- tor-relays - lists.torproject.org

Handling abuse - like to get your help please
by pa011 21 Jun '16

21 Jun '16

As I am new to this business could somebody please give me a hint how to best handle such an abuse complain - possibly stop it? Thanks, Regards and a nice weekend. we have detected abuse from the IP address xxx.xxx.xxx,xxx, which according to a whois lookup is on your network. We would appreciate if you would investigate and take action as appropriate. Log lines are given below, but please ask if you require any further information. If you are not the correct person to contact about this please accept our apologies - your e-mail address was extracted from the whois record by an automated process. This mail was automatically generated. Note: Local timezone is +0200 (CEST) /var/log/apache2/access.log:xxx.xxx.xxx.xxx - - [17/Jun/2016:09:25:50 +0200] "POST /cgi-bin/php-cgi?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%6E HTTP/1.1" 404 293 "-" "Mozilla/5.0 (iPad; CPU OS 6_0 like Mac OS X) AppleWebKit/536.26(KHTML, like Gecko) Version/6.0 Mobile/10A5355d Safari/8536.25" /var/log/apache2/access.log:xxx.xxx.xxx.xxx - - [17/Jun/2016:09:25:51 +0200] "POST /cgi-bin/php.cgi?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%6E HTTP/1.1" 404 293 "-" "Mozilla/5.0 (iPad; CPU OS 6_0 like Mac OS X) AppleWebKit/536.26(KHTML, like Gecko) Version/6.0 Mobile/10A5355d Safari/8536.25" /var/log/apache2/access.log:xxx.xxx.xxx.xxx - - [17/Jun/2016:09:25:52 +0200] "POST /cgi-bin/php4?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%6E HTTP/1.1" 404 290 "-" "Mozilla/5.0 (iPad; CPU OS 6_0 like Mac OS X) AppleWebKit/536.26(KHTML, like Gecko) Version/6.0 Mobile/10A5355d Safari/8536.25"

13 18

[warn] eventdns: All nameservers have failed
by pa011 20 Jun '16

20 Jun '16

Jun 19 20:24:38.000 [warn] eventdns: All nameservers have failed Jun 19 20:24:38.000 [notice] eventdns: Nameserver 8.8.4.4:53 is back up I do get this in my logs on an exit (Tor 0.2.7.6) several times every hour. The /etc/resolv.conf contains # Generated by SolusVM nameserver 8.8.8.8 nameserver 8.8.4.4 Is it really best to set only one DNS like specified here https://trac.torproject.org/projects/tor/ticket/11600 ? Or are there better working solutions?

4 3

Why are you using torproject's RPMs? (was: We need a new RPM maintainer)
by nusenu 17 Jun '16

17 Jun '16

(forwarding a question from tor-dev since here are probably more ops that might want to answer the question bellow) https://lists.torproject.org/pipermail/tor-dev/2016-June/011073.html Dear tor-relay operators, are you using torproject's RPMs (instead of those provided by your distro maintainer)? If so: Nick Mathewson asked: > People who download our RPMs: in what way are they beneficial?

3 4

Tor-arm
by NotRandom Someone 16 Jun '16

16 Jun '16

Hi everyone, I have a question about monitoring a tor middle relay. What do you think about using tor-arm ? Is it safe ? (Bugs, leaks,etc) ? Or using just the informations on globe/atlas.torproject.org is more useful ? Thank you.

6 5

8 universities doing joint HS research? (2016-06-12)
by nusenu 15 Jun '16

15 Jun '16

This looks interesting, 8 new relays joined together: http://article.gmane.org/gmane.network.onion-routing.ornetradar/1373 "hsde" => hidden service discovery?

2 1

DDOS
by Markus Koch 15 Jun '16

15 Jun '16

4 of my 5 tor servers are under a incoming DDOS attack. Am I the only one or is anyone else feeling the "love"? Markus

8 11

Re: [tor-relays] Tor Weather has been discontinued
by Arisbe 13 Jun '16

13 Jun '16

When did t-shirts become more important than the work we are doing to keep people safe and anonymous on the internet?

