tor-relays

tor-relays@lists.torproject.org

36 participants
4815 discussions

arm crashes
by smichel0 26 Mar '18

26 Mar '18

Hello, from time to time, arm looks like below: https://smichel.ocloud.de/index.php/s/q2knnq3AD67rPjK But with a simple keystroke (arrow) it runs again. After a few days it seems to crash completely: https://smichel.ocloud.de/index.php/s/GjwdCLebR4iDkuv I dont't know then, if the relay is still working. Last time this happend, I simply startet arm again and it worked. But thiis way I will never reach the guard-flag :) Yours SMichel Sent with [ProtonMail](https://protonmail.com) Secure Email.

5 18

relayor v0.3.3 is released
by nusenu 26 Mar '18

26 Mar '18

Hi, relayor v0.3.3 is released. relayor helps you with running relays with minimal effort (automate everything). https://github.com/nusenu/ansible-relayor Changes since v0.3.2: ------------------------------ - major workaround for an upstream bug in tor that prevented us from running more than 2 instances per server. This affected only users with a non-default tor_maxPublicIPs setting. (#153) Thanks to Tim Niemeyer (@RedDog99) (f3netze.de) for bringing this to our attention. - relayor now ships a kitchen file for integration testing (#149) Thanks to Ondrej Vaško (@Lirt) for the patch. Main benefits for a tor relay operator ====================================== * automation - no more manual setup tasks * security: offline Ed25519 master keys every tor instance is run with a distinct user * automatically makes use of IPv6 IPs (if available) * automatic tor instance generation (two by default - configurable) * enables tor's Sandbox feature by default on Debian-based systems * easily choose between alpha/non-alpha releases * easily restore a relay setup * easily choose between exit relay/non-exit relay mode * automatic deployment of a tor exit notice html page via tor's DirPort * automatic MyFamily management Supported Operating Systems ---------------------------- Debian 8, 9 and Debian Testing OpenBSD 6.2 FreeBSD 10.4, 11.1 HardenedBSD 11 Ubuntu 16.04 CentOS 7 Fedora 27 regards, nusenu -- https://mastodon.social/@nusenu twitter: @nusenu_

2 1

Hello new exit operator F3 Netze
by nusenu 25 Mar '18

25 Mar '18

Hello F3 Netze, I saw you recently added 8 new tor exit instances and wanted to thank you for contributing exit bandwidth to the tor network! Should there arise questions related to the operations of tor relays you can reach out to the public tor-relays mailing list [0]. Your AS information is not yet in Maxmind's databases so it does not show yet on Relay Search [1] pages but this will solve itself over time. I saw your have IPv6 addresses [2]. If your connectivity/routing allows also for IPv6 exiting and ORPorts, enabling IPv6 on your exits would be great and appreciated. Looking at your ORPorts and your perfect MyFamily configuration this looks like an ansible-relayor setup, in which case IPv6 will be automatically enabled on the next playbook run once the servers have IPv6 addresses (if you didn't opt-out). thanks for joining the network and happy packet forwarding! nusenu [0] https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays [1] https://metrics.torproject.org/rs.html#search/family:6BCB964AB74E23F8986BDA… [2] https://bgp.he.net/AS205100#_prefixes6 -- https://mastodon.social/@nusenu twitter: @nusenu_

3 7

Publishing bridge contact information
by Karsten Loesing 23 Mar '18

23 Mar '18

Hello relay and/or bridge operators, you might already know this: we're publishing sanitized versions of bridge descriptors on Tor Metrics. https://metrics.torproject.org/collector.html#bridge-descriptors We're using these sanitized descriptors to visualize interesting facts about Tor bridges, among other things: https://metrics.torproject.org/bridges-ipv6.html We're now considering to drop one step in the sanitizing step, which is to remove contact information. The result would be that we'd keep contact information in sanitized descriptors in the exact same way as the bridge operator put it into their torrc file. https://metrics.torproject.org/bridge-descriptors.html#contact https://trac.torproject.org/projects/tor/ticket/20983 Possible advantages are: - Relay Search would support searching for bridges by contact information. - People who keep a watching eye on the Tor network could reach out to bridge operators to inform them that they're running an outdated tor/PT version, or that running bridges and exits together is not cool. - If somebody ever revives OnionTip/TorTip, bridges could participate and receive donations for running a bridge. Or t-shirts, who knows. Note that I'm not promising either here, but without contact information, neither would even be possible. Possible disadvantages are: - If somebody runs a relay and a bridge, both with the same contact information, a censoring adversary might guess that the bridge might run on a nearby IP address as the relay. However, they could as well assume that for all relays and block or scan the IP space around all known relays. - Bridge operators might be surprised to see their contact information in a public archive. We do have a warning in the tor manual https://www.torproject.org/docs/tor-manual.html.en#ContactInfo, but maybe nobody reads the fine manual. Your opinion counts. Is this a good or a bad idea, and why? I'll keep this discussion open for a week and not start changing anything during that time. If you want to state your opinion, please do it on this list by Wednesday, February 14. Thanks! All the best, Karsten

8 21

DoSer is back, Tor dev's please consider
by starlight.2017q4＠binnacle.cx 23 Mar '18

