- tor-relays - lists.torproject.org

Want to help test 'Sandbox 1'? (Linux only)
by nusenu 02 Aug '17

02 Aug '17

Hi, I'm aiming to enable tor's 'Sandbox' feature by default on Debian based relays starting with the next release of ansible-relayor [1]. Before doing so I'd like to collect some feedback from tor relay operators willing to test this feature. If you - run tor 0.3.0.x >= 0.3.0.8 - are on Linux - willing to report proplems it would be greate if you could add the following line to your torrc configuration file: Sandbox 1 Ideally you have also a system monitoring in place that tells you whether this config change has any impact (i.e. on CPU or bandwidth). [1] https://github.com/nusenu/ansible-relayor -- https://mastodon.social/@nusenu https://twitter.com/nusenu_

5 6

Util helping maintain MyFamily
by Ryru 02 Aug '17

02 Aug '17

Hello Everyone I wrote a bash script helping maintaining the MyFamily string in torrc. The idea is to have one single file with all relay nicknames and there fingerprints and generate the MyFamily string uniquely for every node in the family. You will find a copy here: https://github.com/ryru/myfam If you like a bit more background check out: https://blog.addere.ch/2017/07/13/myfam-a-utility-helping-you-maintaining-y… Hope this helps anyone! cheers pascal

2 1

Debian9 install gpg repository problem
by Petrusko 01 Aug '17

01 Aug '17

Hey! I've set up quickly a Debian9 on a Windows Virtualbox. When trying to follow the guide here "Option two: Tor on Ubuntu or Debian" https://www.torproject.org/docs/debian.html.en#ubuntu The first command line result is (root account used) : # gpg --keyserver keys.gnupg.net --recv A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 gpg: failed to start the dirmngr '/usr/bin/dirmngr': Aucun fichier ou dossier de ce type gpg: connecting dirmngr at '/root/.gnupg/S.dirmngr' failed: Aucun fichier ou dossier de ce type gpg: keyserver receive failed: Pas de dirmngr -- Petrusko C0BF 2184 4A77 4A18 90E9 F72C B3CA E665 EBE2 3AE5

2 2

[warn] assign_to_cpuworker failed. Ignoring.
by Ybslik 31 Jul '17

31 Jul '17

Hi All, Me - 9D60A484CFBDB5B890FB5B18941494734584BA17 Have just had this occur to me - Copy of my torrc log Jul 31 14:37:34.000 [notice] Heartbeat: Tor's uptime is 32 days 23:28 hours, with 1287 circuits open. I've sent 901.91 GB and received 900.57 GB. Jul 31 14:37:34.000 [notice] Average packaged cell fullness: 70.114%. TLS write overhead: 2% Jul 31 14:37:34.000 [notice] Circuit handshake stats since last time: 3487/3487 TAP, 60593/60593 NTor. Jul 31 14:37:34.000 [notice] Since startup, we have initiated 0 v1 connections, 0 v2 connections, 3 v3 connections, and 900860 v4 connections; and received 3504 v1 connections, 254 v2 connections, 7 v3 connections, and 1142913 v4 connections. Jul 31 20:37:34.000 [notice] Heartbeat: Tor's uptime is 33 days 5:28 hours, with _41089_ circuits open. I've sent 909.67 GB and received 907.90 GB. Jul 31 20:37:34.000 [notice] Average packaged cell fullness: 72.276%. TLS write overhead: 2% Jul 31 20:37:34.000 [notice] Circuit handshake stats since last time: 3465/3465 TAP, 666475/666475 NTor. Jul 31 20:37:34.000 [notice] Since startup, we have initiated 0 v1 connections, 0 v2 connections, 3 v3 connections, and 908239 v4 connections; and received 3548 v1 connections, 254 v2 connections, 7 v3 connections, and 1155164 v4 connections. Jul 31 20:41:57.000 [warn] assign_to_cpuworker failed. Ignoring. Jul 31 20:41:57.000 [warn] assign_to_cpuworker failed. Ignoring. Jul 31 20:41:57.000 [warn] assign_to_cpuworker failed. Ignoring. Jul 31 20:41:57.000 [warn] assign_to_cpuworker failed. Ignoring. Jul 31 20:41:57.000 [warn] assign_to_cpuworker failed. Ignoring. Jul 31 20:41:57.000 [warn] assign_to_cpuworker failed. Ignoring. Jul 31 21:49:55.000 [warn] assign_to_cpuworker failed. Ignoring. Jul 31 21:49:55.000 [warn] assign_to_cpuworker failed. Ignoring. I've highlighted the number of circuits in red......never had that many before..... Is there anything I should be doing, Only been up 70 days or so, Thanks I am a novice at everything, especially with Ubuntu and moving around the system Ybslik (Steve Bishop)

