- tor-relays - lists.torproject.org

tor enters uninterruptible sleep forever when using transparent proxy
by Nicolás Dato 23 May '18

23 May '18

Hello there, First thanks for reading! I've been running a tor relay for almost two weeks from my home. Yesterday,* I did some upgrades to my Slackware 14.2 including glibc and kernel*. I run tor there and it worked fine. After upgrading Slackware I had to reboot and run windows for the night. Windows messes with the machine time. Today, *I rebooted and run Slackware and (as usual after running windows) *the clock was -3 hours apart. I do run NTP but looks like it doesn't make the adjustment if the difference is way too big. I adjusted the time and run the NTP service again. *Tor daemon launches at startup* so it was running when my clock was -3 hours from present time. I use irssi (IRC client) connecting to the tor transparent proxy using iptables. As usual, I runned irssi and tried to connect to a server but the connection hangs forever and tor hangs forever too, hanging the relay too. I tried a different server but hangs too. *Before trying to connect with irssi, this works:* The tor relay works fine and accepts connections and delivers traffic. I can run nyx and it connects fine and shows me the stats. I can connect to the socks proxy and it works and doesn't hangs tor daemon. After trying to connect with irsse, *all of that stop working.* I didn't changed any tor configuration neither the iptables configuration I did build the tor packages (recompiling it) and installed it, but didn't work I removed some files and folders from /var/log/tor, only removed the ones modified yesterday and today, but it didn't work neither. tor is reported by ps to be on uninterruptible sleep 1347 ? Dl 0:06 11 0 491216 87432 2.2 /usr/bin/tor and there is no way to kill it other than rebooting, neither kill -9 as root works after all the reboots, after removing some /var/lib/tor files, and having the machine clock on time, tor still hangs when using the transparent proxy this are the last lines from the debug log: https://paste.debian.net/plain/1025878 (that's from the time I tried to connect to freenode and it hanged, no more logs after that) this is my iptables: http://paste.debian.net/plainh/c949bc2a (irssi runs as ircuser) this is my torrc: http://paste.debian.net/plain/1025881 (I didn't copy some lines) Thanks again for reading.

2 3

VPNGate Project Exit Node Volunteers / I2P
by grarpamp 22 May '18

22 May '18

http://www.vpngate.net/ For those relay operators who may have extra non tor listed IP addresses and want to help a related projects / userbase. https://geti2p.net/ I2P also has an exit proxy function. " VPNGate: Free Access to World Knowledge Beyond Government's Firewall. VPN Gate Academic Experiment Project is an online service as an academic research at Graduate School of University of Tsukuba, Japan. The purpose of this research is to expand the knowledge of "Global Distributed Public VPN Relay Servers" . You can take these advantages by using VPN Gate: You can get through the government's firewall to browse restricted web sites (e.g. YouTube). You can disguise your IP address to hide your identity while surfing the Internet. You can protect yourself by utilizing its strong encryption while using public Wi-Fi. Unlike traditional VPN services, VPN Gate can get through most firewalls. VPN Gate is free of charge. Not a single registration is required " " I2P I2P is an anonymous overlay network - a network within a network. It is intended to protect communication from dragnet surveillance and monitoring by third parties such as ISPs. "

3 5

Running a bridge remotely
by Keifer Bly 22 May '18

22 May '18

Hello, I have been running my home computer as a public tor relay for some time now with no issues, and unfortunately do not have a data center or anywhere else to run my relay from. I have noticed that there are far fewer bridges (about 2,000) then there are relays (about 7,000). As I have been running my home computer as a relay since last year, my ip address has already been in the tor network for a while, and thus will already be known as a relay to begin with. Is there a free way that I could remotely run an obfuscated bridge as well? I would need a way to do this remotely as I said my only available network ip has been on the public tor network for a considerable while.

3 2

DirPort DOS activity against Fallback Directories
by starlight.2017q4＠binnacle.cx 21 May '18

21 May '18

Recently I noticed excessive DirPort requests to my relay, where DirPort bandwidth reached 15% of ORPort bandwidth. Normal DirPort load is around 2%. https://lists.torproject.org/pipermail/tor-relays/2018-May/015253.html Just looked over a sample of FallBackDir relays in Relay Search and it appears this excess-load abuse is directed at them in particular. Some fall-back directories show more than a month of excess request traffic, presumably on the DirPort. Logs here indicate six weeks of abuse escalating in increments. Possibly this foreshadows a major increase in an effort to impair FallBackDir relay functionality. Either an iptables connection-rate limit or disabling DirPort resolves the problem.

3 3

Nyx and Arm
by gerard＠bulger.co.uk 21 May '18

21 May '18

Arm says I have 3506 outbound 354 exit Nyx has long blue list but states 50 outbound. No mention of exits. What am I doing wrong with Nyx? Gerry

2 2

Re: [tor-relays] can dirport be disabled on fallback directory?
by starlight.2017q4＠binnacle.cx 20 May '18

20 May '18

On May 20, 2018 17:37:07 UTC, Damian Johnson atagar at torproject.org wrote: > >> There don't seem to be any examples of ORPort endpoints in the Stem >> repository. I think Dave plans to add some more documentation as part of Tor >> Summer of Privacy. > >Oh interesting. You're right. I recently added Stem's ORPort >capabilities but seems I forgot to add usage examples in the docs. >Thanks for pointing that out, I'll add it to my todo list. In the >meantime I provided an example here... > >https://blog.atagar.com/april2018/ Thank you! Does a command-line utility to make such requests exist or can one be created? The availability of a command tool for ORPort document downloads would bring DirPort one step closer to complete obsolesce.

