- tor-relays - lists.torproject.org

Understanding bandwidth rate
by Florian Lindner 11 Dec '13

11 Dec '13

Hello, I'm using tor 0.2.3.25 from Debian Wheezy, the exit policy is recject *.*, I'm not using the node myself. arm shows these actual bandwidths: Bandwidth (limit: 16 Mb/s, burst: 32 Mb/s, measured: 48.6 Kb/s): Download (13.9 Mb/sec - avg: 11.3 Mb/sec, total: 211.9 GB): Upload (16.0 Mb/sec - avg: 12.6 Mb/sec, total: 237.9 GB): This is my related config: BandwidthRate 5 MB # not set in config BandwidthBurst 10 MB # not set in config RelayBandwidthRate 2 MB # set in config RelayBandwidthBurst 4 MB # set in config I'm a bit puzzled.... Why is bandwidth limit 16 Mb/s? Why bandwidth burst 32 Mb/s? Since I'm not using the node for anything else but relaying I except the bandwidth is more or less equal the RelayBandwidth limit I set. But the averages are so much higher than either the BandwidthRate and the RelayBandwidthRate? What is my problem of understanding here? Thanks, Florian

7 8

Re: [tor-relays] Understanding bandwidth rate
by Oliver Schönefeld 10 Dec '13

10 Dec '13

actually it's Mb, which stands for megabit. since one byte is 8 bit, 2 becomes 16 and 4 becomes 32. therfoe you shoul set your config to 250 Kb (250 Kbit * 8 equals 2000 KByte equals 2 MByte) and 500 Kb (500 Kbit * 8 equals42000 KByte equals 4 MByte). kind regards, Oli Am 10.12.2013 um 13:00 schrieb tor-relays-request(a)lists.torproject.org: > Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > Today's Topics: > > 1. Understanding bandwidth rate (Florian Lindner) > 2. Re: Understanding bandwidth rate (BugZ) > 3. Re: Understanding bandwidth rate (Roman Mamedov) > > Von: Florian Lindner <mailinglists(a)xgm.de> > Betreff: [tor-relays] Understanding bandwidth rate > Datum: 10 .Dezember 2013 11:47:45 MEZ > An: tor-relays(a)lists.torproject.org > Antwort an: tor-relays(a)lists.torproject.org > > > Hello, > > I'm using tor 0.2.3.25 from Debian Wheezy, the exit policy is recject *.*, I'm not using the node myself. > > arm shows these actual bandwidths: > > Bandwidth (limit: 16 Mb/s, burst: 32 Mb/s, measured: 48.6 Kb/s): > Download (13.9 Mb/sec - avg: 11.3 Mb/sec, total: 211.9 GB): > Upload (16.0 Mb/sec - avg: 12.6 Mb/sec, total: 237.9 GB): > > This is my related config: > > BandwidthRate 5 MB # not set in config > BandwidthBurst 10 MB # not set in config > RelayBandwidthRate 2 MB # set in config > RelayBandwidthBurst 4 MB # set in config > > I'm a bit puzzled.... > > Why is bandwidth limit 16 Mb/s? Why bandwidth burst 32 Mb/s? > > Since I'm not using the node for anything else but relaying I except the bandwidth is more or less equal the RelayBandwidth limit I set. But the averages are so much higher than either the BandwidthRate and the RelayBandwidthRate? > > What is my problem of understanding here? > > Thanks, > Florian > > > > > Von: BugZ <bugmagnet1(a)gmail.com> > Betreff: Aw: [tor-relays] Understanding bandwidth rate > Datum: 10 .Dezember 2013 12:39:00 MEZ > An: tor-relays(a)lists.torproject.org > Antwort an: tor-relays(a)lists.torproject.org > > > B=bytes > b=bits > > therefore, > Your config setting of 2MB = 16mb > Your config setting of 4MB = 32mb > > > > On 12/10/2013 5:47 AM, Florian Lindner wrote: >> Hello, >> >> I'm using tor 0.2.3.25 from Debian Wheezy, the exit policy is recject *.*, I'm not using the node myself. >> >> arm shows these actual bandwidths: >> >> Bandwidth (limit: 16 Mb/s, burst: 32 Mb/s, measured: 48.6 Kb/s): >> Download (13.9 Mb/sec - avg: 11.3 Mb/sec, total: 211.9 GB): >> Upload (16.0 Mb/sec - avg: 12.6 Mb/sec, total: 237.9 GB): >> >> This is my related config: >> >> BandwidthRate 5 MB # not set in config >> BandwidthBurst 10 MB # not set in config >> RelayBandwidthRate 2 MB # set in config >> RelayBandwidthBurst 4 MB # set in config >> >> I'm a bit puzzled.... >> >> Why is bandwidth limit 16 Mb/s? Why bandwidth burst 32 Mb/s? >> >> Since I'm not using the node for anything else but relaying I except the bandwidth is more or less equal the RelayBandwidth limit I set. But the averages are so much higher than either the BandwidthRate and the RelayBandwidthRate? >> >> What is my problem of understanding here? >> >> Thanks, >> Florian >> _______________________________________________ >> tor-relays mailing list >> tor-relays(a)lists.torproject.org >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > > > > Von: Roman Mamedov <rm(a)romanrm.net> > Betreff: Aw: [tor-relays] Understanding bandwidth rate > Datum: 10 .Dezember 2013 12:50:58 MEZ > An: tor-relays(a)lists.torproject.org > Antwort an: tor-relays(a)lists.torproject.org > > > On Tue, 10 Dec 2013 06:39:00 -0500 > BugZ <bugmagnet1(a)gmail.com> wrote: > >> Your config setting of 2MB = 16mb >> Your config setting of 4MB = 32mb > > "mb" what, millibytes? https://en.wikipedia.org/wiki/Metric_prefix > > If you're trying to teach others then at least get it right yourself... > > -- > With respect, > Roman > > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

Your system clock just jumped
by Jobiwan Kenobi 04 Dec '13

04 Dec '13

I've been running a relay for about months now. It runs on an 1.6 Ghz single core Atom with hyperthreading, 1GB of RAM. It's on my home connection; I advertise only 176 KB/sec. Under normal conditions, it pumps around 100KB/sec, it has around 600 connections, it uses around 20% CPU. Everything looks very healthy. Lately I have seen a couple of incidents where the number of connections suddenly goes up to over 3000, traffic increases heavily, CPU usage goes well over 150% (out of possible 200). Traffic can go up to between 500 and 1000 KB/sec for long periods of time. Sometimes it seems that my relay just can't take it anymore. In the log, the ratio of TAP handshakes goes wild, and I get clock jump warnings. My clock does not jump. This is Tor hanging while allocating memory. Today I had a really bad episode, where the box started thrashing. When it became responsive again, Tor was left in a state where it was constantly downloading about 400KB/sec more than it was uploading. Normally I have a little bit more up than down, because I'm a directory server as well. I can not explain having a lot more down than up. I can fantasize that those hangs/clock jumps ("assuming established circuits no longer work") could leave 'half' circuits. Finally I restarted my relay, (which I really don't like to do) and after a while it stabilized. At this point, my router shows a peak of almost 8000 NAT sessions. Is this normal behavior of the network (esp. the sudden increase in connections) or is this another kind of attack/probe like what we've seen in early September? Is this because this machine is just too underpowered? Should I collect/provide any diagnostics? Have others seen similar events? Thanks, -Job Nov 16 22:39:52.000 [notice] Heartbeat: Tor's uptime is 36 days 6:00 hours, with 615 circuits open. I've sent 192.16 GB and received 171.74 GB. Nov 16 22:39:52.000 [notice] Average packaged cell fullness: 87.305% Nov 16 22:39:52.000 [notice] TLS write overhead: 9% Nov 16 23:39:28.000 [notice] Circuit handshake stats since last time: 6011/6013 TAP, 35/35 NTor. Nov 17 00:39:28.000 [notice] Circuit handshake stats since last time: 12521/12521 TAP, 47/47 NTor. Nov 17 01:24:45.000 [warn] Your system clock just jumped 138 seconds forward; assuming established circuits no longer work. Nov 17 01:39:28.000 [notice] Circuit handshake stats since last time: 49689/1454481 TAP, 51/51 NTor. Nov 17 02:28:44.000 [warn] Your system clock just jumped 174 seconds forward; assuming established circuits no longer work. Nov 17 02:33:12.000 [warn] Your system clock just jumped 268 seconds forward; assuming established circuits no longer work. Nov 17 02:35:17.000 [warn] Your system clock just jumped 125 seconds forward; assuming established circuits no longer work. Nov 17 02:39:28.000 [notice] Circuit handshake stats since last time: 55822/3477278 TAP, 37/37 NTor. Nov 25 06:53:31.000 [notice] Circuit handshake stats since last time: 28194/28200 TAP, 32/32 NTor. Nov 25 07:29:57.000 [warn] Your system clock just jumped 114 seconds forward; assuming established circuits no longer work. Nov 25 07:31:58.000 [warn] Your system clock just jumped 121 seconds forward; assuming established circuits no longer work. Nov 25 07:53:31.000 [notice] Circuit handshake stats since last time: 24207/2692265 TAP, 42/42 NTor. Nov 25 08:53:31.000 [notice] Circuit handshake stats since last time: 76451/4271579 TAP, 49/49 NTor. Nov 25 09:53:31.000 [notice] Circuit handshake stats since last time: 84956/3666170 TAP, 42/42 NTor. Nov 25 10:45:15.000 [warn] Your system clock just jumped 302 seconds forward; assuming established circuits no longer work. Nov 25 11:01:59.000 [warn] Your system clock just jumped 1004 seconds forward; assuming established circuits no longer work. Nov 25 11:02:04.000 [notice] Circuit handshake stats since last time: 64816/3151447 TAP, 38/38 NTor. Nov 25 11:02:18.000 [notice] Heartbeat: Tor's uptime is 5 days 11:42 hours, with 2450 circuits open. I've sent 46.92 GB and received 46.11 GB. Nov 25 11:02:18.000 [notice] Average packaged cell fullness: 82.623% Nov 25 11:02:18.000 [notice] TLS write overhead: 8% Nov 25 11:53:31.000 [notice] Circuit handshake stats since last time: 18710/1099205 TAP, 193/202 NTor. Nov 25 13:22:03.000 [warn] Your system clock just jumped 1923 seconds forward; assuming established circuits no longer work. Nov 25 13:27:23.000 [notice] Circuit handshake stats since last time: 70795/3452514 TAP, 138/140 NTor. Nov 25 13:35:51.000 [warn] Your system clock just jumped 828 seconds forward; assuming established circuits no longer work. Nov 25 13:42:15.000 [warn] Your system clock just jumped 384 seconds forward; assuming established circuits no longer work. Nov 25 13:43:15.000 [notice] Received reload signal (hup). Reloading config and resetting internal state. Nov 25 13:43:16.000 [notice] Read configuration file "/opt/etc/tor/torrc". Nov 25 13:46:09.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Nov 25 13:46:39.000 [notice] Clean shutdown finished. Exiting.

