- tor-relays - lists.torproject.org

tor-fw-helper
by Alexander Færøy 07 Apr '17

07 Apr '17

Hello. I'm interested in hearing if anybody on this list is currently using the tor-fw-helper[0] tool in their relay setup? We are currently fixing some issues in Tor's way of doing I/O between subprocesses, but before spending too much time on this task it would be useful to know if this tool is used at all. Cheers, Alex. [0]: https://gitweb.torproject.org/tor-fw-helper.git -- Alexander Færøy

2 1

rise in bridges starting with ~2017-03-28
by nusenu 06 Apr '17

06 Apr '17

Hi, I don't know if the discussion of the thread "22% of bridges run by a single entity?" [1] sparked this, but someone was very busy adding lots of obfs4 bridges. Normally you would see <50 new bridges per day, in the last few days we saw >120 new bridges per day. They all run tor 0.2.9.10, support the obfs4 transport and have a nickname that looks like it is generated from a dictionary. https://github.com/nusenu/tor-network-observations/blob/master/2017-03-29_m… You can even see it on metrics: https://metrics.torproject.org/networksize.html [1] https://lists.torproject.org/pipermail/tor-relays/2017-March/012156.html -- https://mastodon.social/@nusenu https://twitter.com/nusenu_

1 0

why my exit is not being used?
by gustavo panizzo (gfa) 06 Apr '17

06 Apr '17

Hello I ran sorrentini [1] as a relay for a month or two and everything was fine. then 2-3 weeks ago i decided to allow exit, the traffic went down significantly, is that expected? it has recovered a bit but i feel the node is underutilized, is it stational? I've attached node's munin graphs [1] https://atlas.torproject.org/#details/5E762A58B1F7FF92E791A1EA4F18695CAC667… here is my torrc # general Nickname sorrentini Log notice syslog ControlPort 9051 HashedControlPassword XXXXXXXXX AccountingStart month 01 00:00 AccountingRule sum AccountingMax 1024GB ContactInfo 0x44BB1BA79F6C6333 <tor-admin AT zumbi dot com dot ar> MyFamily 82C92FBAF2196EC346670D12BB9650FE9FF55741,EFD2EEB91E5C5D8CB999B1EC68D89E51F8776AC7 SocksPort 0 SocksPolicy reject * ## IPv4 ORPort 128.199.76.145:443 DirPort 128.199.76.145:80 Address 128.199.76.145 OutboundBindAddress 128.199.76.145 ##IPv6 IPv6Exit 1 ORPort [2400:6180:0:d0::18a7:d001]:443 OutboundBindAddress [2400:6180:0:d0::18a7:d001] # Exit DirPortFrontPage /etc/tor/tor-exit-notice.html CellStatistics 1 DirReqStatistics 1 EntryStatistics 1 ExitPortStatistics 1 ExtraInfoStatistics 1 HiddenServiceStatistics 1 ExitRelay 1 ExitPolicy accept *:53 # DNS ExitPolicy accept *:80 # HTTP ExitPolicy accept *:110 # POP3 ExitPolicy accept *:143 # IMAP ExitPolicy accept *:220 # IMAP3 ExitPolicy accept *:443 # HTTPS ExitPolicy accept *:873 # rsync ExitPolicy accept *:989-990 # FTPS ExitPolicy accept *:991 # NAS Usenet ExitPolicy accept *:992 # TELNETS ExitPolicy accept *:993 # IMAPS ExitPolicy accept *:995 # POP3S ExitPolicy accept *:1194 # OpenVPN ExitPolicy accept *:1293 # IPSec ExitPolicy accept *:3690 # SVN Subversion ExitPolicy accept *:4321 # RWHOIS ExitPolicy accept *:5222-5223 # XMPP, XMPP SSL ExitPolicy accept *:5228 # Android Market ExitPolicy accept *:9418 # git ExitPolicy accept *:11371 # OpenPGP hkp ExitPolicy accept *:64738 # Mumble ExitPolicy reject *:* # nothing else is allowed -- 1AE0 322E B8F7 4717 BDEA BF1D 44BB 1BA7 9F6C 6333 keybase: https://keybase.io/gfa

