- tor-relays - lists.torproject.org

Reminder: Pre-PETS event Tuesday
by Moritz Bartl 15 Jul '14

15 Jul '14

Everyone in Amsterdam should come. And bring friends! :) https://blog.torproject.org/events/researchers-practitioners-meetup-pets-am… -- Moritz Bartl https://www.torservers.net/

2 1

Oubound Ports
by Greg Moss 11 Jul '14

11 Jul '14

Newbie to Tor but have a Debian server up and running as a relay. Do I need to filter outbound traffic from the tor server on my firewall. If yes what ports would I need to open. I am also have a good look a Tails any suggestions would be helpful. Thanks - gm

10 18

Exits behind a next-gen firewall? Opinions please
by Jesse Victors 11 Jul '14

11 Jul '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hey guys, I've been running some exit nodes for some time now, and they're doing well. They've burned through many terabytes of bandwidth, and thanks to Tor's recommended reduced exit policy, complaints have been minimal. Clearly the vast majority of the Tor traffic is not malicious, but I have received some reports from other companies and from my ISP of hacking attempts: SQL Injection, XSS, botnet C&C, basic things like that. My ISP now tells me that they could reduce the reports even further by routing the exits through a "next-generation firewall" which apparently can detect an obvious clearnet attack and drop that connection a few milliseconds after the attack occurs. I don't know how the firewall works in detail, perhaps it has the ability to drop a specific connection rather than drop all access to the destination IP for a while, nor do I know how it would interact with Tor's traffic patterns out of an exit. I'm posting here for opinions. My question is, is this a good idea, and if so, any advice? Does anyone have any experience with such a setup? - -- Jesse V. /PGP 0xC20BEC80/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQF8BAEBCgBmBQJTvyBdXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQxMjgyMjhENjEyODQ1OTU1NzBCMjgwRkFB RDk3MzY0RkMyMEJFQzgwAAoJEK2XNk/CC+yAbrcH/2IG+Z6jVNhj9j5EpvHkzl0V XXn1Fbkw7EV8P+cRfQwgmouGQZ4IhuD9QP21ql7wvAIHIkIeaKNtXDb1jELL6F3z b1r8IRm2ePOJNl3X3m/5NIbqbz2utdaRqLglo9vhmr26zx+VMJBfzE5AvVLUhq9B CzBYjJujJcASH9KWN08hhjxu81mS0xUmUnFJIfoV7sJto2y3EmJuCQXauMBsxDsf 1rNQFcoxfKS1YI1v1MdBA/xHNO+UaLUShFQR1mw7RIW8jaPNLTGE157nPXMq9xiX nTzOjkgZ3RI+qrmhcjwJEcV9BAAO86C6HXJvflbhkVPZkCBB43LFCeUKf+SGRR4= =98Se -----END PGP SIGNATURE-----

4 3

Parliamentary inquiry about legal status of running Tor in Austria
by MacLemon 09 Jul '14

09 Jul '14

Hoi! This is a cross posting tor-talk/tor-relays (Due to the current attention on the recent events in Austria. Thanks for understanding.) Niko Alm (of Austrian political party NEOS) has made an official parliamentary inquiry to the Austrian ministry of justice about the legal status of Tor. Blog posting: http://alm.at/tor/ (in german language) Inquiry: http://neos.eu/klub/20140708_AF-TOR-BMJ.pdf (in german language) In theory running a relay/exit _should_ be covered by Austrian E-Commerce law §13. It's just not legally proven that Tor also falls under the definition of a “communications network” from a legal point of view. Technically everyone would certainly agree that this is the case. From what I understand the goal is to get an official statement by the Austrian ministry of justice that Tor falls under the legal definition of a communications network. Which would mean, that Relay-Ops are not liable for the traffic passing through their relays given they do not initiate the traffic by themselves do not select the recipient of the information do not select or alter the transmitted information This includes caching. Austrian E-Commerce law, §13 legal text (german language) http://www.jusline.at/index.php?cpid=ba688068a8c8a95352ed951ddb88783e&lawid… Best regards MacLemon

2 1

Unprompted HUPs
by kingqueen 09 Jul '14

09 Jul '14

hi, Checking the log of my relay, I see that sometimes it reloads its configuration from what it says is a HUP signal. An example: "06:40:57 [NOTICE] Received reload signal (hup). Reloading config and resetting internal state." I don't understand, as I was asleep at that point and didn't interact with the relay or the server at all, I haven't set up anything to automatically issue a HUP. Does Tor automatically trigger its own HUP every so often? Thanks --- This email is free from viruses and malware because avast! Antivirus protection is active. http://www.avast.com

2 1

Google captcha
by kingqueen 09 Jul '14

09 Jul '14

Hello Since running a relay, I have frequently had the notice akin to "Google has detected unusual activity from your computer or network" and had to do the captcha, when I have connected via the server that the relay is running on; both by Chromium over VNC and by Firefox over OpenVPN. The thing is, I am not, and have never been, an exit node. I was a middle node and am now a guard node. So I am somewhat confused as to why Google is getting unusual activity from my server? I guess it could be a coincidence and somebody else from the server farm has tripped it, but it seems a remarkable coincidence, as I have run the dedi for nearly a year and didn't have the Google notice until after the Tor relay was started in the last three weeks or so. But I don't understand how being a Tor relay could have tripped it, as I've never been an exit node. Thank you --- This email is free from viruses and malware because avast! Antivirus protection is active. http://www.avast.com

3 3

"excessive bounces" on tor-relay list
by Kali Tor 09 Jul '14

09 Jul '14

Hi, I keep getting the warning once in a while that there are excessive bounces from my email address and that my membership to this list has been disabled until I click on a link to re-enable it. Is there any reason why something like this would happen? I use yahoo mail, as you can see but I just don't know why Yahoo Mail would bounce any message. I have not received any warnings from Yahoo about such an action. Thanks, -kali-

4 3

Re: [tor-relays] different torrc and fingerprint when rebooted
by tor＠t-3.net 09 Jul '14

09 Jul '14

In my experience yes, you should be able to move those files to the current working directory and it will just work.