3 3

Relay - Conflicting data (Atlas != log)
by Mark Jamsek 03 Dec '13

03 Dec '13

I am trying to run a restricted exit relay on FreeBSD 9.2-RELEASE in a jail. I tested it out a couple days ago on an old(er) box, and everything worked fine: https://atlas.torproject.org/#details/A5CA10E554124289C1B42B4CCA68F0CACFE50… Decided to get it running on a fresher rig, all appears well according to system data: $ tail notices.log Dec 02 15:49:31.000 [notice] Bootstrapped 90%: Establishing a Tor circuit. Dec 02 15:49:34.000 [notice] Tor has successfully opened a circuit. Looks like client functionality is working. Dec 02 15:49:34.000 [notice] Bootstrapped 100%: Done. Dec 02 15:49:34.000 [notice] Now checking whether ORPort 110.146.133.98:9001 and DirPort 110.146.133.98:9030 are reachable... (this may take up to 20 minutes -- look for log messages indicating success) Dec 02 15:49:40.000 [notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor. Dec 02 15:49:59.000 [notice] Performing bandwidth self-test...done. Dec 02 15:50:33.000 [notice] Self-testing indicates your DirPort is reachable from the outside. Excellent. Dec 02 15:50:33.000 [notice] Not advertising DirPort (Reason: AccountingMax enabled) Dec 02 15:51:50.000 [notice] Your DNS provider gave an answer for "rmus4fklislhf", which is not supposed to exist. Apparently they are hijacking DNS failures. Trying to correct for this. We've noticed 1 possibly bad address so far. Dec 02 21:49:39.000 [notice] Heartbeat: Tor's uptime is 6:00 hours, with 0 circuits open. I've sent 946 kB and received 7.09 MB. $ ps -aux |grep tor USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND torrelay 86844 0.0 12.1 60532 52796 ?? IJ 3:49PM 0:33.50 tor --RunAsDaemon 1 Apart from the DNS hijacking entry(?), Tor is apparently up and running. However, according to Atlas, it is not: https://atlas.torproject.org/#details/EE16D7A4FBCF6494FEE75C856D76782295CB9… (forgot to backup tor key; hence, the different print) Not sure what to think or do. Is it advertised on Atlas as false due to this entry: [notice] Not advertising DirPort (Reason: AccountingMax enabled) Or is one of the two sources (system or Atlas) wrongly reporting? Thank you. -- 01101101 01100001 01110010 01101011

2 2

Proper bandwidth units [was: Exit nodes on Gandi]
by grarpamp 02 Dec '13

02 Dec '13

On Fri, Nov 15, 2013 at 3:47 PM, Eric van der Vlist <vdv(a)dyomedea.com> wrote: > Without bandwidth limitation that's true. OTH, I currently consume only > ~ 50 Gbits/month and the limit is 500 Gbits. Would a relay limited to > let's say 200 or 300 Gbits/month still be useful for the community? People, can we please mind using the proper units. I know Tor doesn't make it easy because Tor itself incorrectly uses Bytes. But Tor is a network application, and real network apps are measured in 'bits per second', not 'bytes transferred off disk', even if the latter is what silly hosters sell by... mostly due to their presumed need to tie in with their typical customers supposed Apache access_logs. But believe me, what hosters really care about is their upstream bill in bps rate, they're just converting that for access_log presentation to you. Your further mixing of 'giga bits per month' doesn't help *at all*. Please try to use 'bits per second' as the common denominator on this (network application) list. BTW, Gandi is historically a fairly progressive company. The right approach could have some good wins there.

10 24

Newly configured relay questions
by Conrad Rockenhaus 01 Dec '13

01 Dec '13

Hello all, I brought a new non-exit relay online: ec2bridgerocks001 D06C B145 56C1 F73A F317 B555 C279 2F7B 105C 95B4 It's been operational for 6 days now, Tor has been reporting bandwidth usage, but when I try to look for it in the TorStatus page, it's not listed. I'm operating this relay on EC2 and I've opened all the usual ports. I've also checked the Tor metric portal, can't find it there either. So, I'm wondering - is there something I missed in the configuration? The torrc is pretty much the default EC2 one. Thank you I appreciate any thoughts/assistance. Respectfully, -- Conrad Rockenhaus http://www.rockenhaus.com/ http://www.lagparty.org/~conradr/

5 6

Named flag
by Sebastian Urbach 28 Nov '13

28 Nov '13

Dear colleagues, Im a bit confused about the "named" flag. My relay is running smooth and i already received the "guard" flag but still no named flag. I also read the directory specification paper. I dont have the unnamed status nor is there another server with that name in use. Im not sure if the authority supports name binding but from what i understand the authority should support it. Maybe someone on this list is able to look into that matter ... Router Name: ParEpistemenTaksis Fingerprint: 3C82 285F AC21 71FA 5178 340A 82B0 5F21 90AB 68E9 -- Mit freundlichen Grüssen / Sincerely yours Sebsstian Urbach ----------------------------------- Religion is a symptom of irrational belief and groundless hope. ----------------------------------- Gregory House, M.D.

3 4

Huge harrassment by Irdeto and IP-Echelon, 83 mails, in 2 weeks, need your help
by julien.robin28＠free.fr 19 Nov '13

19 Nov '13

Hello everybody, My 2 exit nodes servers are ArachnideFR35 and ArachnideFR35v2, with respective observed bandwidth of approximately 100Mb/s and 30 Mb/s (12 200 KB/s and 3800 kB/s). They are momentarily down since I have decided today to put them down while I will be trying to solve this enormous Irdeto/IP-Echelon problem. I want to keep my servers alive but I realize that it will not be possible if harassment doesn't stop quickly. My ISP is just transmitting to me a huge amount of abuse complaints every day (and never makes any comment) but they are too many and the incredible patience of my ISP cannot be unlimited. And all this, despite of the fact that my reverse DNS are set, since the first day, to http://digi00277.torproxy-readme-arachnide-fr-35.fr and http://digi00433.torproxy-readme-arachnide-fr-35.fr with the Tor Exit Notice on port 80. And it is this address that appears into the Tor Relay lists. I have decided to temporarily shut down my servers today (November 13, 2013, 14:50 UTC) while I'm trying to solve this enormous Irdeto/IP-Echelon problem, and to send a mail to my ISP to tell them that I will try to fix this problem before to restart my servers. Since August 18, 2013, the two machines that I'm running as Tor Relays are full exit nodes (reject *:25, *:26, *:27, accept *:*) (before it, since May 2013, they was only Relays nodes) because I was thininking that : if there is abuse complaints, I will be able to face them. I'm not the only one in this case (accept *:*), But as I see in this mailing-list it seems that the amount of abuse complaint I'm receiving is completely abnormal. My service provider is Digicube.fr, it's a really little company that doesn't seems to be able of handle everything in time. I not sure if there was no abuse complaints before end of October, but if there was, I never seen them. I have tried everything: by mail or by the Web Interface that figures in the mails, with all these arguments: - Since 08/18/2013, 95.130.10.70 and 95.130.9.89 are dedicated high speed Tor Exit Router, they do not host or share anything, they are just international network routers with empty hard disk drives. - All reports you sent about these permanent IP Addresses (95.130.10.70 and 95.130.9.89) for several weeks are wrong: the IP Address that appears into your reports is the IP Address of the router, not the user. - These routers and his responsible are NOT infringing any copyright. Neither technically nor legally. - You got to understand that the goal of such a network is a way much fair goal than movies on the Internet. In March 2011, the Tor Project was awarded the Free Software Foundation's 2010 Award for Projects of Social Benefit on the following grounds: "Using free software, Tor has enabled roughly 36 million people around the world to experience freedom of access and expression on the Internet while keeping them in control of their privacy and anonymity. Its network has proved pivotal in dissident movements in both Iran and more recently Egypt." But for both Irdeto and IP-Echelon, they don't care, and every day, the harassment procedure continues. I think they don't read my emails, I hope they can receive them; I never had any answers from them. I told them that if there is no answer, I will not have any reason to keep watching their emails... may be I need to ask my ISP to put a spam-filter about that, but I think that such a proposal have no chance to be welcome into an abuse service ! Don't be horrified: here is, below, the list of all abuse complaints I've received from them. You will understand why I love my ISP, and why I need to quickly find a solution! The olders ones are from October, 29 2013. 1 - IP-Echelon part : notices.sony(a)ip-echelon.com : Unauthorized Distribution of the Copyrighted Motion Picture Entitled "White House Down" - Case ID 131400838 Unauthorized Distribution of the Copyrighted Motion Picture Entitled "White House Down" - Case ID 131396212 Unauthorized Distribution of the Copyrighted Motion Picture Entitled "White House Down" - Case ID 131732460 notices.warner(a)ip-echelon.com : Notice of Claimed Infringement - Case ID 130362722 Notice of Claimed Infringement - Case ID 130296727 Notice of Claimed Infringement - Case ID 130308292 Notice of Claimed Infringement - Case ID 131314345 Notice of Claimed Infringement - Case ID 131160950 Notice of Claimed Infringement - Case ID 131049815 Notice of Claimed Infringement - Case ID 131044521 Notice of Claimed Infringement - Case ID 130778319 2 - Irdeto part : activision(a)copyright-compliance.com : 290-117780660 Notice of Unauthorized Use of Activision Property 290-117744045 Notice of Unauthorized Use of Activision Property 290-117740528 Notice of Unauthorized Use of Activision Property 290-117895342 Notice of Unauthorized Use of Activision Property 290-117877594 Notice of Unauthorized Use of Activision Property 290-117854157 Notice of Unauthorized Use of Activision Property 290-117818254 Notice of Unauthorized Use of Activision Property 290-118018138 Notice of Unauthorized Use of Activision Property 290-117983726 Notice of Unauthorized Use of Activision Property 290-117965572 Notice of Unauthorized Use of Activision Property 290-117961867 Notice of Unauthorized Use of Activision Property 290-118628905 Notice of Unauthorized Use of Activision Property 290-118491174 Notice of Unauthorized Use of Activision Property 290-118453073 Notice of Unauthorized Use of Activision Property 290-118398863 Notice of Unauthorized Use of Activision Property 290-118374287 Notice of Unauthorized Use of Activision Property starz_media(a)copyright-compliance.com 314-117685560 Notice of Unauthorized Use of Starz, LLC ("Starz") Property 314-117684996 Notice of Unauthorized Use of Starz, LLC ("Starz") Property 314-117666358 Notice of Unauthorized Use of Starz, LLC ("Starz") Property 314-117666311 Notice of Unauthorized Use of Starz, LLC ("Starz") Property 314-117663952 Notice of Unauthorized Use of Starz, LLC ("Starz") Property 314-117653783 Notice of Unauthorized Use of Starz, LLC ("Starz") Property 314-117780831 Notice of Unauthorized Use of Starz, LLC ("Starz") Property 314-117509673 Notice of Unauthorized Use of Starz, LLC ("Starz") Property 314-117452028 Notice of Unauthorized Use of Starz, LLC ("Starz") Property 314-117258420 Notice of Unauthorized Use of Starz, LLC ("Starz") Property 314-117005314 Notice of Unauthorized Use of Starz, LLC ("Starz") Property 314-117827226 Notice of Unauthorized Use of Starz, LLC ("Starz") Property 314-118012162 Notice of Unauthorized Use of Starz, LLC ("Starz") Property teachingcompany(a)copyright-compliance.com : 120-117780245 Unauthorized Use of The Teaching Company Limited Partnership Property paramount(a)copyright-compliance.com : 22-116418467 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-116390947 Notice of Unauthorized Use of Paramount Pictures Corporation/Dreamworks Animation SKG, Inc. Property 22-116289727 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-116462954 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-116463639 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-116468964 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-117784969 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-117784422 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-117668962 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-117637379 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-117360665 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-117326212 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-117319457 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-117260566 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-117206174 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-117194860 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-117194189 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-117174717 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-117143821 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-117049672 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-116899426 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-116897671 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-116892769 Notice of Unauthorized Use of Paramount Pictures Corporation/Dreamworks Animation SKG, Inc. Property 22-116887099 Notice of Unauthorized Use of Paramount Pictures Corporation/Dreamworks Animation SKG, Inc. Property 22-116847203 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-117909973 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-117903528 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-117858364 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-117857551 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-117815491 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-117978380 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-117946018 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-117933311 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-117930244 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-117916165 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-118620584 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-118611592 Notice of Unauthorized Use of Paramount Pictures Corporation/Dreamworks Animation SKG, Inc. Property 22-118607311 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-118523821 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-118519781 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-118369725 Notice of Unauthorized Use of Paramount Pictures Corporation Property 22-118369726 Notice of Unauthorized Use of Paramount Pictures Corporation Property ----------------------------------------------------------------------- I wanted to die when my fingers have typed this sentence : /etc/init.d/tor stop And watching my server slowly going down... :( I understood that a solution is to put a restricted exit policy, and only enable people to browse the web and nothing else, but before to do this and become something like "quarter of an exit node" (I'm kidding but you see what I mean ^^) I want to know if the amount of abuse complaint from Irdeto and IP-Echelon are normal with a full exit policy, or if I have a chance to make them stop while keep operating full exit nodes. Thank you in advance, Arachnide needs your help ! Best regards, Julien ROBIN PS : I will be at work the entire day tomorrow, sorry if I don't answer before tomorrow evening.

