- tor-relays - lists.torproject.org

bandwidth authority algorithm is cracked
by starlight.2014q1＠binnacle.cx 22 Jan '14

22 Jan '14

The bandwidth authorities assign all kinds of wildly incorrect capacities to the Tor node here. The Tor relay software has been up for 45 days and has not been down for more than five minutes for three or four months. Occasional outages from the ISP mucking with their network, but nothing more than ten or fifteen minutes in any week. The local node bandwidth calculation is consistently 490-495 Kbytes/sec. Very stable. Very consistent. The Tor bandwidth authorities assign values anywhere from 100 Kbytes/sec to almost 700 Kbytes/sec in an oscillating pattern with a period of about one week. Something is seriously wrong with that.

6 10

Trying Trusted Tor Traceroutes / Scoreboard bug
by Sebastian Urbach 21 Jan '14

21 Jan '14

Dear list members, We have seen a small amount of odd entries like "slash24-proxy" in the "phases completed" column at the scoreboard: http://128.174.241.211:443/relay_scoreboard It was a small script bug and Anupam is going to fix it today. No data is lost, please check back with the scoreboard in a few hours. Thank you for your patience. -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ---------------------------------------------- Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. ---------------------------------------------- Benjamin Franklin (1706 - 1790), Inventor, journalist, printer, diplomat, and statesman

1 0

Legal implications of tor relays
by tor＠gmx.info 21 Jan '14

21 Jan '14

4 3

Need help to set up Tor + Router: ORPort and DirPort unreachable
by Christian Stadelmann 20 Jan '14

20 Jan '14

Hi I am running tor 0.2.4.20 from official RPM repositories on my local machine (Fedora 20). I can use it to surf the web and https://check.torproject.org/ (besides others) tells me that tor is running. I had the same problem with 0.2.3.25 from fedora's own repository. According to `netstat -tulpen` tor listens on 0.0.0.0:9001, 0.0.0.0:9030, and Control port + Socks port. I configured my Router to port-forward 9001 and 9030 for both TCP+UDP and IPv4+IPv6. How can I test that this worked? I am running a local firewall but it does not seem to matter whether it is enabled or disabled. Is there anything else I could be missing? Regards Chris

3 3

Re: [tor-relays] Trying Trusted Tor Traceroutes
by Sebastian Urbach 20 Jan '14

20 Jan '14

Hi Mick, Thanks for participating ! And another relay hits the road :-) -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ---------------------------------------------- Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. ---------------------------------------------- Benjamin Franklin (1706 - 1790), Inventor, journalist, printer, diplomat, and statesman Am 20. Januar 2014 19:33:48 schrieb mick <mbm(a)rlogin.net>: > On Sun, 19 Jan 2014 20:57:07 -0600 > Anupam Das <anupam009(a)gmail.com> allegedly wrote: > > > Dear Tor relay operators, > > We have recently received a good > > rate of participation by relay operators to our measurement project. > > To give everyone an idea of the current participation rate we have > > hosted a live scoreboard of all our participants, available at > > http://128.174.241.211:443/relay_scoreboard > > The live scoreboard highlights all the IPs from which we received > > traceroute results along with the current status of the script > > running in their machine. The live scorebaord also summarizes the > > participation by the top Tor Families and the top guard and exit > > relays. > > We thank all the relay operators who have participated and hope more > > relay operators will participate soon. > > All > > Before starting this (given the Hetzner experiences), I checked with my > VPS provider (DigitalOcean) that they were happy. They have said that > they see no problem, and even if they do later spot an issue they will > take no precipitate action because of my prior alert to them. > > So. guard relay 0xbaddad now has the script running. > > Mick --------------------------------------------------------------------- > > Mick Morgan > gpg fingerprint: FC23 3338 F664 5E66 876B 72C0 0A1F E60B 5BAD D312 > http://baldric.net > > --------------------------------------------------------------------- > >

