- tor-relays - lists.torproject.org

Lets increase Routing Security for Tor related BGP Prefixes
by nusenu 06 Sep '18

06 Sep '18

Hi, I measured the adoption of RPKI ROAs that help with routing security and some other properties for the >3k BGP prefixes that make up the Tor network. https://medium.com/@nusenu/how-vulnerable-is-the-tor-network-to-bgp-hijacki… You might want to jup directly to section "Recommendations for Tor Relay Operators". (I could paste it here but then all the URLs would be lost) Since OVH SAS and DO do not deploy ROAs at all yet: If you are an OVH SAS or Digital Ocean customer (directly or indirectly just on the same AS) it would be great if you could ask your customer support when they are planing to deploy RPKI ROAs (like other big hosters already did). thanks, nusenu -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

3 8

4 of Conrad Rockenhaus trial servers are in the top ten exit relays for Canada
by zimmer linux 06 Sep '18

06 Sep '18

Hi, Just to let you know that following on with the one month trial with tor exit relays that Conrad kindly offered, at least four of his exit relays are now in the top 10 listing for Canada, out of 68 Canadian exit relays. https://metrics.torproject.org/rs.html#search/country:ca%20flag:exit Well done to Conrad - I say. The more, the merrier. If you want any help with setting up your own FreeBSD tor exit relay, feel free to contact me off list. Zim

13 31

Possible problem with NYX
by arisbe 05 Sep '18

05 Sep '18

Hello ops, Today I noticed something on NYX that I find disturbing. Page 2 (list of inbound/outbound connections) showed me the IP address of an inbound connection on one of my bridges! Not the authority. This is crazy as these are indicated as <scrubbed>:port for the users protection! I have never seen this before and haven't seen it since. Of course, on low usage bridges, the connection IP address can possibly be disseminated from netstat but that's not the point. It's my sense that this should never happen. I get chills imagining this happening on a guard relay operated by an antagonist ! ! I'm using the default NYX configuration on Ubuntu server 18.04.1 LTS, Tor 0.3.3.9. Arisbe -- One person's moral compass is another person's face in the dirt.

4 5

new exit relay 4AEBDC4710D2C34FE02AB2A660B62B2A9EE97C5C
by deep.thought＠riseup.net 05 Sep '18

05 Sep '18

Dear fellow relay operators, we are a loose collective of students inside AS553 (Universität Stuttgart) running one node there. At the moment, we are not allowed to run any nodes since two abuse complaints attracted too much attention to the NOC. The complaints were probably triggered by the well-known DDOS problems a few months ago. After all, the cloud operator was not amused at all but we are in the process of getting back our right to run middle relays in AS553 to support AS diversity. However, we are happy to announce a new exit node: 4AEBDC4710D2C34FE02AB2A660B62B2A9EE97C5C (howdoyouturnthison) in AS24940 (Hetzner) running on FreeBSD with a local DNS cache. We are aware of the fact that this is not supporting AS diversity but still better than no relay :) So far and thanks for all the fish, Random Person

4 4

FW: Re: [AusNOG] Dutton decryption bill
by I 05 Sep '18

05 Sep '18

1 0

Re: [tor-relays] Congrats to Nullvoid
by Paul 05 Sep '18

05 Sep '18

For me running several FreeBSD relays this is a great hint! Maybe it will find its way to https://trac.torproject.org/projects/tor/wiki/TorRelayGuide/FreeBSD > Not a problem with FreeBSD. > > Switch over to https and latest... > > /etc/pkg/FreeBSD.conf: > > url: "pkg+https://pkg.FreeBSD.org/${ABI}/latest", > > and run 'pkg upgrade' . > Could you please explain a bit more on this - what exactly to do ? > If it's a shared box, you probably also want > devcpu-data, and optionally cpupdate.

3 5

The Assistance and Access Bill 2018
by Paul Templeton 05 Sep '18

05 Sep '18

On a satire note - https://www.youtube.com/watch?v=eW-OMR-iWOE But seriously - https://www.homeaffairs.gov.au/about/consultations/assistance-and-access-bi… And - https://www.homeaffairs.gov.au/about/national-security/five-country-ministe… The thing that worries me is that this bill will probably go through and it can hoover up relay operators. That is they can force you to add/develop tools to eavesdrop on you. Is there any real defense against this bill? IE having a parameter in the torrc that would act like a canary? Paul 137CF322859E400455E457DB920F65FFDD222CDF

7 8

SSH login attempts
by Marcus Wahle 05 Sep '18

05 Sep '18

Dear all, Since 14:00 my logs (middle node) are spamed with around 100 faild ssh login attemps from different ips. Is there anybody else affected? Best regards Marcus

14 14

Multi node management programs/platforms?
by Isaac Grover, Aileron I.T. 04 Sep '18

04 Sep '18

Good evening, For those of you who manage multiple exits and/or relays, what program/platform do you use to manage them? Make your day great, Isaac Grover, Senior I.T. Consultant Aileron I.T. - "Practical & Proactive I.T. Solutions" Office: 715-377-0440, Fax:715-690-1029, Web: www.aileronit.com

9 11

9 routing security recommendations for relay operators
by nusenu 04 Sep '18

04 Sep '18

(mostly a copy paste from [0]) 1. Monitor your relay’s BGP prefix for suspicious BGP activity and share alerts with this mailing list. The easiest way to do so is to subscribe to your prefixes using https://bgpmon.net/. You should practically get zero alerts. 2. Check the following properties of the prefixes you use (ideally even before ordering servers): prefix length and IRR state [1] RPKI state [2] 3. Ask your ISP/IP holder to create ROAs [4] for the prefixes you use, if the ROA is currently missing. 4. Ensure the ROA creator is aware of the risks of the maxlength attribute [3] and uses it accordingly (in the best case not at all) 5. Monitor the RPKI validity state of your prefixes (can also be done with bgpmon) 6. Ask your ISP to announce the IP space of your relays in /24 prefixes (/48 for IPv6) to avoid more-specific prefix hijacks (this makes sense even if you have ROAs in place due to the low ROV coverage) 7. If your relay uses IP addresses from the RIPE region: ask your provider to create route(6) objects matching the announcements if they are not present yet. You can use RIPEstat’s prefix routing consistency widget [1] to check the current state (the “In RIS” and “RIPE IRR” columns should both say “yes”). 8. Be aware that “LEGACY” or “ERX” IP space might be less likely to get ROAs by your ISP 9. Enable IPv6 on your relays [0] https://medium.com/@nusenu/how-vulnerable-is-the-tor-network-to-bgp-hijacki… [1] https://stat.ripe.net/widget/prefix-routing-consistency [2] https://rpki-validator.ripe.net/bgp-preview [3] https://www.youtube.com/watch?v=I3Owb0u8Wuk [4] https://www.ripe.net/manage-ips-and-asns/resource-management/certification/… https://www.arin.net/resources/rpki/using_rpki.html -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

1 0