6 8

Apologies for the email about Sugarcube
by Sriakhil Gogineni 19 Nov '13

19 Nov '13

Hello all, I'm very sorry about an email that went out yesterday that some of you received. It was only supposed to go to my contacts, around 2000 people. I exported my contacts and removed all mailing lists from the pool but it seems some people who were cc'd on threads got added in. It seems I have deeply offended about a dozen of you and for that I'm sorry. I know how precious inbox sanity is and I did not intend to spam anyone -- this email was only supposed to go to family and friends. Rest assured there is no 'list' and you will not be receiving any future email from me regarding Sugarcube. Best, Sri

1 0

Re: [tor-relays] which aws ami?
by Ralph Guntermann 17 Nov '13

17 Nov '13

yes, that worked for me & now running - thanks! --- runa.sandvik(a)gmail.com wrote: From: "Runa A. Sandvik" <runa.sandvik(a)gmail.com> To: tor-relays(a)lists.torproject.org Subject: Re: [tor-relays] which aws ami? Date: Sun, 17 Nov 2013 16:47:39 +0000 On Sun, Nov 17, 2013 at 2:57 PM, Ralph Guntermann <ralphguntermann(a)swissmail.net> wrote: > Hi! Hi, > I'm trying to set up 2 tor bridge relays on amazon aws. > > I follow the guide on the tor cloud web page at torproject.org but I'm > unable to view the AMI or instance configuration when I get logged-in to my > aws account. > > I've figured out that I can set-up my instance from within my aws account > but I'm uncertain how to proceed. > > This is what I'd like to do: > > Set-up 2 instances on my aws account with 1 instance based in the region > South America (São Paulo) and another instance in the region Asia Pacific > (Singapore) using the AMI for Obfsproxy Bridges. > > I've found 2 tor-cloud AMIs listed in the Community AMIs. These are: > > Tor-Cloud-EC2--us-east-1-04-13-2013-20616 - ami-69d30974 > [Copied ami-4a7c1a23 from us-east-1] > Tor-Cloud-EC2--us-east-1...13-2013-20616 > Root device type: ebs Virtualization type: paravirtual > > & > > Tor-Cloud-EC2--us-east-1-04-13-2013-7427 - ami-6bd30976 > [Copied ami-567c1a3f from us-east-1] > Tor-Cloud-EC2--us-east-1...-13-2013-7427 > Root device type: ebs Virtualization type: paravirtual > > Perhaps there is a choice of 2 AMIs because 1 is for Obfsproxy Bridges & the > other is for Private Bridges? I'm not sure which AMI I should choose for > Obfsproxy Bridges. Correct. For a shared obfsproxy bridge in São Paulo use AMI ID ami-69d30974. For a private obfsproxy bridge in Singapore use AMI ID ami-601c5332. You can find this information on https://cloud.torproject.org/#get_started. > From what I can see, once I've chosen the correct AMI it should be very easy > to finish the configuration. It is, but please remember to open the right ports in the firewall before booting the instances. See https://cloud.torproject.org/#get_started for a list of ports. > Also, am I correct in thinking that I can host 2 instances in different > regions on the same account? It doesn't matter so much if this isn't > possible, I suppose I could host both instance in the same region. This is possible. You should be able to change the location with a drop-down menu somewhere. -- Runa A. Sandvik _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays _____________________________________________________________ Sign up for FREE email from www.swissmail.net at http://www.swissmail.net

1 0

which aws ami?
by Ralph Guntermann 17 Nov '13

17 Nov '13

3 3

Re: [tor-relays] Tor relay in Russia/China
by Tony Xue 17 Nov '13

17 Nov '13

> Message: 2 > Date: Sat, 16 Nov 2013 05:20:22 -0500 > From: that guy <grep(a)gmx.us> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Tor relay in Russia/China > Message-ID: <528746E6.1030208(a)gmx.us> > Content-Type: text/plain; charset=ISO-8859-1 > > On 11/15/2013 06:20 PM, tor-relays-request(a)lists.torproject.org wrote: >> I've heard that some ISPs in China provide uncensored network >> access to foreign companies. But this is hearsay > > You are correct but it is not that simple nor widespread. What I've > seen most often is execs from big companies getting special > considerations so while "uncensored" might be a stretch there is some > truth to the above. I can find out more any time if anyone needs some > info please contact me any time as I don't think it will be a big > topic of discussion here:) I have seen heavy use of VPN's by western > students visiting, or studying in Bejing w/out issue. I'll have very > current info and can get some near instant feedback in the next day or > two. > > And to the guys saying "avoid the ussa like the plague" this wanna-be > expat agrees 100%. Sadly! And for a whole lot more than just Tor nodes. But keep in mind that Chinese people like to do things in a tricky way. They might say not censored network but they didn't say they're not monitoring it. The gov has said that they will be strict on "ideology" in any situation. I did hear about someone in "a famous Finnish mobile phone company which will belong to a US operating system making company" said they can access facebook directly but I haven't got a chance to see whether they are using an enterprise level VPN or uncensored network. > > -- > ----------------------------------------------------------------------- > PGP Fingerprint : > 7770 D186 A06E A329 2217 > 3161 63EB F269 37B8 8644 > > http://pastebin.com/8W8vyNjb > ----------------------------------------------------------------------- > "... Governments are instituted among Men, deriving their just powers > from > the consent of the governed, --That whenever any Form of Government > becomes destructive of these ends, it is the Right of the People to alter > or to abolish it, and to institute new Government, laying its > foundation on > such principles and organizing its powers in such form, as to them shall > seem most likely to effect their Safety and Happiness." > > >From the United States of America's Declaration of Independence > July 4, 1776 > ----------------------------------------------------------------------- > > > ------------------------------ >

2 1

Building on a Udoo Dual
by Richard Budd 17 Nov '13

17 Nov '13

Does anyone know if the Tor Project has sources for top that can be compiled on a Udoo Dual? It's running Ubuntu 11.10 (oneiric) on a ARMv7 processor. I've tried following the instructions on https://www.torproject.org/docs/debian, but I get an Err http://deb.torproject.org/torproject.org/ experimental-oneiric/main tor 0.2.4.17-rc-1~oneiric+1 (dsc) 404 Not Found [IP: 38.229.72.14 80] error when trying to run the "sudo apt-get source tor" command. I had no problem compiling on a Raspberry Pi, but of course this is a different animal. Thanks, Richard

2 2

Re: [tor-relays] Tor relay in Russia/China
by that guy 16 Nov '13

16 Nov '13

On 11/15/2013 06:20 PM, tor-relays-request(a)lists.torproject.org wrote: > I've heard that some ISPs in China provide uncensored network > access to foreign companies. But this is hearsay You are correct but it is not that simple nor widespread. What I've seen most often is execs from big companies getting special considerations so while "uncensored" might be a stretch there is some truth to the above. I can find out more any time if anyone needs some info please contact me any time as I don't think it will be a big topic of discussion here:) I have seen heavy use of VPN's by western students visiting, or studying in Bejing w/out issue. I'll have very current info and can get some near instant feedback in the next day or two. And to the guys saying "avoid the ussa like the plague" this wanna-be expat agrees 100%. Sadly! And for a whole lot more than just Tor nodes. -- ----------------------------------------------------------------------- PGP Fingerprint : 7770 D186 A06E A329 2217 3161 63EB F269 37B8 8644 http://pastebin.com/8W8vyNjb ----------------------------------------------------------------------- "... Governments are instituted among Men, deriving their just powers from the consent of the governed, --That whenever any Form of Government becomes destructive of these ends, it is the Right of the People to alter or to abolish it, and to institute new Government, laying its foundation on such principles and organizing its powers in such form, as to them shall seem most likely to effect their Safety and Happiness." >From the United States of America's Declaration of Independence July 4, 1776 -----------------------------------------------------------------------

3 2

Re: [tor-relays] Running random web services on a bridge-server?
by Kostas Jakeliunas 16 Nov '13

16 Nov '13

On Nov 16, 2013 1:01 PM, "Martin Kepplinger" <martink(a)posteo.de> wrote: > > Hi, > > Sorry for being lazy, I'm not sure if I can figure it enirely out > myself: Is there _any_ implication on the status of a bridge in the Tor > network when I run random web services like an open website, xmpp > server, whatever, on the same device/IP? It'll somehow be more exposed > that way but I'd be happy on any opinion. I guess probability that > someone finds out that there is a bridge behind my IP is rising. I really have nothing to back this up but I would *think* that additional services on the same IP might mask the bridge from / confuse some active/reactive probing based bridge disovery attacks. Then again, if active probing is usually only done on a particular (ip, port) pair (the one that someone in China is connecting to, for example), then there's probably no difference anyway.

1 0

Running random web services on a bridge-server?
by Martin Kepplinger 16 Nov '13

16 Nov '13

Hi, Sorry for being lazy, I'm not sure if I can figure it enirely out myself: Is there _any_ implication on the status of a bridge in the Tor network when I run random web services like an open website, xmpp server, whatever, on the same device/IP? It'll somehow be more exposed that way but I'd be happy on any opinion. I guess probability that someone finds out that there is a bridge behind my IP is rising. thanks, martin

1 0

Tor replay in Finland
by Anonymous 15 Nov '13

15 Nov '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello all list readers, Someone has experience with Finland tor replays/exits? Do you know any problem with running it from the lagal side? I may say that I'm currently hosting an tor exit node in Finland, but unsure if it's an good idea. - -- Best Regars, Anonymous - Supporter of Free Speech. GPG: 0x78612223 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJShplBAAoJEFy6M0x4YSIj9N4P/1Mj3Dclm4yJqDqPz2GfsFTk iksvd6y7hiFrSQoEle19DQ7Z/mxC2GFjohJ2zrYNnjEfRb/sUDbyLFbF21CRjrZV spmyv0cvi33hBSEvAB3IHKGj9wMkRU9Yd0DNV58YkrvqavDEPd/8UN+u7GKowuGK ms0Z+wFuIlBeqAA5gdoQZoARbULuXZrIvuJbbmadgXLmBss80YG2UFhLKAt5oJN4 CtW5wibpmIRAxOqBlCJTTGxHatxWarGovgMG4evdSYqqThg7rMf17NXHNIrT6qX/ BELlUn5lkKYoGg5/yxXSUAP9+S2KEnRvEaP0bgPybYhzTs2Y4OAJlkbayq67NMS4 VmiE9aBn3etDSxGGsLtafXWWw1XCN2jIJVkevGTB/Pbr5aBKe48jjAHoQqooHHpQ iRe/G4esipaficbD/74cEOe8yD0Dbt9KDpG+Eqj5NuSJLwqnJdJFXXWVWpNuWVMj TZaCrxArLScdw/2BlfgbQc4sidSGRs6YhijbE1fCe2zq6Jh/KOBentXVGgl8XWel crrjpr0lvg0km076RyMW6Jy9eF6pQSlcHMPP32sfZmQ+V1sZCzfORMxRCSUQmjda jA8ZNXN9yoTHM5pEuTjgl74TaebBjxoI2ZCD6FnP8D5S9vy2lIwT2DYFz8klyrC/ 7p56MdJhPzawQrLnJHdv =Q86H -----END PGP SIGNATURE-----

