- tor-relays - lists.torproject.org

Question on warnings
by Santiago Roland 30 May '16

30 May '16

Hi, i have installed a non-exit relay in my home server and for many days i have had this warnings: 20:42:57 [ARM_NOTICE] Unable to prepopulate bandwidth information (unable to read the state file) 20:42:56 [ARM_WARN] Unable to read tor's log file: /var/log/tor/log [1 duplicate hidden] 20:42:56 [ARM_NOTICE] Tor is preventing system utilities like netstat and lsof from working. This means that arm can't provide you with connection information. You can change this by adding 'DisableDebuggerAttachment 0' to your torrc and restarting tor. For more information see... https://trac.torproject.org/3313 20:42:52 [ARM_NOTICE] No armrc loaded, using defaults. You can customize arm by placing a configuration file at '/home/santiago/.arm/armrc' (see the armrc.sample for its options). I just wanted to know if there are safe warnings or should i modify something in my config Best regards, -- Santiago Roland.- --------------------------------- Jabber: santiago(a)undernet.uy GNU Social: http://bit.ly/gnusr openPGP ID: 5ADF0F53 openPGP key: http://bit.ly/pgpun CX1DR - Grid Locator: GF25bf ---------------------------------

2 1

I'm Running A Tor Exit Node And NEVER Initiated It
by Percy Blakeney 30 May '16

30 May '16

Like I stated a few minutes ago, I am and have been running Tor from my location yet I have nothing to do with it. I have been sitting on this for a while. Before anyone comes down on me for it, you have to understand what I've been going through with my network. Tor is only the tip of the iceberg. This is as of today: usr/share/tor/tor-service-defaults-torrc DataDirectory /var/lib/tor PIDFile /var/run/tor/tor.pid RunasDaemon 1 user debian-tor control socket /var/run/tor/control control socket group writable 1 cookie authentication 1 cookie auth file group readable 1 cookie auth file /var/run/tor/control-authcookie log notice file /var/log/tor/log etc/tor/torrc contact info 0xFFFFFFFF Random Person <nobody AT example dot com> #Dirport 80 No Listen #Dirport 127.0.0.1:9091 No Advertise #Dirport front page /etc/tor/tor-exit-notice.html #Exit Policy Accept *:6660-6667, reject *:* #allow irc ports but no more #accept *:119 # accept nntp as well as default exit policy var/lib/tor lock-Mon 16 May 2016 09:48:32 PM EDT (File content is not visible to me) cached-certs-Mon 16 May 2016 09:48:32 PM EDT (File content is not visible to me) cached-microdescs-Mon 16 May 2016 10:18:34 PM EDT (File content is not visible to me) cached-microdescs.new-Mon 16 May 2016 10:18:34 PM EDT (File content is not visible to me) state-Wed 25 May 2016 04:36:02 AM EDT (This one IS visible) cached-microdesc-consensus-Sun 29 May 2016 09:17:15 AM EDT (File content is not visible to me) tor.pid-32156 /var/lib/tor/state #Tor state file last generated on 2016-05-25 04:36:02 local time #Other times below are in UTC #You *do not* need to edit this file. EntryGuard Jans 50586E25BE067FD1F739998550EDDCB1A14CA5B2 DirCache EntryGuardAddedBy 50586E25BE067FD1F739998550EDDCB1A14CA5B2 0.2.4.27 2016-04-28 16:16:20 THERE'S WAY more to the above file but I'm not sure what I should and shouldn't share on here. As a matter of fact, I'm not sure what half of this stuff means so I've spent the last few months trying to educate myself on as much of this as possible. Like I said, I am MORE than willing to talk to anyone out there who may be able to help.

9 15

Re: [tor-relays] I'm Running A Tor Exit But Never Initiated It
by david.carlson.417＠gmail.com 29 May '16

29 May '16

Two thoughts: I did not see mentioned whether your Wi-fi is secured.If your running a guest machine in a vm you will not know about the host.Have you tried booting into a rescue DVD? David C Sent from my LG G Pad 7.0 LTE, an AT&T 4G LTE tablet ------ Original message------From: ng0Date: Sun, May 29, 2016 12:36 PMTo: tor-relays@lists.torproject.org;Subject:Re: [tor-relays] I'm Running A Tor Exit But Never Initiated It On 2016-05-29(04:32:12+0000), krutt(a)anche.no wrote:> Hey there,>> This situation sounds really weird. Could you try running> sudo cat /var/lib/tor/fingerprint> on one of your Tor-machines? Then we can determine whether you are> really running an exit relay.>> As Arjen stated before, you can probably remove the Tor package with> sudo apt-get install torCorrection: apt-get remove tor> Best regards,> KRutt>> Percy Blakeney:> > There is NO ONE else in this house that uses my computers other than my 13> > year old daughter who plays Minecraft on hers. I have one Dell desktop> > that runs Linux Mint Rosa, however, sometimes when I turn it on a black> > screen appears with a message stating "VirtualBox restarting." Neither my> > child nor myself installed VirtualBox on the desktop. I also have an Acer> > laptop that runs Linux Mint Mate and a Lenovo that runs Windows 10. When I> > try to install the Tor browser on my Acer it tells me I already have it and> > it's running, however when I try to open it I'm told I don't have it. Yet> > my folders and files tell me otherwise. I have so much to get out that> > once again I'll apologize for my ADD responses.> >> > On Sun, May 29, 2016 at 11:23 AM, krutt(a)anche.no wrote:> >> >> Hey percy,> >>> >> I can't image a single reason why Tor should be configured to run a> >> relay without the system admins knowledge. Are there any other useres> >> with root access at those machines?> >> You could issue "(sudo) ls -al" on that folder to find out when the Tor> >> configs were created. Are there any other settings set in your torrc?> >>> >> I'm not quite sure but this could be a "good" crypto locker too.> >>> >> Best regards,> >> KRutt> >>> >> Percy Blakeney:> >>> According to files and folders I have on two separate computers in my> >>> house, I am running a Tor exit but I absolutely have nothing to do with> >>> it. I am only able to physically view certain files ie; var/log/tor,> >>> etc/tor/torrc, while other files like var /lib/tor/lock the content is> >>> invisible. I am MORE than willing to talk to anyone who may be able to> >>> help.--♥Ⓐ ng0 | http://www.n0.is/u/n4096R/13212A27975AF07677A29F7002A296150C201823_________… mailing listtor-relays@lists.torproject.orghttps://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

