- tor-relays - lists.torproject.org

Tor relays Workshop in FOSSCOMM
by George Kadianakis 17 Oct '18

17 Oct '18

Greetings list, a few days ago, Elias Papavasileiou did a "Setup your own Tor relay" workshop in the Greek open source conference FOSSCOMM. I attended the workshop and helped out a bit. During the workshop, a presentation was given describing how to setup a relay, and then we moved to hands-on, where we helped 3 groups of 2 people each setup a Tor bridge in their laptop. Even tho a laptop is definitely not the right platform for this, the idea was that if those people learned how to setup a Tor relay/bridge they could afterwards set it up themselves on proper hardware. A few takeaways: - Setting up a Tor relay is not easy even if it's just "apt-get tor, edit torrc, reload tor". There are various things that can go wrong in the between, and basically all groups asked for assistance even tho they all seemed experienced with Linux system administration. - Example of fail: One group put a wrong line in their torrc (they tried to launch with a low-port ORPort of 443 even tho they were not root), then had trouble debugging what's going on, then wiped logs and ran Tor manually as root. Tor overwrote the log file, permission issues occured, and Tor could not start again. We had to manually figure this out and remove the bad log file for Tor to work again. That took a while. - Example of fail: People kind of gave up reading all the comments in the Debian default torrc and asked us for assistance because they did not know what they had to do to make it work. aka what was necessary and what was optional. - After about 45 mins all three groups managed to successfuly run a bridge. I'm just mentioning these things here in case someone can relate and improve the situation. There might be a few things we can do (aka improve the default Debian torrc), or even provide images/docker/vagrant for relays. But I'm not good with these things so I can't really suggest things. Cheers!

2 1

"ORPort auto" versus "ORPort 9001" for a bridge
by Toralf Förster 16 Oct '18

16 Oct '18

I do wonder if the advice [1] is ok or wrong. [1] https://tor.stackexchange.com/questions/6370/how-to-run-an-obfs4-bridge -- Toralf PGP C4EACDDE 0076E94E

2 3

libssh vulnerability (CVE-2018-10933)
by Colin Childs 16 Oct '18

16 Oct '18

Hi tor-relays, This email is just to notify the list of a recent libssh vulnerability[1], and encourage any operators who may be running a vulnerable version of libssh to update. It appears this only impacts libssh in server mode: “This is an important security and maintenance release in order to address CVE-2018-10933., libssh versions 0.6 and above have an authentication bypass vulnerability in the server code. By presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication the attacker could successfully authenticate without any credentials. The bug was discovered by Peter Winter-Smith of NCC Group.” Thanks for being relay operators! [1]: https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfi…

1 0

Circuit ID assignment
by Gabbi Fisher 14 Oct '18

14 Oct '18

Hi all, I wanted to learn more about how Tor circuit IDs work. Correct me if I'm wrong, but this is my current understanding: Each hop along the Tor network has its own circuit ID number. (No universal circuit ID number is used to identify a ip-to-ip stream of traffic). How are the circuit ID numbers determined at each hop? What generates the circuit ID number given to a packet? Thanks!

3 2

Why tor new version having problem's with switching tor.exe file
by dave` dave 14 Oct '18

14 Oct '18

In the old version of tor (less than 8.0) i could download the source code and recompile it( change the number of nodes for example) and create a new tor.exe file and switch it with the tor.exefile, that create with tor installation. but now, in the new version of tor the 8.0, and above, when im doing that i'm having error- 0xc00007b-which means that i'm working with 32 bit on 64 bit or 64 bit on 32 bit. i found work around way that i can install an old version of tor(less than 8.0 version) do the update to 8.0.2 and then i can change the tor.exe file without any error. why this thing happens?

2 1

Internal Services
by Sebastian Urbach 14 Oct '18

14 Oct '18

Good Morning, If someone on this list can take care of trac tickets directed to internal services please contact me. Thx. Sebastian -- Sincerely yours / M.f.G. / Sincères salutations Sebastian Urbach -- Zitat von Alissa Sinowjewna Rosenbaum aka Ayn Rand (1905-1982): We can igenore reality, but we cannot ignore the consequences of ignoring reality.

3 3

Re: [tor-relays] DSL Router
by Isaac Grover, Aileron I.T. 13 Oct '18

13 Oct '18

Good morning onion, I don't know what your definition of "new to networking" is but I'm going to assume you've been using consumer gear for your network. That being said, there is a learning curve to the Mikrotik though they do come with a working but very vanilla configuration out of the box. If you would like, I would be willing to help you with a working configuration if you decide to go with a Mikrotik for your network. Make your day great, Isaac Grover, Senior I.T. Consultant Aileron I.T. - "Practical & Proactive I.T. Solutions" Office: 715-377-0440, Fax:715-690-1029, Web: www.aileronit.com

2 1

Exit Node shutdown
by Tyler Durden 12 Oct '18

12 Oct '18

Hi Our two exit nodes "chulak" and "aurora" will be terminated by the end of this month. Both are listed in the Fallback Directory Mirror list and need to be removed. Fingerprints: 379FB450010D17078B3766C2273303C358C3A442 B0279A521375F3CB2AE210BDBFC645FDD2E1973A The shutdown is due to an internal reorganization. Greetings Sam Grüneisen - President FVDE

3 2

Re: [tor-relays] DSL Router
by Isaac Grover, Aileron I.T. 12 Oct '18

12 Oct '18

Good morning, Both "cheap" and "useful" for running Tor nodes at home won't be found in big box retail ever, so I would take a look at the Mikrotik RB750Gr3 - it will do exactly what you want after it's configured properly. I used to have an RB1200 and recently upgraded to a CCR1009, both from Mikrotik, and have found them to be quite capable under heavy load. Make your day great, Isaac Grover, Senior I.T. Consultant Aileron I.T. - "Practical & Proactive I.T. Solutions" Office: 715-377-0440, Fax:715-690-1029, Web: www.aileronit.com

5 4

Documentation on hardening Debian and Tor Bridge?
by Nathaniel Suchy 12 Oct '18

12 Oct '18

Hi, What documentation, if any exists on hardening my Debian install as well as my Tor Bridge? It's using OBFS4 and using IPTABLES NAT Forwarding for access through port 443 to obfuscate the protocol and of course avoid people from getting suspicious based on the port number? Is there a way I can make Tor use even stronger keys and such? I want things to be as hard to hack as possible. Cordially, Nathaniel Suchy

1 0