2 4

Tor relay in Russia
by jj tor 15 Nov '13

15 Nov '13

Hi, list readers, Someone has experience with russian tor relays? Do you know of any legal problem for an exit relay ? Thank you

5 5

Exit nodes on a Gandi VPS
by Eric van der Vlist 15 Nov '13

15 Nov '13

Hi list, I am a (happy) Gandi customer and I'd like to support the Tor project by setting up an exit node on one of their VPS (https://www.gandi.net/hosting/iaas) As mentioned on the list of Good/bad ISPs, (https://trac.torproject.org/projects/tor/wiki/doc/GoodBadISPs Gandi does accept Tor exit nodes. I have contacted their technical support who said they did support the Tor project but wouldn't ne able to do specific ARIN declarations and that it would be my responsibility to be reactive to abuse complaints. Despite this perspective (and Julien Robin's bad experience) I am still willing to give it a try. Gandi have data centers in Paris (France), Luxembourg and Baltimore (US) that I can use with the same cost and efforts and I am wondering which of these locations would be more useful for the community. Thanks for your advises! Eric

3 4

Ingoing & Outgoing connections
by earlgrey 15 Nov '13

15 Nov '13

Hello, is it possible to achieve this behaviour : RELAY RELAY RELAY RELAYRELAY RELAY | | | | | | +--------+--------+--------+--------+--------+ | | ( internet connection 1 ) | | MY RELAY ( on computer #1 ) | | ( LAN connection ) | | PROXY ( on computer #2 ) | | ( internet connection 2 ) | | +---------------+---------------+----------------+ ||| | EXIT_CONNECTION EXIT_CONNECTION EXIT_CONNECTION EXIT_CONNECTION I cant find / undertand the options in torrc documentation. In fact I would have a "ExitConnectionProxy IP:Port" option. Any idea ?

3 2

Bad idea to switch from a relay to a bridge?
by Nick 14 Nov '13

14 Nov '13

Hi, I've been running a very low bandwidth relay for a little while with my home ADSL connection, but given the up speed is so poor, and (more importantly) my ADSL provider has stopped switching my IP about every 24 hours, I'd like to switch to be a bridge. However, I'm wondering whether the fact that my IP is already known as a relay means that it wouldn't be useful? That is, if the people bridges try to foil are likely to just blacklist any relays they see by default (it wasn't an exit or guard). Thanks for any advice, Nick

3 3

Setting UP an Tor exit node with resrictions
by Anonymous 14 Nov '13

14 Nov '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello! How may I create an Tor exit node with some ports and sites blacklisted? So the user trying to enter an blacklisted page will get an page saying that the maintainer has denied the access to that page/site. I whould like to deny access to IRC and some forums so how is that posible if it is? - -- Best Regars, Anonymous - Supporter of Free Speech. GPG: 0x78612223 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJSgRo8AAoJEFy6M0x4YSIjN+AQAKB9GQqNWfGYOdVCUiSE3UGv Kb21VcsK75QEg5ccbTyGs9c4bsh1UNkzHd0tClsVloV67nkdh13aAzXUYqUllJuB S2PzpdAE+mdr1lKpHpOUAeIZwd4KQ6HRb4GA+iLTUoBI0oLP1Le3zVclPl5TO4Ei U3QL6wrQUwOId5cfTk3Q1029oGKptilDzajrqgoR5jMxDsrVZdBp10yM981650Pv ZQe/XBI5hDPM74soEDKitZpAsc6gUUBFWLyRzCUAUtL1U3Bv8hbvkcO/nlWk5yzH GYSTDAyvkq2ZY9Q5F2+Z5+GL7YAnUg8p607ndlB0grXxXb3JpA7ASlLi0SGouQCQ of8gUCKpNbZQk0euSXqqSdU7jQRxmI12K/k7wzidE1G6UNDrMucwbAiLo5TELkEz 6iCQ2FuoH0aFDJ3JF5Ftsu3CKTPlYNjejag5d/139B+0fZ56Sza+sSZvYY9HxWvB JUohIPuY+X9ngUarjtAmBJ61tpOzMFM0QkomRE3XCDrTjb4Vqch2/2lHVODlTBa6 G7MZc2Fx/l71nO87tHHSzG08VBtJ91cmJtFcBZ36zjaj5xNW6TPVYiIMvbjYXVaZ AXALaxtJWa6Lx76F+VLcOK0i3/k1y9y3hgRBT9SVj93sDiAEr7FenXGcDr3XapnZ L6TUANsYlJtb6xsZaykk =Sk1v -----END PGP SIGNATURE-----

4 6

Re: [tor-relays] Checking a bridge
by Gary Anderson 13 Nov '13

13 Nov '13

I have the same worry as Martin. I set up a bridge on AWS 2 weeks ago by following the instructions here https://cloud.torproject.org/ and choosing a bridge image for Ireland. Setup went well, log files on startup tell me my bridge contacts the tor network, and I checked I could use my bridge by explicitly configuring it in a tor client. But the traffic I see in arm is very small (around 100 MB / week) compared to what I observed when I tested a tor relay (over 2 GB in a week-end). On the other hand, I didn't find my fingerprint in Globe. Is there something wrong or can this be a normal situation that happens sometime ? Do all fingerprints end up in Globe ? T. Lunar : > Martin Kepplinger: >> When my bridge uses only the same few MBs each day, i guess it isn't >> used at all right? >> >> Is there a simple way to ensure it is in bridgeDB and functioning as it >> should? > > You can search for the bridge fingerprint in Globe: > http://globe.rndm.de/ > > Globe will hash the fingerprint before sending it to Onionoo to prevent > leaks. >

3 3

Traffic in port 9050 in a relay (denial of service attack?)
by jj tor 12 Nov '13

12 Nov '13

Hello all, I've set up a tor exit relay (0.2.4.17-rc, debian testing) on a VPS, and it's running well (about 20Gbs/day). But a lot of traffic (about 50%!) is using port 9050 for incoming connections. It's something more than random scans. Because I am worried, I've run tcpdump on this port and the packets length is about 50-60 bytes long. It seems like DOS or flood traffic: external ip tries to connect and my server refuses (RST, ACK), each time. My OR port is 9001, and, of course, SocksPort = 0 in my torrc. Do you think something is wrong with my relay? Why that traffic if my only tor port is 9001? Should I block that traffic using iptables?

11 23

(no subject)
by Jon Hernandez 12 Nov '13

12 Nov '13

1 0

Does TOR need TUN/TAP
by Sebastian Pfeifer 12 Nov '13

12 Nov '13

Hello! A short question I didn't found in the FAQ or with Google: "Does Tor (as an exit node) need a TUN or TAP device"? I am a poor pupil and with my provider servers without TUN/TAP (VRS) are 1€ cheaper per month than the ones with (KVM). LG Sebastian -- vy 73 de Sebastian Pfeifer OE6SPD Folgt mir auf Twitter! @0xDEADDA7A http://www.qth.at/oe6spd/index.php?seite=start http://www.greenpeace.org/austria/de/aktivwerden/greenpeace-teams/team_wien/ Denk an die Umwelt! Musstest du diese Mail wirklich ausdrucken? 0xB1120583 生き甲斐

3 3

Re: [tor-relays] tor-relays Digest, Vol 34, Issue 27
by bbzxrmy wowman 12 Nov '13

12 Nov '13

MATH SPAWN 4 INFINITEZMALL PLAYSIMZ 0.4190909090909091 ZRVYNIMPLKKJUYTRMBBBGFDDRWQSA EARTH TRAVELLING@ 96000 YEARS A DAY, TIME COMPRESSION - 4 BILLION YEARS, FROM 13BILLION PIONT 6= 12 YEARS REMAINING TO DISABLE THE VIRAL JAM SYSTEM PROGRAM CODE LIFE SPANKER EARTH FLYING OFF COURSE 0 TO 9 CAN CREATE PARADISE IN 2022 4000YRZ X 24HRS= 96000 YRZ/DAY 96000 X 366DAY/YR =35136000YRZ/ YR X 3 {TRIATH OF 9 REPEAT) = 105408000 BILLION YEARS PER 1 YEAR EARTH TIME****<*> 13BILLION YR CYCLE(+0} CREATION(TEST LIFE)- 4BILLION OFF(MISTAKES) 4BILLION YEARS SPACE(HOLOGRAPHIC TRAIL+ERROR} = 12 YEARS FROM 2012 2022 X 4 PIONT GALAXY SEX PAIRS = 8088 ARMY OF PARADISE 8088 MEN DIVIDED/ 22 OMEGA GIRLS= ***367.6363636363636*** ( 1.60 DAYS MISSING FROM YEAR{SECRET SONMAP) 367 RECIPROCAL= 19.57 .10{REPEAT ALL TEST LIFE) .10 HIGHER THAN GOLD RATIO 19.47 = MISSING LEADER 10 (PHONY DEVOURALL| HIDING IN GOLD PROJECTED FALSE UNIVERSE 8088/22 % = 1351.564958677686 OUTER ROTATION TRIAX / 22 HELL/HEAVEN GATES= ***0.136363636363634*** THEN SQROOOT==== ============= 0.3 >69{} 27 44 >72937<-99+82 ||||||||||||| 9BIRTH .22 NEGATIVE FORCE / 22 NOOQ = 0.4190909090909091 6 SOLMATES BLOCKED BY WAVE CALIBRE DIRECTIONAL PROGRAM p{DEATH| .4= 4 PIONT 4 ELEMENT GRID EXPONENTIALIEZER PREVENTING ALPHA-+ OMEGA+- 2 PROCEED TO ZERO TEST HOLOGRAM LIFE FINAL, WEAR AFTER NIL, POSSIBLE FOR BOTH 2 2CREATE REALITY.... STARTING @ 2 PERFECT OPPOSITE FROZEN EXISTENCES {MAN + GIRL WHO WAITED 14BILLION YEARS FOR THIS VIRTUAL UNIVERSE TO COMPLETE ITS ETHERIC TESTING| @ CLIMAX ALPHA + OMEGA(CODES) + EXISTENCE MINIMAL + LIFE MAX = 0-9 INFINATE LIFE 4 ALL EXISTING AND CREATION _{+})_*ETERNIADISE%%*&^()?"}" }{}{}{}{}{}{}{}{ BbZzXArmy PrajectoRkiDD ****MASS CHAIN MESSAGE read and spread to all your friendlists (. http://zeja11.blogspot.com/ .) 22eterniA .xex ________________________________ From: "tor-relays-request(a)lists.torproject.org" <tor-relays-request(a)lists.torproject.org> To: tor-relays(a)lists.torproject.org Sent: Monday, November 11, 2013 12:06:18 PM Subject: tor-relays Digest, Vol 34, Issue 27 Send tor-relays mailing list submissions to tor-relays(a)lists.torproject.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays or, via email, send a message with subject or body 'help' to tor-relays-request(a)lists.torproject.org You can reach the person managing the list at tor-relays-owner(a)lists.torproject.org When replying, please edit your Subject line so it is more specific than "Re: Contents of tor-relays digest..." Today's Topics: 1. Re: exit and skype (David Carlson) 2. Setting UP an Tor exit node with resrictions (Anonymous) 3. Re: Setting UP an Tor exit node with resrictions (krishna e bera) 4. Re: Setting UP an Tor exit node with resrictions (Anonymous) 5. Does TOR need TUN/TAP (Sebastian Pfeifer) 6. Re: Does TOR need TUN/TAP (Anonymous) ---------------------------------------------------------------------- Message: 1 Date: Mon, 11 Nov 2013 08:21:40 -0600 From: David Carlson <david.carlson.417(a)gmail.com> To: tor-relays(a)lists.torproject.org Subject: Re: [tor-relays] exit and skype Message-ID: <5280E7F4.1020707(a)gmail.com> Content-Type: text/plain; charset="iso-8859-1" On 11/10/2013 5:37 AM, Thomas Hand wrote: > > This is true. Some websites download lists of all relays and just mass > block the ips. Its usually webmasters who have no idea how tor works > and don't realise that a middle relay poses them no threat whatsoever. > This is why education is best. If someone is blocking your IP, just > email them explaining how tor works and try to convince them that your > IP is no threat. > If a web commerce provider is summarily blocking every IP address on his copy of the list, chances are that they will not change to a policy of only blocking exit addresses, as that takes extra thinking. Of course such a list goes out of date faster than a phone book. That is another reason that using a list is an exercise in futility. Even more thought required to see that. Thus it would be hit or miss to try to access their website using Tor. If they do not respond to a suggestion that they learn more about Tor, a better choice is either to move on to a competitive website or to move our relay (exit or not) to a different IP address. Those options are already on the table in this thread. The situation would change if Tor became the normal means of accessing Internet commerce websites. > On Nov 10, 2013 8:27 AM, "Sebastian G. <bastik.tor>" > <bastik.tor(a)googlemail.com <mailto:bastik.tor@googlemail.com>> wrote: > > 10.11.2013 07:56, gq: > > Dave, > > > > Unless I am mistaken, your non-exit relay never connects to a > web page. > > Only exit relays do that, so it can't be your IP that is blocked but > > whatever exit relay you may be connecting through. > > The original problem seemed to be that Skype rejects connection > attempts > from exits. In the mentioned case someone tried to make a call > from one > of the exits (the same machine with the same IP address) without > using Tor. > > Unless I am getting the reply you replied to wrong, the same may > happen > when one runs a non-exit relay and tries to connect from the same > machine to a service that blocks the Tor network, whenever the traffic > comes form an exit or not. (One reason could be, not knowing that > there > is a difference, or just to be sure there's no trouble, or that's just > the default [third-party]list they always use for blocking without > carrying what's on the list) >

