- tor-relays - lists.torproject.org

[release] ExoneraTor 4.0.0
by Karsten Loesing 15 Sep '18

15 Sep '18

Good evening, today we released and deployed version 4.0.0 [0] of the ExoneraTor service [1]. This new version greatly reduces database size and variance of query response times. Changes in this version are heavily based on work done by Sebastian Hahn. Earlier ExoneraTor databases can be migrated by running the new psql script [2] that comes with a migration function. Please direct comments and questions to the metrics-team mailing list [3]. All the best, Karsten [0] https://dist.torproject.org/exonerator/4.0.0/ [1] https://metrics.torproject.org/exonerator.html [2] https://gitweb.torproject.org/exonerator.git/tree/src/main/sql/exonerator2.… [3] https://lists.torproject.org/cgi-bin/mailman/listinfo/metrics-team

3 3

Torservers relay family decreased? (solved)
by niftybunny 13 Sep '18

13 Sep '18

› Hello, › › recently, I noticed some strange aspects related to networks › of Torservers/Zwiebelfreunde. Since there was no way to get any › further information on this topic so far, I am posting it here. › Maybe someone can help. Lets recap this for a moment: 1. Every relay of my family has my e-mail. Write an e-mail and ask. Problem solved. 2. The e-mails are running on a domain, registered my me, make a whois lookup for the domain. Problem solved. 3. The /24 IP space is registered by me. Make a RIPE (or whoever provides IP lookup) and you also have my name. Problem solved. 4. Ask someone from Torservers about me. They gave me the /24 for hosting Tor exits. Problem solved. 5. Take a look at the Tor relay mailing list, I was active there. Problem solved. 6. I am an registered InterExchangeCarrier under German law. Ask the Bundesnetzagentur for my Information. Problem solved. 7. The RIPE entries are maintained by F3Netze/Zwiebelfreunde. Ask Tim about me. Problem solved. 8. Write a snail mail letter to my address. Problem solved. 9. Send me a facsimile to my official RIPE abuse records. Problem solved. and the list goes on and on … Welcome to the Interwebs where people ask who you are ... To perfect sum it up: https://i.imgur.com/20wmhNT.jpg › (b) Who is the operator behind family B771AA877687F88E6F1CA5354756DF6C8A7B6B24 ? › There are some /24 IPv4 BGP allocations claiming to belong to the › umbrella organisation "Zwiebelfreunde e.V.", which operate(d|s) › the relay family mentioned above. There is still no family fingerprint. We did not ever claimed to belong to Zwiebelfreunde e.V. Stop making shit up. › I will ask further questions about this in (c) . › › However, there is a _huge_ relay family (27 members, with a › total bandwith of ~ 1,245 MB) located in 185.220.101.0/24 , › which uses Zwiebelfreunde as a contact role and has not been › changed since 2017-09-08. No, we do not. We are the ADMIN-C and the TECH-C. Zwiebelfreunde is just the MNT-REF. Look it up for yourself: https://apps.db.ripe.net/db-web-ui/#/query?bflag&searchtext=185.220.101.0&s… It even has a fucking disclaimer on it: netname: MK-TOR-EXIT remarks: ----------------------------------- remarks: This network is used for Tor Exits. remarks: We do not have any logs at all. remarks: For more information please visit: remarks: https://www.torproject.org remarks: ----------------------------------- remarks: Dieses Netz hostet nur Tor remarks: Exists. Wir haben keinerlei Logs. remarks: Mehr Informationen unter: remarks: https://www.torproject.org The (current) owner of the IPs is: https://apps.db.ripe.net/db-web-ui/#/lookup?source=ripe&key=ORG-MK113-RIPE&… and the abuse contact: https://apps.db.ripe.net/db-web-ui/#/lookup?source=RIPE&key=ACRO11287-RIPE&… › The relays itself, however, all use <abuse