- tor-relays - lists.torproject.org

Running an exit node from home
by Isaac Grover, Aileron I.T. 30 Oct '18

30 Oct '18

Good morning, As a followup to my last (and other) posts on this list, I have been cautioned multiple times of running an exit node from my home. After careful consideration and previous direct feedback from this list, I configured an exit node with the following exit policy, which allows traffic on ports that are "safe" in my opinion, meaning that they're not likely to generate complaints or search warrants. accept *:5228 accept *:8333 accept *:9418 accept *:11371 reject *:* Regarding these aforementioned cautions, they all seem to be based on dated posts and/or irresponsible exit policies. I would not open any of the web, email, irc, remote desktop, ssh, etc. ports on an exit node based at home as those would generate complaints and/or search warrants very quickly, so I am open to discussion about modifying the groupthink behind this blanket "don't run an exit node at home" advice. Make your day great, Isaac Grover, Senior I.T. Consultant Aileron I.T. - "Practical & Proactive I.T. Solutions" O: 715-377-0440<tel:715-425-0440>, F:715-690-1029<tel:715-690-1029>, W: www.aileronit.com<http://www.aileronit.com/> LinkedIn: https://www.linkedin.com/in/IsaacGrover/ YouTube: https://www.youtube.com/channel/UCqrwZNFKdR-guKtuQzFPObQ

4 3

Re: [tor-relays] freebsd relay doesnt receive any traffic (after 1 month)
by dlugasny＠protonmail.com 30 Oct '18

30 Oct '18

Hi Matt, thanks for Your hints. To build my BSD relay, I used some of the available in the internet BSD tutorials. It seems that I have copied some parameters without understanding what for they are. I would like to run non-exit tor relay. Which parameters should I commented out ? Documentation, in did I have to read it, but it would be much easier (much faster) to have some example which user can copy with some small modifications. Cheers Dlugasny Sent with ProtonMail Secure Email. ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Thursday, October 25, 2018 5:11 PM, Matt Traudt <pastly(a)torproject.org> wrote: > On 10/25/18 13:05, dlugasny(a)protonmail.com wrote: > > > Hi, > > few weeks ago ( more than 4) I have installed Freebsd with Tor relay > > service. > > System is connected to Tor network since more than one month but I see > > only 1-2 connections per day. > > I had Tor relay service on my Debian server for many years and I havent > > got any problems. With Freebsd its pain, nothing is working as expected. > > Any how I would like to build more BSD instances in few different > > countries, but first I need to know why its not working. > > Does any one could help me to do some troubleshooting ? > > Maybe some of the parameters in the torrc are blocking traffic ? > > My torrc without Hashedpassword, Nickname: > > ########################### > > SocksPort 0 > > Log notice file /var/log/tor/notices.log > > ControlPort 9051 > > ORPort 9001 > > RelayBandwidthRate 400 KBytes # Throttle traffic to 100KB/s (800Kbps) > > RelayBandwidthBurst 600 KBytes # But allow bursts up to 200KB (1600Kb) > > ContactInfo Dlugas-ny <dlugasny AT protonmail dot com> > > DirPort 9030 # what port to advertise for directory connections > > ExitPolicy reject : # no exits allowed > > PublishServerDescriptor 0 > > CellStatistics 1 > > ExtraInfoStatistics 1 > > ConnDirectionStatistics 1 > > EntryStatistics 1 > > LogMessageDomains 1 > > AvoidDiskWrites 1 > > WarnPlaintextPorts > > HeartbeatPeriod 1hours > > ServerTransportPlugin obfs2,obfs3 exec /usr/local/bin/obfsproxy managed > > ServerTransportPlugin obfs4 exec /usr/local/bin/obfsproxy managed > > ExtORPort auto > > ############################ > > Thanks in advance for any support > > This is a very confused torrc. What are you trying to accomplish with it? > > There's lines indicating you want to run a bridge > (ServerTransportPlugin, ExtORPort) > > There's a line indicating you don't want your bridge to be one > distrubted via BridgeDB (PublishServerDescriptor 0), yet you wonder why > no one is using your bride/relay. > > Please read > > https://trac.torproject.org/projects/tor/wiki/TorRelayGuide > > And don't set any options that it doesn't tell you to set. And don't set > options you don't understand. `man tor` can help you understand what > you're setting > > Matt