1 0

exit and skype
by Jan Hendrik den Besten 11 Nov '13

11 Nov '13

Boy, now I am in trouble... I run an exit node from my home address for a few weeks now, but my gf starts complaining she cannot use Skype anymore to chat with her mum. I understand Microsoft blocks all tor exits from accessing Skype. Is there anything I can do except converting the exit into a relay? --

14 16

(no subject)
by bbzxrmy wowman 11 Nov '13

11 Nov '13

00:11][BlakbirdzejA] ()+_earth changes spawning chaos releases, react to time speeding, and proclaim a more established eternia for all exisT. aviod control, imperge immortality and fight with new designs without permitting harm, devour opposites, refrain from weakness hiding in false powers. when the weather shifts 2 death burn the corpses and re-taliate with health and completionZ, do not starve there is soil and water for all to eat for 100s of years. gather and destroy not-wanted pain and looping, seperate for strength and evolve. SeX interRaciaLL to merge galaxy code N eradicate idolismz BBZzXArmy8::22 }{}{}{}{}{}{}{}{ BbZzXArmy PrajectoRkiDD ****MASS CHAIN MESSAGE read and spread to all your friendlists (. http://zeja11.blogspot.com/ .) 22eterniA .xex

1 0

Tor relays and exits exposing Privoxy publicly
by Claudio 11 Nov '13

11 Nov '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello everyone, Some months ago I encountered a situation where a user running an exit node with a publicly exposed privoxy (intentionally or not, I'm not sure) was constantly receiving a number of requests directed to advertisement networks. Fundamentally, someone is/was running an infrastructure using exposed Privoxies to perform some sort of advertisement fraud. It's been roughly documented also here: https://b.kentbackman.com/2013/04/15/rotpoion-botnet-powered-by-thousands-o… Out of interest, I gave a quick look at existing relays and exists and it turns out that there's ~20 nodes exposing Privoxy on public IPs. Host: 46.65.12.134 (46-65-12-134.zone16.bethere.co.uk) Ports: 8118/open/tcp//privoxy/// Host: 66.146.193.31 (sable.dredel.com) Ports: 8118/open/tcp//privoxy/// Host: 66.180.193.219 (tor-proxy.die.net) Ports: 8118/open/tcp//privoxy/// Host: 69.164.211.18 (nsi.mirt.net) Ports: 8118/open/tcp//privoxy/// Host: 71.246.241.109 (koansys.com) Ports: 8118/open/tcp//privoxy/// Host: 75.137.122.118 (75-137-122-118.dhcp.gnvl.sc.charter.com) Ports: 8118/open/tcp//privoxy/// Host: 78.47.41.125 (maurer-web.wisseberger-jonges.de) Ports: 8118/open/tcp//privoxy/// Host: 81.56.102.224 (perso.schenck.fr) Ports: 8118/open/tcp//privoxy/// Host: 82.45.34.136 (cpc11-hawk13-2-0-cust135.aztw.cable.virginm.net) Ports: 8118/open/tcp//privoxy/// Host: 93.207.83.51 (p5DCF5333.dip0.t-ipconnect.de) Ports: 8118/open/tcp//privoxy/// Host: 95.140.34.187 (medea.tobias.vn) Ports: 8118/open/tcp//privoxy/// Host: 95.140.34.188 (mikrobi.tobias.vn) Ports: 8118/open/tcp//privoxy/// Host: 123.254.105.104 () Ports: 8118/open/tcp//privoxy/// Host: 151.28.124.42 (ppp-42-124.28-151.libero.it) Ports: 8118/open/tcp//privoxy/// Host: 162.243.5.88 () Ports: 8118/open/tcp//privoxy/// Host: 165.154.108.120 () Ports: 8118/open/tcp//privoxy/// Host: 176.31.127.140 (ks396886.kimsufi.com) Ports: 8118/open/tcp//privoxy/// Host: 199.184.154.12 () Ports: 8118/open/tcp//privoxy/// First thing first, I'm interested to know whether there's an actual reason for doing this or if it's something discouraged. Best, /nex -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJSf4ReAAoJEDmTLM1sbEdvCgMP/id8RbYksJwVBwAXQwJmRMbI +MDLGARDSRlLaQYfNoJyfViuj2rX1RowbwemUsmOQgogHMBJgWSzHMhE4cuxmRG0 dFlcSQI5Fs9y2aFzo4BeS2409yU3/ewpBcgly9AFWAiChCyV2j1q7pZjDcbmxQZK /2AQjRmNeAtLuEnJO7cTSc3ljmnr6IXENFuS4I440c3YWubjqa4TTSy1iONLH0Xi iq0Sgfz/Fs2rGArKRlfamNZIaAyvecuFkbqSp96lu5klAVlCnmYhqt9TStMvskb6 yWegDjTlzVfnjEC5dZIwlMTtHBJT3ERKbShouErjKgGGv0Ld4bgOR56JZO+wmUzC 4XRh41wxh7WbWryTFbdYup546rASPIPSeuyWwqKLnDyVUJa2ehm/8ZQoYT4To4tk eYDOkYkEmr9seqn1p+5+H2CbqPotHscyPwpDTyKTVhg+WhACX2jiZSTBCuJQ61wt rqGlnuZgy28nw+4jzk8V6BrqxSw9t0l7hfGTCqNimE0EHIvb80wwMH80tztR4CNT CpkY3o3DOqQkk0CSjTIRmzR62kmGdNCRP3QnLXCQuA61RdH1Lg5GZh4zCcfitnS3 4ixaIaDhMnRqyUR5QNEpWXBGHEDc3EHjcBCI1Vy/j03fSZaxGZ/BavJfK+0GEE31 VeVmDYjM0Kut1w5PXFEx =asRg -----END PGP SIGNATURE-----

5 7

Amazon abuse report
by Sanjeev Gupta 10 Nov '13

10 Nov '13

Hi, I am running a number of Tor relays, in my own DC and at Amazon Singapore. I got an email from Amazon last week, for the Windows instance: == Hello, It's come to our attention that one of your EC2 instances may be configured as a Tor exit node. Please note that any open proxy activity is prohibited in our AUP: http://aws.amazon.com/aup/ Please respond to this email detailing the corrective measures you plan to take. If you believe our findings to be in error, please provide additional information about how this activity relates to your use case. Regards, Amazon EC2 Abuse Team == Since Tor Cloud https://cloud.torproject.org/ suggests running on Amazon EC2, I am confused. -- Sanjeev Gupta +65 98551208 http://www.linkedin.com/in/ghane

