- tor-relays - lists.torproject.org

Operator straw poll: Reasons why you use Tor LTS versions?
by Mike Perry 21 Oct '19

21 Oct '19

Hello relay operators, Thanks for running relays, and thanks to those of you who are moving off of our old EOL Tor versions. Thanks especially to those of you who moved directly to Tor 0.4.1! We would like to transition the LTS Tor to be for use in edge/client/non-relay infrastructure only. We would like to minimize even that use. We need to update our network protocols to improve performance, security, and to add defenses against DoS attacks. Doing this while supporting LTS for relays is expensive, especially when large backports must be done to keep the network safe. It also slows down the uniform deployment of performance improvements, which contributes to the frustrating user experience of abysmal-but-rare performance edge cases. Unfortunately, we still have something like 2500 relays on either Tor 0.2.9-LTS or Tor 0.3.5-LTS. What are the reasons for this? My guess is the top 5 most common responses are: 1. "I didn't know that Debian's backports repo has latest-stable Tor!" 2. "I didn't see the Tor Project repos mentioned in Tor's Relay docs!" 3. "I'm running a distribution that Tor Project doesn't have repos for." 4. "I rolled my own custom Tor from git and forgot about it." 5. "My relay machine was not getting any updates at all. Oops." Does anyone have a reason that they think many other relay operators also share? How can we fix that for you, or at least, how can we make it easier to run the very latest stable series Tor on your relay? -- Mike Perry

10 17

Install on Tor on fresh Debian 10 failed (gpg key invalid)
by Olaf Grimm 20 Oct '19

20 Oct '19

Hello! I updated my VPS with a fresh Debian 10 install. According procedure in the documentation 'curl https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E8… | gpg --import' I get the error message '2019-10-17 20:34:32 (1.01 MB/s) - ‘A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc’ saved [19665/19665] gpg: no valid OpenPGP data found. gpg: Total number processed: 0 What is going wrong? Is this an invalid key? After weeks ago my other install on Debian 10 was ok. Best regards! Olaf

4 5

DDNS with Relays and/or Bridges?
by nottryingtobelame＠protonmail.com 20 Oct '19

20 Oct '19

Forgive me if this is a dumb or newbie question, but can DDNS be used with either relays or bridges? I was considering setting up DDNS with FreeDNS mostly for my bridge so that if the IP changes (I have chosen not to subscribe to a static IP with my ISP), my clients can still access the bridge, rather than having to reset and start the bridge from scratch. Obviously I would not make it "torbridge.anonymousnetwork.com" or anything that would suggest its true use. Maybe something like "photoserver.whatever.com" or something like that. If DDNS can be used, my follow-up question is where all would I need to set that information? I'm guessing just in torrc? I do not remember the flag for identifying your IP, as I've always left it blank for Tor to guess, but could the DDNS hostname be entered here in lieu of the IP? Thanks for your time.

3 2

Using unattended upgrades with tor expert bundle
by Keifer Bly 19 Oct '19

19 Oct '19

Hi all, So I have been running an OBFS4 bridge via the Tor Expert Bundle for a year now, and it is going quite well. However, from what I have researched, using unattended upgrades to keep tor up to date is configured in the torrc file. I am wondering, can this be configured in tor expert bundle? Thanks very much. --Keifer

2 1

ns consensus directory issue
by Badger 16 Oct '19

16 Oct '19

Hi, Would appreciate if anyone could let me know how to resolve the warning below: 07:19:01 [WARN] Unable to load ns consensus directory downloaded from server '154.35.175.225:80'. I'll try again soon. [5 duplicates │ hidden] │ 07:19:01 [WARN] Unable to parse networkstatus consensus [11 duplicates hidden] │ 07:19:01 [WARN] Unable to compute digest of network-status [11 duplicates hidden] │ 07:19:01 [WARN] couldn't find start of hashed material "network-status-version" [11 duplicates hidden] │ 07:18:01 [WARN] Unable to load ns consensus directory downloaded from server '131.188.40.189:80'. I'll try again soon. Thanks a lot --