1 0

Re: [tor-relays] Trying Trusted Tor Traceroutes
by Sebastian Urbach 20 Jan '14

20 Jan '14

Hi elrippo, Thanks for participating ! Your logs are looking good. -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ---------------------------------------------- Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. ---------------------------------------------- Benjamin Franklin (1706 - 1790), Inventor, journalist, printer, diplomat, and statesman Hy dear mailing list Traceroute maintainers. At the moment three relays are doing the traceroutescript with scamper. All of them started yesterday evening, somewhat 24hours ago. Listed down in below you find some outputs, maybe these are helpful. NODE 1 /Traceroute-results$ ls -la total 9532 drwxrwxr-x 2 user user 4096 Jan 20 15:49 . drwxr-xr-x 5 user user 4096 Jan 19 14:51 .. -rw-rw-r-- 1 user user 702271 Jan 20 15:49 slash24-1390154252-node-60.ips -rw-rw-r-- 1 user user 9043968 Jan 20 16:02 slash24-1390154252-node-60.scamper ~/Traceroute-results$ ps ax | grep scamper 10058 ? S 1:11 scamper -c trace -p 1000 -f slash24-1390154252- node-60.ips 10059 ? S 0:00 scamper -c trace -p 1000 -f slash24-1390154252- node-60.ips NODE 2 /Traceroute-results$ ls -la insgesamt 4216 drwxr-xr-x 2 user user 4096 Jän 20 16:53 . drwxr-xr-x 5 user user 4096 Jän 19 15:33 .. -rw-r--r-- 1 user user 702272 Jän 20 16:53 slash24-1390154992-node-54.ips -rw-r--r-- 1 user user 3604480 Jän 20 17:00 slash24-1390154992-node-54.scamper ~/Traceroute-results$ ps ax | grep scamper 22758 ? S 1:47 scamper -c trace -p 1000 -f slash24-1390154992- node-54.ips 22759 ? S 0:00 scamper -c trace -p 1000 -f slash24-1390154992- node-54.ips NODE 3 /Traceroute-results$ ls -la insgesamt 3796 drwxrwxr-x 2 user user 4096 Jän 20 16:55 . drwxr-xr-x 5 user user 4096 Jän 19 15:44 .. -rw-rw-r-- 1 user user 702223 Jän 20 16:55 slash24-1390156006-node-48.ips -rw-rw-r-- 1 user user 3174400 Jän 20 17:01 slash24-1390156006-node-48.scamper ~/Traceroute-results$ ps ax | grep scamper 20212 ? S 0:58 scamper -c trace -p 1000 -f slash24-1390156006- node-48.ips 20215 ? S 0:00 scamper -c trace -p 1000 -f slash24-1390156006- node-48.ips Kind regards, elrippo Dear Tor relay operators, We have recently received a good rate of participation by relay operators to our measurement project. To give everyone an idea of the current participation rate we have hosted a live scoreboard of all our participants, available at http://128.174.241.211:443/relay_scoreboard The live scoreboard highlights all the IPs from which we received traceroute results along with the current status of the script running in their machine. The live scorebaord also summarizes the participation by the top Tor Families and the top guard and exit relays. We thank all the relay operators who have participated and hope more relay operators will participate soon. Thanks Anupam -- We don't bubble you, we don't spoof you ;) Keep your data encrypted! Log you soon, your Admin elrippo(a)elrippoisland.net Encrypted messages are welcome. 0x84DF1F7E6AE03644 -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.11 (GNU/Linux) mQINBFH797MBEAC0Y0NeI7lmDR9szTEcWuHuRe0r/WjSRC0Nr5nXsghuMcxpJ3Dd BOBimi4hdMMK4iqPVMwNw6GpKYR3A9LHHjbYRXHUKrJmB+BaJVyzJXN5H6XvxTTb UfX+DaXAGJW/G+3cBB3qm/QaU8QGkBKfXq0DLTaTGPkGKxEAldj/8onGZhawdJs+ B92JrW+S2HDh15pIuXzSqe7eCcIOdvvwfWe0fJi2AraA7LYGpxP6GcC/b9JJpbq5 Y6DfE2Aun9ZK3iHqURyrms0Whbv1CgmUahL2MVYCsTsXwe0GwlAxxKvjXAiXuo+R 9wO5wsXvVVSVNqsk9Yqi+wYzdPKndTU0GyxSApQHroF+cxaZ8Lk0xloj18+LdCSs e5IiTSXH0MMsDdWWdHlrgk+bgDG+0Gu3ne4vMwGdKO7AhYgQW/ueMy4RnkG/nsV9 jry5BO4gGAI1Ij8KvqUzEnvJFGE3ptJogU+zazWWDUWmL3ecKb3aDRlJFnZ3kJ5h q8GolZVjpk99V+4B5WVRPXdej/p5J19tXycK/jdNmr4oC8NyUhIpe8xHELnfoB4z +rxiTx+KMnW0rY8EQg8O2ixEYt5my90IwQkxcxIxextVrqjJjYn8extc2/v8yGzI KmTEJxdADB5v/Jx4HiLHNDSfBUb8gfONCkNSTYvTcSwTjWzHOkXeE/9ZbQARAQAB tD5lbHJpcHBvIChrZWVwIHlvdXIgZGF0YSBlbmNyeXB0ZWQpIDxlbHJpcHBvQGVs cmlwcG9pc2xhbmQubmV0PokCOAQTAQIAIgUCUfv3swIbLwYLCQgHAwIGFQgCCQoL BBYCAwECHgECF4AACgkQhN8ffmrgNkT8+BAAoAXBqu4/O2Cs5FSWWZpzgScNEgq7 uHhOKeYmRfgKlOUPoYlPB1DBqdOAXSKb9OvsmyOvpoGnqijB7aAJBoyQYW/OCQgd U8L4eTCf4yRZnfFLdgskcPfN1p0Rs/yinGEooBJFtYa7mT6J0UTW2JjCLZK2AFCW oF+KBu5JICXGBXigb2ZbX1jWjxP5H1RidQw6HF5z4z34SjLWAOOeZ8B/Xfz6Fs0s IAuLu2O4HE4DI8Qu196LhSVHHgr3uMTkvN1t5nKwyjrRQztwXXk9qIomII3ydNYb BYAGdWNNMfLb1kmDwC5wQHAFvSP1aiMF3aKAY+gl2wXSGO6JqM0SteJS3dytIljI kzu0atc9HuGs/HDQgdmpAS4WU2YefEr/WieltSiAKlwuC+3wg+CONJ6TE1vgNDU/ axerttb0jq7UQb/nAp05bsrB7XH1Vs+1ON9lUPEfWRmwQcrVK5JUrUWa/4tA/UeM XvFcPFtFluGTlLewgJIqcvjPXFwpbDZprXJsMkwew/A6B6n3+0sbgf7p3QSGkVbi dwQAymTbHdYqLnbcnKZhjto3Wjw1J5QB2wuiRYlpjV3i7AWTGlqoSTOWCCV+HamQ qeFYNYAWNFx3+J/oi7xDi8t9bHVNA205equ+y2sj3G5uGJ6LSHQ8AXp9uOipUUvU 1MJN0yLXr9PIwvi5Ag0EUfv3swEQAL0+MnxHGrTjSYdfdua4SBpmytDONM1EngeY s+WyaC/760MughKbaysI/nK2LB1vnwEY7f3NM4fxBx8u2T7VBm6Ez6Fs23Bb8Rkz f97bPSdxCmg64GPHfLA9uwTIXcYS+MpI86WOf6eWY0rRpf7Y9Nl7YoUNvzOyUPqc ggdcnHce8zYv7A/WS8flZDm8tVFPsHrQDEwNMws7ZhiNnHkeZeRJrvCuB7oEVich O/ROYoA5o6NozWYQbjxe1f6Yur4Q10qgVcxVnyLFJSbg6vZSzL7KYh3Z5iBOzPHt 7cwEDrW8W4Kl2Qj8rhJ4Wxs94CAtua7IXK44sVZWQbyHcOXRikgGMZKkEZzVCQa5 KD1u1ZrcBCyuMAir0hsmS3jhCUwpiE2c3SRk8O8CgixhTcBk0X/k9ZFu3Hbi1JMB FLzs/Nq3tYAYvVivhPloSxmYBPsafYHCZM83yBNNsralXh5zjB+di90G+AMXt2PN LTcdovZuWtC0s8/jrx+zv/AA4FAGYU9OVl+YL9ybFX8gSdMEcixyzQcKfiFBjpWv 5iFrwIuDlaXMcheyrhc9aGOxfx44OXc505+VjO/1Q/8EOWlJ6UwOi6GMkj5T+RFJ MDyP0UixS7dt6wTuD5t6PRuyWWxZswgrbL9hjwGFr154Z19TWeNWc23pWtUvQJos UCxl2nFHABEBAAGJBD4EGAECAAkFAlH797MCGy4CKQkQhN8ffmrgNkTBXSAEGQEC AAYFAlH797MACgkQJEPd69lQ0evA+Q/+M7lSFlrQWiRsFqDjh+kTJc+0OEBCvnfo N2KPyXXbfc//qup55PfEygE6C60zvrlv3WE33GZ5GS5MLuDMP82b+a5Yt16NQU7L WtAg1g0S0BvazW+28TgnfO8bhbGaFeE9ccw3xLmlbwZQ3f3LtMKdwFIROiG6hvAs 9U54QYti3tv9DowRYYWpdr0Ga8RqeGNtCKc0v2opy51MpzKWjwUW0i3XlSlyY8Lj 1KT8PyznNPw32nYpmDizz+0OUJNnn/kT+GnFoR3DJnFosTOrnxFJp+N+nejMp/gW r9NM0/E7H+P53IiytBOt5/0vsOaCFGdYGhKEjmJi3dHS4Xk1ObD1mjdD1YDOlWWU 3Md6BDHd4W7Q8gT7oQfTIMLd3HzV+WNPIdocPLBaeA/tRD8Pg5CCmncAmSub4F5T An7FlnACtSOv3cIWQ0TymS42DihDaJ5d1RvNzKw+zHYdPvf471JFZR3TDhkPbLIr 9czR7kbpnXRwchgwXQn306NVWf37TgA8wpbnFTazZ38iOeqcb9oKprqnbgEdr3PN OhKSlMTkzAqf3MEi2Fyua4BADMhS3oBwCRgDTlt6wquEytpNSlZaHnyiyIgOpekF Uy5K3w8NhHqeifRPrNb/UcCbXtXz+puqIEZHMenpv6FRlTTKpdoHoVXSkp1TPMGN /VaCiLbP4Z3xEw/9EbAJJkhmmx1Qw3ueoqc4h1MmhUtIdxSZ/oA9SjwlnY++zvaZ 6w1wTS4P+OUkETNDtItdpxXMJ9qfSy9voAQc2K43WMZCCmpPJYSdqaZZNPFj+Ne8 6FNtNKuUkXREybpHwlVAXnHzInmFOOM9RAmF70r3zEmKt77W1ztBLo2o9X79gPgL u9ThgrH6Oc2k46n+9nc3joccr7miiX/bp976DNWcWdOYThiSSOCb8Zw9/Zs935i1 wUVkYTj24tmBH4H5ov9ib7RPmU21ru458RbUKG0ONAqBtAHNyXHzUnXsrke+D4VW MI06YcXSk8YeYgQ8GxgHQc+W2bb8LIbKN1hEYJ0wzM62vKR2/Oiwuf8lXutIKTuz +v7Vj1PQd66DGHsxtWRaWnr1c54JTL2wICHJYKFH4grp7864+GL/uQ1O/Z/XxVku E1JQ/AnwBGU1M1S6otwWGWVRjzEzQtxsfcCEPvV/9td3FIFQAbGTPb+48XFU+TY9 8AlcXBlDzXq7c5f8Evn/oSIsZDt63K4HNTmMGqOTl/p1aA0e4eyX76LczY06rDP5 GMSNs+AHmYgZiS4RYhRUIvS9uLXMnnDAMYst0SDl2orDUUeHBTzu0rchyknBZMGP p5wQuWQ9CFlV+dj3UYbrBwC1lTkAMXRG2vlhA0V0TZqos7A5D4VHgSUQQjE= =otlL -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: [tor-relays] Legal implications of tor relays
by Lars Kumbier 20 Jan '14

20 Jan '14

(Copy to the list) Hi there, runing a non-exit relay is usually deemed safe, a separate abuse-handling is not necessary (because no exit-connections happen, that might infringe laws, but only connections to other tor nodes). You should however check the terms of service of your provider to make sure, that running an anonymization service is covered and allowed - some providers are calculating their prices and traffic allowances with very small profit margins and might suspend your account, if you produce too much traffic or use too much VPS resources. You can find several lists online[1][2] for some TL;DR-Shortcuts. If you still do need assistance, feel free to contact me on the mailaddress lars+tor(a)kumbier.it. You might also want to check out Zwiebelfreunde e.V. or other local tor groups like the Torrorists e.V.[3]. Best Regards, Lars _________________________________________________________ [1] https://www.torservers.net/wiki/hoster/experience [2] https://wiki.raumzeitlabor.de/wiki/Torrorists/Hoster [3] http://torrorists.de Am 20.01.2014 17:08, schrieb tor(a)gmx.info: > Hi list, > > I have set up a tor relay with no exit functionality yet. Having read > through the documentation and general legal hints, I am still unsure > of the legal situation in Germany. Are there some of you guys who > had contact with hosting providers because of abuse claims? > Is there anything you can share? Are pure relays safe to use or > are the hosting providers still clueless? > > Thanks and best regards. > > > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

Re: [tor-relays] Trying Trusted Tor Traceroutes
by Sebastian Urbach 20 Jan '14

20 Jan '14

Hi Konrad, Please check if your files looks like this: slash24-220.ips slash24-220.scamper It would be a lower value than 220 though, just an example. You could check if there is a scamper and or traceroute process running. The speed and the filename documented on the site are indicating that you are running traceroute and not scamper. If we need to dig deeper i would suggest that we do this via private mail and inform the list if there is something relevant. -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ---------------------------------------------- Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. ---------------------------------------------- Benjamin Franklin (1706 - 1790), Inventor, journalist, printer, diplomat, and statesman