2 1

Re: [tor-relays] Reliable way to gauge tor throttling?
by tor＠t-3.net 09 Jul '14

09 Jul '14

Assuming the Tor service is running on a dedicated host, you could use an SNMP-aware switch and query it with Cacti for graphs on the switchports, or maybe run an snmpd on the node and use Cacti to build graphs against the node's ethernet card stats. http://www.cacti.net . It can also be pulled down as an RPM from some repositories, such as epel.

1 0

Re: [tor-relays] Hits againast GFC hex--string fingerprint in IPTables yesterday
by tor＠t-3.net 09 Jul '14

09 Jul '14

This has happened again, to the same node. The 4 hits came between approx. 16:39:57 and 16:40:27 EST on July 8. 4 offending IPs, one hit each: 1.50.251.122, 210.72.140.17, 119.4.5.55, 115.200.236.120 (they are all from China, per Apnic). They hit against the same hex-string rule as before.

1 0

Setting up relay on fedora
by Joker Hacker 08 Jul '14

08 Jul '14

I would like to setup tor relay on my fedora box it runs 16 to 18hrs a day.' Could you please point appropriate links or videos? - Thanks

2 1

Reliable way to gauge tor throttling?
by jason＠icetor.is 08 Jul '14

08 Jul '14

What would be a good method to determine if tor traffic is being throttled on a exit relay vs normal internet traffic? -J

2 1

CPU usage
by kingqueen 08 Jul '14

08 Jul '14

Hi, I'm running a Tor relay on a low cost dedicated server. The tor relay is named kingqueen and it's running on an Intel Atom N2700 dual core hyperthreaded CPU with 2gb of memory, in a data centre with a symmetric 100mbps connection. I have found as time goes on and usage of my relay increases (about 3 weeks now) that the Tor process is increasingly using more of the CPU. TOP shows Tor using over 100% of CPU and the load average is 2 or more. I use the dedi for other, less intensive things (OpenVPN, seedbox, also Owncloud though this falls over). I know that this is sub-optimal and ideally the dedi should be for the relay alone. I was wondering if the CPU usage is standard. I guess it could be, given it has decryption work to be done? Is it high? Is there anything I can do to lower it, other than rate limiting, which I don't want to do? Thank you

7 11

different torrc and fingerprint when rebooted
by Kali Tor 07 Jul '14

07 Jul '14

Hi all, When I installed tor for the first on an Ubuntu machine, ran it when logged in as normal user "tor" using the /etc/tor/torrc. However today I had to reboot the node and when it came back ps showed that it was using a different torrc /usr/sbin/tor --defaults-torrc /usr/share/tor/tor-service-defaults-torrc --hush IN addition, it seem to be running with a different/new fingerprint! The content of /usr/share/tor/tor-service-defaults-torrc is: DataDirectory /var/lib/tor PidFile /var/run/tor/tor.pid RunAsDaemon 1 User debian-tor ControlSocket /var/run/tor/control ControlSocketsGroupWritable 1 CookieAuthentication 1 CookieAuthFileGroupReadable 1 CookieAuthFile /var/run/tor/control.authcookie Log notice file /var/log/tor/log Could it be due to the different "User" that I have a new fingerprint? How do I make sure that the next time I reboot I use the correct torrc at /etc/tor/torrc and the correct fingerprint? Thanks, -kali-

1 1

Re: [tor-relays] Trying Trusted Tor Traceroutes
by Sebastian Urbach 06 Jul '14

06 Jul '14

Dear Renke, Dear list-members, Yes, the TTTT project is alive. Thank you for asking and for your ongoing support. Yes the repo was updated but it is not ready for review yet. We are making changes for the next traceroute round and will ask for testing / testers as soon as it is ready. There is also being worked on a reverse traceroute and we had people at the last tor-dev meeting as well who are trying to figure out what step to do next. Regarding your comment on "Dynamic download of relay IPs". It's just downloading the current list of relay IP instead of using a static list. I don't see any harm in that as one of the participant in the past pointed out to use the latest IPs anyway. Theres a lot of work to do with limited human resources, please stay tuned. We will be back ;-) Hi Sebestian, > Just a quick update regarding the TTTT project. There are multiple GB's > of data to analyse and it is still being worked on. We are also working > on the public script(s) as well. is your project still on-going? I'm asking because your score board was not updated since May (except one test(?) upload in the phase foo-foo) and though the repository updates are interesting (dynamic download of relay ips) they were never approved for usage according to your installation notes. Renke ---------- _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