4 5

searching the tor-relays archives
by torix＠protonmail.com 30 Oct '18

30 Oct '18

Before I download months of gzipped archives and zgrep them myself, is there a way to search the messages themselves? I'm looking at: https://lists.torproject.org/pipermail/tor-relays/ but maybe there as another setup somewhere else. TIA, --Torix Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 2

Re: [tor-relays] Monitoring exit node traffic by port?
by Isaac Grover, Aileron I.T. 30 Oct '18

30 Oct '18

Good morning all, My motivation for the traffic graphing per port was simply to get an idea if the ports were even being used, and I would only view them internally - would this still be a violation of user trust? Make your day great, Isaac Grover, Senior I.T. Consultant Aileron I.T. - "Practical & Proactive I.T. Solutions" O: 715-377-0440, F:715-690-1029, W: www.aileronit.com LinkedIn: https://www.linkedin.com/in/IsaacGrover/ YouTube: https://www.youtube.com/channel/UCqrwZNFKdR-guKtuQzFPObQ

1 0

new log message: [warn] Unparseable microdescriptor
by Toralf Förster 30 Oct '18

30 Oct '18

Get this at my exit relay since yesterday: # head /tmp/warn.log Oct 23 23:30:17.000 [notice] Tor 0.3.5.3-alpha opening new log file. Oct 23 23:30:33.000 [warn] parse error: internal NUL character. Oct 23 23:30:33.000 [warn] Unparseable microdescriptor Oct 23 23:30:33.000 [warn] parse error: internal NUL character. Oct 23 23:30:33.000 [warn] Unparseable microdescriptor even with log level "debug" there seems to be no more information. Anything I should worry about? -- Toralf PGP C4EACDDE 0076E94E

3 3

Re: [tor-relays] New to Tor Relay, using Rasberry Pi3. Grateful for Help
by Judd Briggs 26 Oct '18

26 Oct '18

HI Matt and Felix. Thank you so much for the guidance. Matt you are right, I never really asked a question, but I think you have helped steer me in the right direction. Alex: Yes...typo on ORport....will fix that. Log file: Yes, it is in the right location, but crazily just stops....clean stop! Also, I went back and seriously studied the relay page. The RaspPi part is a bit confusing especially now, if Pi3 are not a problem, why does it state there is a problem?. But I understand wtih Pi3, more Debian items (TOR) are stable I will add to my source list Debian location which should allow me to update to the latest stable TOR on Debian. Can I have more than one source in the sourcelist? I had another question about the gg2g key thingy...I can't find the exact place in the Tor website. Wasn't sure where to do apt-get "?what?" Give me a couple of days to get back to you on my progress. Regarding the other question asked...yes, I restated like you posted. In next update, I will provide terminal window information. Thanks and best regards, Judd ************************************************************ Date: Fri, 26 Oct 2018 21:31:57 +0200 From: Felix <zwiebel(a)quantentunnel.de> To: tor-relays(a)lists.torproject.org Subject: Re: [tor-relays] New to Tor Relay, using Rasberry Pi3. Grateful for Help Message-ID: <5BD36BAD.4010005(a)quantentunnel.de> Content-Type: text/plain; charset=utf-8 Hi Judge The torrc shows 'ORPORT' instead of 'ORPort'. I remember some issues with case sensitive torrc entries. Can you try 'ORPort' ? SocksPort 0 Log notice file /var/log/tor/notices.log RunAsDaemon 1 ORPORT 9001 DirPort 9030 ExitPolicy reject *.* RelayBandwidthRate 200 KB RelayBandwidthBurst 400KB -> ORPort 9001 PS: *Lebowski1* how cool! -- Cheers, Felix ------------------------------ Date: Fri, 26 Oct 2018 08:59:09 -0400 From: Matt Traudt <pastly(a)torproject.org> To: tor-relays(a)lists.torproject.org Subject: Re: [tor-relays] New to Tor Relay, using Rasberry Pi3. Grateful for Help Message-ID: <0736abd6-3b7a-c5ff-a300-da79da2c0ddd(a)torproject.org> Content-Type: text/plain; charset=utf-8 On 10/26/18 08:38, Judd Briggs wrote: > Good evening, thanks for taking the time to help me. > > I am fairly new to Pi, Linux/Raspbian, and TOR. But I believe in what > TOR stands for so I wanted to do something with the Pi I had sitting around. > > [... snip ...] > > Appreciate any help. And by the way, i did go back and look through the > archives over the last several months and didn't find a solution. > > Best regards, > > Judge > Thanks for running a relay! You never actually asked a question so I can only guess what you're problem is and what you're looking for help on. In short, see Tor's official relay guide: https://trac.torproject.org/projects/tor/wiki/TorRelayGuide # Version 0.2.9.15 is part of the LTS release series and is an okay version to be running. If you're looking for a newer version of Tor, you'll need to add the Tor Project Debian repos. https://www.torproject.org/docs/debian.html.en#ubuntu Note that I'm only pretty sure the tor you'll get from there will work on rpi 3. Read the warnings on the page. # Am I running a relay correctly? Your torrc looks correct for running a non-exit relay. The logs you shared don't have the lines that I'd expect for any type of relay. Is your torrc located at /etc/tor/torrc? Did you start Tor via systemd like 'sudo systemctl restart tor' or from the command line manually? Hope that helps. Matt *******************************************************************************

