- tor-relays - lists.torproject.org

Fwd: Spam mailout
by Petrusko 22 Nov '16

22 Nov '16

Hey, Here a copy of a mail containing an attached file logs_petrusko.zip containing .js sent to my mail address used for relays... This file edit here : https://framabin.org/?0b8d246a55e76e07#deg6j9x5HjLbtOhY9rA6FIiINzthE0t+qfYU… It smells like shit... I'm not 100% sure, but first time it happens on this mailbox. May be a new bot scanning relays informations...? Take care. ps: torrc contains this mail address obfuscated... not enough may be ? Here is the mail (name changed...), : Dear petrusko We've been receiving spam mailout from your address recently. Contents and logging of such messages are in the attachment. Please look into it and contact us. Best Regards, Marian Henderson ISP Support Tel.: xxx

4 4

33C3 Ticket
by pa011 21 Nov '16

21 Nov '16

Looking to meet other Exits in Hamburg - just need a ticket :-) Paul

1 0

Bug Log
by Kevin Zvilt 20 Nov '16

20 Nov '16

11/18/2016 17:28:08 PM.600 [NOTICE] Bootstrapped 85%: Finishing handshake with first hop 11/18/2016 17:28:08 PM.900 [NOTICE] Bootstrapped 90%: Establishing a Tor circuit 11/18/2016 17:28:10 PM.300 [NOTICE] Tor has successfully opened a circuit. Looks like client functionality is working. 11/18/2016 17:28:10 PM.300 [NOTICE] Bootstrapped 100%: Done 11/18/2016 17:28:11 PM.700 [NOTICE] New control connection opened from 127.0.0.1. 11/18/2016 17:28:11 PM.700 [NOTICE] New control connection opened from 127.0.0.1. 11/18/2016 17:32:25 PM.200 [NOTICE] Closing no-longer-configured Socks listener on 127.0.0.1:9150 11/18/2016 17:32:25 PM.200 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 11/18/2016 17:32:25 PM.200 [NOTICE] Closing old Socks listener on 127.0.0.1:9150 11/18/2016 17:32:25 PM.200 [NOTICE] Delaying directory fetches: DisableNetwork is set. 11/18/2016 22:38:05 PM.400 [NOTICE] Bootstrapped 85%: Finishing handshake with first hop 11/18/2016 22:38:06 PM.400 [NOTICE] Bootstrapped 90%: Establishing a Tor circuit 11/18/2016 22:38:06 PM.600 [NOTICE] Closing no-longer-configured Socks listener on 127.0.0.1:9150 11/18/2016 22:38:06 PM.600 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 11/18/2016 22:38:06 PM.600 [NOTICE] Closing old Socks listener on 127.0.0.1:9150 11/18/2016 22:38:07 PM.200 [NOTICE] Delaying directory fetches: DisableNetwork is set.

3 5

DoS from my tor guard VPS
by Arisbe 16 Nov '16

16 Nov '16

One of my tor guard relays is a medium size VPS operating in the Czech Republic. It's been up and stable for several years. Several weeks ago I was notified that my VPS was a source of UDP DoS traffic. It was shut down. Logs showed no intrusions. I installed a different instance of linux, changed my SSH port, added fail2ban and even installed clamav. I did not make changes to the tor exit policy. Then, this week I received the following: "Hello, surveillance system detected a disproportionate outgoing DoS traffic on your VPS torexitcz and then our network under a DDoS attack. Your server torexitcz has been stopped. This is another problem with your VPS. Your service will be terminated. Thanks for understanding." Can anyone offer an opinion as to how my relay was used for DoS? How can I avoid this in the future? My goal, as always is to provide stable nodes to the tor network while protecting myself and my VPS supplier. 4061C553CA88021B8302F0814365070AAE617270 185.100.85.101

5 4

Is my relay affected by cve-2016-8860?
by nusenu 15 Nov '16

15 Nov '16

https://blog.torproject.org/blog/tor-0289-released-important-fixes If you are unsure whether you are running a vulnerable tor relay, you can search your contact string on the following page (sorted by cw fraction): https://github.com/ornetstats/stats/blob/master/o/cve-2016-8860.txt (generated daily) If you are on that page you are likely running a vulnerable version (unless someone else is using your contactinfo as well) Unfortunately the opposite does not hold true - meaning you are not 100% safe if you are not listed (I tried to keep the false positives low for the price of a higher false-negative rate).

2 1

obfs4 - how to from source
by Petrusko 15 Nov '16

15 Nov '16

Hey! Coming here to take some good tips about obfs4 compil from source... Not enough time since http://archives.seul.org/or/relays/Jul-2016/msg00101.html Now it's ok to try another time ! On the Raspbian set up, I've started with : apt-get install git golang-go golang-go.crypto-dev golang-go.net-dev golang-goptlib-dev golang-ed25519-dev golang-siphash-dev After this, with /root/ account : go get git.torproject.org/pluggable-transports/obfs4.git/obfs4proxy Result is : *package git.torproject.org/pluggable-transports/obfs4.git/obfs4proxy: cannot download, $GOPATH not set. For more details see: go help gopath* I've tried many things, GOPATH=/home/petrusko and may be GOPATH=/home/petrusko/obfs4 Tried too to clone git with /git clone https://git.torproject.org/pluggable-transports/obfs4.git /And now I'm lost with this GOPATH problem ! Is there a wiki explaining how to compil/install this obfs4proxy from source. I've found nothing about it... From readme, I don't understand this... To build: `go get git.torproject.org/pluggable-transports/obfs4.git/obfs4proxy` To install: Copy `$GOPATH/bin/obfs4proxy` to a permanent location (Eg: `/usr/local/bin`) Many thx for help :) -- Petrusko EBE23AE5