Re: [tor-relays] UK Exit Node
by Thomas White 06 Jul '14

06 Jul '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Michael, First of all thank you for running an exit. I run a large series of exits in the Netherlands (https://globe.torproject.org/#/search/query=Chandler&filters[country]=nl) and I am a UK citizen. Having experienced many troubles, including server seizures, I decided to move the servers to a jurisdiction I am not living in or plan on living in as if there is legal trouble, you want to put up as many layers as protection as you can. That means even if my node in NL is seized and I could face a conviction (theoretically), because it is not illegal in the UK there is nothing that the government can do to force me over there under the concept of dual-criminality. Furthermore, running a Tor exit at a residential address is a very, very bad idea. I speak from experience here after encountering UK police already and their version of "knock and greet" is at 4am with the door taken off when they don't realise it is an exit node. You want to separate your traffic from that of your exits wherever possible because assuming you were asked in court if you ever used your own exit, it would be conceivable that ANY traffic from that exit server COULD have been yours if you've used or were on the same IP as it. This is of course not the case if you don't use the same IP/residence for your personal traffic. Also, on the topic of blacklisting IPs I find it a bad idea both morally and legally. Most believe morals would dictate blocking child porn/peer to peer is a good act, but this is the same guise governments have used to overextend their reach and so I don't block any traffic regardless of how questionable it is. The second reason is because of your legal liability in the UK as my solicitor has advised me; by blocking one set of IP's you are then accepting control to filter and moderate the traffic of your servers and therefore you don't have the same (full set of) safe-harbor provisions protecting you. It then becomes a trivial matter for law enforcement to come to you and order you block more sites without a court order. So overall, freedom of speech and the right to read are inherently against the idea of blocking content merely because the overwhelming majority of people believe it should be blocked. Freedom isn't free if it isn't totally free. - -Tom On 06/07/2014 08:51, Sanjeev Gupta wrote: > On Sun, Jul 6, 2014 at 3:39 PM, Michael Banks <c(a)starbs.net> > wrote: > >> The block lists are very limited, i.e P2P, lists of known >> blackhats/paedophiles, unallocated IP ranges and most >> importantly: government-owned address and anti-tor addresses > > > True, and I agree with your definition of malicious. > > My concern is that it is not either my place, or yours, to define > what is good or bad for the Random User to visit, _IF_ we are > offering a Tor relay. Our intentions in using this list, in > particular, are not relevant. After all, the Govt of China also > claims to be shielding its users from known bad guys. > > We are against such censorship, so why should we add our own > blocks, without warning, without anyway for the user to even know > we have such a block? > > > > _______________________________________________ tor-relays mailing > list tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) iQIcBAEBAgAGBQJTuZIYAAoJEE2uQiaesOsL0ycQAKn1kFwjLMVAEvQ8v3hQUvOl dFzDhDLHR+SMUO+K6M8PvwsKHVB1og3jN4UN4hYvzGJl1qOsOhMGaWp6uvAxwJJJ JqjwyCnpHSTdYH2LKVjtKz3o/W00TDl8fJxXt5AfmDNUX9M/MsHieq7U6KPpKWyy K8U0xAxrLyFzaaFVVHjotZzRoCg67IMiLPXx/l6QurD+MCwNG7DWf+aMAgjxTQvJ 5OFQ938hmhAe7bXEkz0uc3zg5C36GOlif42Z7s3kqNMbP//yBBzSnV1dCtggGNqt F/IRMcK8TKkBecC5IlW3E3rHh1lcXH6VmkSKYC6/2KTkYlhdkROM8blGbt4P3kkf EHKmSa6kN0/iwUTdNsoY/duu2P96bWpZ69WFywf95WqRq6I/pwBMs2crN/QQWJ0t qu67OAIb4daBccBtf4XSq5S9W9KWej7cE6tdyoxBxBZlSTkmEljdhtLr5qkahtdL SEVHdY8ko4bFOBNMjZxGl8HKQbE2UlCiF3ErK8IyRGeLBwUlB29OlinaoJrewXud CHrkrNEXrDjePcUerz74Y7sRgtv2yOSKBhF4L/1kVV/govvysz3TuLQjmU9e1rQf alHm4wvRF18Lodlp+AnlKTlmVCP9cklTAsfNVb/TCOyjRmQewHXJd0JFdXpBQD8J x12SnIhToKOq0Q/iQOCF =doV0 -----END PGP SIGNATURE-----

1 0

UK Exit Node
by Michael Banks 06 Jul '14

06 Jul '14

Any tips for UK Exit Node operators on a Residential ISP (BT)? Running a reduced exit policy, informed various teams at the ISP, running PeerGuardian on the server in question (blocking P2P/kiddyporn/hacking related IPs), have a hostname setup tor-relay.itschip.com, planning to leave the thing running 24/7 So far, it's been live on and off (ironing out issues) for the past few days and it's transferred well in excess of 300GB already. Looks like I'm one of the fastest Exit Nodes in the UK c:

6 11

Relay not making connections.
by Lluís 06 Jul '14

06 Jul '14

After reading the documentation and related FAQs I got my TOR relay installed and configured. It is listed in Atlas with the running, V2Dir and valid flags for more than 5 days. However, it receives almost no connections and the following notice appears frequently in the logs: [notice] No circuits are opened. Relaxed timeout for circuit 1331 (a Testing circuit 3-hop circuit in state doing handshakes with channel state open) to 60000ms. However, it appears the circuit has timed out anyway. 6 guards are live. [7 similar message(s) suppressed in last 3600 seconds] Can anyone point me over the right track ? Thanks, Lluis

2 2

Trying Trusted Tor Traceroutes
by Sebastian Urbach 06 Jul '14

06 Jul '14

Dear list members, Just a quick update regarding the TTTT project. There are multiple GB's of data to analyse and it is still being worked on. We are also working on the public script(s) as well. Thanks for your ongoing support ! -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ---------------------------------------------- Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. ---------------------------------------------- Benjamin Franklin (1706 - 1790), Inventor, journalist, printer, diplomat and statesman

2 1

Relays or exits: which is needed?
by michaelball＠riseup.net 06 Jul '14

06 Jul '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 I'm (hopefully) going to be running a few high-speed Tor servers sometime in the near future. Which type of Tor server (exits vs. relays) is needed the most right now? Thanks. Michael Ball @cryptostone - 0x0BEF5055 -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJTuMmTAAoJEPz+HqEL71BVSK4P/3QLZN0dXoMFgz4//pKzCEsl A0GW/DZEgmVwjo0GVmuvKnxcY+e8w53NQ7nD4XtIJw+KC/VgYnYomjA+JxI8UMWF HkQ3KHuX90YbUTPFD2aJmcj6ZUs99pHjgZblEzPzMxfPWgHXDe09bT7Z1TBGsJg0 JW1aQuo64tF1YPqhh98P7Qqn9mRU7MiWhzJjRUCPsj5CeQO1x/QcXBYP77UGtPe3 y6bpwberzbM6GgDjwdIb61LJScE/5bueApOEmvO6PJ3lMwwnJhrynExmE/nhR/lC bZ7YCwD4ICCuHIv9b0DqBMZDHb5mZuRtqDiUKzFwXX/M3Mj88RtBQemNZXTbvBp4 3cXejN5cPUAOgE2RC93bk40n7oYGkDtQDHu7i7Ed8K3r8yCGDbUt0KZzbHU3/EDQ v2AlFY/UqDR7XTjYMQAPcwG+iHbaHVClMRn9V512sBqMtjliV2ODbqEZYhpUfvTF jMUgNE9vFVmlmIGmxZAbeoktxM+8o3M/coyV5xz9GbkL6ChYFHX5h215LstXqtBk M3dW8GMV48Qsa1zSDGp1aMXTpXZ1gm6h/+SfokEhKYSqcJFbqQIYvjL+V5+DLlZ/ 9Njcg+bAirvQfLIEtSsNQNenmJG5juB/eUs6LZjCbuL2YGbRuVtPMSmmxORQMnXl f/CTUUssfdxwt05GG4cz =kLYH -----END PGP SIGNATURE-----

3 2

Re: [tor-relays] New Tor node operator hibernation question
by pandemicrelay＠hushmail.com 05 Jul '14

05 Jul '14

Thank you for explaining hibernation better. Could there be any issue though since I 'forced' my relay out of this hibernation?