20 53

Watching the attacks on my relay
by elrippo 09 Nov '13

09 Nov '13

Hy there. I did some graphs of the attacks raiding against the network and the method is quite interesting. Take a look at it, maybe it helps a bit. https://elrippoisland.net/public/tor_attack/attack.html -- We don't bubble you, we don't spoof you ;) Keep your data encrypted! Log you soon, your Admin elrippo(a)elrippoisland.net Encrypted messages are welcome. 0x84DF1F7E6AE03644 -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.11 (GNU/Linux) mQINBFH797MBEAC0Y0NeI7lmDR9szTEcWuHuRe0r/WjSRC0Nr5nXsghuMcxpJ3Dd BOBimi4hdMMK4iqPVMwNw6GpKYR3A9LHHjbYRXHUKrJmB+BaJVyzJXN5H6XvxTTb UfX+DaXAGJW/G+3cBB3qm/QaU8QGkBKfXq0DLTaTGPkGKxEAldj/8onGZhawdJs+ B92JrW+S2HDh15pIuXzSqe7eCcIOdvvwfWe0fJi2AraA7LYGpxP6GcC/b9JJpbq5 Y6DfE2Aun9ZK3iHqURyrms0Whbv1CgmUahL2MVYCsTsXwe0GwlAxxKvjXAiXuo+R 9wO5wsXvVVSVNqsk9Yqi+wYzdPKndTU0GyxSApQHroF+cxaZ8Lk0xloj18+LdCSs e5IiTSXH0MMsDdWWdHlrgk+bgDG+0Gu3ne4vMwGdKO7AhYgQW/ueMy4RnkG/nsV9 jry5BO4gGAI1Ij8KvqUzEnvJFGE3ptJogU+zazWWDUWmL3ecKb3aDRlJFnZ3kJ5h q8GolZVjpk99V+4B5WVRPXdej/p5J19tXycK/jdNmr4oC8NyUhIpe8xHELnfoB4z +rxiTx+KMnW0rY8EQg8O2ixEYt5my90IwQkxcxIxextVrqjJjYn8extc2/v8yGzI KmTEJxdADB5v/Jx4HiLHNDSfBUb8gfONCkNSTYvTcSwTjWzHOkXeE/9ZbQARAQAB tD5lbHJpcHBvIChrZWVwIHlvdXIgZGF0YSBlbmNyeXB0ZWQpIDxlbHJpcHBvQGVs cmlwcG9pc2xhbmQubmV0PokCOAQTAQIAIgUCUfv3swIbLwYLCQgHAwIGFQgCCQoL BBYCAwECHgECF4AACgkQhN8ffmrgNkT8+BAAoAXBqu4/O2Cs5FSWWZpzgScNEgq7 uHhOKeYmRfgKlOUPoYlPB1DBqdOAXSKb9OvsmyOvpoGnqijB7aAJBoyQYW/OCQgd U8L4eTCf4yRZnfFLdgskcPfN1p0Rs/yinGEooBJFtYa7mT6J0UTW2JjCLZK2AFCW oF+KBu5JICXGBXigb2ZbX1jWjxP5H1RidQw6HF5z4z34SjLWAOOeZ8B/Xfz6Fs0s IAuLu2O4HE4DI8Qu196LhSVHHgr3uMTkvN1t5nKwyjrRQztwXXk9qIomII3ydNYb BYAGdWNNMfLb1kmDwC5wQHAFvSP1aiMF3aKAY+gl2wXSGO6JqM0SteJS3dytIljI kzu0atc9HuGs/HDQgdmpAS4WU2YefEr/WieltSiAKlwuC+3wg+CONJ6TE1vgNDU/ axerttb0jq7UQb/nAp05bsrB7XH1Vs+1ON9lUPEfWRmwQcrVK5JUrUWa/4tA/UeM XvFcPFtFluGTlLewgJIqcvjPXFwpbDZprXJsMkwew/A6B6n3+0sbgf7p3QSGkVbi dwQAymTbHdYqLnbcnKZhjto3Wjw1J5QB2wuiRYlpjV3i7AWTGlqoSTOWCCV+HamQ qeFYNYAWNFx3+J/oi7xDi8t9bHVNA205equ+y2sj3G5uGJ6LSHQ8AXp9uOipUUvU 1MJN0yLXr9PIwvi5Ag0EUfv3swEQAL0+MnxHGrTjSYdfdua4SBpmytDONM1EngeY s+WyaC/760MughKbaysI/nK2LB1vnwEY7f3NM4fxBx8u2T7VBm6Ez6Fs23Bb8Rkz f97bPSdxCmg64GPHfLA9uwTIXcYS+MpI86WOf6eWY0rRpf7Y9Nl7YoUNvzOyUPqc ggdcnHce8zYv7A/WS8flZDm8tVFPsHrQDEwNMws7ZhiNnHkeZeRJrvCuB7oEVich O/ROYoA5o6NozWYQbjxe1f6Yur4Q10qgVcxVnyLFJSbg6vZSzL7KYh3Z5iBOzPHt 7cwEDrW8W4Kl2Qj8rhJ4Wxs94CAtua7IXK44sVZWQbyHcOXRikgGMZKkEZzVCQa5 KD1u1ZrcBCyuMAir0hsmS3jhCUwpiE2c3SRk8O8CgixhTcBk0X/k9ZFu3Hbi1JMB FLzs/Nq3tYAYvVivhPloSxmYBPsafYHCZM83yBNNsralXh5zjB+di90G+AMXt2PN LTcdovZuWtC0s8/jrx+zv/AA4FAGYU9OVl+YL9ybFX8gSdMEcixyzQcKfiFBjpWv 5iFrwIuDlaXMcheyrhc9aGOxfx44OXc505+VjO/1Q/8EOWlJ6UwOi6GMkj5T+RFJ MDyP0UixS7dt6wTuD5t6PRuyWWxZswgrbL9hjwGFr154Z19TWeNWc23pWtUvQJos UCxl2nFHABEBAAGJBD4EGAECAAkFAlH797MCGy4CKQkQhN8ffmrgNkTBXSAEGQEC AAYFAlH797MACgkQJEPd69lQ0evA+Q/+M7lSFlrQWiRsFqDjh+kTJc+0OEBCvnfo N2KPyXXbfc//qup55PfEygE6C60zvrlv3WE33GZ5GS5MLuDMP82b+a5Yt16NQU7L WtAg1g0S0BvazW+28TgnfO8bhbGaFeE9ccw3xLmlbwZQ3f3LtMKdwFIROiG6hvAs 9U54QYti3tv9DowRYYWpdr0Ga8RqeGNtCKc0v2opy51MpzKWjwUW0i3XlSlyY8Lj 1KT8PyznNPw32nYpmDizz+0OUJNnn/kT+GnFoR3DJnFosTOrnxFJp+N+nejMp/gW r9NM0/E7H+P53IiytBOt5/0vsOaCFGdYGhKEjmJi3dHS4Xk1ObD1mjdD1YDOlWWU 3Md6BDHd4W7Q8gT7oQfTIMLd3HzV+WNPIdocPLBaeA/tRD8Pg5CCmncAmSub4F5T An7FlnACtSOv3cIWQ0TymS42DihDaJ5d1RvNzKw+zHYdPvf471JFZR3TDhkPbLIr 9czR7kbpnXRwchgwXQn306NVWf37TgA8wpbnFTazZ38iOeqcb9oKprqnbgEdr3PN OhKSlMTkzAqf3MEi2Fyua4BADMhS3oBwCRgDTlt6wquEytpNSlZaHnyiyIgOpekF Uy5K3w8NhHqeifRPrNb/UcCbXtXz+puqIEZHMenpv6FRlTTKpdoHoVXSkp1TPMGN /VaCiLbP4Z3xEw/9EbAJJkhmmx1Qw3ueoqc4h1MmhUtIdxSZ/oA9SjwlnY++zvaZ 6w1wTS4P+OUkETNDtItdpxXMJ9qfSy9voAQc2K43WMZCCmpPJYSdqaZZNPFj+Ne8 6FNtNKuUkXREybpHwlVAXnHzInmFOOM9RAmF70r3zEmKt77W1ztBLo2o9X79gPgL u9ThgrH6Oc2k46n+9nc3joccr7miiX/bp976DNWcWdOYThiSSOCb8Zw9/Zs935i1 wUVkYTj24tmBH4H5ov9ib7RPmU21ru458RbUKG0ONAqBtAHNyXHzUnXsrke+D4VW MI06YcXSk8YeYgQ8GxgHQc+W2bb8LIbKN1hEYJ0wzM62vKR2/Oiwuf8lXutIKTuz +v7Vj1PQd66DGHsxtWRaWnr1c54JTL2wICHJYKFH4grp7864+GL/uQ1O/Z/XxVku E1JQ/AnwBGU1M1S6otwWGWVRjzEzQtxsfcCEPvV/9td3FIFQAbGTPb+48XFU+TY9 8AlcXBlDzXq7c5f8Evn/oSIsZDt63K4HNTmMGqOTl/p1aA0e4eyX76LczY06rDP5 GMSNs+AHmYgZiS4RYhRUIvS9uLXMnnDAMYst0SDl2orDUUeHBTzu0rchyknBZMGP p5wQuWQ9CFlV+dj3UYbrBwC1lTkAMXRG2vlhA0V0TZqos7A5D4VHgSUQQjE= =otlL -----END PGP PUBLIC KEY BLOCK-----

8 11

Relay-Bandwith
by Oliver Schönefeld 09 Nov '13

09 Nov '13

hey folks i'm having some issues with my bandwidth... my ISP is offering 50 Mbps downstream 10 Mbps up, so i thought i'd share 20 Mbps max and 15 Mbps avg (respectively 2560 KBps max and 1920 KBps avg) in a inner tor-relay. so i put the latter vaues in the bandwith-limits tab of the sharing options in vidalia with the download speed set to custom. However the tor metrics indicate an advertised bandwith of 317,44 KBps and the worldmap of vidalia even shows just 20 KBps :( So my question is now: Can this be improved and if so, what should i do about it? Or is this maybe because the relay isn't even up 24 hrs and the bandwith will level in somehow later? thx 4 any advice in advance, 1v3ry

4 3

Re: [tor-relays] tor-relays Digest, Vol 34, Issue 22
by that guy 09 Nov '13

09 Nov '13

On 11/09/2013 11:32 AM, tor-relays-request(a)lists.torproject.org wrote: > Using a VPN *might* work, but Microsoft blocks access from many of those too. > > Complaining to Microsoft, especially if you're a paying Skype customer, might not help, but it can't hurt. Same boat but with two woman on two continents and both use Mshit and there is not a chance in the world that they will ever ever ever get jitsi, linphone, Ekiga or any of the other joke excuses for a Skype replacement going. Until there is a non-MS solution that lets non-techies use a service like that from behind NAT they are a HUGE waste of developer's time not to mention consumers. Take a look at the Ekiga mailing list, makes the problems people have with tor relay's seem like child's play. It is almost pathetic listening to them try to help people who WILL NEVER manage to get one up and running. It is a joke. My VPN blocks Skype. I tried hard to get rid of it but it is just not possible unless it's another geek that you are talking to. Complaining to MS or Apple can hurt actually, in the hopelessness area. May end up hanging yourself after trying to talk to them.

1 0

(no subject)
by bbzxrmy wowman 09 Nov '13

09 Nov '13

high, i recently set my relay and also mailing list, however my screen name "BBZzXArmy does not show on the tor world map, can anyone confirm or help me with this im pissed at it zigzagarmy }{}{}{}{}{}{}{}{ BbZzXArmy PrajectoRkiDD ****MASS CHAIN MESSAGE read and spread to all your friendlists (. http://zeja11.blogspot.com/ .) 22eterniA .xex

3 2

Re: [tor-relays] exit and skype
by Jan Hendrik den Besten 09 Nov '13

09 Nov '13

> Date: Wed, 6 Nov 2013 17:12:37 +0000 > From: Thomas Hand <th6045(a)gmail.com> > To: tor-relays <tor-relays(a)lists.torproject.org> > Subject: Re: [tor-relays] exit and skype > Message-ID: > <CAKqc3T7u6mWC6CZLMoaEGkr2iUPe3rabgV-=fi=3LzP67w=oHA(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > If you want to continue using skype, you could invest in a VPN just to hide > it from your ISP and make microshaft think you are coming from a different, > non-tor related IP. > > Tom Thanks for the suggestion. Jitsi is working fine, in combination with running prosody on my server. Gf is happy too, fhew! One down, one to go (her mother).

1 0

Gmail forcing a password reset with tor birdy
by Zack Becker 08 Nov '13

08 Nov '13

I use Gmail for my junk email because of its storage. I would like to use Tor Birdy for thunder bird, but Google forces me to reset the password because of a "suspicious sign in prevented".

2 1

How to install Tor on Ubunt 12.10?
by The Maker 06 Nov '13

06 Nov '13

I want to run a relay that starts every time I login to my machine. I went to the page that discusses how to add the correct PPA to Ubuntu but it stops at 11.10. Is this also the PPA I should use for 12.04 or is there another one? Many Thanks, The Maker

3 2

Re: [tor-relays] exit and skype
by Jan Hendrik den Besten 05 Nov '13

05 Nov '13

> On Tue, Nov 5, 2013 at 2:54 PM, Lars Nood?n <lars.nooden(a)gmail.com> wrote: > > > On 11/05/2013 09:00 PM, Jan Hendrik den Besten wrote: > > > Boy, now I am in trouble... > > > > > > I run an exit node from my home address for a few weeks now, but my gf > > > starts complaining she cannot use Skype anymore to chat with her mum. > > > > > > I understand Microsoft blocks all tor exits from accessing Skype. Is > > there > > > anything I can do except converting the exit into a relay? > > > > You could try Jitsi or Blink. They're not the same as Skype but they > > are freer and the sound is better. > > > > /Lars Thanks for the suggestions. I would need something cross-platform (Linux, Windows, ipad). I'll try Jitsi.