1 0

Re: [tor-relays] System Time
by Sebastian Urbach 20 Jan '14

20 Jan '14

Good Morning, I really tried very hard to stay calm but at least someone has to say it. I think operating relays / bridges can be described as a cutting edge job or experience. It seems that everybody wants to be an node operator these days but sadly enough there is absolutely no test or qualification that proves that one has at least something like minimum admin skills or other capabilities to do the job. Anybody who wants to drive a car needs a license though. Honestly, its great that it is getting a little bit easier to operate a tor node but when there are discussions over a period of days on how to adjust a VPS clock or basic lectures about udp / tcp ports, 100 % cpu load and so on then there is only so much to say: If you don't know what you are doing, then be honest to yourself and stop doing it ! Neither is this mailing list nor the tor project in general the right place to make first steps as an admin. This project needs serious people with serious skills in this serious time which are capable to operate reliable, stable and when possible of course fast systems. There is a reason why most operators are it professionals with years and years of experience in operating different systems all over the world. And further, i strongly disagree with the text Robert wrote today that the project should provide more material for newbies because there is already more than enough material. And if you feel that this is insufficient then thats just proving my point that you and others are way out of your depth and i seriously doubt that flooding the relay list with "linux for dummies" questions is helping the project with its limited personal and technical resources in any way. I would like to propose a new list which may or may not be called "tor-relays-new" or so. New operators should start there for a certain period of time and if everything seems to be in order they may be transferred to tor-relays. Of course this is just a very rough proposal, there may should be other criteria involved, like uptime, received flags etc. Im sure that there could be a reasonable list of achievements for new relay operators. I expect a bit of resistance and a bit of a shitstorm right now. Please feel free to direct this straight to me and not to the list. I also would like a discussion regarding the facts of the matter to take place on this list very much. Keep in mind that i'm just the messenger and probably just saying out loud what a lot of people are thinking ... -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ------------------------------------ In time of war, the first casualty is always truth. ------------------------------------ Hiram Warren Johnson (1866-1945) US Senator, California Moritz and Jeroen, Thank you both. I tried both your ideas but the system is set to prevent the time being changed as you thought. Another plea to the VPS controllers and it was corrected. So the lesson there is presume it is the VPS set-up first and foremost. You both should know that the concise and clear advice like yours is what this list needs rather than mysterious jargon and code. Anyone finding the instructions you gave would also see the complete explanation with them. I don't know how but it would be good to facilitate the search for or extract such advice for keen newboys. The subject line isn't always the best label as I demonstrated. Robert _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

7 9

privoxy, port 8118 scans
by Mateusz Błaszczyk 20 Jan '14

20 Jan '14

Hey I am wondering if this is a coincidence but since I started the tor relay, I see a lot of TCP/8118 connections attempts on my relay's external IP. I run the offending source IPs (aggregated to /24s) through cymru's ip-to-asn decoder and here are results of only today: Bulk mode; whois.cymru.com [2014-01-19 15:16:19 +0000] 15003 | 108.177.181.0 | 108.177.180.0/22 | US | arin | 2012-03-15 | NOBIS-TECH - Nobis Technology Group, LLC 15003 | 142.91.245.0 | 142.91.240.0/21 | US | arin | 2012-06-08 | NOBIS-TECH - Nobis Technology Group, LLC 15003 | 172.240.255.0 | 172.240.0.0/16 | US | arin | 2013-04-08 | NOBIS-TECH - Nobis Technology Group, LLC 15003 | 173.208.16.0 | 173.208.16.0/21 | US | arin | 2009-12-17 | NOBIS-TECH - Nobis Technology Group, LLC 15003 | 173.208.57.0 | 173.208.56.0/22 | US | arin | 2009-12-17 | NOBIS-TECH - Nobis Technology Group, LLC 15003 | 173.208.85.0 | 173.208.80.0/21 | US | arin | 2009-12-17 | NOBIS-TECH - Nobis Technology Group, LLC 15003 | 173.234.12.0 | 173.234.12.0/22 | US | arin | 2010-02-12 | NOBIS-TECH - Nobis Technology Group, LLC 15003 | 173.234.153.0 | 173.234.152.0/22 | US | arin | 2010-02-12 | NOBIS-TECH - Nobis Technology Group, LLC 15003 | 173.234.235.0 | 173.234.232.0/22 | US | arin | 2010-02-12 | NOBIS-TECH - Nobis Technology Group, LLC 15003 | 173.234.247.0 | 173.234.244.0/22 | US | arin | 2010-02-12 | NOBIS-TECH - Nobis Technology Group, LLC 15003 | 173.234.33.0 | 173.234.32.0/22 | US | arin | 2010-02-12 | NOBIS-TECH - Nobis Technology Group, LLC 15003 | 173.234.41.0 | 173.234.40.0/22 | US | arin | 2010-02-12 | NOBIS-TECH - Nobis Technology Group, LLC 15003 | 173.234.60.0 | 173.234.56.0/21 | US | arin | 2010-02-12 | NOBIS-TECH - Nobis Technology Group, LLC 15003 | 23.19.130.0 | 23.19.128.0/22 | US | arin | 2011-04-25 | NOBIS-TECH - Nobis Technology Group, LLC 15003 | 23.19.50.0 | 23.19.50.0/23 | US | arin | 2011-04-25 | NOBIS-TECH - Nobis Technology Group, LLC 15003 | 23.19.54.0 | 23.19.52.0/22 | US | arin | 2011-04-25 | NOBIS-TECH - Nobis Technology Group, LLC 15003 | 23.19.67.0 | 23.19.64.0/20 | US | arin | 2011-04-25 | NOBIS-TECH - Nobis Technology Group, LLC 15003 | 23.19.75.0 | 23.19.64.0/20 | US | arin | 2011-04-25 | NOBIS-TECH - Nobis Technology Group, LLC 15003 | 23.19.89.0 | 23.19.88.0/21 | US | arin | 2011-04-25 | NOBIS-TECH - Nobis Technology Group, LLC 15003 | 70.32.43.0 | 70.32.43.0/24 | US | arin | 2008-07-25 | NOBIS-TECH - Nobis Technology Group, LLC 18450 | 173.231.54.0 | 173.231.0.0/18 | US | arin | 2010-03-19 | WEBNX - WebNX, Inc. 20248 | 74.82.191.0 | 74.82.176.0/20 | US | arin | 2010-01-26 | TAKE2 - Take 2 Hosting, Inc. 40676 | 216.24.204.0 | 216.24.192.0/20 | US | arin | 2010-10-14 | AS40676 - Psychz Networks 46475 | 192.169.84.0 | 192.169.80.0/20 | US | arin | 2012-11-02 | LIMESTONENETWORKS - Limestone Networks, Inc. 46475 | 192.169.86.0 | 192.169.80.0/20 | US | arin | 2012-11-02 | LIMESTONENETWORKS - Limestone Networks, Inc. 46475 | 208.115.203.0 | 208.115.192.0/18 | US | arin | 2010-01-06 | LIMESTONENETWORKS - Limestone Networks, Inc. 46475 | 208.115.228.0 | 208.115.192.0/18 | US | arin | 2010-01-06 | LIMESTONENETWORKS - Limestone Networks, Inc. 46475 | 216.245.222.0 | 216.245.192.0/19 | US | arin | 2008-01-28 | LIMESTONENETWORKS - Limestone Networks, Inc. 46475 | 63.143.33.0 | 63.143.32.0/19 | US | arin | 2011-10-27 | LIMESTONENETWORKS - Limestone Networks, Inc. 46475 | 63.143.36.0 | 63.143.32.0/19 | US | arin | 2011-10-27 | LIMESTONENETWORKS - Limestone Networks, Inc. 46475 | 63.143.52.0 | 63.143.32.0/19 | US | arin | 2011-10-27 | LIMESTONENETWORKS - Limestone Networks, Inc. 46475 | 64.31.43.0 | 64.31.0.0/18 | US | arin | 2010-12-27 | LIMESTONENETWORKS - Limestone Networks, Inc. 46475 | 69.162.116.0 | 69.162.64.0/18 | US | arin | 2008-06-27 | LIMESTONENETWORKS - Limestone Networks, Inc. 46475 | 69.162.74.0 | 69.162.64.0/18 | US | arin | 2008-06-27 | LIMESTONENETWORKS - Limestone Networks, Inc. 46475 | 74.63.226.0 | 74.63.192.0/18 | US | arin | 2008-08-29 | LIMESTONENETWORKS - Limestone Networks, Inc. 46475 | 74.63.249.0 | 74.63.192.0/18 | US | arin | 2008-08-29 | LIMESTONENETWORKS - Limestone Networks, Inc. There were almost 200k SYN packets sent for the last 15h from the 228 unique IP addresses. Would that be part of tor project? I have never run privoxy on my network and I am not really sure what the relation between tor and privoxy is? Can somebody shine some light on that? [0] https://www.team-cymru.org/Services/ip-to-asn.html Thanks, -mateusz

2 1

Re: [tor-relays] Trying Trusted Tor Traceroutes
by Sebastian Urbach 20 Jan '14

20 Jan '14

Hi, Of course there are systems still working on the task and probably there will be a few more wit a complete set of results. Considering the fact that this project is running for a few months now and based on the starting dates you can see it does not look good so far. >From what i can see you run the script with traceroute and not with scamper. That will take roughly 1 month to finish. You started yesterday and submitted the data from phase 1,2 and 7 runs from phase 3. Since you are in an early stage i would suggest stopping the script and install scamper as recommended. ETA will go down from about 30 days go 4 days ... -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ---------------------------------------------- Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. ---------------------------------------------- Benjamin Franklin (1706 - 1790), Inventor, journalist, printer, diplomat, and statesman Am 20. Januar 2014 13:21:44 schrieb Konrad Neitzel <konrad(a)neitzel.de>: > Hi! > > Am 2014-01-20 12:36, schrieb Sebastian Urbach: > > > Just made a count and the sad truth is that 35 out of 167 systems in > > total completed the task ending with a regular slash24-220.scamper > > entry. Thats even worse than i expected and way more completed test > > results are necessary... > > I am just wondering: My understanding is, that the webpage also shows "work > in progress". Maybe I missed something, but on my system (idkneitzel, > 81.7.11.129) the process is still running and the results inside > Traceroute-results/ are still growing and up to date. > > And I am running a tor node on a low end system so from what I read I > wouldn't expect the job to finish the work in less than a day (just started > yesterday evening after receiving a reply from my provider). > > If there is something wrong then I am willing to do more investigations. > Right now I would expect that everything works as it should. > > With kind regards, > > Konrad > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

