- tor-relays - lists.torproject.org

most (>57% cwfr) of the tor network still vulnerable to CVE-2016-8860 - update your relay!
by nusenu 01 Nov '16

01 Nov '16

just a reminder since most of the tor network (including some of the biggest operators) still runs vulnerable relays https://blog.torproject.org/blog/tor-0289-released-important-fixes Since 2/3 directory authorities removed most vulnerable versions from their 'recommended versions' you should see a log entry if you run outdated versions (except if you run 0.2.5.12). It is not possible to reliable determine the exact CW fraction affected[1] due to the fact that patches were released that didn't increase tor's version number. Therefore it is also possible that you get log entries even if you run a patched version (IMHO this hasn't been handled in the most professional way). Update instructions Debian/Ubuntu ============== make sure you use the Torproject repository: https://www.torproject.org/docs/debian.html.en (you can also use the debian repository but the Torproject's repo will provide you with the latest releases) aptitude update && aptitude install tor CentOS/RHEL/Fedora =================== yum install --enablerepo=epel-testing tor FreeBSD ============ pkg update pkg upgrade OpenBSD =========== pkg_add -u tor Windows ======== No updated binaries available for this platform yet. [1] as of 2016-10-25 18:00 (onionoo data) conservative estimate ---------------------- (counts only 0.2.8.9 and 0.2.9.4-alpha as patched) 31% CW fraction patched optimistic estimate ------------------- (additionally assumes every non-Windows running 0.2.4.27, 0.2.5.12, 0.2.6.10, 0.2.7.6 that restarted since 2016-10-17 is patched): 43% CW fraction patched

9 16

assign_to_cpuworker failed. Ignoring.
by Felix 01 Nov '16

01 Nov '16

Hi everybody May be someone can help with this warning: The security update (Tor v0.2.8.9 running on FreeBSD with Libevent 2.0.22-stable, OpenSSL LibreSSL 2.4.3 and Zlib 1.2.8.) shows the following log entry each hour: Oct 19 02:51:07.000 [warn] Your system clock just jumped 136 seconds forward; assuming established circuits no longer work. Oct 19 02:51:07.000 [warn] assign_to_cpuworker failed. Ignoring. ... Oct 19 02:51:07.000 [warn] assign_to_cpuworker failed. Ignoring. Oct 19 02:51:15.000 [notice] Tor has successfully opened a circuit. Looks like client functionality is working. ... Oct 19 03:51:10.000 [warn] Your system clock just jumped 138 seconds forward; assuming established circuits no longer work. Oct 19 03:51:11.000 [warn] assign_to_cpuworker failed. Ignoring. ... Oct 19 04:50:37.000 [warn] Your system clock just jumped 105 seconds forward; assuming established circuits no longer work. Oct 19 04:50:37.000 [warn] assign_to_cpuworker failed. Ignoring. ... Oct 19 05:51:14.000 [warn] Your system clock just jumped 142 seconds forward; assuming established circuits no longer work. Oct 19 05:51:15.000 [warn] assign_to_cpuworker failed. Ignoring. ... The warning first appeared on 2.8.7 after update on September 13th (Tor v0.2.8.7 running on FreeBSD with Libevent 2.0.22-stable, OpenSSL LibreSSL 2.4.2 and Zlib 1.2.8.). That time I switched back (Tor v0.2.7.6 running on FreeBSD with Libevent 2.0.22-stable, OpenSSL LibreSSL 2.4.2 and Zlib 1.2.8.) and the warning disappeared. What can I do? The warning is reproted in tor-talk: https:// lists.torproject.org/pipermail/tor-talk/2016-October/042425.html -- Best regards, Felix

3 7

Blocking Domains
by Tristan 01 Nov '16

01 Nov '16

Is it possible to block domain names in Tor's ExitPolicy? I've been getting abuses on *.panelboxmanager.com, and I'd like to be proactive about this if possible.

