dev] Hidden service policies
by grarpamp 21 Jul '14

21 Jul '14

On Sun, Jul 20, 2014 at 6:34 PM, Mike Hearn <mike(a)plan99.net> wrote: > Hello, > > As we know, hidden services can be useful for all kinds of legitimate things > (Pond's usage is particularly interesting), however they do also sometimes > get used by botnets and other problematic things. > > Tor provides exit policies to let exit relay operators restrict traffic they > consider to be unwanted or abusive. In this way a kind of international > group consensus emerges about what is and is not acceptable usage of Tor. > For instance, SMTP out is widely restricted. > > Has there been any discussion of implementing similar controls for hidden > services, where relays would refuse to act as introduction points for hidden > services that match certain criteria e.g. have a particular key, or whose > key appears in a list downloaded occasionally via Tor itself. In this way > relay operators could avoid their resources being used for establishing > communication with botnet CnC servers. > > Obviously such a scheme would require a protocol and client upgrade to avoid > nodes building circuits to relays that then refuse to introduce. > > The downside is additional complexity. The upside is potentially recruiting > new relay operators. HS's will just change their HS keys out from under your list. Then it becomes whack a mole. And you'll also be taking out shared services with the bathwater. Are you funding maintenance of that list? Ready to be called a censor when you exceed your noble intent as all have done before? And to be ignored by those operators who don't care to subscribe to your censor list thus nullifying your efforts (not least of why because it may be illegal for them to look at services on the list to verify it, or to look at and make decisions regarding content of traffic that transits them). And ignored by botnet ops who will surely run their own relays and internal pathing.

4 8

Fwd: [Abuse[...]] GameoverZeus-Infektionen
by Ch'Gans 20 Jul '14

20 Jul '14

Hi there, I'm here to look for advice or comments on how to handle abuse reports when you run a TOR relay exit on a "server for the mass". I'm running the TOR exit node 18B6EBAF10814335242ECA5705A04AAD29774078 on Hetzner netowrk (50E/month, this is my contribution to the TOR project) So far I had to deal with few "easy" abuse reports (ssh scan, forum insults, spams, ...), I think i performed pretty well so far (thanks to Hetzner cooperation?) But today I just received this botnet related one. I do take this report seriously, I know that malware are more and more using the TOR network as an anonymous covert, I don't like malware, I don't like malicious botnet and I don't like spammers. Still I end up being identify as one of them. I knew from day one that it was a risky business to run an exit TOR node, but I want to stand up and fight. If only I can convince people of my right doing. First of all I am quite surprised that cert-bund.de (the complainant) didn't notice that I am a TOR exit node, so my first question (for people familiar with these guys) is: - How legit are these guys? Do they run for the German government? Are their simply trying to scare the shit out of me by citing europol.europa.eu, and us-cert.gov? (see redacted forwarded message below, my own opinion is "Yes") Then - Do they simply spam hosting company each time they have a probe sensing something somewhere (I know it's vague, but I can use that as a "this complainant is a spammer" kind of argument) Any other thoughts/remarks/comment on that matter? Regards, Chris Thought of the day: Nowadays it looks like server administrator tend to send abuse report each time they receive an illegal ping request! Testimony of the day: Last time I received an "SSH scan" abuse report, I sent back my SSH honeypot logs, which contains more than 5k login attempts per day. -------- Original Message -------- [..] ----- attachment ----- Dear Sir or Madam "Gameover Zeus" is malicious software which is primarily used by cybercriminals to carry out online banking fraud and to spy out login credentials for online services on infected PCs. It can also be used to install further malicious software (including blackmailing trojans such as "CryptoLocker" ransomware) on PCs or to carry out DDoS attacks. In a joint international campaign since the end of May 2014, law enforcement agencies, with the support of private sector partners, have taken action against the "Gameover Zeus" botnet [1]. As part of this campaign, it has now been possible to identify the IP addresses of systems infected with "Gameover Zeus" [2]. We are sending you a list of infected systems in your net area. Would you please examine the situation thoroughly and take appropriate measures to cleanse the systems. Sources: [1] Europol: International action against 'Gameover Zeus' botnet and 'CryptoLocker' ransomware <https://www.europol.europa.eu/content/international-action-against- gameover-zeus-botnet-and-cryptolocker-ransomware> [2] ShadowServer: Gameover Zeus & Cryptolocker <http://blog.shadowserver.org/2014/06/08/gameover-zeus-cryptolocker/> [3] US-CERT: GameOver Zeus P2P Malware <https://www.us-cert.gov/ncas/alerts/TA14-150A> A list of infected systems in your net area: [...] Kind regards, Team CERT-Bund

6 8

Busted links on Tor Relay standard web page
by mick 15 Jul '14

15 Jul '14

My apologies if this has been discussed before and I have missed it. I have been reviewing the web page on my relay (which is based on the standard Tor explanation page) and have noticed that several links are now broken following update of the Tor site itself (e.g. https://www.torproject.org/torusers.html.en no longer exists) I also notice that https://tor-svn.freehaven.net/svn/tor/trunk/contrib/exitlist cannot be reached at all and the same page over http seems not to exist. If other operators are similarly using a page based on the old template, they may wish to update. Best Mick --------------------------------------------------------------------- Mick Morgan gpg fingerprint: FC23 3338 F664 5E66 876B 72C0 0A1F E60B 5BAD D312 http://baldric.net ---------------------------------------------------------------------

1 0

badexit D9B6E8F3DC60095F25252A1986E90932454C24D3
by grarpamp 15 Jul '14

15 Jul '14

Breaks TLS on check.torproject.org, etc.

4 7