2 1

Numbers of circuits are fluctuating
by Jens Kubieziel 20 Jan '14

20 Jan '14

Hi, I found a question at the Q&A site which deals with circuits: <URL:http://tor.stackexchange.com/q/492/88> The guy set up a Tor relay on its DSL connection. According to the Tor logs there are some low numbers of circuits open. From time to time this number jumps up (from 8--1 circuits to 700--850). Do you also see such numbers? What can be the reason for this jump? -- Jens Kubieziel http://www.kubieziel.de

5 4

Re: [tor-relays] tor-relays Digest, Vol 36, Issue 23
by Jack Wilborn 19 Jan '14

19 Jan '14

I have an extra machine that I was hoping to configure for a Tor relay. I'm not a wizard with Linux (Debian), but if there are some more, specific instructions to ensure everything is working, I'd love to do it. My current ISP is Cox and I have about 30 MB/sec Down and about 24 MB/sec up. I understand this is wide enough. If anyone can assist please e-mail me. Thanks Jack On Sat, Jan 18, 2014 at 5:00 AM, <tor-relays-request(a)lists.torproject.org>wrote: > Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > > > Today's Topics: > > 1. dutch operators and experience with dutch providers (Rejo Zenger) > 2. VPS ports impassable (I) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 18 Jan 2014 10:22:49 +0100 > From: Rejo Zenger <rejo(a)zenger.nl> > To: tor-relays(a)lists.torproject.org > Subject: [tor-relays] dutch operators and experience with dutch > providers > Message-ID: <20140118092249.GD24192(a)ix.home> > Content-Type: text/plain; charset="us-ascii" > > Hi, > > Are you a Dutch relay operator or do you have experience with hosting a > Tor node with a Dutch ISP? Please get in touch with me! > > I'm colaborating with a journalist from one of the leading technology > media websites on one or more stories that will describe the environment > for Dutch Tor relay operators. What are the main problems you are > facing, are Tor relays a problem to the average Dutch ISP, etc? > > > -- > Rejo Zenger . <rejo(a)zenger.nl> . 0x21DBEFD4 . <https://rejo.zenger.nl> > GPG encrypted e-mail preferred . +31.6.39642738 . @rejozenger >

4 3

Trying Trusted Tor Traceroutes
by Sebastian Urbach 19 Jan '14

19 Jan '14

Dear list members, A little addition to my mail from a few hours ago. I talked to Anupam Das who is one of the responsible people for this project. I just want to quote what he said a few hours ago because its short and precise. It has absolutely nothing to do with the fact that it guys are known as extremely lazy, errr ;-) "Well we did some preliminary analysis which my advisor Prof. Nikita Borisov presented in the 30c3 meeting. Our main conclusion was that we need more data to conclude anything for certain. Previously we had a lot of incomplete traceroutes, so hopefully we'll get some concrete results now. Once we do we'll inform all our participants :)" It would be beneficial for everybody if we all could make an effort. Thanks for your patience -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ---------------------------------------------- Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. ---------------------------------------------- Benjamin Franklin (1706 - 1790), Inventor, journalist, printer, diplomat, and statesman

1 0

Trying Trusted Tor Traceroutes
by Sebastian Urbach 19 Jan '14

19 Jan '14

Dear list members, I would like to encourage you to participate in the "Trying Trusted Tor Traceroutes" project: http://web.engr.illinois.edu/~das17/tor-traceroute_v1.html#description Please consider that this project can take a bit longer, somewhere between 4-24 days. If you run a relay of any kind, youre welcome. * * * * * Important: No Bridge Relays ! * * * * * Quick and dirty manual: 1: Install scamper or use traceroute (not as useful and way slower) 2: Download, extract: https://web.engr.illinois.edu/~das17/traceroute-from-tor-relays-4493e7c2119… 3: Run traceroutes.sh, lean back and wait a few days. More details at the page mentioned above. -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ---------------------------------------------- Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. ---------------------------------------------- Benjamin Franklin (1706 - 1790), Inventor, journalist, printer, diplomat, and statesman

1 0

VPS ports impassable
by I 19 Jan '14

19 Jan '14

Hej, [WARNING - if you don't want to see another Tor relay get going stop reading now.] After installing Tor on a VPS running Ubuntu 12.04.4 LTS it reports [warn] Your server (173.208.211.179:9030) has not managed to confirm that its DirPort is reachable. Please check your firewalls, ports, address,... The VPS operator is trying his best but says the ports are open and is asking others. In the meantime does anyone have anything to offer? Robert

3 5

(no subject)
by I 18 Jan '14

18 Jan '14

5 6

Re: [tor-relays] dutch operators and experience with dutch providers (Rejo Zenger)
by Jan Hendrik den Besten 18 Jan '14

18 Jan '14

Rejo, my encrypted mail tot you does not arrive. See below. Mail Administrator <Postmaster(a)chello.at> schreef: >This Message was undeliverable due to the following reason: > >Your message was not delivered because the destination computer does >not support electronic mail (SMTP). Correct any mistakes in the >address and try sending the message again. > >The following recipients did not receive this message: > > <rejo(a)zenger.nl> > > Please reply to <Postmaster(a)chello.at> > if you feel this message to be in error. > > >------------------------------------------------------------------------ > >Van: "J.H. den Besten" tor(a)janhendrik.eu> >Aan: rejo(a)zenger.nl >Verzonden: Sat Jan 18 16:57:24 CET 2014 >Onderwerp: Re: tor-relays Digest, Vol 36, Issue 23 > >-----BEGIN PGP MESSAGE----- >Version: APG v1.0.9 > >hQEMA/Nqa4fSrms4AQf7BKOj2Jv2RLYipadTb2XFLD7u1U7WgcvJl381cHUcchXZ >bv0jr3/u5gugjyieFXDhC5TQRQLMVCoqtrjP/aIRUWXmOI/X6dp90f4DLDHL0QHo >GFIcUyCkoI2ee7d3fDBi6YMrxf903gJe5w0Wy25CjwaQussqIZyK0w/lGAiFWMJs >2fx4TbJs4AAY1PAMwx8fcX034+uXMni9scml2bXYAMRDrMOXTneUg0QYAyyphGEm >GlGk2bpUKXRZQ+fAMxmKrmQdOama+dKbBPsU7RC3nonOCc9+aYPMa3XneG9OhEEx >pqRhjRUNZmGPnKw2ddk9havSpMT1CZJBonmi1j1cgIUCDAPpghcw8xmKlAEP/jCl >00awlVZsvOeQiCx1BXGQh7cKrhrWN8++qQPwN5qPRRfxKyO1YStxNzqFXvJ1UJ+c >JwK+tEqmvLfvpDO625l7ez3KsbgRXKXiapWYXTj/d6t0ZAotpUdDDNclZ6uQ1kEh >Kp1yQN5x0+bFtMMfA+MEy7R6prWhl81D8JuXEoUjcyp+wQUxxVDPOhphvYBofTWK >3etBN8vdIbaURJATBJbPA9JuslLZ8512XBNmkx21f87ZcAS24vNe8xi2YKeGw+F4 >U/KmfqNHlYc69CytSqw3hHJf4SqeEoojP3nz9tPBWvYLPX9o7h3RNWuEslPaHE29 >0tGVKiD4QHOJ3MJBTOnVoSxaBsobHP5NAddbUe4r3sAdnEKLm2ENuH7I68O/nwmE >h1QJdL+uSBhuymUcNCpQ7uPNw+fO3fQd5v7RI1FryygXOiBEt9SrmUCj/xr4Auqo >HZT4SwN56etZFS41nI0B+gmBRv8kT2HPxrXhWsKolKG9SB3dOXh4BD0W22vl1rqA >AdbpovKnx5oD6rTF3bVzcRBacacvw9KdCwwQHgojXvGkCWPLu+z+liUOogGERj2L >9Uoo5al0xrAaRt21XphtqQPuv9Kwe/tuSuxzHscX0Opx+VCa4He8hdO0Ic0WsC1B >ztFpZ2FCDJGRqyyZsAntq+skYrthrn/NsPjZDqdx0sPQAfFoteeMwSiuLynNWbGu >qTXfcVNv+2hR2A87z8v60A9EGA2T6kCy4B39Ixz/fles36fbN4AAfYwKL/095bXO >fQrG5FvVbiTUVUDFumAwnvKp7Hi31BiyKj0zgQ4aDloXy+6EzbJVrwmMbB2wMJVD >IlxVgHagk2NkvoNb9w+XU8DoJxTxryoGnUkYCWRiAmdbcgyTqMH9Zt0gftg4NewL >Np7WdohiPmZoe6TEjbieOK/UGkR7yGh4rrpHgt+dmnH0dzlkS3RD8FTjr+WKebi+ >u/3ewXUh01EadNz6fOVG8jEid2ulXsYA88JEif9lmfbZ7PDqJeCKkcUl3aPwFsKu >D8NGEU4P85/g7RRRHA3SmG4hkWJjPyCIHHMPAt5Q+FZd7xsX0sn2zXf0jQpvLnno >WgcKVEyCtILhu2IRGzGNVZUvGfFpP5Ja81E788TsHzbqYTWA5XBjX0StIjx+julq >lPHeHs4cJBO+9G/wDuThblxwImRvaDhWAduYm0qmpSLQUZlq1HsJXzLQLze68Iwb >EdipLsLRZk1nQrEbVD7lLEgwSeRSV7MnpQBptyLTqzv2ERYk/rDvPN0grqBzVCgk >JW6Uw1/oVTSJE0wo3grhmU5mFpLXkF0Yh+UYttuiAqLNbrH0kuQe+Gs50A8Zbept >jzKy02QuLxpTkRKmtaMwBdp/GA6VAby3iac5UqzPft6gGunZGjZnYKAEZ0TaP/or >qcMrebAUNjTB9+KoNWIIHp0pJS63izggp9gVxItK6j80Rpkwe374CwEexDwuKkJ1 >tWJUDES0nKd0VbRrweUibZEslpWULfjvSgWldG7NrZEQWFb/77RULvxrAb5LPVNM >1u0VeSj8OotH5/IOWNzCsF1XOdeCAxI9dsLZIgYARfK0LmqVDxAvMtVenIVjL8Jo >ryxa/gT8RTi1mBX1osYEapKXzN2l63kbsiaLVSajb9atBTuY8PflSOqUi3lD9jUd >60iVFxFw10C/DrhpDG0PwzFG1flb1ajz4nyMuPLsYP8tC2bUGVv4nato9s+zpJlN >sgS1aHzzXKTAqnLiBA0BOCLoQu7mmCUShDYwLwzPqGdRiXfmZ0X4vGDbeXq0cxE9 >/IsQv7nJlWZWHyJJaC9K1ubyjUYS7zvodFXd6nL/6w0EIZTnmZ+R+PvZkw9C0z4J >EeUIB6uNVikn2qVCylncQGIsKZuSBz+VZS0281GsM0K+Be/Mx6Q9BEDR7wSqUbx/ >tHZWtvwQwtutnd/sWGsRseHtx5pK79+sgwTDQDgxI4Jnyz2FKupyyXNNm6bzljS4 >qJbvXC+Q1rH/XD1L4zTBYqQsUQrJdpSCnCbqyTR4a+HfZNHcfsxJ4890h0WPE9cC >gGom2XoZ6LeHpMtL+RyNbL9lVVPwbPzl+Nrp1Yf7qLtBjSi0kTUh8tArJLbYMh+z >Tz7Dc4qjj35Eu+5jAV+Nv09yumfq40IfGBZnxy8KUfKMo6GcuII1xsn2RRpx0wrP >8L87xKjRi5l4UFuPhv5aMNixU6JR+VRp7XPKryfsLsac8OaxOqSoU3zeAQB67Wlu >hQ== >=rBPU >-----END PGP MESSAGE-----