8 13

Stats not updated for several days?
by Pascal Terjan 01 Nov '16

01 Nov '16

For example https://atlas.torproject.org/#details/20462CBA5DA4C2D963567D17D0B7249718114… says uptime is 12 days and current version is 0.2.6.10 but I upgraded the machine and updated tor to 0.2.8.9 over a day ago: # uptime 09:30:50 up 1 day, 8:32, 1 user, load average: 0.68, 0.81, 0.88 # ps aux | grep t[o]r debian-+ 3389 60.4 15.3 510300 314260 ? Ssl Oct31 1177:17 /usr/bin/tor --defaults-torrc /usr/share/tor/tor-service-defaults-torrc -f /etc/tor/torrc --RunAsDaemon 0 # dpkg -l tor Desired=Unknown/Install/Remove/Purge/Hold | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad) ||/ Name Version Architecture Description +++-=========================================-=========================-=========================-======================================================================================== ii tor 0.2.8.9-1~xenial+1 amd64 anonymizing overlay network for TCP My new relay also is not known yet, and does not appear in "Family Members" while it was added yesterday.

5 7

OpenWrt
by Nima Fatemi 31 Oct '16

31 Oct '16

Hi relay operators, I'm curious to see if there are any openwrt users here and if by any chance any of you is running a relay or a bridge on it. Here's why: The current Tor package on openwrt is left without an active maintainer. I just send a patch to update it to 0.2.8.9 and I'm wondering whether it's worth to put the time and maintain the package. Best, -- Nima 0X58C4B928A3E218F6 | @mrphs "I disapprove of what you say, but I will defend to the death your right to say it" --Evelyn Beatrice Hall

2 1

ExitPolicy reject 184.107.0.0/16* funio.com
by Markus Koch 28 Oct '16

28 Oct '16

Getting abuse mass mails on nearly all exist in the last hours: The following intrusion attempts were detected: ./pilipia/pilipiak.com:188.166.63.113 - - [27/Oct/2016:18:06:35 -0400] "GET / HTTP/1.1" 200 5734 "-" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1" ./pilipia/pilipiak.com:188.166.63.113 - - [27/Oct/2016:18:06:36 -0400] "GET /?subscribe-email=dlcw87%40hotmail.com&subscribe-submit=Informez-moi& HTTP/1.1" 200 5734 "http://pilipiak.com/" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1" ./autoparcs.promoafrik.com:188.166.63.113 - - [27/Oct/2016:00:30:30 -0400] "GET / HTTP/1.1" 200 26737 "-" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1" ./autoparcs.promoafrik.com:188.166.63.113 - - [27/Oct/2016:00:30:31 -0400] "GET /search-listing.php?list_search_box=&subscribe=Search& HTTP/1.1" 200 9280 "http://autoparcs.com/" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1" ./pilipiak.com:188.166.63.113 - - [27/Oct/2016:18:06:35 -0400] "GET / HTTP/1.1" 200 5734 "-" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1" ./pilipiak.com:188.166.63.113 - - [27/Oct/2016:18:06:36 -0400] "GET /?subscribe-email=dlcw87%40hotmail.com&subscribe-submit=Informez-moi& HTTP/1.1" 200 5734 "http://pilipiak.com/" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1" ./promoaf/autoparcs.promoafrik.com:188.166.63.113 - - [27/Oct/2016:00:30:30 -0400] "GET / HTTP/1.1" 200 26737 "-" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1" ./promoaf/autoparcs.promoafrik.com:188.166.63.113 - - [27/Oct/2016:00:30:31 -0400] "GET /search-listing.php?list_search_box=&subscribe=Search& HTTP/1.1" 200 9280 "http://autoparcs.com/" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [26/Oct/2016:23:41:12 -0400] "GET /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [26/Oct/2016:23:41:16 -0400] "POST /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 116 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:00:02:49 -0400] "GET /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:00:02:51 -0400] "POST /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 116 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:10:32:33 -0400] "GET /index.php?option=com_user&task=activate&activation=e36afd6ab6a066e3485fcd4aedbc74ac HTTP/1.1" 200 11230 "-" "" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:10:32:34 -0400] "GET /index.php?option=com_user&view=login HTTP/1.1" 200 12349 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:10:32:36 -0400] "POST /index.php?option=com_user&view=login HTTP/1.1" 200 116 "http://hq-hospitality.com/index.php?option=com_user&view=login" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:10:32:38 -0400] "GET /index.php?option=com_user&view=user&task=edit HTTP/1.1" 200 25720 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:12:55:40 -0400] "GET /index.php?option=com_user&task=activate&activation=72ca806c4be186be71e7a5e0316e8681 HTTP/1.1" 200 11230 "-" "" ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:19:28:56 -0400] "GET /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [26/Oct/2016:23:41:12 -0400] "GET /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [26/Oct/2016:23:41:16 -0400] "POST /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 116 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:00:02:49 -0400] "GET /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:00:02:51 -0400] "POST /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 116 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:10:32:33 -0400] "GET /index.php?option=com_user&task=activate&activation=e36afd6ab6a066e3485fcd4aedbc74ac HTTP/1.1" 200 11230 "-" "" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:10:32:34 -0400] "GET /index.php?option=com_user&view=login HTTP/1.1" 200 12349 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:10:32:36 -0400] "POST /index.php?option=com_user&view=login HTTP/1.1" 200 116 "http://hq-hospitality.com/index.php?option=com_user&view=login" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:10:32:38 -0400] "GET /index.php?option=com_user&view=user&task=edit HTTP/1.1" 200 25720 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:12:55:40 -0400] "GET /index.php?option=com_user&task=activate&activation=72ca806c4be186be71e7a5e0316e8681 HTTP/1.1" 200 11230 "-" "" ./hqhospitality.hansen-quao.com:188.166.63.113 - - [27/Oct/2016:19:28:56 -0400] "GET /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0" Abuse Department Funio to stop the mass flood of abuse bot mails I tried to reject the IP space of funio but Tor is telling me its not allowed. Why? Markus

