- tor-relays - lists.torproject.org

SSH Bruteforce Attempts
by tanous .c 05 Oct '17

05 Oct '17

Hi, I have been running one tor exit relay for about 51 days and i recently got this abuse report: Good afternoon, Your Ip address (212.47.239.73) has been reported to us by profihost because it seems to have attempted to bruteforce. Thank you to take the necessary action as soon as possible. You will find more information about this report below this message. Feel free to contact Online.net technical assistance for more information. Online.net Abuse service ------------------------------------------------------------------------------ (time is MET / GMT+1): Tue Oct 3 08:59:40 2017: user: root service: ssh target: 77.75.252.250 source: 212.47.239.73 Tue Oct 3 08:59:10 2017: user: root service: ssh target: 77.75.252.250 source: 212.47.239.73 Tue Oct 3 08:59:10 2017: user: root service: ssh target: 77.75.252.250 source: 212.47.239.73 Tue Oct 3 08:36:18 2017: user: admin service: ssh target: 37.228.155.188 source: 212.47.239.73 Tue Oct 3 07:06:42 2017: user: user service: ssh target: 77.75.252.80 source: 212.47.239.73 Tue Oct 3 07:06:12 2017: user: user1 service: ssh target: 77.75.252.80 source: 212.47.239.73 Tue Oct 3 06:14:12 2017: user: admin service: ssh target: 77.75.251.85 source: 212.47.239.73 Tue Oct 3 06:01:41 2017: user: admin service: ssh target: 77.75.252.78 source: 212.47.239.73 Tue Oct 3 05:37:01 2017: user: admin service: ssh target: 185.39.221.52 source: 212.47.239.73 Tue Oct 3 02:07:46 2017: user: admin service: ssh target: 77.75.249.19 source: 212.47.239.73 Tue Oct 3 01:23:57 2017: user: admin service: ssh target: 85.158.176.137 source: 212.47.239.73 Mon Oct 2 20:10:45 2017: user: admin service: ssh target: 77.75.255.76 source: 212.47.239.73 Mon Oct 2 17:30:13 2017: user: admin service: ssh target: 185.39.221.145 source: 212.47.239.73 Mon Oct 2 17:30:13 2017: user: admin service: ssh target: 185.39.221.145 source: 212.47.239.73 Mon Oct 2 17:09:32 2017: user: admin service: ssh target: 37.228.154.149 source: 212.47.239.73 Mon Oct 2 17:09:23 2017: user: admin service: ssh target: 37.228.154.102 source: 212.47.239.73 Mon Oct 2 16:43:12 2017: user: admin service: ssh target: 77.75.252.233 source: 212.47.239.73 Mon Oct 2 16:23:41 2017: user: admin service: ssh target: 37.228.155.125 source: 212.47.239.73 Mon Oct 2 14:17:24 2017: user: admin service: ssh target: 77.75.250.84 source: 212.47.239.73 Mon Oct 2 13:24:14 2017: user: supervisor service: ssh target: 37.228.159.139 source: 212.47.239.73 Mon Oct 2 13:24:14 2017: user: support service: ssh target: 37.228.159.139 source: 212.47.239.73 Mon Oct 2 13:23:44 2017: user: super service: ssh target: 37.228.159.139 source: 212.47.239.73 Mon Oct 2 12:48:09 2017: user: user service: ssh target: 37.228.159.98 source: 212.47.239.73 Mon Oct 2 12:47:39 2017: user: user service: ssh target: 37.228.159.98 source: 212.47.239.73 ------ This data has been truncated because it was too long ------ Have any of you had this sort of problem? I'm having difficulty determining if this log information represents a normal exit relay ocurrence or if my server has been compromised... What could i do in order to solve this? Thank you all, Tanous

4 4

SSH brute force attempts to connect to my Middle Relay IP address
by Fr33d0m4all 04 Oct '17