1 0

Re: [tor-relays] gazduire.ro
by icetor.is＠bitmessage.ro 05 Jul '14

05 Jul '14

On 7/5/2014 6:14 AM, Moritz Bartl wrote:> Potentially interesting candidate for Tor exits. Someone on IRC said > they accepted exits. I didn't look at it in detail, it would be > interesting to know if they're just using Voxility or a different data > center/peering. > > https://www.gazduire.ro/ > https://www.voxility.com/ > > One of our bridge servers is located at m247, which are very friendly, > but I don't know if they allow exits, and they're a subsidiary of a UK > company: > > https://www.m247.ro/ > Hi, They do allow exits. 6C36F9ACBA57AC9C10DBC39D330CFA337522E72B The one and only in their network. They are nice and cooperative, never had a problem in > 3 months of continious usage. Only requiremenet is to block port TCP 25 outgoing (SMTP) to prevent email spam. No anti p2p filesharing policy. I don't think they are the same datacenter with Voxility. This is NETBRIDGE group, a group of comapnies running multiple very high profile websites here (like advertising websites and traffic measurement websites for .ro TLD). Their headoffice is in Bucharest, but the datacenter I think it's not in Bucharest, it is in other city (Suceava) some few hundreds KMs distance. Pros: - very srong uptime - good datacenter respecting highest industry's standards - nice ccoopeartion - vmware esxi virtualization - good network speed and quality - unmetered traffic Cons: - non-english version of their website (can be easily fixed); - only accepting visa/mastercard/paypal payments (maybe they can be convinced to go for BTC or WMZ if they are properly educated abut it); I have a good relation with them, Moritz, if you need specific details let me know and I'll update you here. ---Robert

1 0

gazduire.ro
by Moritz Bartl 05 Jul '14

05 Jul '14

Potentially interesting candidate for Tor exits. Someone on IRC said they accepted exits. I didn't look at it in detail, it would be interesting to know if they're just using Voxility or a different data center/peering. https://www.gazduire.ro/ https://www.voxility.com/ One of our bridge servers is located at m247, which are very friendly, but I don't know if they allow exits, and they're a subsidiary of a UK company: https://www.m247.ro/ -- Moritz Bartl https://www.torservers.net/

2 1

Why did my relay fall out of the consensus?
by Steve Snyder 04 Jul '14

04 Jul '14

On June 9th my relay, which was established about 20 months ago, fell out of the cached consensus. There are no errors in the logs, just notices that the relay is not in the cached consensus. Apart from upgrading to Tor v0.2.4.22 3 days earlier I haven't made any changes to the server. Anyone know what's going on here? https://exonerator.torproject.org/?targetaddr=&targetPort=&ip=5.9.191.52&ti… Thanks.

4 7

TAO on tor ops
by obx＠riseup.net 03 Jul '14

03 Jul '14

Do we have to assume to get targeted by TAO? Should we dump hardware ordered online?

2 1

NSA special treatment for Tor community
by no.thing_to-hide＠cryptopathie.eu 03 Jul '14

03 Jul '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello Tor relays! If you did not subscribe to the talk-list, like me until this evening, you may have missed the latest surveillance news: The NSA targets directly the nine Tor directory servers https://daserste.ndr.de/panorama/aktuell/nsa230_page-1.html The whole article is highly recommended to read. In what way normal, internal relays like mine are affected, is not further investigated. Best regards, and: Stay wiretapped! Anton - -- no.thing_to-hide at cryptopathie dot eu 0x30C3CDF0, RSA 2048, 24 Mar 2014 0FF8 A811 8857 1B7E 195B 649E CC26 E1A5 30C3 CDF0 Bitmessage (no metadata): BM-2cXixKZaqzJmTfz6ojiyLzmKg2JbzDnApC -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQEcBAEBAgAGBQJTtdjNAAoJEMwm4aUww83wl1gH/0k7HpY1k+ZQVrwowyZfVRK+ EnIJLarO8sOTKIz9wFpu3ZTo8x8zDBlca05au6Wa/RuxHzf8W5yl+xgulBKKhQkR l+lqQvv0Me2DcwFTfUsBoYkNxaoaf0sF1yO2Bn1OF3iMQO+nyF5bMV6WLq722AoR jFsvvvVP6JIRd14HFVLKMrpOvqEPkJa0XTpvQGBUpKxJA/+/hj+Od+/RpwC2eyIM lAjrDxvDGFwIzCFn/vgBGMSvOUmm+LVnMR/uVmNCRAylmF25YtkP3t4tM7iPKMNg 1aQWCCnT6UusdkSzjs3AazcIA9797029wDTZ4B9dUljhB4i3DrcdgiX3txjqQQw= =zCCT -----END PGP SIGNATURE-----

2 1

Re: [tor-relays] New Tor node operator hibernation question
by Simon Hanna 03 Jul '14

03 Jul '14

On Tue, Jul 1, 2014 at 7:34 AM, <pandemicrelay(a)hushmail.com> wrote: > Hello, > > I am a new Tor relay operator, and have setup my first relay. It's been > running as a Tor middle relay for about 10 days now, and it's been running > solid. It has the stable, guard, fast, running, and valid flags. I have my > AccountingMax quota set to start at the first of each month at midnight. > However, just past midnight on 07-01 Tor said it was going to hibernate > until 07-05. This had me confused as I was only about half way through my > monthly quota setup in AccountingMax for June, and my hosting provider > reset the data on the first at midnight. I read the manual page about > AccountingMax again, and it appears this may have been normal behavior. > However before I read the manual page, I forced my relay to wake up out of > that hibernation. It appears to be operating normally right now. However, I > am wondering if this will cause any issues this month, or in future months? > Also, can someone explain if the hibernation of 5 days was normal behavior > to begin with. > > Thank you > As far as I know, tor startes at some random point so that not all nodes are up in the beginning of the month. If every node would do that, at the end of the month (or day if all have accounting per day) nobody would be able to use tor...