1 0

Restore tor exit node
by node47＠torsrv.de 26 Oct '18

26 Oct '18

Dear all, I have the following problem: My VPS-Hoster has deleted my server. Now I reinstalled tor on fresh Debian 9 minimal in version 0.3.4.8 (as before). I also restored my keys from /var/lib/tor/keys and set the datadir in torrc to /var/lib/tor When I started the tor-service a new ed25519_signing_cert and ed25519_signing_secret_key were generated as well as a new fingerprint. The secret_* files still have the old timestamp but new fingerprint had been created. Now the server is listed 3 times in the relaysearch and my node is known as “new” node instead of getting the old fingerprint and the old flags/status. Who can assist me in how to do the restore of the fingerprint and how to correct the relaysearch?! Best regards from Germany Max

4 3

Restore tor exit node
by node47＠torsrv.de 26 Oct '18

26 Oct '18

Dear all, I have the following problem: My VPS-Hoster has deleted my server. Now I reinstalled tor on fresh Debian 9 minimal (as before) in version 0.3.4.8 I restored my keys from /var/lib/tor/keys and set the datadir in torrc to /var/lib/tor When I started the tor-service a new ed25519_signing_cert and ed25519_signing_secret_key were generated as well as a new fingerprint. The secret_* files still have the old timestamp but new fingerprint had been created. Now the server is listed 3 times in the relaysearch and my node is known as “new” node instead of getting the old fingerprint and the old flags/status. Who can assist me in how to do the restore of the fingerprint and how to correct the relaysearch?! Best regards from Germany Max

1 0

Something Keeps Causing Tor Relay Software To Automatically Close On Windows 10?
by Keifer Bly 26 Oct '18

26 Oct '18

Hello, So for my bridge running on Windows 10, for some reason the tor expert bundle automatically closes after 1-2 days, as in the process just stops and the command line window it is in just closes. As you can imagine, this is frustrating for keeping the bridge stable and all. It is strange that this is happening as I am not closing the software it just shuts off automatically for some reason. Some of my thoughts on what could be causing this: 1. In my experience, the Windows CMD (which the tor expert bundle runs through) has the habit to automatically close the second a program sends a signal that isn’t immediately recognized by Windows, even if the command is from the program itself. I wonder if this could be the issue… 2. I will try running tor.exe as administrator and see if it happens again, maybe it’s an issue with the software not having enough permissions from the OS? Another thing I am trying this time is that according to https://ccm.net/faq/2353-prevent-the-command-prompt-closing-automatically, running the command cmd -K in the beginning should prevent the CMD from auto closing. Any other thoughts on why this might be happening is appreciated. The tor version is tor 0.3.4.8 on Windows 10. Thanks. --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

1 0

New to Tor Relay, using Rasberry Pi3. Grateful for Help
by Judd Briggs 26 Oct '18