04 Oct '17

Hi, My Tor middle relay public IP address is victim of SSH brute force connections’ attempts and the attack is going on since two weeks ago. It’s not a problem, the server that is listening with SSH on the same IP address than my Tor relay blocks the connections and bans the IP addresses (with Fail2Ban) but I just wanted to know if there is some campaign of attacks carried against Tor relays.. are you experiencing the same? The attacks are carried on with a botnet given the large amount of different IP addresses that I see in the logs. Best regards, Fr33d0m4All

10 11

Attacks to and from Tor
by Thomas Dünser 04 Oct '17

04 Oct '17

Hi everybody, I've read a few threads about attacks from exit nodes to the clear net and from the clear net to tor nodes and have several questions: -How can you recognize that the attacks to tor nodes are especially against Tor? -And how can a clear net user or better IDS easily differencing between an attacker that comes over Tor (exit node) or from a clear net host? I think this is important to categorize the situation. Thanks, Tom

2 1

Feedback wanted: letter to my university's library
by AJ Jordan 02 Oct '17

02 Oct '17

Hey, all! I'm AJ; I've been lurking on this list for many years but have never had cause to post. I've run a Tor relay (`strugees`) on AWS for a number of years now, but haven't been able to dedicate all that much bandwidth to it due to cost concerns. However I've just started college at the University of Rochester, which obviously presents a great opportunity to set up a relay on a really great network. I'm planning to reach out to the library with the following email and would love some feedback: > Heya! > > I'm a new first-year student and I'm active in the technology > activism community. One of the things I'm very interested in is the > Tor Project (https://torproject.org) whose mission is to make it > possible to freely and anonymously use the internet, without fear of > surveillance or censorship. Tor is used by a wide variety of people > - activists, journalists, corporations, law enforcement, and > individuals - to gain free access to information and speak their > mind. Tor is able to provide this free expression by utilizing a > worldwide network of relays run by volunteers. A relay can make a > big difference on the Tor network if it's run on a connection which > is fast and has lots of bandwidth - like the University's > connection. > > I think it would be really cool if UR would donate part of its > internet resources to the Tor network. I considered directly > contacting IT, but I thought it actually made sense to talk to the > library first since the core values are actually really similar - > libraries and the Tor project both know the value and power of > unrestricted access to information and are dedicated to making > information available to anyone who wants it. > > If this is something that sounds interesting, I would love to chat > about this in person. I would also be willing to invest the time > needed to administrate the relay - I have several years of > experience doing this already, but haven't had access to the > resources the University has. > > Thanks very much! > > AJ Jordan Does anyone who's done something like this before have any tips or suggestions? Am I going about this in the best way? Cheers! AJ

8 9

Relay uptime versus outdated Tor version
by K. Besig 02 Oct '17

02 Oct '17

One of my relays has over 416 days of uptime, which I'm very proud of, however it's running an outdated version of Tor. I should probably already know the answer, but it seems to me I would have to stop the tor service to update the relay. Would I in fact lose my uptime or would it be seamless? Thanks for the response

14 21

bwauths doesn't reach reliable my relay
by Toralf Förster 30 Sep '17

30 Sep '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I do wonder why both longclaw and Faravahar seems since few days not to reach my relays 1AF72E8906E6C49481A791A6F8F84F8DFEBBB2BA and 6EABEBF38CE7E3DF672C4DB01383606FE3EB2215 respectively - resulting in a bw value of 20. B/c I switched to version 0.3.1.7 I do wonder if this could be the culprit ? - -- Toralf PGP C4EACDDE 0076E94E -----BEGIN PGP SIGNATURE----- iI0EAREIADUWIQQaN2+ZSp0CbxPiTc/E6s3eAHbpTgUCWcwE1BccdG9yYWxmLmZv ZXJzdGVyQGdteC5kZQAKCRDE6s3eAHbpTik4AP4ubRPDKm3jz73xGXmNAhupWarC 9pVPhRNqoD19jgpbGwD/QUnYKHIpbV4983kVMBjr9vbt2zwHRwmT0o+YMFJEVws= =NYwf -----END PGP SIGNATURE-----