1 0

Obfs + Non-obfs bridges
by Daniel Thill 03 Jul '14

03 Jul '14

Can a single tor daemon instance provide both non-obfuscated and various other obfuscated transports? Right now, I have one instance that provides both obfs3 and scramblesuit. E.g., ServerTransportPlugin obfs3,scramblesuit exec /usr/local/bin/obfsproxy managed ServerTransportListenAddr obfs3 MYIP:PORT ServerTransportListenAddr scramblesuit MYIP:PORT2 I currently have another tor instance that runs a vanilla bridge configuration (no transports) on a different port. Is this really necessary? I couldn't find any documentation that address this. Can non-transport clients use any bridge by simply not negotiating a transport? There is a "none" pluggable transport type, but I figured that was for debugging purposes. Thanks, Dan

2 1

Running tor in VPS - keep away snooping eyes
by Kali Tor 03 Jul '14

03 Jul '14

All, Are there anything special that needs to be done to make sure that Tor nodes running inside VMs (VPS) is protected from snooping eyes? Since there is hardly any data at rest I am assuming not, but then, what do I know!:) -kali-

5 10

rejected hit from China
by Larry Brandt 03 Jul '14

03 Jul '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Today my router blocked two hits from Chinese server 218.77.79.43:59762 to my 68.66.154.214:21. I don't listen to port 21. I don't listen to 21. Should I take some action? Is this normal or academic or...? glowworm -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJTtMqbAAoJEGtidykNvjCmS+AH/353bFiZs8tJ+3iUwCPARUOj 9stR4/Hhq+vCk9NCnaYYJ/rQn3d0ZQW8SaZXmxzaqsTe+8eioy9n8sAELLEe9xMe VMenA5tYMkjIl08V7PW3v05S7Ap631BtTuO2TXeCickmz0frcDnEHVHAbfklFNLZ h67U/uAN2OYp1iu6++IBBoZOTpU6dAsDpRUGZofS9gWpNdqWB5En3hzaoCS2hEXT sG6N/mkExMBbmQri3pp02KIakOx8OzYi3Nl+ByxDHIqtmLEmu+3+clEEpYlSI6yN 3je75ek+e42HLVSepvLXhfA8rDQabl3TjGOq+VXdDZNwPWntBfpnfkwBhp+TnQk= =/PSG -----END PGP SIGNATURE-----

2 1

Why is UFW bllocking allowed TOR traffic?
by Jeff Odell 02 Jul '14

02 Jul '14

I was monitoring UFW today and noticed that it was periodically blocking allowed TOR traffic. any ideas why from those with more experience than I? toradmin@IrvineTorExit:~$ sudo ufw status Status: active To Action From -- ------ ---- 22 ALLOW Anywhere 9001/tcp ALLOW Anywhere 9030/tcp ALLOW Anywhere 80 ALLOW Anywhere 22 (v6) ALLOW Anywhere (v6) 9001/tcp (v6) ALLOW Anywhere (v6) 9030/tcp (v6) ALLOW Anywhere (v6) 80 (v6) ALLOW Anywhere (v6) toradmin@IrvineTorExit:~$ sudo tail -f /var/log/syslog | grep DPT=9001 Jun 22 15:38:12 IrvineTorExit kernel: [ 2159.246977] [UFW BLOCK] IN=eth0 OUT= MAC=04:01:1b:5e:9a:01:28:8a:1c:64:cf:f0:08:00 SRC=92.108.200.200 DST=188.226.199.250 LEN=52 TOS=0x00 PREC=0x00 TTL=120 ID=10392 DF PROTO=TCP SPT=52000 DPT=9001 WINDOW=16652 RES=0x00 ACK URGP=0 Jun 22 15:38:12 IrvineTorExit kernel: [ 2159.246988] [UFW BLOCK] IN=eth0 OUT= MAC=04:01:1b:5e:9a:01:28:8a:1c:64:cf:f0:08:00 SRC=92.108.200.200 DST=188.226.199.250 LEN=52 TOS=0x00 PREC=0x00 TTL=120 ID=10396 DF PROTO=TCP SPT=52000 DPT=9001 WINDOW=16652 RES=0x00 ACK URGP=0 Regards, Jeff

3 2

FYI: Tor-Ops Meeting in Vienna
by MacLemon 02 Jul '14

02 Jul '14

Hoi! Yes, this is a crosspost of tor-talk, please be gentle. There will be a Tor-ops meeting on Thursday, 2014-07-03, 19:00 at the Metalab[0] in Vienna/Austria. The meeting was planned way before the recent rulings in Austria became known but they will be discussed for certain. The actual purpose of the meeting shall be to finally found a Torservers.at organisation (German word: Verein) in Austria that works on running nodes in the public interest as well as exchange know-how and best practice on running relays, bridges and exits. So in case you're in Vienna, please join! Best regards MacLemon [0]: http://metalab.at/wiki/Lage "How to get to Metalab"

4 4

Bandwidth usage for an established relay node
by Kali Tor 02 Jul '14

02 Jul '14

Hi all, Curious as to how much bandwidth a stable, well established relay node will chew through in a month on an average? Anyone has any figures? -kali-

