- tor-relays - lists.torproject.org

Relay Fingerprint Changed After Updates
by Brian Kroll 22 Jun '16

22 Jun '16

Hi All, I had a weird event happen where the fingerprint of my relay changed after updates to the OS. The host is running Debian 8.3 and the Tor version was at 0.2.7.6 at the time of update. Apt was used to update packages and the following packages were installed/upgraded. libapt-inst1.5:amd64 (1.0.9.8.3) libssl1.0.0:amd64 (1.0.1t-1+deb8u2) libidn11:amd64 (1.29-1+deb8u1) libtasn1-6:amd64 (4.2-3+deb8u2) libxml2:amd64 (2.9.1+dfsg1-5+deb8u2) libcairo2:amd64 (1.14.0-2.1+deb8u1) libexpat1:amd64 (2.1.0-6+deb8u3) libglib2.0-0:amd64 (2.42.1-1+b1) libgdk-pixbuf2.0-common (2.31.1-2+deb8u5) libgdk-pixbuf2.0-0:amd64 (2.31.1-2+deb8u5) libgtk2.0-common (2.24.25-3+deb8u1) libgtk2.0-0:amd64 (2.24.25-3+deb8u1) libgtk2.0-bin (2.24.25-3+deb8u1) libnettle4:amd64 (2.7.1-5+deb8u1) libhogweed2:amd64 (2.7.1-5+deb8u1) libksba8:amd64 (1.3.2-1+deb8u1) apt-utils (1.0.9.8.3) libxapian22 (1.2.19-1+deb8u1) locales (2.19-18+deb8u4) openssh-client (1:6.7p1-5+deb8u2) openssh-sftp-server (1:6.7p1-5+deb8u2) openssh-server (1:6.7p1-5+deb8u2) openssl (1.0.1t-1+deb8u2) After the updates completed I checked on the status of the relay and noticed that it was not running and started the Tor process again. After starting the process the fingerprint changed. My relay BrownLine was 9504CB22EEB25D344DE63CB7A6F2C46F895C3686 and now after updates is 9C8A123081EFBE022EF795630F447839DDFDDDEC. I have looked through Tor logs and can find nothing of value but heartbeat notices. I have also reviewed system logs and can find nothing out of the ordinary. Any thoughts on this? Any help would be appreciated. I will also open a bug report if needed. Thanks! //Brian

2 1

Handling abuse - like to get your help please
by pa011 21 Jun '16

21 Jun '16

As I am new to this business could somebody please give me a hint how to best handle such an abuse complain - possibly stop it? Thanks, Regards and a nice weekend. we have detected abuse from the IP address xxx.xxx.xxx,xxx, which according to a whois lookup is on your network. We would appreciate if you would investigate and take action as appropriate. Log lines are given below, but please ask if you require any further information. If you are not the correct person to contact about this please accept our apologies - your e-mail address was extracted from the whois record by an automated process. This mail was automatically generated. Note: Local timezone is +0200 (CEST) /var/log/apache2/access.log:xxx.xxx.xxx.xxx - - [17/Jun/2016:09:25:50 +0200] "POST /cgi-bin/php-cgi?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%6E HTTP/1.1" 404 293 "-" "Mozilla/5.0 (iPad; CPU OS 6_0 like Mac OS X) AppleWebKit/536.26(KHTML, like Gecko) Version/6.0 Mobile/10A5355d Safari/8536.25" /var/log/apache2/access.log:xxx.xxx.xxx.xxx - - [17/Jun/2016:09:25:51 +0200] "POST /cgi-bin/php.cgi?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%6E HTTP/1.1" 404 293 "-" "Mozilla/5.0 (iPad; CPU OS 6_0 like Mac OS X) AppleWebKit/536.26(KHTML, like Gecko) Version/6.0 Mobile/10A5355d Safari/8536.25" /var/log/apache2/access.log:xxx.xxx.xxx.xxx - - [17/Jun/2016:09:25:52 +0200] "POST /cgi-bin/php4?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%6E HTTP/1.1" 404 290 "-" "Mozilla/5.0 (iPad; CPU OS 6_0 like Mac OS X) AppleWebKit/536.26(KHTML, like Gecko) Version/6.0 Mobile/10A5355d Safari/8536.25"

13 18

[warn] eventdns: All nameservers have failed
by pa011 20 Jun '16

20 Jun '16

Jun 19 20:24:38.000 [warn] eventdns: All nameservers have failed Jun 19 20:24:38.000 [notice] eventdns: Nameserver 8.8.4.4:53 is back up I do get this in my logs on an exit (Tor 0.2.7.6) several times every hour. The /etc/resolv.conf contains # Generated by SolusVM nameserver 8.8.8.8 nameserver 8.8.4.4 Is it really best to set only one DNS like specified here https://trac.torproject.org/projects/tor/ticket/11600 ? Or are there better working solutions?