2 1

list of actually rejected fingerprints? (from 2019-10-08)
by nusenu 15 Oct '19

15 Oct '19

Dear Tor Directory Authorities, since there is a minor confusion about how the rejection list actually looked like, would you mind publishing the actual list of fingerprints you rejected this time (2019-10-08) like you did the last time during the removal of heartbleed relays? [1] thanks, nusenu [1] https://lists.torproject.org/pipermail/tor-relays/2014-April/004336.html https://lists.torproject.org/pipermail/tor-relays/2014-April/004342.html -- https://twitter.com/nusenu https://mastodon.social/@nusenu

2 1

Re: [tor-relays] Problem with authorities?
by teor 14 Oct '19

14 Oct '19

Hi, > On 14 Oct 2019, at 22:23, tschador(a)posteo.de wrote: > > On 2019-10-14 11:48, teor wrote: > >>> what's about the autorities maatu., tor26, bastet, gabel., and farav.? >> >> They either: >> - check IPv6 reachability, or >> - have a high stable MTBF (mean time before failure): >> https://consensus-health.torproject.org/#flagthresholds > > Thank you for the reply. What does the 'stable MTBF' mean? Time in > seconds (18 .. 48 days) before my relay get the stable flag back? It's a measure of the stability of your relay. A MTBF is an average time before your relay is next expected to fail, based on its past failures. For more details, see: https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt#n1800 > Downtime was from 2019-09-24 10:00 - 2019-09-26 06:00. > >> Keep your relay up, and its IPv6 address reachable, and you should be fine. > > The ReachableIPv6 flag is set and usage is ~5500 connections. If your IPv6 address becomes unreachable, that counts as a failure. I don't have exact data, but it does seem that the IPv6 authorities think your relay has a lower stability. T

1 0

Newbie qustion installing relay on Linux Mint
by Dag N 14 Oct '19

14 Oct '19

I followed the instruction on following sites: [projects/tor/wiki/TorRelayGuide/DebianUbuntuUpdates]and[https://trac.torpro…] trac.torproject.org/projects/tor/wiki/TorRelayGuide/DebianUbuntu but I think it don't work. I tried to do relay search:No Results found!No Tor relays matched your query :( Uptime now is 10 hour. Best RegardsDAG

2 1

Questions about Fallbacks
by [REDACTED] 14 Oct '19

14 Oct '19

Hi, when i setted up my relays i choosed 443 as the ORPort. My thought behind it was that 443 is most likely not blocked and less likely observed because the ISP could expect to anyway only see encrypted data so a Tor connection will more likely slip through it. I let the DirPort on 9030 because i read that clients anyway only use the ORPort and i thought if a authority will connect to me it makes no difference because none of my ports is blocked. Now some of my relays are Fallbacks. Would it be a benefit for the network if i change the DirPort to 80 or is the DirPort still not used by clients? Is it necessary to opt-out the relay as a fallback if it was shut down by the provider and already is long gone from metrics?

2 1

Firewall rules as a "replacement" for MyFamily on a bridge?
by Marco Gruß 14 Oct '19

14 Oct '19

Hi, I have been running 2 middle relays for a while and now fired up an obfs4 bridge (in a relay-free AS no less ;) as well. I've been thinking, as MyFamily is a no-no for bridges, how about firewalling the bridge from my nodes? If I add rules on my bridge that prevent it from connecting to my other relays and prevent my other relays from connecting to it (using iptables' -j REJECT, which results in a "connection refused", as if the tcp port was closed), it would be technically impossible for my bridge to inadvertently build a circuit through one of my other relays. (Well, it could of course still choose them as the second hop.) Does this make any sense at all? Will this break stuff? Thanks! Best, Marco

2 2