3 3

optimize performance of a relay running on a VM
by s7r 02 Jul '14

02 Jul '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have multiple relays running on the following systems: - - vmware vsphere virtualization technology - - 100 mbps port - - 1GB dedicated RAM - - 2.6 Ghz 1 core CPU dedicated - - OS: FreeBSD 10.0 Release amd64 or Debian Stable - - DO NOT KNOW IF I HAVE AES-NI SUPPORT OR HOW TO ACTIVATE IT (?) Currently atlas shows 3-4-5 MB/s advertised bandwidth for these relays. Arm shows between 600 and 1200 concurrent circuits (total of inbound, outbound and exit) and average traffic consumption is 5-6 TB per month (total both download and upload). I think this can be improved, but how? The servers have only purpose Tor, there is nothing else running on them and there is no bandwidth cap or throttling. Suggestions? Thanks in advance. - -- s7r PGP Fingerprint: 7C36 9232 5ABD FB0B 3021 03F1 837F A52C 8126 5B11 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) iQEcBAEBAgAGBQJTswH9AAoJEIN/pSyBJlsRtTMH/jFV2FdfSksYNalSn9fmHcRk sKoWfNuRL/FQAQ1R0faN0F3lemOfDq80vosmd95h5EIZG7UmmN/xs9s8K9PQAzxf j3XHwCtYVkKkEA1djdAbFUB5s3WN6ieNm0qnnqZeBk16A9vJeRI2wkYFPRaDn6c5 n9u+p5QUjRmBKMkY/TOZ12TWSdeD683SoGdx4O5FeP90B+Q61SFgDtkvX6wtWKZr flWM/Bf0gpQL6Qowl9E49J5dJj+RgSYqPZ943x37nutBYzGmn0pbqXU1ulg0WFuz 3tu4bjwLITg1BB64jnF9hwn91pnd8ECay8OMqnZxbI1QycvPTPcNkwkasqARfTs= =MJBs -----END PGP SIGNATURE-----

3 4

Re: [tor-relays] One IPv4 address, 1Gbit connection
by Tim 01 Jul '14

01 Jul '14

Tom, Why not run multiple tor relays on different ports on the same IPv4 address? For example, you could run 6 relays on 6 different ports on your IPv4 address (6 x 180 Mpbs > 1 Gbps). This would also utilise your 4 cores much more efficiently than running 2 relays (each relay will only ever use 1 core for most operations). Tim > Mon, 30 Jun 2014 14:48:59 +0200 Christian Dietrich <christian.d.dietrich(a)gmail.com>: > > Hi there, > > You will never be able to utilize the whole gigabit connection, at least > with the current tor version. > I'm also running 2 tor nodes (00000000000myTOR) on a single machine (3rd > gen Core i, Quad Core /w AES-NI) on an single IP, > reaching ~1.3 Gbit/s on an 1000 Base-T FD connection. Since you do not use > hardware accelerated crypto, > your transfer speed should be much lower. Anway my relays are also cpu > limited due to the fact that tor isn't > really utilizing much more than one cpu core. > > - Christian > > > 2014-06-30 13:05 GMT+02:00 Tom van der Woerdt <info(a)tvdw.eu>: > >> Hi, >> >> I'm running a Tor exit node on a 1gbit connection. Currently it's maxing >> at about 180Mbit/s (both ways, so 360Mbit/s) per instance, and I'm running >> two instances. >> >> That's not really using the connection well. The box has 4 cores (no >> AES-NI) and I'm looking for ways to utilize the other 640Mbit/s. >> >> Sadly it's not possible to get more IPv4 addresses on this box. I do >> however have access to a big range of IPv6 addresses. >> >> Can I somehow run more Tor instances on this box by utilizing those IPv6 >> addresses? Or are there other ways to optimize the throughput and get >> closer to that 1Gbit? >> >> Tom

3 3

New Tor node operator hibernation question
by pandemicrelay＠hushmail.com 01 Jul '14

01 Jul '14

Hello, I am a new Tor relay operator, and have setup my first relay. It's been running as a Tor middle relay for about 10 days now, and it's been running solid. It has the stable, guard, fast, running, and valid flags. I have my AccountingMax quota set to start at the first of each month at midnight. However, just past midnight on 07-01 Tor said it was going to hibernate until 07-05. This had me confused as I was only about half way through my monthly quota setup in AccountingMax for June, and my hosting provider reset the data on the first at midnight. I read the manual page about AccountingMax again, and it appears this may have been normal behavior. However before I read the manual page, I forced my relay to wake up out of that hibernation. It appears to be operating normally right now. However, I am wondering if this will cause any issues this month, or in future months? Also, can someone explain if the hibernation of 5 days was normal behavior to begin with. Thank you

1 0

Hits against GFC hex-string fingerprint in IPTables yesterday
by tor＠t-3.net 30 Jun '14

30 Jun '14

Wanted to point out to the list that we got 3 hits to our "Libero2" relay on port 9001 from chinese IP address 210.72.9.44 to a "GFC" reject line in the relay's iptables. I think this is the first time we've seen hits to this type of rule. The packets were dropped via this iptables detection: -A INPUT -p tcp -m string --hex-string "|00002800390038008800870035008400160013000a00330032009a009900450044002f00960041000500ff020100000400230000|" --algo kmp The packets came through at approximately these times EST: Jun 29 15:36:10 Jun 29 15:36:38 Jun 29 15:37:15

1 0

One IPv4 address, 1Gbit connection
by Tom van der Woerdt 30 Jun '14

30 Jun '14

Hi, I'm running a Tor exit node on a 1gbit connection. Currently it's maxing at about 180Mbit/s (both ways, so 360Mbit/s) per instance, and I'm running two instances. That's not really using the connection well. The box has 4 cores (no AES-NI) and I'm looking for ways to utilize the other 640Mbit/s. Sadly it's not possible to get more IPv4 addresses on this box. I do however have access to a big range of IPv6 addresses. Can I somehow run more Tor instances on this box by utilizing those IPv6 addresses? Or are there other ways to optimize the throughput and get closer to that 1Gbit? Tom

2 1

Spam
by kingqueen 29 Jun '14

29 Jun '14

hi, well having run a relay for just under 2 weeks, I've got my first spam on this email address. As you will no doubt have guessed, this is not my usual email address, it is only used for the Tor relay contact details, this email list and a very few other projects that will not have published my email address anywhere. So I guess that this spam is as a result of my email address appearing on Atlas or Globe or similar as a result of it being the contact address for my Tor relay. I know this possibility is mentioned in the Tor documentation; I read it somewhere. I guess there's not much to be done about it; I wouldn't want to remove contact details - the address is already in the public domain anyway, and I want to be contactable with any problems. I guess I just have to use the standard spam filtering and combating measures. Could those with experience of running a relay for longer, please advise if this will become a major problem? Will spam increase substantially? Also, any suggestions very gratefully received. Thank you! KQ --- This email is free from viruses and malware because avast! Antivirus protection is active. http://www.avast.com