2 1

dutch operators and experience with dutch providers
by Rejo Zenger 18 Jan '14

18 Jan '14

Hi, Are you a Dutch relay operator or do you have experience with hosting a Tor node with a Dutch ISP? Please get in touch with me! I'm colaborating with a journalist from one of the leading technology media websites on one or more stories that will describe the environment for Dutch Tor relay operators. What are the main problems you are facing, are Tor relays a problem to the average Dutch ISP, etc? -- Rejo Zenger . <rejo(a)zenger.nl> . 0x21DBEFD4 . <https://rejo.zenger.nl> GPG encrypted e-mail preferred . +31.6.39642738 . @rejozenger

1 0

Irony and inconsistency
by I 18 Jan '14

18 Jan '14

In this morning's messages - One about three relays paid for a year in advance. “Something Solutions LLC has decided to ban the usage of TOR.“ despite “We DO Allow Tor Relays" being in their current AUP. One about downloading Tor and installing it as an exit for me when I couldn't. “This issue has now been resolved. root@XXXIX:/# tor Jan 02 23:51:53.668 [notice] Tor v0.2.4.20 (git-0d50b03673670de6) running on Linux with Libevent 2.0.19-stable and OpenSSL 1.0.1c. Best Regards," Robert ____________________________________________________________ FREE 3D EARTH SCREENSAVER - Watch the Earth right on your desktop! Check it out at http://www.inbox.com/earth

5 6

Tor listenes to UDP ports?
by Wollomatic 18 Jan '14

18 Jan '14

Dear all, i run a tor relay (version 0.2.4.20) on debian wheezy. Today I noticed Tor uses some UDP ports: # netstat -tulpen tcp 0 0 0.0.0.0:9030 0.0.0.0:* LISTEN 0 46692311 26643/tor tcp 0 0 0.0.0.0:9001 0.0.0.0:* LISTEN 0 46692310 26643/tor [...] udp 0 0 0.0.0.0:33915 0.0.0.0:* 104 46692315 26643/tor udp 0 0 0.0.0.0:56554 0.0.0.0:* 104 46692316 26643/tor udp 0 0 0.0.0.0:34821 0.0.0.0:* 104 46692317 26643/tor udp 0 0 0.0.0.0:49463 0.0.0.0:* 104 46692314 26643/tor Since I thought Tor only uses TCP may this be a security problem with my server? Best regards, Wollomatic -- PGP 0xC1BF1482

4 4

Tor Cloud: still not listed
by Patrick ZAJDA 18 Jan '14

18 Jan '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, I have set up an Amazon EC2 instance to run a Tor Relay, I chose Obfsproxy Bridges. First, I am blind and I am not to read the "How to" in the Get started page of cloud.torproject.org, so I though all was configured, and had a surprise with the security group I have to define by myself. :) So my question is: would it be possible to make the step by step instructions accessible please ? Less pictures or more text in all cases, having text doesn't require to remove images. The second point is: I looked at the configuration, and noticed bridge is set to 1. I though it made the tor relay private, do I have miss-understood something? If I didn't miss-understand, that explains why it is still not listed on atlas.torproject.org, and there is a problem with the provided EC2 image. Else, how long in my relay will be listed? And which reasons could make my relay unavailable on atlas? I opened all four ports I found on the get started page but half an hour latter, it is still not listed. Thanks, - -- Patrick ZAJDA Skype : gansta93 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJS1o1vAAoJEKPVT2DeSPb41WYIAKc3PWOf5RB0dUdo/Rcru2iF 8LceynqNjYbqyjJxwQbBIdpXkUHfoD1t2D9Tv8DYYrm0pLHrPWDzRZbbKHKPCiKI VlvrUy7TKyLPl6CKV3QztMMx62jGYsxitEOjy2b7GS2XyA1VnWu5JR8TgDNBeh4L KeP3CQOLKGS3dyqOfEjXzBpSb3sQQwJbzVjZJIZBaGMgqYbEVU7YsPdP/+e+1/0H V0T/uDTgquCE2eo7tXjgQLp97IAKIxrufJewaVnwJjTNDVwAxh5VigFhMbebf7yW rLo3PRGZMrCrJ5I9niGziGglmnnqWHmLxLIHRHx00TH1E+2fV+fPlWY3ssMwEuk= =SfE2 -----END PGP SIGNATURE-----

7 11

Relay, bridge, and family members
by Patrick ZAJDA 18 Jan '14

18 Jan '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, Now I created a bridge, I'd like to create a relay on a dedicated server. I read about the FamilyMembers configuration value, to list all relay which are from the same owner. If I create another relay, do I have to put the bridge fingerprint to the new relay and put the relay fingerprint in the bridge configuration? Thanks, - -- Patrick ZAJDA Skype : gansta93 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJS1qH1AAoJEKPVT2DeSPb4+QUIALJNLP9MsGN8FbPEP6EegNV9 gcc66Iz2Z7maJD35pMquQqBqJrK+Zo6brSe2aX0N9+GipV9+jCpMa0hUOfzsf1h8 oebEjDLPgf4nxE6GuztU7Jkm0XwqHFmT1ELFPS2qU/EwGOBhj4l0Pywff7qfhBBC nvM+5O6+DRVD/44RGyhQqaNCDkxYuUkcLMJUX104RCoBQ6WmPYRBEPBm8YbrPKmc eGZNpRggSDRYzITZrT0SneIzExFP5IbTdGlHidyL4it70iJDI+LBZsm/ZGMENv/h lUYHe8RQbmDgt81BB+dq763zIeFMvBMOtJEdVdWPtuzsGypLxWJPMiR0NKqf6ZI= =X0ps -----END PGP SIGNATURE-----

6 7

Bad experience with hetzner.de and "Trusted Tor Traceroutes" experiment
by irregulator＠riseup.net 18 Jan '14