26 Oct '18

Good evening, thanks for taking the time to help me. I am fairly new to Pi, Linux/Raspbian, and TOR. But I believe in what TOR stands for so I wanted to do something with the Pi I had sitting around. i have a clean install of Rasbian on my Pi3.I followed an Instructables guide to get most all of my settings for installing TorAll my Apt-gets update and upgrades are current.I am running Tor ver 0.2.9.15 (I need to figure out how to painlessless update that) Apparantely that is the latest version in the sources file. Below is my sources file content: deb http://raspbian.raspberrypi.org/raspbian/ stretch main contrib non-free rpi# Uncomment line below then 'apt-get update' to enable 'apt-get source'deb-src http://raspbian.raspberrypi.org/raspbian/ stretch main contrib non-free rpi#deb http://deb.torproject.org/torproject.org Rasbian main Here is my log file contents: Oct 25 21:23:04.000 [notice] Tor 0.2.9.15 (git-2dc1a1a2abab5403) opening new log file.Oct 25 21:23:04.579 [notice] Tor 0.2.9.15 (git-2dc1a1a2abab5403) running on Linux with Libevent 2.0.21-stable, OpenSSL 1.1.0f and Zlib 1.2.8.Oct 25 21:23:04.579 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warningOct 25 21:23:04.579 [notice] Read configuration file "/usr/share/tor/tor-service-defaults-torrc".Oct 25 21:23:04.579 [notice] Read configuration file "/etc/tor/torrc".Oct 25 21:23:04.593 [notice] Opening Socks listener on 127.0.0.1:9050Oct 25 21:23:04.000 [notice] Parsing GEOIP IPv4 file /usr/share/tor/geoip.Oct 25 21:23:05.000 [notice] Parsing GEOIP IPv6 file /usr/share/tor/geoip6.Oct 25 21:23:06.000 [notice] Bootstrapped 0%: StartingOct 25 21:23:06.000 [notice] Signaled readiness to systemdOct 25 21:23:07.000 [notice] Opening Socks listener on /var/run/tor/socksOct 25 21:23:07.000 [notice] Opening Control listener on /var/run/tor/controlOct 25 21:23:07.000 [notice] Bootstrapped 5%: Connecting to directory serverOct 25 21:23:07.000 [notice] Bootstrapped 10%: Finishing handshake with directory serverOct 25 21:23:09.000 [notice] Bootstrapped 15%: Establishing an encrypted directory connectionOct 25 21:23:09.000 [notice] Bootstrapped 20%: Asking for networkstatus consensusOct 25 21:23:09.000 [notice] Bootstrapped 25%: Loading networkstatus consensusOct 25 21:23:20.000 [notice] I learned some more directory information, but not enough to build a circuit: We have no usable consensus.Oct 25 21:23:20.000 [notice] Bootstrapped 40%: Loading authority key certsOct 25 21:23:21.000 [notice] Bootstrapped 45%: Asking for relay descriptorsOct 25 21:23:21.000 [notice] I learned some more directory information, but not enough to build a circuit: We need more microdescriptors: we have 0/6404, and can only build 0% of likely paths. (We have 0% of guards bw, 0% of midpoint bw, and 0% of exit bw = 0% of path bw.)Oct 25 21:23:23.000 [notice] Bootstrapped 50%: Loading relay descriptorsOct 25 21:23:23.000 [notice] I learned some more directory information, but not enough to build a circuit: We need more microdescriptors: we have 0/6404, and can only build 0% of likely paths. (We have 0% of guards bw, 0% of midpoint bw, and 0% of exit bw = 0% of path bw.)Oct 25 21:23:25.000 [notice] Bootstrapped 56%: Loading relay descriptorsOct 25 21:23:25.000 [notice] Bootstrapped 65%: Loading relay descriptorsOct 25 21:23:25.000 [notice] Bootstrapped 71%: Loading relay descriptorsOct 25 21:23:25.000 [notice] Bootstrapped 78%: Loading relay descriptorsOct 25 21:23:26.000 [notice] Bootstrapped 80%: Connecting to the Tor networkOct 25 21:23:26.000 [notice] Bootstrapped 90%: Establishing a Tor circuitOct 25 21:23:27.000 [notice] Tor has successfully opened a circuit. Looks like client functionality is working.Oct 25 21:23:27.000 [notice] Bootstrapped 100%: DoneOct 25 21:58:10.000 [notice] Interrupt: exiting cleanly.(END) My torrc file is as follows...sorry there are lots of things commented out...I started with a template and just added a few lines as recommended by the Instructables. ## Configuration file for a typical Tor user## Last updated 22 September 2015 for Tor 0.2.7.3-alpha.## (may or may not work for much older or much newer versions of Tor.)#### Lines that begin with "## " try to explain what's going on. Lines## that begin with just "#" are disabled commands: you can enable them## by removing the "#" symbol.#### See 'man tor', or https://www.torproject.org/docs/tor-manual.html,## for more options you can use in this file.