8 13

Circuit purposes
by Joel Cretan 28 Jun '14

28 Jun '14

I'm running a relay that I do not intend to use for anything else, so I set SocksPort to 0. I usually have two or three circuits established anyway, though, so I guess I haven't managed to disable creating those. I'm not sure what they are for. They are always labeled "Purpose: Ags=is_internal,need_capacity,". Several of them seem to get created around the same time, stay open for a while, and then get closed around the same time. I see some other circuit purposes documented here: https://stem.torproject.org/api/control.html But that documentation indicates that "Tor may provide purposes not in this enum", which is the case here. What are these circuits for, and do I need them? Here's my torrc: http://pastebin.com/fuQv8B2m Here's my ifconfig output: http://pastebin.com/mxMkhbMj I'm running tor 0.2.4.22 compiled from source (did not specify any options on make) on raspbian wheezy June 2014 with kernel version 3.12.20+. Thanks, Joel

2 3

Directory Server and bandwidth accounting
by Kali Tor 28 Jun '14

28 Jun '14

Hi, Is my understanding correct that if I set AccountingMax, the relay will never be used as a DR? It kind of feels odd because in my situation I can donate 500GB (and maybe even more) but I do want to keep a max limit and at the same time let the relay be a DR as well. Any way to achieve this? -kali-

4 5

BBC iPlayer blocked for UK middle relay operators?
by Chris Whittleston 28 Jun '14

28 Jun '14

Is anyone else running a relay in the UK having issues accessing BBC iPlayer from the same connection? For the last 6 weeks or so now I've been getting messages telling me I'm 'outside the UK' when I'm in London, and my IP address clearly resolves to show that. Just wondering if the provider BBC use for iPlayer might have started just blocking all Tor IPs recently - including middle relays. Chris

3 6

Bridge still advertising removed pluggable transport?
by Rick Huebner 28 Jun '14

28 Jun '14

Hi. I removed the recently-deprecated obfs2 transport from my (0.2.4.22) bridge's torrc, but after restarting, it seems to still be advertising support for it. It correctly doesn't appear as a "Registered server transport obfs2" line in the tor log file, and it's not listed in the TOR_PT_SERVER_TRANSPORTS or TOR_PT_SERVER_BINDADDR env vars fed to obfsproxy, nor is obfsproxy listening at the port that was formerly used for obfs2 any more. But... it's still listed in a "TransportProxy obfs2" line in the tor state file after several hours, and is still showing up as a supported transport in my bridge's details page on globe.torproject.org. It seems like that would mean it's still being handed out as a working bridge by BridgeDB for those requesting obfs2 bridges, though that port and transport will never be up again. And it might trigger mistaken "bridge is down" or "destination is censored" signals from those attempting to monitor such things. Is there something else I need to do besides dropping obfs2 from the torrc ServerTransportPlugin line, or is this just a bug? If so, it'll be showing up a lot more as obfs2 is phased out. Thanks.

2 1

Bridge clients don't *really* update dynamic bridge IPs from fingerprints?
by Rick Huebner 28 Jun '14

28 Jun '14

I run a bridge from a "semi-static" home internet account, where the address is dynamically assigned but only changes when either the ISP or my hardware router goes down and forces a reconnect, which only happens maybe once every several months. I've read in a few places that Tor bridges with dynamic IP addresses are just as useful as those with static addresses, even if their address changes pretty often, because the bridge user's client will use the bridge's fingerprint to look up its current address and port from the bridge authority if it fails to connect. How certain are we that this is actually happening? It's not the behavior I'm seeing here. My IP address has changed maybe 3 times in the last year, once for an ISP outage after a storm, and for a couple of hardware router firmware updates on my end. In each case, my bridge's traffic plummeted back to essentially nil, with a long slow regrowth over several weeks (or months!) as the new address slowly propagated around to a new set of users. I like to monitor the "Who has used my bridge?" status from Vidalia, and I get a real heartwarming glow when I see places like Syria and Iran showing up regularly. I've had a nice steady clientele keeping my bridge pretty busy for the past few months, and then yesterday I needed to do a firmware update, and *pfft* all my clients are gone again and I'm back to square one. Sigh. What's worse, I then picture that hypothetical Syrian civil rights dissident who's come to rely on my bridge always being there, suddenly being stranded without a connection and needing to scramble to find another one. Unnecessarily, as I was back up in minutes, just with a new address. It's pretty clear that the mechanism for clients to refresh their bridge's addresses is there, but I'm doubting that it's actually working right. I can think of two main failure modes: either the fingerprint isn't being distributed (or entered), leaving the user with just the current IP address and port with no way to query the bridge authority for an update. Or it's being entered, but not actually used by the client. For the first, BridgeDB does distribute the fingerprints, but I note that the docs/bridges.html.en page mentions that it's optional, but then doesn't say anything about what it's good for or why you should include it, so I wonder if many users just don't bother, especially if they need to query BridgeDB from a different PC than they run their own copy of TBB on and can't easily copy & paste the whole thing. Also, it seems the email responder channel doesn't even give out the fingerprints at all, leaving all those users automatically without updates. I don't know the distribution split between BridgeDB site queries and email queries, so it's hard to guess the impact of that lack, but it seems like something that could be easily fixed regardless. Probably more critical though, is the second option. Why would the fingerprint not be used if it was entered? Maybe some key option got disabled somehow? If I'm reading the torrc manual right, there's an option called UpdateBridgesFromAuthority that controls exactly this behavior... and it defaults to off. And to see how it ends up being set in the actual TBB, I installed that and checked its torrc, and it's not in there either, so apparently it stays disabled. "Well, there's your problem..." So am I missing something, or has this feature somehow fallen through the cracks and ended up accidentally disabled for the vast majority of all bridge users? It seems like this must be having a pretty serious impact on overall bridge usage, as I was under the impression that a big percentage of bridges are run off of dynamic address accounts, and many of those will be changing addresses more often than mine, maybe as frequently as daily in the worst cases. And every time they do, they lose their entire clientele and have to restart the long, slow ramp up to a new user base again from scratch. This kind of forced, pointless churn can't possibly be good for the network. How many bridge operators are we losing every year because they never see significant traffic due to changing IP addresses too often? And if they ask about it, they're just told, "Sure, dynamic IP is fine, just be patient and they will come." And what's the impact on the bridge users of having their bridge connections going bad so much more often than they should? I think simply getting a bridge address might be a risk exposure for many of these people, and making them do it more often could be dangerous for them. Or maybe I'm just totally misreading this, and my own experiences of losing all my bridge clients on each change aren't typical, but are due to some other unknown singular issue. How about you other bridge providers, how many of you are on dynamic IP addresses, and have you noticed a similar huge drop in traffic after a change, or does your traffic seem to snap back pretty quickly as it should?