3 6

Re: [tor-relays] About relay size
by Dhalgren Tor 30 Sep '17

30 Sep '17

FWIW I run a 100TB (150mbps) exit and am convinced that this size provides better quality exit connectivity than the highest ranked monster bandwidth relays. The biggest relays attract the greatest blacklist treatment due to the volume of abuse emanating from them. As a user of Tor I frequently observe connection attempts commencing with a handful of top-rated relays, only to work down to a mid-bandwidth relay such as mine before successfully completing. For this reason I would like to see the exit selection algorithm bias somewhat away from relays rated over 50000. Is annoying to wait 30 seconds for the discovery of a usable path. Hard 100mbps connections will be easier to manage than the 100TB class of service, as the latter is usually over a 1GB link with a FUP (fair use policy) associated with it and extravagant surcharges for exceeding the limit. ________________________________ >Hi Tor list, > >I'm already running a small exit node (100Mbps bandwidth) and I'm ready >to spend more money on it, so have a question for you guys : > >Is it better if I run other small ones (100Mbps too) or only 1 big exit >relay (1 Gbps) ? What's best for the network stability/security ? > >Thanks a lot > >IPonU

1 0

Info about HW Encryption on Raspberry
by Fr33d0m4all 29 Sep '17

29 Sep '17

Hi, I have a Raspberry Pi3 that runs a Tor mid-relay and I’ve noticed that in the last weeks it reaches high temperatures (about 76°C) due to high CPU usage when Tor traffic increases. It did not reach this temperature until this summer (but it is not due to an higher environment temperature), so I don’t know if it can be related to 0.3 version. Now I’m running Tor 0.3.1.7. Should Tor 0.3.x use Raspberry Pi3 AES-NI hardware acceleration to reduce high cpu usage? Is there a way to check and enable it if disabled? # openssl speed -evp aes-256-cbc Doing aes-256-cbc for 3s on 16 size blocks: 5560204 aes-256-cbc's in 3.00s Doing aes-256-cbc for 3s on 64 size blocks: 1631984 aes-256-cbc's in 3.00s Doing aes-256-cbc for 3s on 256 size blocks: 425826 aes-256-cbc's in 3.00s Doing aes-256-cbc for 3s on 1024 size blocks: 107776 aes-256-cbc's in 3.00s Doing aes-256-cbc for 3s on 8192 size blocks: 13489 aes-256-cbc's in 3.00s OpenSSL 1.0.1t 3 May 2016 built on: Fri Jan 27 22:44:27 2017 options:bn(64,32) rc4(ptr,char) des(idx,cisc,16,long) aes(partial) blowfish(ptr) compiler: gcc -I. -I.. -I../include -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN -DTERMIO -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -Wl,-z,relro -Wa,--noexecstack -Wall -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DAES_ASM -DGHASH_ASM The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes aes-256-cbc 29654.42k 34815.66k 36337.15k 36787.54k 36833.96k Best regards, Fr33d0m4All

2 1

NTor
by Sebastian Urbach 29 Sep '17

29 Sep '17

Dear List, I just noticed an increase from 670k to 8.8 million NTor handshakes. CPU load reached the limit and Consensus Weight dropped. Something is going around ... https://atlas.torproject.org/#details/4198BD138E5E11B15B05C826B427148CED7D9… -- Sincerely yours / M.f.G. / Sincères salutations Sebastian Urbach --------------------------------------------------------------------------- Those who surrender freedom for security will not have, nor do they deserve, either one. --------------------------------------------------------------------------- Benjamin Franklin (1706-1790)

1 0

No Gaurd
by Kurt Besig 29 Sep '17

29 Sep '17

https://atlas.torproject.org/#details/E65D300F11E1DB12C534B0146BDAB6972F1A8… Relay looks pretty stable to me, I'm re-visiting the lack of guard status... ideas?

4 3