7 22

visualbasic033 relays: please update 'MyFamily' in your torrc
by nusenu 06 Apr '17

06 Apr '17

Hi visualbasic033, thanks for running relays. Please do not forget to set/update the MyFamily parameter in your torrc configuration to tell clients your relays belong to a single operator, otherwise they might use your relays in multiple positions within a circuit, which is rather bad for their anonymity. If you need help with the MyFamily option let us know. thanks, nusenu -- https://mastodon.social/@nusenu https://twitter.com/nusenu_ https://raw.githubusercontent.com/ornetstats/stats/master/o/potentially_dan… https://github.com/nusenu/ansible-relayor The counter in the last column should match the number of rows: +------------+------+-----------------+-----------+---------------+ | first_seen | exit | IP | nickname | FamilyMembers | +------------+------+-----------------+-----------+---------------+ | 2015-12-04 | 0 | 141.255.166.150 | doutreval | 1 | | 2016-03-07 | 1 | 162.220.246.230 | dlavolos | 1 | | 2016-08-08 | 1 | 91.223.82.156 | sowinetz | 1 | +------------+------+-----------------+-----------+---------------+

1 0

42bpm relays: please update 'MyFamily' in your torrc
by nusenu 06 Apr '17

06 Apr '17

Hi contact42bpm, thanks for adding a new relay. Please do not forget to set/update the MyFamily parameter in your torrc configuration to tell clients your relays belong to a single operator, otherwise they might use your relays in multiple positions within a circuit, which is rather bad for their anonymity. If you need help with the MyFamily option let us know. thanks, nusenu -- https://mastodon.social/@nusenu https://twitter.com/nusenu_ https://raw.githubusercontent.com/ornetstats/stats/master/o/potentially_dan… The counter in the last column should match the number of rows: +------------+------+-----------------+-------------+---------------+ | first_seen | exit | IP | nickname | FamilyMembers | +------------+------+-----------------+-------------+---------------+ | 2016-09-18 | 0 | 92.169.22.209 | RedOctober | 4 | | 2016-12-07 | 0 | 163.172.223.165 | May68 | 4 | | 2017-02-02 | 0 | 62.210.84.34 | 9OfDecember | 4 | | 2017-02-03 | 1 | 94.23.173.249 | 14OfJuly | 4 | | 2017-04-04 | 0 | 62.210.247.178 | 5OfNovember | 1 | +------------+------+-----------------+-------------+---------------+