4 4

Filter Tor Exit Node for blatant attacks on servers
by Dr Gerard Bulger 13 Jun '16

13 Jun '16

It is heresy to suggest that Exit relays do anything of a sort, that is attempt to reject obvious attackers on an IP? Tor is neutral. Once TOR exits attempts any filtering where would it stop? It is a slippery slope. I think not, as to extend to other areas would far too complex and have diminishing returns. DMCA complaints for example was waste of time, and not all counties have copyright laws. I know that everyone on the internet should secure their servers, and take their own measures to block attacks, but too often those corporate measures include an automated abuse complaint being sent out. No explaining to ISP on what it means helps, as many of their staff are just too dumb and have to play safe. It is more than embarrassing to run an exit node and get abuse complaints about persistent and repeated attacks on an IP. The intent is clearly criminal. VPS providers in the UK are increasing intolerant in receiving such complaints. The whole VPS can be closed down by the ISP/VPS provider not forcing a closure of the TOR exit. Fewer ISPs will allow you to install an exit node at all. I am only wondering about blocking the obvious attacks or mass attacks to block. Is anyone developing such tools? Is it even possible? Those of us who would wish to enact such software, if it could be made, would have a flag on Tor Atlas stating that there is such a filter in place. Gerry

6 9

Re: [tor-relays] Tor Weather has been discontinued
by Michael Armbruster 12 Jun '16

12 Jun '16

On 2016-06-12 at 13:21, Jannis Wiese wrote: > I’m waiting since 7 months now. I know the guys who are handling the T-shirt requests are busy and I am (was) prepared to wait, but it’s a bit frustrating (if I think about it), to be honest. > >> On 08.06.2016, at 19:34, Markus Koch <niftybunny(a)googlemail.com> wrote: >> >> I am waiting since January? >> >> Hope has died a long time ago ... >> >> >> >> 2016-06-08 19:23 GMT+02:00 Michael Armbruster <tor(a)armbrust.me>: >>> On 2016-06-08 at 19:17, Green Dream wrote: >>>> The T-shirt incentive for relay operators is gone, as far as I know. >>>> >>>> If you donate $100 or more here you can pick a T-shirt as the >>>> gift: https://www.torproject.org/donate/donate.html.en >>>> >>>> There are many alternative ways to monitor the health and uptime of your >>>> relay. I like https://www.statuscake.com/ for this and their free plan >>>> is sufficient. I'm not affiliated with them, I just like their product. >>>> >>>> >>>> >>>> >>>> >>>> _______________________________________________ >>>> tor-relays mailing list >>>> tor-relays(a)lists.torproject.org >>>> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >>>> >>> >>> As far as I know, the incentive should still be there. At least it is >>> according to the web page. [1] >>> >>> But if it's really gone, it definitely has to be changed on the webpage, >>> as I myself am thinking right now that I should get a shirt. By the way, >>> I'm also already waiting for an answer for more than 2 weeks. >>> Just some time ago I heard somebody has waited 2 months to get an answer. >>> Well, I'm patient :) >>> >>> Best, >>> Michael >>> >>> [1] https://www.torproject.org/getinvolved/tshirt.html.en >>> >>> >>> _______________________________________________ >>> tor-relays mailing list >>> tor-relays(a)lists.torproject.org >>> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >>> >> _______________________________________________ >> tor-relays mailing list >> tor-relays(a)lists.torproject.org >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > Well, then it won't be several weeks for me to wait, but obviously it will be several months. I of course planned to let the exit node run, but it should definitely be handled in a better way. Even an automatic mail once in a month, stating "We will handle it, but we are busy right now" would give me a better feeling about it. Not even an answer in 2-3 weeks, or in your case 7 months feels a bit uncomfy.

6 7

Re: [tor-relays] Tor Weather has been discontinued
by Michael Armbruster 12 Jun '16

12 Jun '16

On 2016-06-13 at 01:08, Moritz Bartl wrote: > On 06/13/2016 12:17 AM, Green Dream wrote: >> As I already said 4 days ago in this thread, all indications are the >> t-shirt program is no longer active. > > Wrong. It's just being handled by one volunteer at the moment. If you > want shirts, go into a shop and buy a shirt. If you want to contribute > to Tor, and be appreciated and have that appreciation being shown to you > by the community by getting a shirt, wait and magic will happen. > >> If someone here really cares about the false promise of t-shirts, that >> person could submit a pull request to update the website accordingly. > > eg. https://trac.torproject.org/projects/tor/ticket/19354 > See? That's exactly what I wanted to hear. As you have a torservers.net e-mail address, you'll know what you are talking about. So thanks for the explanation. "One volunteer at the moment" is the explanation many people were searching for and I can happily wait for the appreciation of a Tor t-shirt. It's just not the same buying or printing one myself, it's the achievement to get one from the Tor project, so I will wait until they get to me. It was just the communication on why people have to wait so long :) Oh, and thanks for the trac link, it shows a pretty neat IRC log ^^

1 0