18 Jan '14

Hello there, We're running a Tor relay (not exit) on a virtual private server at Hetzner for about a year. On Wednesday January 8th, we decided to take part in the "Trying Trusted Tor Traceroutes" [1] research experiment. There have been various calls for participation on public mailing lists [2] [3]. The traceroutes were conducted using the scamper package, as suggested in README. We imposed no rate limiting to requests, just run the script with default values. Some hours later, Thursday 9th, we received an email from Hetzner stating that our server was taking part in attacks and they would suspend our instance if we didn't react within 8 hours. As soon as we got the warning we killed scamper conducting the traceroutes, and followed the procedure so as not to get our instance suspended. Hetzner also asked for some explanations about why we think our server was not taking part in the attack. We responded via email with a full explanation about the traceroutes from our server and the "Trying Trusted Tor Traceroutes" experiment from various researchers from University of Illinois [1]. We told Hetzner that our server was making harmless and legal traceroutes to various destinations on the Internet, thus they had no reason to suspend our instance. Twenty four hours later, Friday 10th, Hetzner blocked network access to the IP address of our server, did send us an email about blocking, but ignored our exlanations submitted the previous day. After the blockage of our IP we insisted on trying to resolve the case by sending one more email exlaining the situation and asking to unblock us, and then opening a ticket. Hetner's response to the last email (5 hours later) was that we should open a ticket, which we already had done. Alas, our ticket was marked as duplicate and closed(?). During this loophole support nightmare most responses from Hetzner's part actually seemed to be machine generated. At last Hetzner asked us via email to send them a signed document via fax(!) containing explanations about the incident. Now that was ridiculous, since we had submitted explanations already three times with the first submission only four hours after Hetzner's first warning on Thursday. Nevertheless, we did resend the explanation. After about 7 hours of downtime, Hetzner unblocked network access to our server. More than 36 hours later they sent an email "Dear Mr. xxxx, your server is unlocked." Concluding, - Hetzner considers traceroutes to various internet destinations as attack. All relay operators with machines at Hetzner should be _careful_ when taking part in "Trying Trusted Tor Traceroutes" experiment. - Hetzner has awful customer support. Cheers, Alex [1] https://web.engr.illinois.edu/~das17/tor-traceroute_v1.html [2] https://lists.torproject.org/pipermail/tor-relays/2013-October/003113.html [3] https://lists.torproject.org/pipermail/tor-news/2014-January/000027.html

4 7

Re: [tor-relays] using Curve p25519 cryptography for type 2(Mixmaster) and type 3(mixminion) remailer blocks
by grarpamp 15 Jan '14

15 Jan '14

>> On Tue, Jan 14, 2014 at 2:14 PM, gwen hastings <gwen(a)cypherpunks.to> wrote: >>> ... >>> I am looking at resurrecting >>> >>> mixmaster, mixminion and nym.alias.net nymserver designs from the >>> various code wastebaskets and retrofit them with some newer encryption >>> technology based on curve25519 and poly-1305 libsodium based algorithms >>> and routines. I believe there is sufficient demand to merit deployment of a good mix network. As well as perhaps web/other intake frontends due to the now prevalent a) dwindling free email b) demand by mail providers for phone authentication. As for operators, I'd reach out to the Tor, I2P, Bitcoin, etc operators. It's a shame that one of the hardest things to find these days is anonymous free speech in the simple form of the written word.

1 0

Re: [tor-relays] System Time
by Moritz Klammler 15 Jan '14

15 Jan '14

Hi, if the time difference is too big, NTP will refuse to touch the clock altogether. You can force an update by the '-g' option. However, the adjustment might still be slow. I'd do the following (as root): # hwclock --set --utc --date="2014-01-14 22:05:35" # ntpd -qg The first command manually sets the hardware clock to the approximate correct time (which you should adjust, of course). Note that the date string must specify the time in your local timezone, despite the '--utc' option. The second command tells NTP to do a one-shot sync ('-q') and allow an initial big adjustment ('-g'). Then, for the future, just make sure you have the NTP daemon enabled to keep the clock in sync. On Debian, if you have installed the 'ntp' package, this should be fine. Happy Hacking Moritz Jeroen Massar <jeroen(a)massar.ch> writes: > On 2014-01-14 21:05, I wrote: >> Jeroen, >> >> Thank you. It did that but I can't see a change. > > NTP adjusts slowly, as your clock is 6+ hours off, you should force the > timesync first, eg with with rdate (apt-get install rdate): > > rdate -v ntp.xs4all.nl > > should do the trick. Then after that make sure that ntpd is running: > /etc/init.d/ntp restart > >> The VPS person said it is set to UTC. Previously on another VPS it >> was another relay in the ?circuit which had the time difference. > > UTC is a timezone, and having that is great as it avoids all the > pitfalls and annoyances with summer/winter time. > > Note that some VPSs do not allow changing of the time, one will have to > ask the host to set the time. > > Do note that a VPS can be inspected and controlled easily by the Host, > as such, make sure that you trust that operator. > > Greets, > Jeroen -- OpenPGP: Public Key: http://openpgp.klammler.eu Fingerprint: 80C1 EC79 B554 3D84 0A35 A728 7057 B288 CE61 2235

2 1

Throughput changes?
by Thomas Themel 14 Jan '14

14 Jan '14

Hi, I've been running two nodes on the same machine for some time because I was unable to get enough throughput to blow through my bandwidth budget otherwise. However, something seems to have changed recently, since right now I'm blasting through about double my usual bandwidth (~25 MB/s) with the two tor jobs at only ~60% CPU usage each while previously it was always CPU limited. This doesn't seem to correlate with any software updates on the machine. Here's atlas: https://atlas.torproject.org/#details/3DD2523F1B241F01D54818F327714CDA7F542… ciao, -- [*Thomas Themel*] [Albulastrasse 52] To begin with, GNU will be a kernel [...] [ CH-8048 Zürich ] - RMS announcing GNU in 1983 [*+41 78 9070988*]

4 8

recent OVH feedback?
by Alan Turing 13 Jan '14

13 Jan '14

Dear all, I am currently running a fairly large tor relay (no exit, due to OVH's restrictive policies) and would like to know if other people have made experiences with running non-exit relays using OVH's services. Did any contracts get canceled or did you receive any kind of (legal) threats by OVH for doing so? Have you made positive experience with OVH regarding non-exit relays? I'd be grateful for information. regards, s.

3 2

404: /tor/keys/fp-sk/print-print not found
by nano 12 Jan '14

12 Jan '14

I haven't looked into this at all yet, thought I would share it here first. Both my exit relays [0] received these repeated warnings around the same time yesterday: timestamp [warn] Received http status code 404 ("Not found") from server 'server1IP:port' while fetching "/tor/keys/fp-sk/A1B2C3D4E5F6G7H8I9J0K1L2M3N4O5P6Q7R8S9T0-A1B2C3D4E5F6G7H8I9J0K1L2M3N4O5P6Q7R8S9T0". timestamp [warn] Received http status code 404 ("Not found") from server 'server2IP:port' while fetching "/tor/keys/fp-sk/A1B2C3D4E5F6G7H8I9J0K1L2M3N4O5P6Q7R8S9T0-A1B2C3D4E5F6G7H8I9J0K1L2M3N4O5P6Q7R8S9T0". timestamp [warn] Received http status code 404 ("Not found") from server 'server3IP:port' while fetching "/tor/keys/fp-sk/A1B2C3D4E5F6G7H8I9J0K1L2M3N4O5P6Q7R8S9T0-A1B2C3D4E5F6G7H8I9J0K1L2M3N4O5P6Q7R8S9T0". timestamp [warn] Received http status code 404 ("Not found") from server 'server4IP:port' while fetching "/tor/keys/fp-sk/A1B2C3D4E5F6G7H8I9J0K1L2M3N4O5P6Q7R8S9T0-A1B2C3D4E5F6G7H8I9J0K1L2M3N4O5P6Q7R8S9T0". Only one timestamp and serverIP was consistent on both relays. All fingerprints, however, were consistent on both. Hasn't appeared before or since. Anything to worry about? Thanks. [0] https://atlas.torproject.org/#details/799B025E25850A88CD133276301FAFB731C2E… -- syn.bsdbox.co

3 4

Re: [tor-relays] One relay shown as two
by Andy45 11 Jan '14

11 Jan '14

Thanks to everyone who replied to my question. I guess I'll just be patient then! The funny thing is that I never did reinstall Tor/Vidalia... although I got one working then the other with different configs for a while. That may have been it. Thanks! Andy

1 0

One relay shown as two relays in Atlas
by Andy45 10 Jan '14

10 Jan '14

Hello all! My question is related to Atlas. I asked this question on Tor help and I was referred to here. Here are my questions: I run a small exit relay on my computer. (Nickname is Andy45 and IP address is 108.249.221.251 if you want to look at this problem on Atlas for your self.) When I look up my relay on the Atlas, the relay is displayed as two separate relays with differing bandwidths and different uptimes. I'm not sure what's up with that - but my best guess is that it is splitting the amount of bandwidth I donate in half? The one of the average bandwidths listed on Atlas is a fair amount less than what the bandwidth monitor shows I give. (70 kbps rather than 100+ kbps.) Thanks, Andy

3 2

Hidden Service web design to speed load times
by Gordon Morehouse 09 Jan '14

09 Jan '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hey folks, I've been off the list for quite a long time due to personal reasons, and I'm aware I have a couple irons still in the fire WRT RasPi and the SYN flood stuff - I'll get to it. Today, though, I came across this article: http://csswizardry.com/2013/01/front-end-performance-for-web-designers-and-… tl;dr you can add a 'dns-prefetch' link tag in the HEAD of HTML documents to do DNS lookups ASAP, instead of later on when the browser parses the content which does it, or your Javascript (yeah, I know) does it, etc. I'm wondering if this would have any value for Tor hidden services - would a "DNS lookup" of a .onion force Tor to start building a circuit to the hidden service in question? I suppose one could deliberately request a nonexistent file or a 1x1 pixel PNG or something, too, to get the circuit built, but this is obviously a little cleaner and probably a little better for privacy versus an HTTP request which may be logged even if the user never takes an action to *actually* request real info. Just a thought for hidden service operations. It's always easier to get one's message out the less time it takes to load. Best, - -Gordon M. -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJSztxfAAoJED/jpRoe7/ujrx8IAJyREaH6TZ2z5GjBPrZfZcir fWi5zfwO/t/we/uQzn0IriM8DIMvLQOHS1Z9ly/qzUyoBLPRxzUqPpkzmtzXgXOy l2bAhmRCSyGZXDgE4GAXpVXP8w2w3fb7ijJADqy+I/nqQYZX7MMzlcT8hlsqqon9 I39ITwbDoUuem+y/XG/IICcbTVBsrH3m2auhRBfHawAJW8iO6xooltyUS6JExxLB fALfaG64YOy8mv+eyOT4tYoP67r8miEDlmTnplARUKw458lihqlnZ1TrCN+AVaJt OJCXiDnqghvBAJE+v/5JWJOMDr90ucI/+9mitOmbbQh03JOSRsSryeffPmUN08c= =gl1d -----END PGP SIGNATURE-----

1 0

VPS ports closed
by I 09 Jan '14

09 Jan '14

Is there a way to open ports for Tor as an VPS account holder? Robert ____________________________________________________________ FREE ONLINE PHOTOSHARING - Share your photos online with your friends and family! Visit http://www.inbox.com/photosharing to find out more!