5 6

Abuses: Suspicious botnet ramnit attack
by pa011 28 Oct '16

28 Oct '16

Hi, got the abuse below on three different exits. Anybody having any idea what to do and how to possibly to stop this in the future? Thanks Paul CERT-EU has received information regarding an infected IP belonging to your network, which may have security problems. The information regarding the problems is also included as attachments in both CSV and XML formats. All timestamps are in UTC. At this time we do not have any more information. Where: - ASN: is the Autonomous System Number; - IP: the Internet Protocol address associated with this activity; - TIME: discovery time of the malicious activity; - PTR/DNAME: PTR/DNAME record - CC: ISO 3166-1 alpha-2 two-letter country code; - TYPE: type of the security problem or threat; - INFO: provides any additional information, if available.asn|ip|time|ptr|cc|type|info|info2 ASxxxxx|xxx.xxx.xxx.xxx|25-10-2016 12:10:09Z|XX|botnet drone|Description: Ramnit botnet victim connection to sinkhole details, Timestamp : 1477397409.72, City : none, Count: 8, First Seen: 25-10-2016 12:10:09, Last Seen: 25-10-2016

3 2

Re: [tor-relays] Digital Ocean - running Exit node locked
by Tristan 27 Oct '16

27 Oct '16

Guess I'm next. My relay has been running for 3 months now. I'm doing my best to be a good neighbor though. After the first month, I got an SSH abuse, so now I reject SSH traffic. A month later I got an SQL hack attempt, and I switched to the reduced-reduced exit policy. Haven't gotten anything else yet. On Oct 7, 2016 4:34 PM, "Markus Koch" <niftybunny(a)googlemail.com> wrote: They will kick you after 2-3 months. Delete account, make new account. They will kick you after 2-3 months. Delete account, make new account. They will kick you after 2-3 months. Delete account, make new account. They will kick you after 2-3 months. Delete account, make new account. Welcome to DigitalOcean! Markus 2016-10-07 23:23 GMT+02:00 pa011 <pa011(a)web.de>: > Seems like even DO is not very much in favour of running Exits any more ? > > Anybody made the same experience - how to handle this please ? > > Thanks and Regards > Paul > > > "Hello -Although we do not specifically disallow TOR exit nodes, as the account holder you are responsible for all the traffic going through your droplet (including traffic that an exit node may generate). > > Also be aware that we do not allow some of the traffic types that come out of a typical TOR exit node (torrents, spam, SSH probes, hacking attempts, botnets, DDoS, etc). > > If you are unable to stop this sort of traffic, please reconsider running a TOR exit node as it may lead to your account suspension or termination. > > Please refer to our Terms of Service for greater detail on this issue: https://www.digitalocean.com/legal/terms/ > > Best, > > DigitalOcean Support " > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

