- tor-relays - lists.torproject.org

About relay size
by IPonU 08 Oct '17

08 Oct '17

Hi Tor list, I'm already running a small exit node (100Mbps bandwidth) and I'm ready to spend more money on it, so have a question for you guys : Is it better if I run other small ones (100Mbps too) or only 1 big exit relay (1 Gbps) ? What's best for the network stability/security ? Thanks a lot IPonU

13 34

anonymaid tor relays: MyFamily configuration
by nusenu 07 Oct '17

07 Oct '17

Hello anonymaid Relay Operator, thanks for running relays. Since you recently added more relays you are now in a position that can potentially harm tor users if you do not set MyFamily (torrc) on all your relays. Please have a look at you MyFamily configuration. https://nusenu.github.io/OrNetStats/endtoend-correlation-groups some more background: https://hackernoon.com/some-tor-relays-you-might-want-to-avoid-5901597ad821 Let us know if you need help with configuring MyFamily. thanks, nusenu -- https://mastodon.social/@nusenu twitter: @nusenu_

1 0

More recent rpm somewhere?
by Patrick DERWAEL 07 Oct '17

07 Oct '17

Hi folks, I'm running a few relays on CentOS 7 As I'm sticking to the ease of rpm distributions, I'm left behind on 0.2.9.10 from EPEL Does anyone know of another rpm repository with a more up to date version ? Thanks! Patrick

5 7

Blocking outbound 22 or no?
by AMuse 06 Oct '17

06 Oct '17

Hi all! I'm getting a number of ISP Abuse complaints around outbound ssh brute-forcing from our exit relay. I'm personally of the opinion that people should run fail2ban (or equiv) and get on with life and I generally ignore the complaints - but wondered, what are other operators doing? Is anyone exit-policy blocking outbound 22 to make the internet a kinder place? Is anyone refusing to on principle?

5 4

Quintex Exit Relays
by John Ricketts 05 Oct '17

05 Oct '17

All, I am performing some operating system upgrades and my exit nodes may be down for a period of time. Just a heads up. John

1 0

Re: [tor-relays] AU Relays and data retention
by Paul Templeton 05 Oct '17

05 Oct '17

Thanx Teor, I did speak to a lawyer and there is no requirement to retain any data if you run a node. It's treated as a VPN. My question that I sent was more about whether a service (non commercial service) was exempt. They don't delineate. Paul

2 1

AU Relays and data retention
by Paul Templeton 05 Oct '17

05 Oct '17

Hi All, I have asked the Attorney Generals Department about data retention and got the following response. If you run a relay/bridge here you seem to be exempt from retaining data. If your not an ISP and you run a service from home the ISP/carrier will retain the data though. This just general information. Regards, Paul UNCLASSIFIED Dear Mr Templeton Thank you for your enquiry to the Office of Communications and Cybercrime. I am re-sending our reply to your original enquiry that we sent on 12 September 2017 that seems to have not arrived. The extent of data retention obligations for your relevant service would relate to the extent to which elements of the data set “visible” to you. For example, where a provider does not have “visibility” of a customer’s IP address, it is likely that the IP address was assigned as part of a different relevant service. For example, if you have a record of the MAC addresses of users who access your network then this information must be retained for the required period. You are not obliged to retain the identity of the user if this is not information to which you have access. Whether the service is being offered on a commercial basis or is free is irrelevant in determining a service provider's obligations. In your email you noted that "The true origin of a connection and the true destination will never be known and there will be no way of obtaining the information. That also pertains to the ports used in the circuit and all data passing through the circuit will be encrypted." This sentence appears to suggest that you may be looking to offer some kind of an internet access service, in which case the destination is not required to be retained. Your reference to encrypted content suggests a VPN. If this is the case and this service is not operated you, obligations do not apply. Also, data retention would not require you to store the contents of the communications. Please do not hesitate to contact our office if you require further information. Regards Kerry Office of Communications Access & Cybercrime Intelligence and Identity Security Division T: (02) 6141 2884 The information contained in this email is intended as guidance only. It does not constitute legal advice and should not be relied upon as such. If you require legal advice, you should consult an independent legal adviser.