1 0

Re: [tor-relays] Amazon abuse report
by tor＠tafb.xxx 04 Nov '13

04 Nov '13

I'm new to running a relay. There are lots of exit policies when I look at my atlas details: https://atlas.torproject.org/#details/DDB401F4CA108C6F6AF4E0DCE2DFC3407F577… Is this a pretty good exit policy list to prevent harassment from my ISP? Thanks! -Jamie M. > Putting the extensive exit restriction policy in the responses to take-down demands seems like a good idea. > > Robert

7 11

max TCP interruption before Tor circuit teardown?
by Gordon Morehouse 03 Nov '13

03 Nov '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello, I'm working on building support scaffolding[1] for Tor on Raspberry Pi and other small ARM single-board computers (SBCs). With the slower computers, sometimes too many attempts to connect to the ORPort (I am almost positive as part of TAP circuit building, but not *really* sure) can eventually cause Tor to consume more physmem than available and cause the oom-killer to kill Tor. Also, depending on the crappiness of the user's router, it's effectively a SYN flood, and can crash or impair consumer routers. My solution, so far, is to define (through trial and error on a per-machine basis, since [1] is only officially supporting 3 SBCs right now) limits on how many SYNs may be sent to the ORPort and the DirPort per second. This is done with iptables. I experimented, tuned the parameters and watched traffic for weeks and came up with a pretty good set of limits for a 950MHz Raspberry Pi: 4 SYNs/sec burst 10. (For those about to say the Pi is thus too slow to be used as a relay, it's quite capable of relaying *at least* 2.5Mbps, but *not* when it's getting SYN flooded.) So, sometimes hosts exceed this limit. Once the limit is exceeded, my current strategy is to use iptables REJECT to send an ICMP Service Unavailable (or whatever it's called, sorry no coffee yet) back to the hosts that triggered the filter. This is on a per-SYN basis. After watching the data, I noticed that some hosts just try to connect once or twice, or try to connect (during overload conditions) at reasonable intervals of tens of seconds to a few minutes. Other hosts will quadruple-tap the ORPort with SYNs, four in a row, and otherwise be much more aggressive with sending SYNs. I'm currently testing fail2ban[2] as a way to ban aggressive peers by changing that iptables REJECT to a DROP for a short period, in order to accomplish two things: 1. Encourage them to knock off their bad behavior (i.e., go away for a little while). 2. Free up CPU time, RAM and bandwidth because we don't have to construct and send ICMP packets to banned peers. Currently, if a peer violates the 4/sec burst 10 SYN limit more than 5 times in 60 seconds, that peer will be banned for 90 seconds. I'm trying to trim this down to the minimum that will protect the relay, and 90 seconds is a guess given some of my fears, read on... During an overload condition, my primary priority is to protect the relay, but of course I wish to do so with as little disruption to the Tor network as possible. So, here is a potential problem with my approach that I can think of, which could degrade service (mildly, for a few end users) on the Tor network. First, during a SYN flood type overload, some peers which have *existing* circuits built through the relay and are sending SYNs as normal traffic, will stochastically get "caught" in the filter and banned for a short time. If these hosts already have circuits open through the relay which is overloaded, I would prefer to preserve those circuits rather than break them. My defensive strategy versus overload here is to throttle new circuit creation requests, *not* to break existing circuits. So here's the $64,000 question: If a tor relay has a circuit built through a peer, and the peer starts dropping 100% of packets, how long will it take before the relay with the circuit "gives up" on the circuit and tears it down? I want to set my temp ban time *below* this timeout. Thus, unlucky peers that were caught in the filter and have circuits already built through the relay they will experience a brief performance degradation, but they won't lose their active circuits through the overloaded relay, and in the meantime hopefully the overload condition is becoming resolved. Is there such a timeout? There must be. Can someone tell me what it is? Or, is there a better way to protect low-resource machines (slow CPU, 512MB RAM) against the SYN flood "circuit creation storm" conditions which occasionally arise on the Tor network? Again, I must reiterate, machines with specs like these can be very good relays for home broadband users. The true goal of my project[1] is to build a set of software which enables a "plug and forget" relay for home broadband users that costs well under $100. [1] https://github.com/gordon-morehouse/cipollini [2] http://www.fail2ban.org/wiki/index.php/Main_Page Best, - -Gordon M. -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJSZAfXAAoJED/jpRoe7/ujGQ4H/jUUjdufoWw1qthjsqdf4ICO ejJXBuZ60O8TpuiT07EtZq9tSDsb5hLqjJMORNJWPJe3ffD7/BHv/6St0y0fkjFh svEFBwVMmkNfaDd65z2JaFBRnSQTsgtiOeOnQFQt1evWQMeVmFsvoMvVIbqGSkf6 NipJnfFeoAtt/6cCMl7+yIxmGGb1Udl0ZEmlVacIYtFr8MjgIo59vT94k7SuzV1N 4Na9PNeQ9WIBlZf9vyesHgnuzJA8hEkFyoP5Fc3bPT/e3WYdAIifswE6rhZVT+AQ 9rHRvBUVoYpMNyy0fqMY34rLYegelIYstsy26dmW+robJKDxGVC3zBeGbOtcEOE= =mSYu -----END PGP SIGNATURE-----

5 29

Re: [tor-relays] dynamically adjusting bandwidth
by starlight.2013q4＠binnacle.cx 03 Nov '13

03 Nov '13

>The question is, should I put in an adjustment for >'MaxAdvertisedBandwidth' during the backup window >or make any other change to advise remote relays to >de-prioritize the node for the duration? Another unanswered question now understood: As a consequence of a simple parameter tweak, Vidalia buggily zapped (for the second time) the relay configuration and turned off relaying. Quickly restored 'torrc' and restarted the relay, but noticed that the getinfo dir/server/authority observed bandwidth value (third of three) was zapped to a low value for about an hour. This had the effect of causing four out of nine authorities to remove the Guard flag and almost resulted in a consensus "not Guard" state. So the answer here is definitely DO NOT lower 'MaxAdvertisedBandwidth' during intervals when 'RelayBandwidthRate' is reduced for events like offsite backups. Doing so will probably cause the Guard flag to be removed when it is present. The only possible exception would be if one has insane amounts of bandwidth and the lowered value is still quite high. Seems unlikely that 'MaxAdvertisedBandwidth' has any immediate effect on the selection algorithm is only averaged into consensus bandwidth gradually, so probably it's best to not make temporary reductions.

2 1

connecting to obfsproxy bridge from OSX10.9 and TorBrowser-Pluggable-Transports-2.4.17-beta-2-pt3-osx-i386
by Paul Garrett Hugel 03 Nov '13

03 Nov '13

Please steer me to the correct list if off topic here Remote machine is Ubuntu obfsproxy bridge on amazon ec2 using ARM My local machine running 10.9 Mavericks with TorBrowser-Pluggable-Transports-2.4.17-beta-2-pt3-osx-i386 I read the trouble ticket #10030 https://trac.torproject.org/projects/tor/ticket/10030 changed the torrc file entries as indicated below ClientTransportPlugin flashproxy exec ./flashproxy-client --register :0 :9000 ClientTransportPlugin obfs2,obfs3 exec ./obfsproxy.bin managed Still cannot get the Browser to use the proxy Nov 01 22:55:58.740 [Warning] Could not launch managed proxy executable at './flashproxy-client' ('No such file or directory’). Nov 01 22:55:58.764 [Warning] Could not launch managed proxy executable at './obfsproxy.bin' ('No such file or directory’). Ok If I want to get serious and access my Ubuntu obfsproxy bridge on amazon ec2 what Tor components on local machine do I use and configuration Tor builds the circuits but browser can’t connect to proxy so Its non-functional for web browsing Thank you D922 B7B1 3A4D 9BF9 0927 DCA1 7A14 4B7D A3F4 8305

3 2

Re: [tor-relays] significance of different bandwidth values
by starlight.2013q4＠binnacle.cx 01 Nov '13

01 Nov '13

At 16:19 10/15/2013 -0400, starlight(a)binnacle.cx wrote: >Question: > >What the difference between the bandwidth >value given by > getinfo ns/name/xxxxx > >>> w Bandwidth=297 >and > getinfo dir/server/authority > >>> bandwidth 300000 375000 335872 Since no one answered the question and I now have an idea about it, I'll attempt an answer for future web-searchers. . . getinfo ns/name/<node-name> This appears to be a consensus bandwidth calculation generated by five of the nine Tor authority nodes. These nodes run a special relay control client that accumulates and analyzes bandwidth reporting by other Tor nodes via "signal" updates from a daemon control channel. Think they are called 'bwauth's. The value can swing wildly, but appears that the pattern is sinusoidal with an average close to the true bandwidth available from a relay. After a few days the swings in the value seem to dampen somewhat. This "consensus bandwidth" value appears to be what is used by the client nodes' relay path selection algorithm. getinfo dir/server/authority This appears to the observed bandwidth calculation derived from local node statistics. Is much more stable and accurate, but is "informational" and is not used in the path selection algorithms.

1 0

Cisco ASA
by starlight.2013q4＠binnacle.cx 31 Oct '13

31 Oct '13

For anyone running a Cisco ASA between their 'tor' relay and the Internet, some potentially useful info: The default ASA connection timeout is short and often results in 'telnet' sessions through VPN tunnels getting whacked. So one might add timeout conn 48:00:00 to a config to mitigate that issue. However a busy 'tor' relay instance will rapidly accumulate large numbers of dead connection table entries due to loss of FIN packets from flaky corners of Internet. I'm not 100% sure about this, but it seems these dead connection table entries can impair the formation of new connections, not to mention the obvious potential for excessive memory consumption on the ASA. The solution is: access-list tor-class extended permit tcp any host X.X.X.X access-list tor-class extended permit tcp host X.X.X.X any where X.X.X.X is the 'inside' server running 'tor' class-map tor match access-list tor-class policy-map outside class tor set connection timeout idle 0:06:00 As 'tor' sockets have a default KeepalivePeriod 300 any connection with an idle time of more than five minutes is a dead duck and can safely be removed. Checked this out carefully. The comment above was inspired by a seeming performance boost and increase in connections observed after the change was made, not by direct traffic analysis. Could be coincidental. The way to verify it's working is with the show conn addr X.X.X.X long command, which includes the idle timeout associated with each connection. If one has other services running on the same box as 'tor', it might be necessary to adjust the 'access-list' to take them into account.