at to-surf-and-protect.net> › as contact address (which does not seem to be related to › Zwiebelfreunde at all) and use a description beginning with › "nifty". Have you tried to send uns an e-mail and ask? No? They are not related to Zwiebelfreunde because we are not Zwiebelfreunde. And btw, its Nifty + name of a rodent. Yes, I know hedgehogs are no rodents. But they are cute too. › Since most of them have both Guard and Exit flag assigned, I › figure they are handling a huge consensus weight. No. Complete bullshit. Exit flag indicates thats an Exit and Guard indicates a longer uptime. I can make an relay on a wee DSL line with these flags. It indicates not a huge consensus weight at all. RTFM! › Does anybody know the person/organisation behind them? Yes. › Are they related to Zwiebelfreunde/Torservers? Besides the /24, no. What is the physical location of the servers (BGP claims DE, but upstream AS200052 uses UK)? NL BGP claims DE? BGP is a routing protocol, it claims nothing. It doesnt give a flying shit about countries. It routes packets between different ASs. Show me the BGP routing table. › (c) Strange BGP allocations using Zwiebelfreunde as contact role › At the moment, 9 IPv4 BGP prefixes with a length of /24 are › known to use a contact role pointing to Zwiebelfreunde [4] . › › These are as follows: › - 37.218.246.0/24 (Upstream AS47172 "Greenhost", claims EU, but is likely NL, 0 Tor relays found) › - 193.235.207.0/24 (Upstream AS196689 "Digicube", claims EU, but is likely FR, 0 Tor relays found) › - 192.36.61.0/24 (Upstream AS60781 "Leaseweb", claims EU, but is likely NL, 0 Tor relays found) › - 192.36.41.0/24 (Upstream AS34305 "BaseIP", claims EU, but is likely NL, 0 Tor relays found) › - 192.36.27.0/24 (Upstream AS60729 "Zwiebelfreunde" !, claims EU, physical location unknown, 0 Tor relays found) › - 185.220.102.0/24 (Upstream AS60729 "Zwiebelfreunde" !, claims EU, physical location unknown, 0 Tor relays found) › - 185.220.101.0/24 (Upstream AS200052 "Joshua Peter McQuistan", claims DE, physical location unknown, 27 Tor relays found) BGP still claims shit. BGP is still a routing protocol. Look at a looking glas server and start reading RTFs. › What puzzles me here is: › 1. None of these networks has any Tor relays known (or Metrics › does not show them), which is strange as Torservers/Zwiebelfreunde › is more or less dedicated to operate relays. https://nusenu.github.io/OrNetStats/ https://metrics.torproject.org/rs.html › 2. The appearing relays solely belong to the strange and huge › family mentioned in (b) , which cannot be exactly pinpointed to › be run by Torservers/Zwiebelfreunde. Yeah, these strange and huge relays are here for over 3 years, growing. https://imgur.com/1jwtxHX Nusenu twitter page, https://twitter.com/nusenu_ , you should check it out. › 3. I suspected the mentioned IP ranges to be fakely allocated, › but most of them were not changed for more than half a year. Further, › I never observed any traffic from or to these networks. If anybody › does, please drop me a line. Yes! Complete right! You just destroyed our super secret FBI/NSA/BND/MI6 plan to take over the Tor network. Good job, Sherlock! › As of these coincidences, and the observations mentioned in (a) › and (b), I suspect something nasty (or highly unusual) is going on, › but I have no clue what this might be. 100% perfect conclusion. Good job, Sherlock! › It would be great if someone who is in Tor more deeply than I am › could take a look at this. Also, if there is further information › available, please tell me. › "Mit dem Wissen wächst der Zweifel. / Doubt grows with knowledge." › -- Goethe https://imgur.com/JG514ja › Best regards, › T. Westerhever Whatever, niftybunny