3 3

SSH Bruteforce Attempts
by tanous .c 05 Oct '17

05 Oct '17

Hi, I have been running one tor exit relay for about 51 days and i recently got this abuse report: Good afternoon, Your Ip address (212.47.239.73) has been reported to us by profihost because it seems to have attempted to bruteforce. Thank you to take the necessary action as soon as possible. You will find more information about this report below this message. Feel free to contact Online.net technical assistance for more information. Online.net Abuse service ------------------------------------------------------------------------------ (time is MET / GMT+1): Tue Oct 3 08:59:40 2017: user: root service: ssh target: 77.75.252.250 source: 212.47.239.73 Tue Oct 3 08:59:10 2017: user: root service: ssh target: 77.75.252.250 source: 212.47.239.73 Tue Oct 3 08:59:10 2017: user: root service: ssh target: 77.75.252.250 source: 212.47.239.73 Tue Oct 3 08:36:18 2017: user: admin service: ssh target: 37.228.155.188 source: 212.47.239.73 Tue Oct 3 07:06:42 2017: user: user service: ssh target: 77.75.252.80 source: 212.47.239.73 Tue Oct 3 07:06:12 2017: user: user1 service: ssh target: 77.75.252.80 source: 212.47.239.73 Tue Oct 3 06:14:12 2017: user: admin service: ssh target: 77.75.251.85 source: 212.47.239.73 Tue Oct 3 06:01:41 2017: user: admin service: ssh target: 77.75.252.78 source: 212.47.239.73 Tue Oct 3 05:37:01 2017: user: admin service: ssh target: 185.39.221.52 source: 212.47.239.73 Tue Oct 3 02:07:46 2017: user: admin service: ssh target: 77.75.249.19 source: 212.47.239.73 Tue Oct 3 01:23:57 2017: user: admin service: ssh target: 85.158.176.137 source: 212.47.239.73 Mon Oct 2 20:10:45 2017: user: admin service: ssh target: 77.75.255.76 source: 212.47.239.73 Mon Oct 2 17:30:13 2017: user: admin service: ssh target: 185.39.221.145 source: 212.47.239.73 Mon Oct 2 17:30:13 2017: user: admin service: ssh target: 185.39.221.145 source: 212.47.239.73 Mon Oct 2 17:09:32 2017: user: admin service: ssh target: 37.228.154.149 source: 212.47.239.73 Mon Oct 2 17:09:23 2017: user: admin service: ssh target: 37.228.154.102 source: 212.47.239.73 Mon Oct 2 16:43:12 2017: user: admin service: ssh target: 77.75.252.233 source: 212.47.239.73 Mon Oct 2 16:23:41 2017: user: admin service: ssh target: 37.228.155.125 source: 212.47.239.73 Mon Oct 2 14:17:24 2017: user: admin service: ssh target: 77.75.250.84 source: 212.47.239.73 Mon Oct 2 13:24:14 2017: user: supervisor service: ssh target: 37.228.159.139 source: 212.47.239.73 Mon Oct 2 13:24:14 2017: user: support service: ssh target: 37.228.159.139 source: 212.47.239.73 Mon Oct 2 13:23:44 2017: user: super service: ssh target: 37.228.159.139 source: 212.47.239.73 Mon Oct 2 12:48:09 2017: user: user service: ssh target: 37.228.159.98 source: 212.47.239.73 Mon Oct 2 12:47:39 2017: user: user service: ssh target: 37.228.159.98 source: 212.47.239.73 ------ This data has been truncated because it was too long ------ Have any of you had this sort of problem? I'm having difficulty determining if this log information represents a normal exit relay ocurrence or if my server has been compromised... What could i do in order to solve this? Thank you all, Tanous

4 4

SSH brute force attempts to connect to my Middle Relay IP address
by Fr33d0m4all 04 Oct '17

04 Oct '17

Hi, My Tor middle relay public IP address is victim of SSH brute force connections’ attempts and the attack is going on since two weeks ago. It’s not a problem, the server that is listening with SSH on the same IP address than my Tor relay blocks the connections and bans the IP addresses (with Fail2Ban) but I just wanted to know if there is some campaign of attacks carried against Tor relays.. are you experiencing the same? The attacks are carried on with a botnet given the large amount of different IP addresses that I see in the logs. Best regards, Fr33d0m4All

10 11

Attacks to and from Tor
by Thomas Dünser 04 Oct '17

04 Oct '17

Hi everybody, I've read a few threads about attacks from exit nodes to the clear net and from the clear net to tor nodes and have several questions: -How can you recognize that the attacks to tor nodes are especially against Tor? -And how can a clear net user or better IDS easily differencing between an attacker that comes over Tor (exit node) or from a clear net host? I think this is important to categorize the situation. Thanks, Tom

2 1