- tor-relays - lists.torproject.org

tor relay - vps maintenance - what to do ?
by dlugasny＠protonmail.com 21 Jul '20

21 Jul '20

Hi, in the next three days, my VPS provider planning to shutdown ("maintenanance") for 6 hours my VPS where tor relay is running (with some services). What should I do ? I suspect that my VPS will be copied and reviewed (by not authorized persons) afterwards. How do You react in such a situations ? I appreciate any advice. Cheers Dlugasny Sent with [ProtonMail](https://protonmail.com) Secure Email.

6 5

Directory Authority servers still using excessive bandwidth
by Neel Chauhan 20 Jul '20

20 Jul '20

Hi tor-relays@, I have noticed that despite fixing bugs in the past, the directory authority relays are still using excessively high amounts of bandwidth, when looking at Relay Search: Examples: * https://metrics.torproject.org/rs.html#details/7EA6EAD6FD83083C538F44038BBF… * https://metrics.torproject.org/rs.html#details/9695DFC35FFEB861329B9F1AB04C… * https://metrics.torproject.org/rs.html#details/BD6A829255CB08E66FBE7D374836… And many more. I'm asking since I'm having an issue with low consensus weights on a symmetrical "Gigabit" pipe, and I am suspecting the overloaded authority servers are a factor. Are they? It could also be my current ISP's (Wave Broadband) crap peering, but would I really want to use Comcast? -Neel === https://www.neelc.org/

1 0

Re: [tor-relays] Error from LZMA encoder
by nottryingtobelame＠protonmail.com 20 Jul '20

20 Jul '20

This bridge is on Digital Ocean, so I checked my logs and it doesn't appear that my memory usage ever maxed. It hovers right around 80 with the highest spike at about 87%. Is that insufficient? Thank you for the reply.

1 0

Error from LZMA encoder: Unable to allocate memory; NULL stream while compressing
by nottryingtobelame＠protonmail.com 20 Jul '20

20 Jul '20

My bridge was running fine, then started throwing the same error over and over. See my last two days of logs here: https://pastebin.com/7FNXC6PZ. Function doesn't seem to be affected as the heartbeats still show users. Can or should I do anything about this?

2 1

trouble with tor relay software on debian
by Keifer Bly 20 Jul '20

20 Jul '20

Hi all, So my middel guard relay at https://metrics.torproject.org/rs.html#details/79E3B585803DE805CCBC00C1EF36… As well as my bridge at https://metrics.torproject.org/rs.html#details/EF36AE38C162E96E0645E1DF25EF… Are not updating, though I had configured them to be updated by unattended upgrades they are stuck on tor 4.3.5. When running sudo apt update && sudo apt install -y --only-upgrade tor This is the return, it's a google drive link to the screenshot as copy pasting the text ended up in a jumbled mess. https://drive.google.com/file/d/1ULtvt8B28tTwN5DI7oLmfj7mbfBIDh6A/view?usp=… It says ip address not found, I wonder why this is as I had imported tors keyring before hand. What's also going on is, I am trying to see how much traffic my relay has pushed but am not able to open the log file, when using less /var/log/tor/notices.log I am only seeing a black screen with (END) and that's it. I wonder why this is. Thanks very much, --Keifer <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> Virus-free. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> <#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

3 2

Snowflake-proxy restricted NAT
by dmz21 19 Jul '20

19 Jul '20

Hi, I've been running a Snowflake (the stand-alone Go-proxy kind build from source) as a Debian service. I was working fine before, showing a handful of anonymous connections per day. Recently it shows a new log message: "NAT type: restricted" after "starting" and I have not seen any new connections. I'm guessing that a restricted NAT does not allow any client to connect to my VM. Please tell me if I'm wrong. I don't think that I have made any relevant changes to my network or hypervisor setup, recently. I don't know how to configure my OpenWrt router such that I have a suitable NAT to a specific IP in my DMZ. Can anyone tell me what I could try in order to restore my Snowflake-proxy to being useful to others again? kind regards and thanks

2 2

Noticeable Increase in Abuse Traffic
by John Ricketts 19 Jul '20

19 Jul '20

All, I'm getting about 4x the abuse traffic that I normally get from running exits. Anyone else noticing this trend? John Ricketts Quintex Alliance Consulting

4 6

Re: [tor-relays] Noticeable Increase in Abuse Traffic
by info＠backplanedns.org 19 Jul '20

19 Jul '20

I noticed this too. I've gotten about 4-5 abuse complaints to my upstream provider alone in the last few days. A few more directly to my email. According to the abuse report logs they all appear to be a similar xss exploit attempt. DennisSent from my T-Mobile 4G LTE device------ Original message------From: John RickettsDate: Sat, Jul 18, 2020 8:42 PMTo: tor-relays(a)lists.torproject.org;Cc: Subject:[tor-relays] Noticeable Increase in Abuse TrafficAll, I'm getting about 4x the abuse traffic that I normally get from running exits. Anyone else noticing this trend? John Ricketts Quintex Alliance Consulting _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

Please help us find a working alternative to using MaxMind's GeoLite2 databases
by Karsten Loesing 14 Jul '20