4 5

A vote for the amateur relay operator
by torix＠protonmail.com 13 Sep '18

13 Sep '18

My vision for the tor project (toropia, if you will) is that running a relay be normal, i.e. part of the ritual of children leaving home for college would be to make sure their parents know how to reboot the tor relay in the basement when the power goes out. But it would be a big plunge for an amateur to set up an exit relay. So when Conrad Rockenhaus offered SWIPEd freeBSD installed relays, it seemed like a chance to get my feet wet. I have no freeBSD experience, but the new torproject directions turned out fine. I'm trusting that Conrad's install will be fine while I learn about hardened freeBSD and get plugged in about security updates. So Conrad gets the grief, and I just run the relay. Maybe I'm not a "real" relay operator for this one, but I think that's okay; I'm contributing to OS diversity, and a new exit relay. When Conrad wrote about getting a court order this week, and got a reply from teor, and said he was getting help with it, my reaction was "as least he seems to be getting help" - a comforting thought for an amateur reading this list who has never seen a court order. --torix Sent with [ProtonMail](https://protonmail.com) Secure Email.

3 2

Exit node seized
by tor-relays＠geek1.de 12 Sep '18

12 Sep '18

Hello, I've found no information - after short googling - if I should take some action after an exit node got seized. Like marking the fingerprint as compromised or something like that. I'd guess it's ok to just set up a new exit node on the same IP and everything should be fine but I'm not quite 100% sure on this. Node in question: https://metrics.torproject.org/rs.html#details/AF8A3EE078EB81338461F178DBE5… And another question about this topic: Would it be better to create a new exit from scratch or is it ok to restore the latest backup with all keys, etc. ? Cheers Michael

4 6

Court Order
by Conrad Rockenhaus 11 Sep '18

11 Sep '18

Greypony received its first Court Order yesterday. Unfortunately, we have no records to provide since it was a Tor Exit, and we don’t even have records of who owned that relay at that IP address because we don’t keep records of the info. Oops. It’s a pretty broad Court Order, and kind of funny. Oh well. Conrad

6 9

Contact info on exit notice page?
by Isaac Grover, Aileron I.T. 10 Sep '18

10 Sep '18

Good morning fellow exit node operators, I am considering adding a dedicated email address (not this one) to be used for my exit nodes on the exit notice pages, where currently none exist. After reading this list for over two years and the stories of DMCA notices, court orders, etc., would an email address on the page provide some benefit to those parties who need to send complaints and piracy violations, or would it only attract more spam? Make your day great, Isaac Grover, Senior I.T. Consultant Aileron I.T. - "Practical & Proactive I.T. Solutions" Office: 715-377-0440, Fax:715-690-1029, Web: www.aileronit.com

2 1

Difference Between "Number of Routers" And "Number Of Descriptors"
by Keifer Bly 10 Sep '18

10 Sep '18

Hi, So upon checking my relay status at torstatus.blutimage.de, I saw Number of Routers In Cache: Number of Descriptors In Cache: I wanted to double check, what is the difference between “Number of Routers” and “Number of Descriptors”? I know Number of Routers means number of relays currently running. Thank you.

2 1

Reminder: Meeting in #tor-relays
by Colin Childs 10 Sep '18

10 Sep '18

Hi everyone, As promised, this is a reminder email that we will be holding our first IRC relay operator meeting this week! When: September 11th @ 1:00AM UTC Where: irc.oftc.net <http://irc.oftc.net/> @ #tor-relays You can confirm your local date / time by visiting the following page, and selecting your timezone from the dropdown menu: https://www.worldtimeserver.com/convert_time_in_UTC.aspx?y=2018&mo=9&d=11&h… <https://www.worldtimeserver.com/convert_time_in_UTC.aspx?y=2018&mo=9&d=11&h…> See everyone there!

1 0

Suspension of service (ISP Scaleway / tor exit)
by Olaf Grimm 08 Sep '18

08 Sep '18

Dear readers, some days ago I change my relay to an exit relay with a very strict policy. Today came the suspension message into my regular mail account. After login into the Scaleway account I saw that the time between the abuse log message and the deactivation of my exit relay were 6 hours only. At these time I was at work! I was not able to react of the message, neither I knew it. The "abuse message" was a raw firewall log, without spaces hard to read. I'm not a professional, so I could read only "SYNFLOOD src IP xxxx dest IP xxxx". That's all. After I learnt what this is, I responded to the provider that good providers realize own DDOS protection in the network and protect customers too. Why log the provider bad outgoing traffic and ignore bad incoming traffic? They don't know the source of the bad traffic, but have the customer to beat someone! The answer field for the reply were some lines only. Without comment from the ISP the ticket was closed and the VPS locked yet. I try to delete the old instance and build a new one. If the same occur I leave Scaleway (and give info about that again). Now I recommend to set the ISP Scaleway (in France) of the list of bad providers. Scaleway message: Hello, We have tried to contact you about an abuse report concerning one of your server. Unfortunately at this time you did not reply to this report. As stated in our terms of service, we have suspended your account. Sincerly, Scaleway End message To avoid a big shitstorm: I know what I do and it is not my first and only exit. Scaleway was the first trouble and in such a way, that I must leave a comment. To the tor website editors: It is possible to include a basic abuse protection chapter in the tor documentation (config guide)? I've found some iptable rules, but I use the user-friedly "ufw", the overlay to iptables. It would be fine if some good guys could help with an easy configuration guide in the config chapter for tor relays. Have a good time. I feel me better. Olaf

5 6

Lets increase Routing Security for Tor related BGP Prefixes
by nusenu 06 Sep '18

06 Sep '18

Hi, I measured the adoption of RPKI ROAs that help with routing security and some other properties for the >3k BGP prefixes that make up the Tor network. https://medium.com/@nusenu/how-vulnerable-is-the-tor-network-to-bgp-hijacki… You might want to jup directly to section "Recommendations for Tor Relay Operators". (I could paste it here but then all the URLs would be lost) Since OVH SAS and DO do not deploy ROAs at all yet: If you are an OVH SAS or Digital Ocean customer (directly or indirectly just on the same AS) it would be great if you could ask your customer support when they are planing to deploy RPKI ROAs (like other big hosters already did). thanks, nusenu -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

3 8