3 3

running Tor relay live with AddressSanitizer
by starlight.2013q4＠binnacle.cx 27 Jun '14

27 Jun '14

Has anyone tried running a live relay with an image built using GCC 4.8 and -fsanitize=address? AddressSanitizer documentation says it should be no worse than about x4 on CPU and typically about x2, so it looks reasonable to try. I'm seeing peak CPU of about 7-8% of a 2.2GHz AMD core. I'd probably create a static build, with 'libevent' and 'tor' compiled using -fsanitize=address -O1 -fno-omit-frame-pointer -g per the Google documentation and 'libz' compiled normally since 'zlib' is stable and mature. Any thoughts or experience? Thanks

3 6

bitcoin adopt a node idea
by jason＠icetor.is 27 Jun '14

27 Jun '14

This seems pretty damn similiar to something we should be offering for Tor relays, possibly even exits and bridges (if they only run for a month at a time). Possibly co-ordinated through the EFF? http://www.coindesk.com/adopt-node-project-aims-bolster-bitcoin-network-sec… -Jason

6 8

Is my tor exit relay set up correctly?
by Sander Bongers 26 Jun '14

26 Jun '14

Hi, A few weeks ago I setup a tor exit relay, using this documentation: https://www.torproject.org/docs/tor-relay-debian.html.en I have somewhat experience, so I kinda knew what I was doing, and I got the message "Self-testing indicates your ORPort is reachable from the outside. Excellent." in the log file. But my server doesn't seem to appear in any tor relay lists such as https://globe.torproject.org, even after a few weeks. What could I have done wrong?

4 5

Re: [tor-relays] [tor-relay] Spam
by tor＠t-3.net 26 Jun '14

26 Jun '14

The spam to my own Tor relay operator email address (same one as in this list) isn't meaningful in volume. I haven't seen any amounts that a delete key couldn't easily handle. In my experience, you should be careful with spam filtering, as you could end up dumping abuse complaints that you wanted to see and maybe respond to, or have legitimate relay list email not come through. I ended up having to whitelist some stuff for this list to work right because of automatic spam behavior of this mail service. It's not like the sight of spam email in your tor relay box is toxic to your workstation. It's usually obvious from the subject what it is, and that it can be safely and immediately deleted.

2 1

Need help to get TorDNSEL compiled
by BlueStar88 26 Jun '14

26 Jun '14

Hi there, today I've read about the outage at "check.torproject.org". Since my torcheck-service "torcheck.xenobite.eu" needs the underlying TorDNSEL feature I'm trying to get this to work on my host. Like this I won't need to query the TorDNSEL-part of "check.torproject.org" anymore. I'm not into programming and do not know anything about haskell, c++ and such. So be patient with me on such matters. ;-) I've DL'ed the code from the internet website mirror [2]. I've prepp'ed all the dependencies using lucid binary packages: ghc6 6.12.1-12 libghc6-mtl-dev 1.1.0.2-10 libghc6-network-dev 2.2.1.7-1 libghc6-time-dev 1.1.2.4-2 libghc6-hunit-dev 1.2.2.1-2 libssl-dev 0.9.8k-7ubuntu8.15 libghc6-stm-prof 2.1.1.2-5 libghc6-binary-prof 0.5.0.2-1 First error I got on compile attempt was: src/TorDNSEL/Main.hs:81:21: parse error on input `#' That was quite easy thought: import GHC.Prim (Addr#) I deleted the '#' hopefully making it correct this way. Next error is some numbers too high for me now: src/TorDNSEL/DeepSeq.hs:20:7: Could not find module `Data.ByteString': It is a member of the hidden package `bytestring-0.9.1.5'. Perhaps you need to add `bytestring' to the build-depends in your .cabal file. Use -v to see a list of the files searched for. The libghc6-bytestring-dev-0.9.1.5-125af ist installed by it's main package ghc6 6.12.1-12. Any ideas? Or are there some binary packages for TorDNSEL around, to make this more easy for me? :-P Thanks, BlueStar88 [1] https://blog.torproject.org/blog/tor-check-outage-03-and-04-july-2013 [2] https://www.torproject.org/tordnsel/dist/tordnsel-0.0.6.tar.gz

3 7

My exit's traffic isn't rising, is this normal?
by Jesse Victors 24 Jun '14

24 Jun '14

Hello everyone, I run https://globe.torproject.org/#/relay/1946F5E4748B069D3B989B5AF50C7DDD3AC618… and from the graphs it's clear that the traffic has roughly leveled off, rather than continue to climb. I generated a new key after Heartbleed, so it's been up for nearly three months. The bandwidth cap is set at about 100 MB/sec, (gigabit connection) which it's not even close to reaching. There's plenty of CPU available, and by all rights its got enough resources. At this rate, I've no idea how it is supposed to grow and help Tor more. For comparison, when I look at https://globe.torproject.org/#/relay/D3BDECB920E0B7543AD2BA7BF573F7B0F37F7B…, one of the Top 10 relays, I see the traffic growing much at a much higher rate, and https://globe.torproject.org/#/relay/F3B57BB429B4CA82A844B713E42666DF4BF7B8… is another example. What are they doing that I'm not? Another of my exits, https://globe.torproject.org/#/relay/2FC06226AE152FBAB7620BB107CDEF0E70876A…, is on a downward trend, yet has the same configuration as my first one. What can I do to reverse it? Thanks, Jesse V. 0xC20BEC80

1 0