2 1

Best configuration for high speed exit relay with limited bandwith (1Tb)
by King Queen 31 Jul '17

31 Jul '17

hi, I have a relatively new VPS on CockBox running a Tor exit node. It's the $10/month one https://box.cock.li/ which means it has very fast network (Gigabit I think) but I can only use 1TB per month. I've done some reading round of previous posts on here over the year, and as a result I have variously tried / toyed with RelayBandwidthRate (set at 150KBps so it averages ~800gb/month) and with AccountingMax (15GB with AccountingStart day 00:00) But I don't know what's best for the network. Is it best to have a very fast exit relay for a small portion of the day (so AccountingMax set but no RelayBandwidthRate), a not-so-fast exit relay for more of the day (so AccountingMax set at 15Gb and RelayBandwidthRate at 250KBps) or a slower-still exit relay for all the day (RelayBandwidthRate 150KBps and no AccountingMax?) What is of the most benefit to the Tor network? Also: I read somewhere that Tor should un-hibernate at a random point each day and not directly at 00:00 as set in AccountingStart, but that doesn't appear to be what happens. It just sets off at midnight. To combat any deleterious effect that lots of people doing this might have on the Tor network, if I do use AccountingMax, should I set AccountingStart to a random time in the day? Thanks - your guidance would be very much appreciated. Doug

2 1

network traffic gap of >=20% between inbount and outbound traffic vanished after 20th of July
by Toralf Förster 31 Jul '17

31 Jul '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I do wonder, what's causing this. As seen in the attachment since the last week incoming load matrches outgoing load. In the last 2-3 years I had always up to 20-25% more in- than outgoing traffic w/o any real clue, why. - -- Toralf PGP C4EACDDE 0076E94E -----BEGIN PGP SIGNATURE----- iI0EAREIADUWIQQaN2+ZSp0CbxPiTc/E6s3eAHbpTgUCWX4y0BccdG9yYWxmLmZv ZXJzdGVyQGdteC5kZQAKCRDE6s3eAHbpTk/LAP9y568uomJ0yF0SEr0a+YUJzRAw wq7knHtTbxinOvdu/wD/TKrwRZznAwCKT1YIlFd4Ac+Pllz7vmtw7orY7EQ9M4M= =pM2Y -----END PGP SIGNATURE-----

2 2

100K circuit request per minute for hours killed my relay
by Felix 31 Jul '17

31 Jul '17

Hi everybody I observed two circuit bursts around July 19th. On a poor server Tor crashed, on a strong it didn't. The logs below are from the crashed one. I'm on FreeBSD. To my mind the circuit burst exhausts the nmbclusters (not memory, Inact tells). Strong servers have more. How long is more enough ? On FreeBSD nmbclusters is a boot tunable. The strong server took 140k circuits for several hours. Is it worth thinking about a Tor setting like MaxCircuitsPerTime ? MaxAdvertisedBandwidth won't help directly. 1) Normal operation kern.openfiles: 5516 Mem: 36M Active, 1288M Inact, 455M Wired, 1452K Cache, 425M Buf, 191M Free Swap: 3072M Total, 3072M Free USERNAME PRI NICE SIZE RES STATE TIME CPU COMMAND _tor 87 0 309M 283M RUN 125.7H 50.00% tor{tor} _tor 22 0 309M 283M uwait 167:32 3.96% tor{tor} 2) Last minute before crash: kern.openfiles: 5467 Mem: 296M Active, 935M Inact, 692M Wired, 21M Cache, 425M Buf, 27M Free Swap: 3072M Total, 1592K Used, 3070M Free USERNAME PRI NICE SIZE RES STATE TIME CPU COMMAND _tor 85 0 465M 438M RUN 126.8H 43.99% tor{tor} _tor 33 0 465M 438M uwait 186:39 15.97% tor{tor} 3) Crashed: kern.openfiles: 5455 Mem: 295M Active, 936M Inact, 699M Wired, 21M Cache, 425M Buf, 21M Free Swap: 3072M Total, 1592K Used, 3070M Free kernel: [zone: mbuf_cluster] kern.ipc.nmbclusters limit reached sysctl kern.ipc.nmbclusters 126138 Heartbeat: Tor's uptime is 15 days 16:00 hours, with 1611 circuits Heartbeat: Tor's uptime is 15 days 17:00 hours, with 40471 circuits Heartbeat: Tor's uptime is 15 days 18:00 hours, with 88052 circuits Heartbeat: Tor's uptime is 15 days 19:00 hours, with 78444 circuits [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. -- Cheers, Felix