5 7

How to force VPS to update to current release?
by I 08 Jan '14

08 Jan '14

Anyone, On a new VPS putting the right entries in the sources.list won't get the current release. apt-get update or upgrade gets with more Ign http://torproject.org tor-experimental-0.2.5.x-precise/main Translation-en W: Failed to fetch http://torproject.org/torproject.org/dists/precise/main/binar y-i386/Packages Undetermined Error [IP: 38.229.72.14 80] Either could someone tell me how to force an update from the very old Ubuntu held one I managed to get or tell me how to get to the current package some other way? Searching for help for Linux without sufficient jargon is hard. Robert ____________________________________________________________ FREE 3D MARINE AQUARIUM SCREENSAVER - Watch dolphins, sharks & orcas on your desktop! Check it out at http://www.inbox.com/marineaquarium

5 11

Fwd: How to force VPS to update to current release?
by Zack Weinberg 08 Jan '14

08 Jan '14

On Tue, Jan 7, 2014 at 9:33 PM, I <beatthebastards(a)inbox.com> wrote: > Err http://deb.torproject.org experimental-precise/main i386 Packages > 404 Not Found [IP: 86.59.30.40 80] > Ign http://deb.torproject.org precise/main Translation-en_US > Ign http://deb.torproject.org precise/main Translation-en > Ign http://deb.torproject.org experimental-precise/main Translation-en_US > Ign http://deb.torproject.org experimental-precise/main Translation-en > W: Failed to fetch http://deb.torproject.org/torproject.org/dists/experimental-precise/main/bi… 404 Not Found [IP: 86.59.30.40 80] It appears that the experimental-* distributions are no longer available. I think this is probably an intentional change associated with Tor 0.2.4.x having been promoted to stable release, and I think you want to replace *all* your existing 'deb ...' lines in /etc/apt/sources.list that mention torproject.org with one of these two: # Tor 0.2.4 official builds deb http://deb.torproject.org/torproject.org precise main # Tor 0.2.5 experimental builds deb http://deb.torproject.org/torproject.org tor-experimental-0.2.5.x-precise main You should need only one or the other, not both. And of course you need Ubuntu's source in there too. (To be clear, this is *not* an issue with your VPS, this is a change to the package server you are using. If this was an intentional change, it sure woulda been nice if it had been announced here, hint hint.) zw

1 0

[Feedback?] Multiple Tor processes on one host
by Johannes Fürmann 05 Jan '14

05 Jan '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello *, I wrote a short "HowTo" on running multiple Tor processes on one host [1]. Feedback and improvements are greatly appreciated! Johannes Link(s): [1]: https://gist.github.com/waaaaargh/8271499

2 1

Tor Relay Operators Meeting at 30c3 Chaos Communication Congress
by Moritz Bartl 30 Dec '13

30 Dec '13

Torservers.net invites Tor exit relay operators and organizations to a meetup. If possible/relevant, for example if you're a member of one of the 'Torservers partner organizations', please prepare some slides on your activities. We will do quick presentations on recent and future activities around Torservers.net. Afterwards, the official members meeting of German Zwiebelfreunde e.V. will be held in this room. https://events.ccc.de/congress/2013/wiki/Session:Tor_Relay_Operators_Meetup Starts at: 2013/12/27 03:00:00 PM Ends at: 2013/12/27 05:00:00 PM Duration: 120 minutes Location: Hall 13 -- Moritz Bartl https://www.torservers.net/

4 5

Problem installing latest tor on a raspberry pi (ARM arch).
by aowenson＠neomailbox.ch 30 Dec '13

30 Dec '13

I was directed to this mailing list by a user on #tor IRC, so I'm hoping it's ok to ask for help here. For the past 2 to 3 months I've been running tor on my pi without any problems. The repository has been great, pulling out the correct ARM binaries, and it setup fine. This morning I tried updating the software, but the step "Checking if tor configuration is valid" fails; there are also 2x seg faults in the terminal output, not sure if this is a repository issue (fetching an x86 binary instead of ARM). The terminal output is here: http://pastebin.com/9Re2jrRe.

16 22

Re: [tor-relays] tor-relays Digest, Vol 35, Issue 25
by Oliver Schönefeld 30 Dec '13

30 Dec '13

i don't know, who knows how tor-weather sends the t-shirt e-mail. i took a look at the code and found that the mail is sent after 1464 hours of uptime (=61 days), checking every hour. according to this the downtime due to updates is really not that relevant. i'd guess that there are approx. 3 or 4 updates in the required 2 months, which would "cost" you an equivalent amount of hours. i don't think that it matters whether you get your mail 3 or 4 hours later. so i think the algorithm is fine. Am 30.12.2013 um 13:00 schrieb tor-relays-request(a)lists.torproject.org: > Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > Today's Topics: > > 1. Re: Tor Weather getting T-shirt email. Problem > (Random Tor Node Operator) > > Von: Random Tor Node Operator <tor(a)unterderbruecke.de> > Betreff: Aw: [tor-relays] Tor Weather getting T-shirt email. Problem > Datum: 30 .Dezember 2013 12:48:16 MEZ > An: tor-relays(a)lists.torproject.org > Antwort an: tor-relays(a)lists.torproject.org > > > Signierter PGP Teil > On 12/28/2013 01:26 AM, I wrote: > > I think two months is a bit short to be rewarded with a t-shirt > > from donated resources. > > > > It makes more sense to extend the time but include the total time > > running ignoring minor disruptions. > > I agree with that point, because currently, relay operators have the > incentive to not update to the latest Tor version whenever a new > version is released, in order to keep the consecutive uptime high. > That is probably not in the best interest of Tor. > > Maybe Tor Weather could look at the flags instead of the consecutive > uptime instead. For example, you typically don't lose your Guard or > Stable flag due to a reboot. > > > > > > > Robert > > > > > >> : i noticed a problem with tor weather. I should have recieved a > >> email : -Uptime is nearly 100%, > >> > >> Tor weather needs some updating, however it continues to email > >> plenty of relay operators. The reason you didn't get an email is > >> tor weather didn't see your relay matching the uptime > >> requirement, > > > > ____________________________________________________________ GET > > FREE SMILEYS FOR YOUR IM & EMAIL - Learn more at > > http://www.inbox.com/smileys Works with AIM®, MSN® Messenger, > > Yahoo!® Messenger, ICQ®, Google Talk™ and most webmails > > > > > > _______________________________________________ tor-relays mailing > > list tor-relays(a)lists.torproject.org > > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > > > > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

2 1

Inspiration
by I 28 Dec '13

28 Dec '13

Roger Dingledine and Jacob Applebaum speaking on Tor at 30C3 https://www.youtube.com/watch?v=SscFfzD_his ____________________________________________________________ FREE ONLINE PHOTOSHARING - Share your photos online with your friends and family! Visit http://www.inbox.com/photosharing to find out more!

2 1

How get ARM onto CentOS 6
by I 27 Dec '13

27 Dec '13

2 3

(no subject)
by Sebastian Urbach 25 Dec '13

25 Dec '13

Dear Colleagues, Since i switched to 0.2.4.19 a few days ago i noticed some strange behaviour. Sometimes the data seems to he corrupted i see on torstatus.info. The atlas data seems to be right though. Afaik only the contact and family data seems to be wrong. https://atlas.torproject.org/#details/3C82285FAC2171FA5178340A82B05F2190AB6… http://torstatus.info/router_detail.php?FP=3c82285fac2171fa5178340a82b05f21… Im not sure what to make of it right now. A bitcoin for your thoughts ... -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ----------------------------------- Religion is a symptom of irrational belief and groundless hope. ----------------------------------- Gregory House, M.D.

4 3

Shirt
by Sebastian Urbach 25 Dec '13

25 Dec '13

Hi, As long as you are wearing your NSA shirt im gonna wear my tor shirts (received a green and a black one years ago) ;-) On the other days im wearing my Ellsberg/Nikitin/Manning/Snowden shirt. Got ya ;-) -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ----------------------------------- Religion is a symptom of irrational belief and groundless hope. ----------------------------------- Gregory House, M.D.

2 1

Tor malware!
by I 22 Dec '13

22 Dec '13

They are two words I didn't think would be together. Would any pundit tell me if there is anything an exit or relay operator can do about malware using Tor in the news today e.g. Chewbacca (found by Kaspersky) ? Robert ____________________________________________________________ FREE ONLINE PHOTOSHARING - Share your photos online with your friends and family! Visit http://www.inbox.com/photosharing to find out more!