4 3

Why are you using torproject's RPMs? (was: We need a new RPM maintainer)
by nusenu 17 Jun '16

17 Jun '16

(forwarding a question from tor-dev since here are probably more ops that might want to answer the question bellow) https://lists.torproject.org/pipermail/tor-dev/2016-June/011073.html Dear tor-relay operators, are you using torproject's RPMs (instead of those provided by your distro maintainer)? If so: Nick Mathewson asked: > People who download our RPMs: in what way are they beneficial?

3 4

Tor-arm
by NotRandom Someone 16 Jun '16

16 Jun '16

Hi everyone, I have a question about monitoring a tor middle relay. What do you think about using tor-arm ? Is it safe ? (Bugs, leaks,etc) ? Or using just the informations on globe/atlas.torproject.org is more useful ? Thank you.

6 5

8 universities doing joint HS research? (2016-06-12)
by nusenu 16 Jun '16

16 Jun '16

This looks interesting, 8 new relays joined together: http://article.gmane.org/gmane.network.onion-routing.ornetradar/1373 "hsde" => hidden service discovery?

2 1

DDOS
by Markus Koch 15 Jun '16

15 Jun '16

4 of my 5 tor servers are under a incoming DDOS attack. Am I the only one or is anyone else feeling the "love"? Markus

8 11

Re: [tor-relays] Tor Weather has been discontinued
by Arisbe 13 Jun '16

13 Jun '16

When did t-shirts become more important than the work we are doing to keep people safe and anonymous on the internet?

4 4

Filter Tor Exit Node for blatant attacks on servers
by Dr Gerard Bulger 13 Jun '16

13 Jun '16

It is heresy to suggest that Exit relays do anything of a sort, that is attempt to reject obvious attackers on an IP? Tor is neutral. Once TOR exits attempts any filtering where would it stop? It is a slippery slope. I think not, as to extend to other areas would far too complex and have diminishing returns. DMCA complaints for example was waste of time, and not all counties have copyright laws. I know that everyone on the internet should secure their servers, and take their own measures to block attacks, but too often those corporate measures include an automated abuse complaint being sent out. No explaining to ISP on what it means helps, as many of their staff are just too dumb and have to play safe. It is more than embarrassing to run an exit node and get abuse complaints about persistent and repeated attacks on an IP. The intent is clearly criminal. VPS providers in the UK are increasing intolerant in receiving such complaints. The whole VPS can be closed down by the ISP/VPS provider not forcing a closure of the TOR exit. Fewer ISPs will allow you to install an exit node at all. I am only wondering about blocking the obvious attacks or mass attacks to block. Is anyone developing such tools? Is it even possible? Those of us who would wish to enact such software, if it could be made, would have a flag on Tor Atlas stating that there is such a filter in place. Gerry

6 9

Re: [tor-relays] Tor Weather has been discontinued
by Michael Armbruster 13 Jun '16

13 Jun '16

On 2016-06-12 at 13:21, Jannis Wiese wrote: > I’m waiting since 7 months now. I know the guys who are handling the T-shirt requests are busy and I am (was) prepared to wait, but it’s a bit frustrating (if I think about it), to be honest. > >> On 08.06.2016, at 19:34, Markus Koch <niftybunny(a)googlemail.com> wrote: >> >> I am waiting since January? >> >> Hope has died a long time ago ... >> >> >> >> 2016-06-08 19:23 GMT+02:00 Michael Armbruster <tor(a)armbrust.me>: >>> On 2016-06-08 at 19:17, Green Dream wrote: >>>> The T-shirt incentive for relay operators is gone, as far as I know. >>>> >>>> If you donate $100 or more here you can pick a T-shirt as the >>>> gift: https://www.torproject.org/donate/donate.html.en >>>> >>>> There are many alternative ways to monitor the health and uptime of your >>>> relay. I like https://www.statuscake.com/ for this and their free plan >>>> is sufficient. I'm not affiliated with them, I just like their product. >>>> >>>> >>>> >>>> >>>> >>>> _______________________________________________ >>>> tor-relays mailing list >>>> tor-relays(a)lists.torproject.org >>>> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >>>> >>> >>> As far as I know, the incentive should still be there. At least it is >>> according to the web page. [1] >>> >>> But if it's really gone, it definitely has to be changed on the webpage, >>> as I myself am thinking right now that I should get a shirt. By the way, >>> I'm also already waiting for an answer for more than 2 weeks. >>> Just some time ago I heard somebody has waited 2 months to get an answer. >>> Well, I'm patient :) >>> >>> Best, >>> Michael >>> >>> [1] https://www.torproject.org/getinvolved/tshirt.html.en >>> >>> >>> _______________________________________________ >>> tor-relays mailing list >>> tor-relays(a)lists.torproject.org >>> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >>> >> _______________________________________________ >> tor-relays mailing list >> tor-relays(a)lists.torproject.org >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > Well, then it won't be several weeks for me to wait, but obviously it will be several months. I of course planned to let the exit node run, but it should definitely be handled in a better way. Even an automatic mail once in a month, stating "We will handle it, but we are busy right now" would give me a better feeling about it. Not even an answer in 2-3 weeks, or in your case 7 months feels a bit uncomfy.

6 7