#### Tor will look for this file in various places based on your platform:## https://www.torproject.org/docs/faq#torrc SocksPort 0Log notice file /var/log/tor/notices.logRunAsDaemon 1ORPORT 9001DirPort 9030ExitPolicy reject *.*Nickname Lebowski1RelayBandwidthRate 200 KBRelayBandwidthBurst 400KB ## Tor opens a SOCKS proxy on port 9050 by default -- even if you don't## configure one below. Set "SOCKSPort 0" if you plan to run Tor only## as a relay, and not make any local application connections yourself.#SOCKSPort 9050 # Default: Bind to localhost:9050 for local connections.#SOCKSPort 192.168.0.1:9100 # Bind to this address:port too. ## Entry policies to allow/deny SOCKS requests based on IP address.## First entry that matches wins. If no SOCKSPolicy is set, we accept## all (and only) requests that reach a SOCKSPort. Untrusted users who## can access your SOCKSPort may be able to learn about the connections## you make.#SOCKSPolicy accept 192.168.0.0/16#SOCKSPolicy accept6 FC00::/7#SOCKSPolicy reject * ## Logs go to stdout at level "notice" unless redirected by something## else, like one of the below lines. You can have as many Log lines as## you want.#### We advise using "notice" in most cases, since anything more verbose## may provide sensitive information to an attacker who obtains the logs.#### Send all messages of level 'notice' or higher to /var/log/tor/notices.log#Log notice file /var/log/tor/notices.log## Send every possible message to /var/log/tor/debug.log#Log debug file /var/log/tor/debug.log## Use the system log instead of Tor's logfiles#Log notice syslog## To send all messages to stderr:#Log debug stderr ## Uncomment this to start the process in the background... or use## --runasdaemon 1 on the command line. This is ignored on Windows;## see the FAQ entry if you want Tor to run as an NT service.#RunAsDaemon 1 ## The directory for keeping all the keys/etc. By default, we store## things in $HOME/.tor on Unix, and in Application Data\tor on Windows.#DataDirectory /var/lib/tor ## The port on which Tor will listen for local connections from Tor## controller applications, as documented in control-spec.txt.#ControlPort 9051## If you enable the controlport, be sure to enable one of these## authentication methods, to prevent attackers from accessing it.#HashedControlPassword 16:872860B76453A77D60CA2BB8C1A7042072093276A3D701AD684053EC4C#CookieAuthentication 1 ############### This section is just for location-hidden services ### ## Once you have configured a hidden service, you can look at the## contents of the file ".../hidden_service/hostname" for the address#### HiddenServicePort x y:z says to redirect requests on port x to the## address y:z. #HiddenServiceDir /var/lib/tor/hidden_service/#HiddenServicePort 80 127.0.0.1:80 #HiddenServiceDir /var/lib/tor/other_hidden_service/#HiddenServicePort 80 127.0.0.1:80#HiddenServicePort 22 127.0.0.1:22 ################ This section is just for relays ######################## See https://www.torproject.org/docs/tor-doc-relay for details. ## Required: what port to advertise for incoming Tor connections.#ORPort 9001## If you want to listen on a port other than the one advertised in## ORPort (e.g. to advertise 443 but bind to 9090), you can do it as## follows. You'll need to do ipchains or other port forwarding## yourself to make this work.#ORPort 443 NoListen#ORPort 127.0.0.1:9090 NoAdvertise## The IP address or full DNS name for incoming connections to your## relay. Leave commented out and Tor will guess.#Address noname.example.com ## If you have multiple network interfaces, you can specify one for## outgoing traffic to use.# OutboundBindAddress 10.0.0.5 ## A handle for your relay, so people don't have to refer to it by key.## Nicknames must be between 1 and 19 characters inclusive, and must## contain only the characters [a-zA-Z0-9].#Nickname ididnteditheconfig ## Define these to limit how much relayed traffic you will allow. Your## own traffic is still unthrottled. Note that RelayBandwidthRate must## be at least 75 kilobytes per second.## Note that units for these config options are bytes (per second), not## bits (per second), and that prefixes are binary prefixes, i.e. 2^10,## 2^20, etc.#RelayBandwidthRate 100 KBytes # Throttle traffic to 100KB/s (800Kbps)#RelayBandwidthBurst 200 KBytes # But allow bursts up to 200KB (1600Kb) Plus a bunch of other stuff that is commented out. Appreciate any help. And by the way, i did go back and look through the archives over the last several months and didn't find a solution. Best regards, Judge

3 2