3 2

100K circuit request per minute for hours killed my relay
by Pascal Terjan 31 Jul '17

31 Jul '17

Last night for 4h30 (until VPS provider shut it down) one of my middle relays seems to have got in a bad state where it was using 100% CPU continuously It was not using much bandwidth, about 4MB/s, but reading the logs it seems it was getting a lot of circuit requests (70K/minute initially, 100K at the end). Is there anything I can do about it? Jul 20 19:41:20.000 [notice] Heartbeat: Tor's uptime is 157 days 18:00 hours, with 4642 circuits open. I've sent 13916.64 GB and received 13502.43 GB. Jul 20 19:41:20.000 [notice] Average packaged cell fullness: 98.154% Jul 20 19:41:20.000 [notice] TLS write overhead: 2% Jul 20 19:41:20.000 [notice] Circuit handshake stats since last time: 8823/8823 TAP, 112411/112806 NTor. Jul 21 00:52:06.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [398 similar message(s) suppressed in last 60 seconds] Jul 21 00:53:06.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [46893 similar message(s) suppressed in last 60 seconds] Jul 21 00:54:06.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [66339 similar message(s) suppressed in last 60 seconds] Jul 21 00:55:06.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restrict ed exit policy. [69939 similar message(s) suppressed in last 60 seconds] Jul 21 00:56:06.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restrict ed exit policy. [73055 similar message(s) suppressed in last 60 seconds] [...] Jul 21 04:19:08.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [101856 similar message(s) suppressed in last 60 seconds] Jul 21 04:20:08.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [97494 similar message(s) suppressed in last 60 seconds]

8 11

Tor relay operators at DEF CON
by Joel Cretan 29 Jul '17

29 Jul '17

Hi relay operators, If anyone at DEF CON is interested in meeting up, perhaps we could set up a meeting time, maybe in/around the Crypto and Privacy Village. Of course we're all interested in anonymity, so no pressure to speak up. But if enough people tell me they're interested, I'll try to organize something. Hope to meet some of you. Joel

