- tor-relays - lists.torproject.org

Relay Guide - IPv6 Connectivity Testing
by Matthew Finkel 25 Jun '18

25 Jun '18

Over the last few days I've started thinking more about IPv6 and, inevitably, I started thinking about how we can improve support within the Tor network. Within the last few months, there were a few instances of relay operators seeking answers for why their relay did not have the running flag in the consensus. After some investigation, in some cases this was because the relay had an IPv6 ORPort configured but a majority of the IPv6-enabled directory authorities did not believe it was running. Unfortunately, despite IPv6 connectivity being a necessity now, ISP rollout is slow and on-going in some geographical areas and network peering arrangements are sometimes sub-standard or not stable. The Relay Guide[0] has a section describing how an operator can enable an IPv6 ORPort, and there's a supplementary page[1] specifically describing additional information about it. Considering there are potential critical failures when the IPv6 ORPort is configured, should the relay guide suggest the operator confirm they have IPv6 connectivity to all of the IPv6-enabled directory authorities[2] before enabling it ("Please ping6/telnet/nc to these hosts before enabling this.")? It would also be nice if the relay, itself, performed self-checks of this connectivity and printed a warning log if some failure-threshold is reached (and possibly disabling the IPv6 ORPort). But, in reality, this is a hack around a broken internet - and I hesitate advocating for something like this in tor. Maybe there is a compromise we can find between the relay operator manually testing connectivity periodically and tor automatically doing-smart-things. Thoughts? - Matt [0] https://trac.torproject.org/projects/tor/wiki/TorRelayGuide#IPv6 [1] https://trac.torproject.org/projects/tor/wiki/doc/IPv6RelayHowto [2] https://gitweb.torproject.org/tor.git/tree/src/or/auth_dirs.inc

3 5

Number of connections on dir port
by Logforme 25 Jun '18

25 Jun '18

After reading this post https://lists.torproject.org/pipermail/tor-relays/2018-May/015277.html I started looking into what is happening on the dir port on my relay (855BC2DABE24C861CD887DB9B2E950424B49FC34) The bandwidth ratio of dir/or traffic is around 3% to 4%. Not excessive according to the linked post. Looking at the conntrack table I see many IP addresses (usually from Ukraine or Russia) with 100+ connections. Atm there are around 10 IP addresses with 100+ connections and around 30 with 10+ connections. None of the IP addresses I've looked at are Tor relays. Some questions: Is this expected behaviour against on a fallbackdir flagged relay? Does the DoS prevention implemented recently address abuse against the dir port? I read that newer Tor clients don't use the dir port. Correct? Do Tor relays use the dir port? Can I remove the dir port from my relay without reducing my relays usability to the network? Thank you for any answers.

2 1

Re: [tor-relays] Alleged Family Members
by Paul Templeton 24 Jun '18

24 Jun '18

> How long is the timeout for 'Alleged Family Members' to disappear on > 'metrics.torproject.org'? Can I force it? Shouldn't take long, but did you leave the relay finger print in the MyFamily section in the torrc file? P 609662E824251C283164243846C035C803940378

1 0

I get sad when :-(
by Paul Templeton 24 Jun '18

24 Jun '18

I get sad when I lose control over one of the bare metal systems I run and help desk is slow to respond over the weekend. Then you have to throw in the time differences, then the language - its a wonder anything runs... Just wanted to know if there is anyone I can hook up with to talk about some config/stability issues. I have two systems one a VPS the other bare metal and both will drop out of the consensuses about once a day(2 to 3 hours) but are running the whole time. I have 4 bare metal systems but none are at capacity and would like to find the best approach to get more out of them. Consensus is one issue that's limiting capacity usage. I would love to meet up but in a remote part of AU and I just quit my job after 15 years so haven't time to fly anywhere at this time... P 609662E824251C283164243846C035C803940378

3 4

Prepping bridges for censorship
by Keifer Bly 23 Jun '18

23 Jun '18

Hi, So I had a thought. It seems like a lot of the relays run off of various port numbers (of course). However if all of the relays and bridges are running off of various port numbers (ie 9001, 10000, etc.), couldn’t this stop censored users (who’s isp or local firewall only allows certain ports like 80 and 443) from being able to connect to the tor network even when using bridges due to the port that the bridge of guard relay being run on a port number that is blocked by the isp or local firewall? Just a thought.