6 12

Rampup speed of Exit relay
by D.S. Ljungmark 27 Oct '16

27 Oct '16

Hi all, I'm looking at some traffic patterns for my Exit relay, and I'm frankly a bit disappointed with the utilization. Currently it's running at a load average of 0.3-0.5, and CPU idle at 70-80%. We're not limited on Bandwidth (tests show that our max cap is more than safe to produce), yet, we're barely reaching 20% of our potential allocated traffic. We've reached "fast" and "guard", and got the "stable" flag as well, so in theory we ought to see traffic move a bit higher than currently. So, how do we get tor to move past 100-200Mbit? Is it just a waiting game? //D.S. -- 8362 CB14 98AD 11EF CEB6 FA81 FCC3 7674 449E 3CFC

10 21

Really bad ISP
by Lluís 27 Oct '16

27 Oct '16

Hello, I am a relay operator in Spain (or at least I try to). I am just desperate with my ISP, he is just leaving the VDSL2 connection down several times a day, taking the relay with it. Does anyone know a much more stable, tor-friendly, ISP for an Spanish user ? The following record of assigned IPs in a **single** day shows the dimension of the drama: 95.23.157.152 - Tue Oct 25 01:00:02 CEST 2016 95.23.156.52 - Tue Oct 25 07:00:02 CEST 2016 95.23.157.180 - Tue Oct 25 11:54:06 CEST 2016 188.79.227.152 - Tue Oct 25 12:20:52 CEST 2016 95.23.155.112 - Tue Oct 25 13:12:30 CEST 2016 95.23.144.75 - Tue Oct 25 13:15:19 CEST 2016 188.77.208.15 - Tue Oct 25 13:29:02 CEST 2016 95.23.159.249 - Tue Oct 25 14:00:06 CEST 2016 95.23.146.89 - Tue Oct 25 14:12:12 CEST 2016 95.23.159.163 - Tue Oct 25 14:19:21 CEST 2016 188.79.238.188 - Tue Oct 25 14:34:55 CEST 2016 188.79.237.90 - Tue Oct 25 14:36:05 CEST 2016 188.79.229.164 - Tue Oct 25 14:57:30 CEST 2016 95.23.149.124 - Tue Oct 25 15:08:51 CEST 2016 188.79.237.0 - Tue Oct 25 15:10:12 CEST 2016 188.77.213.199 - Tue Oct 25 16:28:47 CEST 2016 95.23.153.98 - Tue Oct 25 16:32:50 CEST 2016 95.23.146.46 - Tue Oct 25 16:49:03 CEST 2016 188.79.235.239 - Tue Oct 25 17:10:03 CEST 2016 188.77.215.232 - Tue Oct 25 17:20:03 CEST 2016 95.23.146.36 - Tue Oct 25 17:30:03 CEST 2016 95.23.148.238 - Tue Oct 25 18:10:03 CEST 2016 95.23.149.136 - Tue Oct 25 18:20:03 CEST 2016 188.77.211.53 - Tue Oct 25 18:50:03 CEST 2016 188.77.211.90 - Tue Oct 25 19:30:03 CEST 2016 188.79.225.153 - Tue Oct 25 20:10:01 CEST 2016 95.23.157.171 - Tue Oct 25 21:00:02 CEST 2016 188.77.212.227 - Tue Oct 25 22:00:02 CEST 2016 95.23.157.179 - Tue Oct 25 22:30:02 CEST 2016 Thanks for your assintance, Lluís

3 5