14 Jul '20

Hi relay operators, as you might have heard, MaxMind has changed access and use of their GeoLite2 databases: https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-us… This affects Onionoo and tor, and I'm trying to find a working alternative on the following ticket: https://trac.torproject.org/projects/tor/ticket/32978 Today I think I found a possible alternative by using data from another provider. But before I name it here, I'd first want to find out how accurate it is. I tried resolving relay IP addresses of relays that have been running in the past week and compared that to our existing lookups using MaxMind's October database. The result is that 7669 relays (93%) had the same country code and ASN. I put the remaining 7% on the following wiki page: https://trac.torproject.org/projects/tor/wiki/doc/MetricsGeoipComparison I'd like to hear from you which data source is right and which is wrong (or if both are wrong). If you'd like to help, please leave comments on the ticket or in the "Comment" column on that wiki page by February 19, 2020. Thanks for helping! All the best, Karsten

12 14

>23% Tor exit relay capacity found to be malicious - call for support for proposal to limit large scale attacks
by nusenu 13 Jul '20

13 Jul '20

Hi, I'm currently writing a follow-up blog post to [1] about a large scale malicious tor exit relay operator that did run more than 23% of the Tor network's exit capacity (May 2020) before (some) of it got reported to the bad-relays team and subsequently removed from the network by the Tor directory authorities. After the initial removal the malicious actor quickly restored its activities and was back at >20% of the Tor network's exit capacity within weeks (June 2020). [1] https://medium.com/@nusenu/the-growing-problem-of-malicious-relays-on-the-t… To prevent this from happening over and over again I'm proposing two simple but to some extend effective relay requirements to make malicious relay operations more expensive, time consuming, less sustainable and more risky for such actors: a) require a verified email address for the exit or guard relay flag. (automated verification, many relays) b) require a verified physical address for large operators (>=0.5% exit or guard probability) (manual verification, low number of operators). It is not required that the address is public or stored after it got verified. For details see bellow [2]. 0.5% exit probability is currently about 500-600 Mbit/s of advertised bandwidth. Q: How many operators would be affected by the physical address verification requirement if we use 0.5% as a threshold? A: About 30 operators. There are currently about 18 exit [3] and 12 guard operators that run >0.5% exit/guard capacity if we ignore the fresh exit groups from 2020. Most exit operators (14 out of these 18) are organizations with public addresses or have their address published in WHOIS anyway. At the end of the upcoming blog post I'd like to give people some idea as to how much support this proposal has. Please let me know if you find this idea to limit attackers useful, especially if you are a long term relay operator, one of the 30 operators running >=0.5% exit/guard capacity, a Tor directory authority operator or part of The Torproject. thanks for your support to fight malicious tor relays! nusenu -- https://mastodon.social/@nusenu [2] Physical address verification procedure could look like this: The Torproject publishes a central registry of trusted entities that agreed to verify addresses of large scale operators. The registry is broken down by area so no central entity needs to see all addresses or is in the position to block all submissions. (even though the number of physical address verifications are expected be stay bellow 50 for the time being). Examples could be: Riseup.net: US, ... Chaos Computer Club (CCC) : DE, ... DFRI: SE, ... (these organizations host Tor directory authorities) - Relay operators that would like to run more than 0.5% guard/exit fraction select their respective area and contact the entity to initiate verification. - before sending an address verification request the operator verifies that they meet the following requirements: - the oldest relay is not younger than two months (https://community.torproject.org/relay/community-resources/swag/ ) - all relays have a proper MyFamily configuration - relays include the verified email address and PGP key fingerprint in the relay's ContactInfo - at least one of their relays gained the exit or guard flag - they have a sustained bandwidth usage of at least 100 Mbit/s (accumulated) - intention to run the capacity for at least 4 months - upon receiving a request the above requirements are verified by the verification entity in addition to: - relay(s) are currently running - the address is in the entity's area - a random string is generated by the address verification entity and send with the welcome tshirt (if requested) to the operator - after sending the token the address is deleted - upon receiving the random string the operator sends it back via email to the verification entity while signing the email with the PGP key mentioned in the relays ContactInfo - the verification entity compares the received string with the generated and mailed string - if the string matches the entity sends the relay fingerprint to the directory authority list to unlock the cap for the operator After this one-time procedure the operator can add more relays as long as they are in the same family as the approved relay (no new verification needed). [3] exit operators running >=0.5% of exit probability without exit groups from 2020 (onionoo data as of 2020-07-03) abuse-contact(a)to-surf-and-protect.net 22.73 Foundation for Applied Privacy 6.05 John L. Ricketts, PhD <john AT quintex dot com> 5.6 F3 Netze <abuse(a)f3netze.de> 5.47 https://www.torservers.net 3.89 Nicholas Merrill <nick AT calyx dot com> 2.48 https://www.digitale-gesellschaft.ch/abuse/ 1.74 Accessnow.org <abuse .AT. accessnow .DOT. org> 1.71 Hart voor Internetvrijheid 1.63 <zwiebeln at online de> 1.44 TNinja <abuse-team at tor dot ninja> 1.43 tech(a)emeraldonion.org 1.31 Frenn vun der Enn FVDE 1 https://www.artikel5ev.de/torcontact/ 0.74 Nos oignons 0.71 tor-abuse<at>mailbox<dot>org 0.67 abuse-node49 AT posteo DOT de 0.57 tor-operator(a)privateinternetaccess.com 0.52 14 out of these 18 operators have their address already publicly listed because they are registered organizations or similar.

15 27