4 6

Tor Relay Operators Needs
by Eran Sandler 22 Jun '18

22 Jun '18

Hi everyone, My name is Eran Sandler and I'm the Operator of tor4thepeople1 (98F44299592FC31FD3F2F8969D27374D00E96B9B) and tor4thepeople3 (CEACA34874EAD103D27CA6A7650B16112F12B209) - tor4thepeople2 had to go away, unfortunately. I also developed the gonionoo (https://github.com/erans/gonionoo) an Go wrapper around the Onionoo API. I've been running various tor relays and exit nodes since Sep/2015. Being a software developer by trade I've been thinking about projects and services that might help Tor Relay Operators and Tor in general and have a few ideas I wanted to pass along and see if anyone sticks. A few of the most notable ones are: - *Tor Weather Replacement* - ever since Tor Weather went down I've found that I actually miss it. It doesn't happen often that my relays are down but it does happen from time to time and in the past Tor Weather really helped get notified. A few things I thought about adding in addition to "Your node is down" alert are: - Node version is too old - New versions of Tor that are relevant to you are available etc - Sends node stats every given interval - *Free domain name for every Tor node operator who wants it*. A while back I purchased torexitnode.net and I wanted to develop a system that, upon verifying a running node (send an email to the published Email address of a node and verify its running) - will give a subdomain under torexitnode.net. I'm currently using it for tor4thepeople1.torexitnode.net and tor4thepeople3.torexitnode.net. I find that it makes things easier to explain when that's the node name. If you can get your hosting service to provide you with an updated reverse DNS for your IP address and point it to a subdomain of torexitnode.net it make it very clear that this is a Tor exit node. - *System to provide tor exit node verification*. Given a pre-registered app and callback and a fingerprint of a node it will find the Email of the operator and email a unique link. When that link is clicked a callback will be made to the preregistered URL - allowing a developer to verify that a certain node operator is truely the one accessing the service. That is actually needed for both of the services mentioned above. - *Simple package to run a webserver + customized tor exit node notice page* - similar to what I configured for http://tor4thepeople1.torexitnode.net. It's very useful and if we can get a super basic web server that only serves this page and would be easy to install (maybe even bundle with Tor) + let's encrypt integration (to serve it under SSL) it would provide great benefit to all operators. If you have additional ideas and or thoughts about the above projects or other projects please let me know. Looking forward to your thoughts. Thanks, Eran

5 13

Re: [tor-relays] tor-relays Digest, Vol 89, Issue 37
by Bill Chapman 21 Jun '18

21 Jun '18

> On Jun 20, 2018, at 1:48 PM, "tor-relays-request(a)lists.torproject.org" <tor-relays-request(a)lists.torproject.org> wrote: > > +

1 0

Relay bandwidth accounting
by Sean Brown 18 Jun '18

18 Jun '18

I just set up a new non-exit relay and in going through information to set up, I came across the T-shirt for contributing and in addition to running for 2 months it says "if you're not an exit but you average 500 KBytes/s traffic." What would be the best way to keep accounting of the traffic my relay is passing? I know of the metrics.torproject.org, is that all the project would need?

2 1

how to set-up multiple debian relays at once
by I 18 Jun '18

18 Jun '18

3 5

Spam Emails Received From This Mailing List
by Keifer Bly 16 Jun '18

16 Jun '18

Hello fellow relay operators, My apologies as this is not related to tor relays, however, there seems to be several spammers subscribed to the relay list. Every time I am involved in a discussion on this list, I receive 3-5 emails supposedly from girls wanting to meet up (for sex). The emails in question claim they are sent from email address tor-relays(a)lists.torproject.org (and always have the same email subject of the discussion I was involved in). I am somewhat in a trap as blocking them with spam filters would block all emails sent from the relay lists address. I am wondering what could be done about this (the email provider in question is Gmail). Thank you.

14 31