1 0

Re: [tor-relays] Advice on dealing with ISP's response toDMCAtakedownnotice.
by tor＠t-3.net 30 Oct '13

30 Oct '13

Yeah. Not saying I see a good way to do it. Not really asking for it. Whiny, IDS-noticed, almost nuisance-type complaints are the only ones we've gotten. The complaints aren't even describing successful intrusions. Sucks if these whinebucket type of complaints are making it harder in real world terms for people to host exit nodes. On Wednesday 30/10/2013 at 8:56 am, Linus Nordberg wrote: > Hi, > > Sounds like you risk ending up with a censorship tool controlled by > those who control the list of attack signatures. > > I'd prefer if we educate service providers about this dangerous place > called the internet with the goal of making them turn down the volume > on > their sirens a notch. > > > tor(a)t-3.net wrote > Wed, 30 Oct 2013 07:56:28 -0400: > > | What he said. > | > | No DMCA so far but, one thing I keep getting is complaints about > "SQL > | injection attacks". Apparently snort or other IDS picks this stuff > up > | and emails the abuse box. Some but not all of the complaints are > | automated. > | > | It would be nice if something could detect these attack signatures > on > | the internet-bound packets from our exit node and drop them. With > | trends as they are, we'd see zero abuse complaints, if there were a > | good way to do that. > | > | > | > | > | On Wednesday 30/10/2013 at 6:41 am, Moritz Bartl wrote: > | > On 25.10.2013 19:13, krishna e bera wrote: > | >> > | >>> > | >>> ExitPolicy accept *:1723 # PPTP > | >> How are you getting PPTP to work over Tor? The ISP-supplied > modems > | >> i've > | >> seen won't pass IP protocol 47 (GRE) packets without putting the > | >> target > | >> machine in a DMZ. > | > > | > > https://trac.torproject.org/projects/tor/wiki/doc/ReducedExitPolicy> > contains it. > | > > | > It's more of a "catch all" exit policy, but gets rid of most DMCA > | > complaints. > | > _______________________________________________ > | > tor-relays mailing list > | > tor-relays(a)lists.torproject.org > | > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > | > | _______________________________________________ > | tor-relays mailing list > | tor-relays(a)lists.torproject.org > | https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

Re: [tor-relays] Advice on dealing with ISP's response to DMCAtakedownnotice.
by tor＠t-3.net 30 Oct '13

30 Oct '13

What he said. No DMCA so far but, one thing I keep getting is complaints about "SQL injection attacks". Apparently snort or other IDS picks this stuff up and emails the abuse box. Some but not all of the complaints are automated. It would be nice if something could detect these attack signatures on the internet-bound packets from our exit node and drop them. With trends as they are, we'd see zero abuse complaints, if there were a good way to do that. On Wednesday 30/10/2013 at 6:41 am, Moritz Bartl wrote: > On 25.10.2013 19:13, krishna e bera wrote: >> >>> >>> ExitPolicy accept *:1723 # PPTP >> How are you getting PPTP to work over Tor? The ISP-supplied modems >> i've >> seen won't pass IP protocol 47 (GRE) packets without putting the >> target >> machine in a DMZ. > > https://trac.torproject.org/projects/tor/wiki/doc/ReducedExitPolicy > contains it. > > It's more of a "catch all" exit policy, but gets rid of most DMCA > complaints. > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

2 1

Re: [tor-relays] Advice on dealing with ISP's response to DMCA takedownnotice.
by tor＠t-3.net 30 Oct '13

30 Oct '13

Reply to the email, say that you found a misconfiguration in your Tor daemon which could have accounted for this problem and you've repaired it, and hopefully this problem is resolved for the future. Put the below as your exit policy in torrc, and I'd stop/start the service to be sure it grabbed it. Using the below exit policy, we've had our exit node running for a couple months or so doing pretty good bandwidth, and not had a single warez-related complaint. Seen some complaints about SQL injection attacks but perhaps those will annoy your ISP less. ExitPolicy accept *:20-23 # FTP, SSH, telnet ExitPolicy accept *:43 # WHOIS ExitPolicy accept *:53 # DNS ExitPolicy accept *:79-81 # finger, HTTP ExitPolicy accept *:88 # kerberos ExitPolicy accept *:110 # POP3 ExitPolicy accept *:143 # IMAP ExitPolicy accept *:194 # IRC ExitPolicy accept *:220 # IMAP3 ExitPolicy accept *:389 # LDAP ExitPolicy accept *:443 # HTTPS ExitPolicy accept *:464 # kpasswd ExitPolicy accept *:531 # IRC/AIM ExitPolicy accept *:543-544 # Kerberos ExitPolicy accept *:554 # RTSP ExitPolicy accept *:563 # NNTP over SSL ExitPolicy accept *:636 # LDAP over SSL ExitPolicy accept *:706 # SILC ExitPolicy accept *:749 # kerberos ExitPolicy accept *:873 # rsync ExitPolicy accept *:902-904 # VMware ExitPolicy accept *:981 # Remote HTTPS management for firewall ExitPolicy accept *:989-995 # FTP over SSL, Netnews etc ExitPolicy accept *:1194 # OpenVPN ExitPolicy accept *:1220 # QT Server Admin ExitPolicy accept *:1293 # PKT-KRB-IPSec ExitPolicy accept *:1500 # VLSI License Manager ExitPolicy accept *:1533 # Sametime ExitPolicy accept *:1677 # GroupWise ExitPolicy accept *:1723 # PPTP ExitPolicy accept *:1755 # RTSP ExitPolicy accept *:1863 # MSNP ExitPolicy accept *:2082 # Infowave Mobility Server ExitPolicy accept *:2083 # Secure Radius Service (radsec) ExitPolicy accept *:2086-2087 # GNUnet, ELI ExitPolicy accept *:2095-2096 # NBX ExitPolicy accept *:2102-2104 # Zephyr ExitPolicy accept *:3128 # SQUID ExitPolicy accept *:3389 # MS WBT ExitPolicy accept *:3690 # SVN ExitPolicy accept *:4321 # RWHOIS ExitPolicy accept *:4643 # Virtuozzo ExitPolicy accept *:5050 # MMCC ExitPolicy accept *:5190 # ICQ ExitPolicy accept *:5222-5223 # XMPP, XMPP over SSL ExitPolicy accept *:5228 # Android Market ExitPolicy accept *:5900 # VNC ExitPolicy accept *:6660-6669 # IRC ExitPolicy accept *:6679 # IRC SSL ExitPolicy accept *:6697 # IRC SSL ExitPolicy accept *:8000 # iRDMI ExitPolicy accept *:8008 # HTTP alternate ExitPolicy accept *:8074 # Gadu-Gadu ExitPolicy accept *:8080 # HTTP Proxies ExitPolicy accept *:8087-8088 # Simplify Media SPP Protocol, Radan HTTP ExitPolicy accept *:8332-8333 # BitCoin ExitPolicy accept *:8443 # PCsync HTTPS ExitPolicy accept *:8888 # HTTP Proxies, NewsEDGE ExitPolicy accept *:9418 # git ExitPolicy accept *:9999 # distinct ExitPolicy accept *:10000 # Network Data Management Protocol ExitPolicy accept *:11371 # OpenPGP hkp (http keyserver protocol) ExitPolicy accept *:12350 # Skype ExitPolicy accept *:19294 # Google Voice TCP ExitPolicy accept *:19638 # Ensim control panel ExitPolicy accept *:23456 # Skype ExitPolicy accept *:33033 # Skype ExitPolicy reject *:* On Thursday 24/10/2013 at 9:11 pm, Christopher Jones wrote: > > I’ve been running an exit relay for about 3 days and, sure enough, > some BitTorrent bugger caused sh3lls.net to send me a DMCA nastygram: > >> >> We have got the following complain, please remove all illegal torrents >> immediately from your server: >> >> Evidentiary Information >> Title: Suits (TV) >> Infringement Source: BitTorrent >> Initial Infringement Timestamp: 17 Oct 2013 22:06:17 GMT Recent >> Infringement Timestamp: 17 Oct 2013 22:06:17 GMT Infringing Filename: >> Suits Season 3 Episode 6 (The Other Time) (HDTV x264)-ASAP (1GBps >> SeedBox).mp4 URL if applicable: >> Infringing File size: 364405400 >> Infringers IP Address: 64.32.14.34 >> Bay ID: 7fbb4256bfca558d5a809b9f6536b5fd5e4e782d|364405400 >> Port ID: 33788 > > I followed through with the templates provided by the Tor Project as a > response to the DMCA takedown notification. A day later, the ISP sent > me this: > >> >> Dear Christopher >> Whether you run Tor or not, we even told you in past, it's your >> responsibility to stop all abuse >> If Tor is causing it, stop the program Tor on your server, if we get >> another complain we will have to suspend/terminate your services >> >> tor always always gets lots and lots of abuse and complains >> >> Update us within 24 hours >> >> Thanks > > I was never provided with the full text of the original DMCA > complaint, so I was unable to respond. Furthermore, I was never > “even told…in the past” that I had to stop all abuse caused by > Tor. Tor is not singled out in the ToS or AUP. And I was certainly > never told anything in the past about abuse and Tor specifically. As I > said, first warning. Then there’s the “tor always always gets lots > and lots of abuse and complains [sic]”. Which is kind of bizarre, > because their position on tor seems a bit cagey. Does the claim about > lots of abuse mean they won’t allow exit nodes? Or is that just a > “hint” that I’d be better off not trying to run it? > > And this is an ISP I picked from the good list. > > Suggestions are welcome. I’m running with the default exit node > policy, which should block most of the abuse-laden ports. > BitTorrent’s a little harder to deal with. I’ve no qualms working > with the ISP to mitigate their concerns, but I’m not sensing their > returning the same spirit of cooperation. > > .cpj_______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >

3 2

Filtering TOR Non-exit Relay - Just Curious
by Nelson 29 Oct '13

29 Oct '13

Tor Exit Relay have the ability to filter traffic by allowing the operator make choices based on personal preferences for personal, legal (ex: country of origin) and for other reasons. Non-exit Relays do not have the ability to set "Relay Policies" (torcc??), and why would they, considering that all this traffic is encrypted anyway, as I understand it, and one would not ever know what type of traffic it is, or its origin, based on the bandwidth graph. I checked my smoothwall firewall logs it does not seem to show the traffic flowing on my relay, I guess this would be obvious because it's Tor traffic; unless I'm not filtering the logs correctly. Running a Tor relay seems straightforward and one could just fire-it-up and easily contribute to the network. But my curiosity gets the best of me. I was looking to add additional URL Filter rules for my smoothwall as a more centralized way of controlling what gets to the LAN for my users. While checking for additional blocklists I came upon P2P rules and I started to compare the new blocklists with my old ones and then I stumbled upon PeerBlock which has been around for a while. On Windows 7, PeerBlock seemed to provide two things I was looking to test on a TOR Relay: 1. Real Time Traffic Logging (ip's and ports logged) 2. The ability to filter traffic. Apparently I am able to do both with PeerBlock, although I'm sure there are more suitable and capable tools available out there that do this, but I'm not aware of or have used any of these tools. In peerblock I can create new custom lists and completely block specific ip ranges (ex: warez, torrents etc.), and I am able to see what traffic is allowed or blocked based on policies created. 1. What problems, if any, arise from using peerblock and Tor together? 2. Why do we not have the ability to at least set our own policy for the type of traffic on a relay just like an Exit Relay?

6 9

"stable" flag voting differences
by starlight.2013q4＠binnacle.cx 28 Oct '13

28 Oct '13

I observed an interesting behavior in the authority votes regarding relay stability and am curious if anyone can comment. Have a new relay, about ten days old. Relay is marked Fast Guard Running Stable Valid One 10 minute network outage three days ago and then a 68 minute outage one day ago for repair. Overall about 4680 seconds down over the last week, and if one uses a 646220 second timeframe per this post https://lists.torproject.org/pipermail/tor-relays/2013-July/002255.html It works out to about 99.27% uptime, which seems within the 98% threshold quoted in the posting. What was interesting was that Faravahar gabelmoo maatuska tor26 urras all immediately removed the "stable" flag when the relay came back online after maintenance, while dannenberg moria1 left the stable flag in place. The two remaining authorities dizum turtles have never set the stable flag due to heavy link congestion between AS286/AS3265 for 'dizum' and congestion within AS6461 for 'turtles'. Then exactly 24-hours after the end of the outage the five naysayers turned the stable flag back on. Mainly a point of curiosity, but I'd guess from this that the first five authorities listed above are using a much shorter window for evaluating stability while the second two are using the seven-day window. I couldn't find per-authority logging of this category of information so it's hard to know. Perhaps it's relevant that the node was removed from the consensus directory briefly immediately after the outage ended. Finally it is interesting that 'dizum' and 'turtles' have set the "guard" flag even though they consider the relay unstable. This is a recent development. Earlier the two impaired-path authorities had the guard flag set off.

2 2