1 0

Bandwidth Accounting troubles
by Tyler Johnson 03 Apr '17

03 Apr '17

Hello! I've enabled bandwidth accounting on my tor relay, but encountering issues when the relay attempts to wake from hibernation.... Mar 20 23:47:25 tcj Tor[74346]: Bandwidth soft limit reached; commencing hibernation. No new connections will be accepted Mar 20 23:52:30 tcj Tor[74346]: Heartbeat: Tor's uptime is 10 days 12:00 hours, with 150 circuits open. I've sent 90.20 GB and received 90.30 GB. We are currently hibernating. Mar 20 23:52:30 tcj Tor[74346]: Circuit handshake stats since last time: 2745/2745 TAP, 15557/15557 NTor. Mar 20 23:52:30 tcj Tor[74346]: Since startup, we have initiated 0 v1 connections, 0 v2 connections, 0 v3 connections, and 113565 v4 connections; and received 1100 v1 connections,130 v2 connections, 41 v3 connections, and 249967 v4 connections. Mar 21 00:00:00 tcj Tor[74346]: Configured hibernation. This interval began at 2017-03-21 00:00:00; the scheduled wake-up time was 2017-03-21 00:00:00; we expect to exhaust our quota for this interval around 2017-03-22 00:00:00; the next interval begins at 2017-03-22 00:00:00 (all times local) Mar 21 00:00:00 tcj Tor[74346]: Hibernation period ended. Resuming normal activity. Mar 21 00:00:00 tcj Tor[74346]: Opening OR listener on 185.92.223.3:8080 Mar 21 00:00:00 tcj Tor[74346]: Could not bind to 185.92.223.3:8080: Address already in use. Is Tor already running? Mar 21 00:01:00 tcj Tor[74346]: Opening OR listener on 185.92.223.3:8080 Mar 21 00:01:00 tcj Tor[74346]: Could not bind to 185.92.223.3:8080: Address already in use. Is Tor already running? Mar 21 00:02:01 tcj Tor[74346]: Opening OR listener on 185.92.223.3:8080 Mar 21 00:02:01 tcj Tor[74346]: Could not bind to 185.92.223.3:8080: Address already in use. Is Tor already running? It will continue in this manner until I manually intervene and restart the relay instance. snippet from torrc: ## Set a maximum of 30 gigabytes each way per period. AccountingMax 30 GBytes ## Each period starts daily at midnight (AccountingMax is per day) AccountingStart day 00:00 ## Required: what port to advertise for incoming Tor connections. ORPort 185.92.223.3:8080 ## The IP address or full DNS name for incoming connections to your ## relay. Leave commented out and Tor will guess. Address 185.92.223.3 ## If you have multiple network interfaces, you can specify one for ## outgoing traffic to use. OutboundBindAddress 185.92.223.3 Tor version and OS: $ tor --version Tor version 0.2.9.10 (git-1f6c8eda0073f464). $ uname -a OpenBSD tcj.me 6.1 GENERIC#224 amd64 Has anyone else experienced this issue? I have only one outbound interface, so is setting the OutboundBindAddress unnecessary and possibly causing the problem? I do apologize if this has been discussed already. Please point me to the relevant post if so! Thanks in advance, Tyler

2 4

22% of bridges run by a single entity?
by nusenu 30 Mar '17

30 Mar '17

Hi, is it known that (likely) a single entity is running ~22% of all bridges? (not the 'ki' bridges [1]) I'm not necessarily saying that this is bad, just curious and wondering if this is somehow known. Since contactinfo is removed from bridge descriptors before publication I can not tell whether this is i.e. torservers, Frenn vun der Enn, AccessNow, ... Added on [2] 2016-01-17 2016-01-18 2016-01-24 [1] https://lists.torproject.org/pipermail/tor-project/2016-December/000851.html [2] https://github.com/nusenu/tor-network-observations/blob/master/bridges_adde…

5 6

Re: [tor-relays] Hackers
by John Ricketts 30 Mar '17

30 Mar '17

Great. On Mar 29, 2017, at 01:03, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: Sure do . From: John Ricketts [mailto:john@quintex.com] Sent: Tuesday, March 28, 2017 11:02 PM To: contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com> Cc: tor-relays(a)lists.torproject.org<mailto:tor-relays@lists.torproject.org> Subject: Re: Hackers Sir, I do not know why you contacted me. You did not tell me what was attacked, when it was attacked, or how it was attacked. Now you're threatening to attack me. Clearly, you are not a reasonable person. Do what you must. My information is public, you know where I live and you have my telephone number. :-) John On Mar 29, 2017, at 00:57, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: Look pal, CC me again to your dark webbers and I will go after you. I clearly contacted you about a complaint for hackers coming from YOUR servers. I copied and pasted it right to you. Don't play games, "doc". Complaints: 1) Hackers are coming from your servers. 2) You're sharing my information with a large email list without my permission about hackers coming from your servers, for contacting you about these very same hackers. Don't play stupid. You know exactly why I contacted you.

3 3

(no subject)
by Nicholas K S Cullen 29 Mar '17

29 Mar '17

Please.unsubscribe me

2 2

(no subject)
by Nicholas K S Cullen 29 Mar '17

29 Mar '17

Please unsubscribe me

1 0