4 9

badexit 29378422C99074D06331D5700E47451610B0D20D
by eric gisse 29 Jul '17

29 Jul '17

it looks like i've found an exit node mitm-ing ssh, or at least giving it a shot. https://atlas.torproject.org/#details/29378422C99074D06331D5700E47451610B0D… that exit policy looks more like a wishlist than anything else, at this point. notice all 3 sites have different clear wire ssh keys (obviously) but all the same when connecting over tor. what a coincidence! module code: https://github.com/jowrjowr/exitmap/blob/master/src/modules/sshmitm.py # ./bin/exitmap sshmitm -e 29378422C99074D06331D5700E47451610B0D20D 2017-07-29 16:52:36,797 exitmap [INFO] Attempting to invoke Tor process in directory "/tmp/exitmap_tor_datadir-root". This might take a while. 2017-07-29 16:52:36,798 exitmap [INFO] No first hop given. Using randomly determined first hops for circuits. 2017-07-29 16:52:37,369 util [INFO] Tor Bootstrapped 0%: Starting 2017-07-29 16:52:41,942 util [INFO] Tor Bootstrapped 80%: Connecting to the Tor network 2017-07-29 16:52:41,943 exitmap [INFO] Successfully started Tor process (PID=31779). 2017-07-29 16:52:42,117 exitmap [INFO] Running module 'sshmitm'. 2017-07-29 16:52:42,269 modules.sshmitm [INFO] obtaining ssh key information for destinations 2017-07-29 16:52:42,269 modules.sshmitm [INFO] getting key for github.com 2017-07-29 16:52:42,643 modules.sshmitm [INFO] getting key for gitlab.com 2017-07-29 16:52:42,889 modules.sshmitm [INFO] getting key for bitbucket.com 2017-07-29 16:52:58,807 relayselector [INFO] 216 relays have non-empty exit policy but no exit flag. 2017-07-29 16:52:58,816 relayselector [INFO] 1 out of 1000 exit relays meet all filter conditions. 2017-07-29 16:52:59,080 exitmap [INFO] Scan is estimated to take around 0:00:03. 2017-07-29 16:52:59,080 exitmap [INFO] Beginning to trigger 1 circuit creation(s). 2017-07-29 16:53:02,018 exitmap [INFO] Done triggering circuit creations after 0:00:02.937566. 2017-07-29 16:53:04,169 modules.sshmitm [CRITICAL] tor ssh key mismatch for github.com:22 (192.30.253.112) over exit relay 29378422C99074D06331D5700E47451610B0D20D clear wire value: AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==, over tor value: AAAAB3NzaC1yc2EAAAADAQABAAABAQCDQ73fwBw1OOjBIrR1TGVVUFn3LCUdVD6Gv0A1Dj2dp235PlHL3qu/w1WPbhS9YcX+OMRVwFOnoWAyZH8XU1/DHx/h21n4HzaVGkgODRuPt3+Q/ytn7Ehb9W3OZLCWCnhoD1HGKATOwhxfv+lLBbi0d37YVnmN6NkUG9db63n74mcj0wySYB+EMVNeoIQBsPiNk6NYDuVukfEsUAxUBBVoA2q117LdmJgdPJojz7wMvCyQMEOm1Vf6aXsTrl7/waCEvYVAgQanBvQMCp0Lq/r8noav8M+o/JMn3JDGqukqmyUG9wMPRoLWRP/RiC3alqTCG09PuqB4GmyvWpvv5iIT 2017-07-29 16:53:05,573 modules.sshmitm [CRITICAL] tor ssh key name mismatch for gitlab.com:22 (52.167.219.168) over exit relay 29378422C99074D06331D5700E47451610B0D20D clear wire value: ssh-ed25519, over tor value: ssh-rsa 2017-07-29 16:53:05,574 modules.sshmitm [CRITICAL] tor ssh key mismatch for gitlab.com:22 (52.167.219.168) over exit relay 29378422C99074D06331D5700E47451610B0D20D clear wire value: AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf, over tor value: AAAAB3NzaC1yc2EAAAADAQABAAABAQCDQ73fwBw1OOjBIrR1TGVVUFn3LCUdVD6Gv0A1Dj2dp235PlHL3qu/w1WPbhS9YcX+OMRVwFOnoWAyZH8XU1/DHx/h21n4HzaVGkgODRuPt3+Q/ytn7Ehb9W3OZLCWCnhoD1HGKATOwhxfv+lLBbi0d37YVnmN6NkUG9db63n74mcj0wySYB+EMVNeoIQBsPiNk6NYDuVukfEsUAxUBBVoA2q117LdmJgdPJojz7wMvCyQMEOm1Vf6aXsTrl7/waCEvYVAgQanBvQMCp0Lq/r8noav8M+o/JMn3JDGqukqmyUG9wMPRoLWRP/RiC3alqTCG09PuqB4GmyvWpvv5iIT 2017-07-29 16:53:06,957 modules.sshmitm [CRITICAL] tor ssh key mismatch for bitbucket.com:22 (104.192.143.8) over exit relay 29378422C99074D06331D5700E47451610B0D20D clear wire value: AAAAB3NzaC1yc2EAAAABIwAAAQEAubiN81eDcafrgMeLzaFPsw2kNvEcqTKl/VqLat/MaB33pZy0y3rJZtnqwR2qOOvbwKZYKiEO1O6VqNEBxKvJJelCq0dTXWT5pbO2gDXC6h6QDXCaHo6pOHGPUy+YBaGQRGuSusMEASYiWunYN0vCAI8QaXnWMXNMdFP3jHAJH0eDsoiGnLPBlBp4TNm6rYI74nMzgz3B9IikW4WVK+dc8KZJZWYjAuORU3jc1c/NPskD2ASinf8v3xnfXeukU0sJ5N6m5E8VLjObPEO+mN2t/FZTMZLiFqPWc/ALSqnMnnhwrNi2rbfg/rd/IpL8Le3pSBne8+seeFVBoGqzHM9yXw==, over tor value: AAAAB3NzaC1yc2EAAAADAQABAAABAQCDQ73fwBw1OOjBIrR1TGVVUFn3LCUdVD6Gv0A1Dj2dp235PlHL3qu/w1WPbhS9YcX+OMRVwFOnoWAyZH8XU1/DHx/h21n4HzaVGkgODRuPt3+Q/ytn7Ehb9W3OZLCWCnhoD1HGKATOwhxfv+lLBbi0d37YVnmN6NkUG9db63n74mcj0wySYB+EMVNeoIQBsPiNk6NYDuVukfEsUAxUBBVoA2q117LdmJgdPJojz7wMvCyQMEOm1Vf6aXsTrl7/waCEvYVAgQanBvQMCp0Lq/r8noav8M+o/JMn3JDGqukqmyUG9wMPRoLWRP/RiC3alqTCG09PuqB4GmyvWpvv5iIT 2017-07-29 16:53:06,959 eventhandler [INFO] Ran 1 module(s) in 0:00:30.168619 and 0/1 circuits failed (0.00%).

2 2