1 0

Re: [tor-relays] can dirport be disabled on fallback directory?
by starlight.2017q4＠binnacle.cx 20 May '18

20 May '18

On May 20, 2018 10:08:17 UTC, gustavo <gfa(a)zumbi.xyz> wrote: > >On May 18, 2018 4:25:23 PM UTC, starlight.2017q4 at binnacle.cx wrote: >>Lately seeing escalating abuse traffic on the relay dirport, now up to >>20k rotating source IP addresses per week. > >How do you detect it? FIRST: your relays are not impacted by this issue because DirPort is disabled in their configuration. So you can stop reading here if you like. >Will tor log it in the logs where I can look for >it or do you monitor the TCP/IP stack ? > >I run two relays (milanese one of them) besides basic >OS level monitoring I don't monitor much else. > >I wonder if I should monitor more or what to search for >in logs (I run my relays without logs since I don't >have an use for) Simply perusing the /var/log/messages log lines for the relay on occasion should be sufficient for most operators. The daemon will complain about many if not all important problems. ---------- For those with DirPort configured, one can check for the problem by looking at the 'state' file with the command egrep '^BWHistory.*WriteValues' state and calculating the percent BWHistoryDirWriteValues is relative to BWHistoryWriteValues for the same samples. Should be under 5%, more like 1-3%. If 15% the attacker is harassing your relay. This particular abuse scenario can be mitigated by applying an 'iptables -m limit' rule set to incoming DirPort connection requests -or- by disabling DirPort in the config since clear-text DirPort is no longer required for the Tor network to function properly. Those running FallBack directories should probably send an update to this list if they apply this change as I belive the FallBackDir script excludes relays where ports differ from the whitelist or have changed in OnionOO historical data.

1 0

can dirport be disabled on fallback directory?
by starlight.2017q4＠binnacle.cx 20 May '18

20 May '18

Lately seeing escalating abuse traffic on the relay dirport, now up to 20k rotating source IP addresses per week. The simple solution is to disable dirport, but the relay is a fallback directory and I don't want to make a change that will negatively affect the relay's ability to function as such. Would disabling dirport be a problem? also: can a non-advertised dirport be left configured for local-system use while the public advertised dirport is disabled? does a command utility or method exist for querying dirport documents via tunnelled-dir-server? including miscellanous documents such as /tor/status-vote/current/consensus.z /tor/keys/all.z /tor/server/all.z /tor/extra/all.z /tor/server/fp/<fp1>+<fp2>+<fp3>.z /tor/extra/fp/<fp1>+<fp2>+<fp3>.z /tor/micro/d/<hash1>-<hash2>.z /tor/keys/fp/<v3ident1>+<v3ident2>.z thanks!

3 3

Help! I'm ripping my hair out trying to get Quintex on IPv6 exit
by John Ricketts 19 May '18

19 May '18

All, I've been trying to bring a relay up for testing IPv6. Relay name is QuintexAirVPN1. Metrics website says that the OR Port is unreachable on [2620:7:6000::ffff:c759:df51]:80 - which isn't where I set the ORPort - should be 443... https://metrics.torproject.org/rs.html#details/F7447E99EB5CBD4D5EB913EE0E35… Config is as follows: ORPort 443 ORPort [2620:7:6000::ffff:c759:df51]:443 Nickname QuintexAirVPN1 ContactInfo John L. Ricketts, PhD <john AT quintex dot com> DirPort 80 # what port to advertise for directory connections DirPortFrontPage /etc/tor/tor-exit-notice.html DisableDebuggerAttachment 0 Sandbox 1 ExitRelay 1 IPv6Exit 1 ExitPolicy accept *:* ExitPolicy accept6 *:* NumCPUs 2 Help!! LOL John L. Ricketts, PhD Quintex Alliance Consulting (325) 262-3488 john(a)quintex.com

2 2

Relay advocate introduction
by Colin Childs 18 May '18

18 May '18

Hello tor-relays! My name is Colin Childs, I have been the support and translation coordinator at the Tor Project for a number of years. I am also a founding director of a TorServers partner named Coldhak here in Canada. Recently, my role within the Tor Project has changed, and I am starting as the new relay advocate (as well as localization coordinator, until this responsibility can be reassigned). My job will be improving the health / happiness of the relay operator community, expanding the relay operator community, and helping improve the community bonds between operators. A few of the things I will be working on are: 1. Open a #tor-relays IRC channel (this is now open, everyone should join!) 2. Reach out to realy operator groups / individuals to introduce myself and solicit feedback (beginning today) 3. Plan a relay operators meet-up at PETS in July (details to come in another email) 4. Form a team of trusted technical and legal volunteers able to help operators around the world. 5. Organizing a larger "relay operator summit" event 6. Working with operators to resolve some of the recent issues brought up on this list (DNS provider, DNSSEC, EOL releases, etc..) While reaching out to operators is point 2 in that list, if you have suggestions or feedback that you'd like to send, please do not hesitate to reach out to me! I would love to hear from all of you with the things you would find most helpful from me / the Tor Project. While I cannot guarantee we can facilitate every request, we will do our best to help! I look forward to working with all of you in the future, and I hope you're having a great week!

9 11