3 3

running a relay on a home connection
by abhiram 19 Dec '13

19 Dec '13

Hello, I am running a tor relay on a home connection. My connection is assigned a new ip as the lease expires every few days. So far I am fixing this my editing my torrc file with the new address value. Are there better ways of handing this? One thing that puzzled me was that when I first setup my relay it was unable to find the external address of my connection and its log files kept complaining that: "If x.x.x.x:9030 is not your correct IP address and directory port, please check your relay's configuration" Obviously it wasn't my ip address, when I looked it up it was from another country. So my question is why is my relay advertising this specific address? thanks for your time. -- Abhiram Chintangal

6 8

Re: [tor-relays] running a relay on a home connection (abhiram)
by Oliver Schönefeld 19 Dec '13

19 Dec '13

hello to everybody, as there were some alternatives for dynmic DNS handling mentioned, i'd like to add the following: as with most commercial dyndns providers come conditions (paid account, limited number of hosts, and - what annoys me the most - login after x days, etc.) i want to point you to https://nsupdate.info. this is an open-source project which offers dynamic DNS service with some advantages. i.e. they state they state in their "why another one?"-section: nagging its users to make a paid subscription annoying its users with advertisements or spam cancelling hosts or accounts after a short period of non-usage hiding the few free features almost undiscoverably between a ton of commercial-only features so check it out and a nice day to all of you!

2 1

bandwith unit
by Kiss Gabor (Bitman) 17 Dec '13

17 Dec '13

Dear folks, I'm tor relay operator since several years but newbie on this list. I just moved node 'traktor' from physical host to virtual machine. So I revised all settings and checked if all works well. I found a funny thing. My RelayBandwidthRate is set to 1 MB (i.e. 8 Mbps). ## Define these to limit how much relayed traffic you will allow. Your ## own traffic is still unthrottled. Note that RelayBandwidthRate must ## be at least 20 KB. ## Note that units for these config options are bytes per second, not bits ## per second, and that prefixes are binary prefixes, i.e. 2^10, 2^20, etc. #RelayBandwidthRate 100 KB # Throttle traffic to 100KB/s (800Kbps) #RelayBandwidthBurst 200 KB # But allow bursts up to 200KB/s (1600Kbps) RelayBandwidthRate 1 MB However on page https://globe.torproject.org/#/search/query=traktor the "Adverised Bandwith" column shows cca. 125 kB/s. Did I misunderstand the difference between kbps and kBps? Gabor

4 5

Relay / Bridge
by Sebastian Urbach 16 Dec '13

16 Dec '13

Hi, Your system is now lsted: ec2bridgerocks001 https://atlas.torproject.org/#details/50855F45464DBE84E917B0ED74E2144E785BA… -- Mit freundlichen Grüssen / Sincerely yours Sebsstian Urbach ----------------------------------- Religion is a symptom of irrational belief and groundless hope. ----------------------------------- Gregory House, M.D.

6 6

Torservers awarded $250,000 by Digital Defenders
by Christian 16 Dec '13

16 Dec '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hej! Torservers.net has been awarded $250,000 over two years by the Digital Defenders Partnership to strengthen and improve the Tor network, the anonymity system crucial to journalists and human rights defenders using the Internet. <https://blog.torservers.net/20131213/torservers-awarded-250000-by-digital-d…> Tor is free software and an open network that helps internet users to defend against traffic analysis, a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security. It is used by hundreds of thousands of daily users worldwide to secure their online communication, avoid tracking, and circumvent censorship. Tor protects users by bouncing communications around a distributed network of relays run by volunteers all around the world: it prevents somebody watching your Internet connection from learning what sites you visit, and it prevents the sites you visit from learning your physical location. Torservers.net provides high bandwidth infrastructure for the Tor network since 2010. We have grown to 10 volunteer-run organizations in 8 countries. Torservers.net distributes donations and grants across independent organizations of IT security professionals, and helps build a sustainable network by teaching others how to run stable Tor infrastructure. The Digital Defenders Partnership was established in 2012 to provide rapid response to threats to internet freedom. The Partnership aims at keeping the internet open and free from emerging threats, specifically in internet repressive and transitional environments. It also wants to increase and better coordinate emergency support for the internet?s critical users, such as bloggers, cyber activists, journalists and human rights defenders, whenever and wherever they are under threat. Thanks to the newly awarded grant of $250,000 over two years, participating Torservers organizations will be able to sustain at least 3 Gbit/s of exit traffic, and 2000 fast and up to date bridges. Tor bridges are required in many countries with state-level censorship. 3 Gbit/s are 949 terabytes, almost a petabyte of user data, every single month, per direction. Call for organizations To strengthen the Tor network and prevent attackers, it is crucial to spread operation across as many groups as possible. Thanks to the Digital Defenders, Torservers.net can now extend its work and help less technical organizations with the setup and maintenance of Tor services. The Institute for War & Peace Reporting (IWPR) is the first civil society organization to join the Torservers program with its Cyber Arabs group. This collaboration allows Cyber Arabs to give stable and working Tor access to activists and journalists in the Arab world. If you are part of an organization interested in supporting Tor, please contact Torservers.net. They have various options available, and are happy to teach tech staff and journalists. ?Since we started Torservers.net a few years ago, Tor finally became fast enough to be used for all Internet communications? comments Moritz Bartl, co-founder of Torservers.net. ?New people also join the Tor network every day. With the help of the Digital Defenders, we have the chance to make the network bigger, safer and more resilient to the benefit of everyone with the desires to protect their online activities from surveillance.? Contact Juris Vetra Zwiebelfreude e.V. c/o DID Dresdner Institut für Datenschutz Palaisplatz 3 D-01097 Dresden Germany Fax: +49-(0)911-30 844 667 48 Phone: +49-(0)351-212 960 19 press(a)torservers.net -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQIcBAEBAgAGBQJSrE7/AAoJEPSKc6jBxtf31rAP/15mEwAiE8dX/+q4n4mKlomj D/eaFJMTRGazwr4J0U92n3ArxBLCAYiIQV/yIYW9R6IGqMTrHX18GSoHw8bF5Xmf BbHDZ4h7IeY2Z6lkMJBqwNejMI0zFqi6rZmIQl4sU4MeByBRtJBePrwJ1+eSn/Kt hSpxZLqTt7geY/V8D97EOjG0+gGfOtZyxCPbmz49g4NTKiI34Sg+pDpgVoqqTFsb XTY8cAn6pDYu60atDTv4F4kyhWkPBKmrkwUL4F65A8VFHu3Hgld2VxveeiZBIbYY 2gsiVz/u16CPts7RGDJdmi/sSa4xo76nKQk5QufM1sS4jahiGn07srNLdWud3NQP VUTty0Wwa8lvBrBbEPUn/Z14sXsXHS3z5WUrLQNGoi4RJxY7+JSimKYxoWz47ejv ps8vHM54McwoJzkbV9wYpOphhQ57v+Ps+l2sW7/T+s3AseP9Ji4sUFotPbeBWhxr MR905ulKYMVXasIWixiOxNsSzPgIPYufIPppMu49dWblaDGKYgkZAgGNgEqa2nl/ C8RAKIW4PwFdb513diUzuYJqHL5GiAGnU+OuPoqn7LYpnN/qmbEGyZNyoXaCp+pR rWAfzQCwL1fTNwMIrcdE3KDZ+oFNmeLZx3uUCHQ45XF4ojuYsGy1lOyhxSAZ1sb3 uWo4s9PMZOKjPOjxt/XQ =6o8b -----END PGP SIGNATURE-----

6 5

Re: [tor-relays] Help testing patch on SandyBridge/IvyBridge? Force disable use of RDRAND in OpenSSL when HardwareAccel is enabled
by coderman 14 Dec '13

14 Dec '13

correct address this time :/ Fwd: #include <std_disclaimer.h> i am not speaking for Tor devs nor Tor project - the cautious should wait for a review and merge. On Sat, Dec 14, 2013 at 6:14 AM, coderman <coderman(a)gmail.com> wrote: > this is logged as trac ticket: > https://trac.torproject.org/projects/tor/ticket/10402 > ... > help coderman test mitigation patch: > https://peertech.org/dist/tor-0.2.4.19-rdrand-disable.patch > https://peertech.org/dist/tor-0.2.5.1-rdrand-disable.patch > https://peertech.org/dist/tor-latest-rdrand-disable.patch many thanks to rl1987! the patches have been updated and verified. anyone running a relay on openssl 1.0.x with HardwareAccel 1 and seeing this line in their notices.log: "[notice] Using OpenSSL engine Intel RDRAND engine [rdrand] for RAND" should** apply the apropos patch above and let me know if it doesn't work. a successful mitigation will look like this: """ [warn] OpenSSL is using RDRAND by default. Attempting to force disable. ... [notice] Using default implementation for RAND . """ **last but not least, please do run a userspace entropy collector like haveged, dakarand, etc. also be sure you're on a recent kernel that is using RDRAND in a conservative / robust manner.[0] best regards, 0. "void extract_buf(struct entropy_store *r, __u8 *out)" https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/driver… good use of RDRAND is: 1. mixed into a hash across the pool, not XOR'd against output, 2. mix the mix back into pool (prevent backtrack attacks) 3. atomically extract portion of pool and mix 4. fold final extracted output in half for conservative operation

1 0