23 Mar '18

Please note: Here parameter DoSCircuitCreationMinConnections=1 is set (rather than the default value of 3). Mar 11 17:23:53 Tor[]: DoS mitigation since startup: 0 circuits rejected . . . . . . Mar 22 11:23:54 Tor[]: DoS mitigation since startup: 299608 circuits rejected. . . Mar 22 17:23:54 Tor[]: DoS mitigation since startup: 806025 circuits rejected. . . I.E. mitigation circuit rejections increased 170% in six hours after moving vaguely for over ten days. Also: top - 19:05:53 up 11 days. PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 1998 tor 20 0 662m 611m 108m R 47.2 15.4 7901:32 tor 2000 tor 20 0 662m 611m 108m S 42.2 15.4 343:28.28 tor 2001 tor 20 0 662m 611m 108m R 56.8 15.4 343:24.46 tor I.E. crypto workers pegged after barely registering since DoSer shut it down on March 7th. 'iptables' mitigation rule here shows the DoS source-IPs ablaze. ========== Suggestion: DoSCircuitCreationMinConnections=1 be established in consensus

3 3

Re: [tor-relays] Previous Guard not getting Guard flag back
by starlight.2017q4＠binnacle.cx 23 Mar '18

23 Mar '18

>While I understand that my relay lost the guard flag because of a weekend >of downtime, I would expect that it would get it back after a while of >stable again? Anyone able to shed some light on when it will get the flag >back? >https://metrics.torproject.org/rs.html#details/924B24AFA7F075D059E8EEB284CC… Guard flag calculation is somewhat involved (due to several get-out-jail promotions/bypasses), but the essential part is weighted uptime in excess of the median uptime of guard candidates, or 98% whichever is lower. Presently the authorities have it somewhere around 96% (they do not publish the value). Your relay is at about 91% and will be back as a Guard in less than five days when it will hit 97%. The attached XLS shows it roughly, left side today and right side as-of 3/26. Uptime data came from the "1_month" section of https://onionoo.torproject.org/uptime?search=NSDFreedom Built this sheet for myself recently and simply stuffed in data for your relay. Enjoy. P.S. If anyone spots flaws in the approach, please comment.

1 5

tor-instance-create vs. /etc/tor/torrc
by Igor Mitrofanov 22 Mar '18

22 Mar '18

Hi, I use tor-instance-create to spawn a number of relay instances. However, there seems to be one extra instance running - the default one that reads /etc/tor/torrc (and not /etc/tor/instances/INSTANCE/torrc). How do I disable that default tor relay? It opens port 9050 and does who else knows what by default. I can delete /etc/tor/torrc and it seems to do the trick, however, I am not sure how permanent this change will be with automatic package updates. Thanks!

4 3

exit operators: DNS failure rate increased - please check your DNS
by nusenu 22 Mar '18

22 Mar '18

Dear Exit relay operators, first of all thanks for running exit relays! One of the crucial service that you provide in addition to forwarding TCP streams is DNS resolution for tor clients. Exits relays which fail to resolve hostnames are barely useful for tor clients. We noticed that lately the failure rates did increase again and would like to urge you to visit Arthur's "Tor Exit DNS Timeouts" page that shows you the DNS error rate for exit relays: https://arthuredelstein.net/exits/ (the page is usually updated once a day) Please consider checking your DNS if your exit consistently shows a high (>=20%) timeout rate - and make sure you run an up to date tor version. If you are an exit operator but have no (or no working) ContactInfo, please consider updating that field in your torrc so we can reach you if something is wrong with your relay. thanks for caring, nusenu -- https://mastodon.social/@nusenu twitter: @nusenu_

1 1

Previous Guard not getting Guard flag back
by Matthew Glennon 21 Mar '18

21 Mar '18

While I understand that my relay lost the guard flag because of a weekend of downtime, I would expect that it would get it back after a while of stable again? Anyone able to shed some light on when it will get the flag back? https://metrics.torproject.org/rs.html#details/924B24AFA7F075D059E8EEB284CC… Thanks -- Matthew Glennon matthew(a)glennon.online PGP Signing Available Upon Request https://keybase.io/crazysane

2 3

Hidden service error in log
by Gary 20 Mar '18

20 Mar '18

Hello. I made a "hello world" hidden service and I had to following message in the logs about exceeding launch limit. I have not seen this before. I had one onion for a while and added a second one recently - not sure if that matters as it is only complaining about the first one. I am not sure what / why it is exceeding launch limit, I would be grateful if someone could explain it to me. Thanks. Mar 14 12:43:24.000 [notice] Bootstrapped 100%: Done Mar 14 12:43:32.000 [warn] Hidden service 4l53ozkhv******* exceeded launch limit with 10 intro points in the last 202 seconds. Intro circuit launches are limited to 10 per 300 seconds. Mar 14 12:43:32.000 [warn] Service configured in "/var/lib/tor/hidden_service/": Mar 14 12:43:32.000 [warn] Intro point 0 at [scrubbed]: circuit is open Mar 14 12:43:32.000 [warn] Intro point 1 at [scrubbed]: circuit is open Mar 14 12:43:32.000 [warn] Intro point 2 at [scrubbed]: circuit is doing handshakes Mar 14 12:43:32.000 [warn] Intro point 3 at [scrubbed]: circuit is open Mar 14 12:43:32.000 [warn] Service configured in "/var/lib/tor/hidden2/": Mar 14 12:43:32.000 [warn] Intro point 0 at [scrubbed]: circuit is doing handshakes Mar 14 12:43:32.000 [warn] Intro point 1 at [scrubbed]: circuit is open Mar 14 12:43:32.000 [warn] Intro point 2 at [scrubbed]: circuit is open Mar 14 12:43:32.000 [warn] Intro point 3 at [scrubbed]: circuit is open Mar 14 12:44:25.000 [notice] Performing bandwidth self-test...done.

3 3

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-relays