2 6

Questions regarding arm on Debian
by Dennis Christ 14 Nov '16

14 Nov '16

Hi, i have installed a new relay on Debian 8 and playing around with the arm tool. 1. Issue: Seeing Connections I have added 'DisableDebuggerAttachment 0' to the config file as suggested and now i get this: 17:20:09 [ARM_NOTICE] We were unable to use any of your system's resolvers to get tor's connections. This is fine, but means that the connect- ions page will be empty. This is usually permissions related so if you would like to fix this then run arm with the same user as tor (ie, "sudo -u <tor user> arm"). 17:19:54 [ARM_NOTICE] Unable to query connections with lsof, trying ss 17:19:39 [ARM_NOTICE] Unable to query connections with sockstat, trying lsof 17:19:24 [ARM_NOTICE] Unable to query connections with netstat, trying sockstat 17:19:09 [ARM_NOTICE] Unable to query connections with proc, trying netstat Tor runs on Debian as user 'debian-tor' with no shell, so i cant just do 'sudo -u <tor user> arm' even if sudo was installed on the server. But i added my user to the debian-tor group. On a side note i never could get the CookieAuthentication working either. Seems to be permission issues with the default installation. Does somebody else have this issues on Debian? 2. Issue: It always says this message in the arm logs even if the service is just started a moment ago. If i reload the config it says the same thing shortly after. 17:18:59 [ARM_WARN] The torrc differs from what tor's using. You can issue a sighup to reload the torrc values by pressing x. - torrc values differ on lines: 118, 127 3. Issue: I dont understand this message. Nickname is edited by me so it does not match its default value. Also why is it unneeded? 17:18:59 [ARM_NOTICE] Unneeded torrc entries found. They've been highlighted in blue on the torrc page. - entry matches its default value: Nickname (line 117)

10 19

relaygroup in entry and exit position
by nusenu 14 Nov '16

14 Nov '16

Hi, thanks for running entry _and_ exit tor relays! You are one out of (currently) 7 relay operators [1] running entry _and_ exit relays (with guard probability > 0) without proper 'MyFamily' configuration. This can be dangerous for tor clients because they might choose you as entry _and_ exit relay. Please help protect tor clients by properly specifying the MyFamily configuration in your torrc files. MyFamily example configuration (a single line with all your relay fingerprints separated by comma): MyFamily 4A549160BEFA50EA10C2F4D6D80E9AFE20DBAF95,88C3708A9D71ECEC1910B63C3FAA5BF60CD7E199 https://atlas.torproject.org can help you show MyFamily misconfiguratons as well. If you need any help please let us know. kind regards, nusenu This list is auto-generated on a daily basis: [1] https://raw.githubusercontent.com/ornetstats/stats/master/o/potentially_dan…

1 0

Re: [tor-relays] torworld relays in entry and exit position
by nusenu 14 Nov '16

14 Nov '16

> We're just asking for an example line Example: MyFamily 4A549160BEFA50EA10C2F4D6D80E9AFE20DBAF95,88C3708A9D71ECEC1910B63C3FAA5BF60CD7E199 > But never the less we'll add this very soon to most of our nodes. "most"? > We're still testing our servers to see which ones will stay or get > cut from the network. We believe that next month on the 1st of > December would be a good time to add this feature. This way we'll be > done with our network testing, and the final cuts to it. This way; we > don't have to keep messing with the MyFamily line over and over > again. We've developed our own in house system for updating all the > nodes, and maintaining them. If there is an automated central management, there is no messing required at all ;)

1 0

Re: [tor-relays] torworld relays in entry and exit position
by nusenu 13 Nov '16

13 Nov '16

(resending this - not sure if the first attempt made it through) > Thank you for bringing this to our attention. We'll go a head, and do > proper research and add the MyFamily tags to all nodes. If you'd like > to give us an example copy to go off of that would be much > appreciated. If responding by email is too slow you're more than > welcomed to join our Slack team, and discuss this further in their. > https://slack.torworld.org > > Again thank you for reaching out to us. The MyFamily torrc setting is just a single line listing all your relay fingerprints. This setting tells tor clients "these are my relays: ... don't use more than one of my relays in any single circuit". This is particularly relevant if the entry _and_ exit probability of your group of relays is > 0% and your relays are spread across more than a single /16 network. Atlas.torproject.org can help you verify that the configuration is set up correctly (effective family has to list all your relays). If you expect to add/remove relays or adjust exit policies in the future on a more or less regular basis, I would suggest you use a configuration management like ansible or puppet to manage your relays - for your own convenience. I'm maintaining an ansible role to help tor relay operators manage MyFamily automatically - no more manual hassle (in addition to configure them using security features like 'OfflineMasterKey'). https://github.com/nusenu/ansible-relayor If you have any further questions - just let us know. regarding your slack group: I prefer to discuss this on the tor-relays mailing list instead of creating yet another place to discuss these topics.

1 0