2 1

Fwd: Enable relay as trusted directory & entry guard
by Tim Wilson-Brown - teor 26 May '16

26 May '16

> Begin forwarded message: > > From: Austin Holiday <aholiday(a)yahoo.com> > Subject: Enable relay as trusted directory & entry guard > Date: 25 May 2016 at 23:24:42 GMT-3 > > Hi, > > I have the extra capacity/bandwidth would like to upgrade my relay to an entry node and directory server: > https://atlas.torproject.org/#details/1523C502A9754B6B42CCA5EB402A833CFF0E4… > > Is there anything I need to do? Hi, This question is best answered on the tor-relays list, I've cc'd the reply there. Your relay may be recommended as a "Guard" (entry node) by the directory authorities if it has enough stability and bandwidth over time. For more information, please read: https://blog.torproject.org/blog/lifecycle-of-a-new-relay Your relay is already a directory mirror, because you have configured a DirPort. Tim Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP 968F094B ricochet:ekmygaiu4rzgsk6n

1 0

Re: [tor-relays] VPS for Exits
by Neel Chauhan 25 May '16

25 May '16

> An exit node could be expensive ... Well, I'm still sticking with CoolHousing/Virtual Server Lite because I hardly ever get abuse complaints. For ITL, I may leave after my term expires. But a few other companies I found were: https://hostmaze.com/ https://www.lcsnet.eu/index.php https://serverastra.com/ https://blazingfast.io/ Thanks, Neel Chauhan https://www.neelc.org/

4 3

TOR router install without access to root
by Markus Koch 25 May '16

25 May '16

possible or do I have to ask my hosting company for the install on a shared server? Markus

9 17

Re: [tor-relays] VPS for Exits
by Neel Chauhan 23 May '16

23 May '16

>Do you know of a VPS for an exit? I have two exits on VPS servers. One is on ITL (https://itldc.com/) and the other one is on CoolHousing using their Virtual Server Lite brand (http://virtualniserverlite.cz/en/) My experience with both hosts has been very good. For the latter, you WILL need a Reduced Exit Policy, and have to remove IRC ports. I also previously had a VPS with Verelox (https://verelox.com/) when they had unlimited bandwidth, and they allow Tor exit nodes as well. I don't know about other providers, but a good place to ask for a Tor friendly VPS is vpsBoard (https://vpsboard.com/) -Neel Chauhan https://www.neelc.org/

4 3

New month, new TOR exit servers, need ELI5 pls
by Markus Koch 22 May '16

22 May '16

As I told you guys ITLDC.com kicked 3 of my exit servers last month. Just got 3 new ones, hosted by DigitalOcean, Hostwinds and soon virtualniserverlite. If things go wrong (and with my luck they will) how many and which ports do I have to forward to be useful as a exit node? eg: I get lots of abuse of port 22, can I close it and the TOR network will for itself find out that sending me ssh traffic is a bad idea? markus

4 7

Re: [tor-relays] New month, new TOR exit servers, need ELI5 pls
by Tristan 22 May '16

22 May '16

You can close port 22 by adding it to your exit policy. The syntax would be something like ExitPolicy reject *:22 You should put this towards the top of the exit policy rules so it isn't overridden by other rules. On May 22, 2016 8:34 AM, "Markus Koch" <niftybunny(a)googlemail.com> wrote: As I told you guys ITLDC.com kicked 3 of my exit servers last month. Just got 3 new ones, hosted by DigitalOcean, Hostwinds and soon virtualniserverlite. If things go wrong (and with my luck they will) how many and which ports do I have to forward to be useful as a exit node? eg: I get lots of abuse of port 22, can I close it and the TOR network will for itself find out that sending me ssh traffic is a bad idea? markus _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

Port scanning via exit node
by ken＠kenbaker.co.uk 21 May '16

21 May '16

Hi Folks: I got an abuse complaint from my VPS host, because someone was using my exit node for port scanning. Here is the first bit of his (redacted) log. Attack detail : 4K scans dateTime srcIp:srcPort dstIp:dstPort protocol flags bytes reason 2016.05.14 17:13:47 CEST xxx.xxx.xxx.xxx:35008 xxx.xxx.xxx.xxx:22 TCP SYN 60 SCAN:SYN 2016.05.14 17:13:47 CEST xxx.xxx.xxx.xxx:46532 xxx.xxx.xxx.xxx:22 TCP SYN 60 SCAN:SYN 2016.05.14 17:13:47 CEST xxx.xxx.xxx.xxx:41718 xxx.xxx.xxx.xxx:22 TCP SYN 60 SCAN:SYN Hosting dude says he'd appreciate it if I could prevent this, but I'm not sure how. I'm afraid I don't have any logs - the VPS got reimaged. Suggestions how to prevent or mitigate this are welcome. Cheers, K.

3 3