- tor-relays - lists.torproject.org

Re: [tor-relays] TOR service wont start with ORPort enabled (SuperSluether)
by Volker Mink 15 Feb '16

15 Feb '16

Hi! This command brings no output. So no Port 9001 in use... Message: 3 Date: Sun, 14 Feb 2016 07:48:07 -0600 From: SuperSluether <supersluether(a)gmail.com> To: tor-relays(a)lists.torproject.org Subject: Re: [tor-relays] TOR service wont start with ORPort enabled Message-ID: <56C08597.10905(a)gmail.com> Content-Type: text/plain; charset="windows-1252"; Format="flowed" Try running "sudo lsof -i :9001" That should tell you what process is bound to the port, and also give you the PID so you can kill it. ***************************

1 0

Re: [tor-relays] TOR service wont start with ORPort enabled
by Volker Mink 14 Feb '16

14 Feb '16

I think I found something..... >> could not bind to 0.0.0.0:9001: address already in use Where can i set the binding? Feb 14 14:04:59 raspberrypi tor[499]: Starting tor daemon...Feb 14 14:04:59.318 [warn] Could not bind to 0.0.0.0:9001: Address already in use. Is Tor already running? Feb 14 14:04:59 raspberrypi tor[499]: Feb 14 14:04:59.324 [warn] Failed to parse/validate config: Failed to bind one of the listener ports. Feb 14 14:04:59 raspberrypi systemd[1]: tor.service: control process exited, code=exited status=1 Feb 14 14:04:59 raspberrypi tor[499]: Feb 14 14:04:59.328 [err] Reading config failed--see warnings above. Feb 14 14:04:59 raspberrypi tor[499]: failed. Feb 14 14:04:59 raspberrypi systemd[1]: Failed to start LSB: Starts The Onion Router daemon processes. Feb 14 14:04:59 raspberrypi systemd[1]: Unit tor.service entered failed state. Feb 14 14:04:59 raspberrypi systemd[1]: Starting Multi-User System. Feb 14 14:04:59 raspberrypi systemd[1]: Reached target Multi-User System. Feb 14 14:04:59 raspberrypi systemd[1]: Starting Graphical Interface. Feb 14 14:04:59 raspberrypi systemd[1]: Reached target Graphical Interface. Feb 14 14:04:59 raspberrypi systemd[1]: Starting Update UTMP about System Runlevel Changes... Feb 14 14:04:59 raspberrypi systemd[1]: Started Update UTMP about System Runlevel Changes. Feb 14 14:04:59 raspberrypi systemd[1]: Startup finished in 2.206s (kernel) + 22.232s (userspace) = 24.439s. Feb 14 14:05:04 raspberrypi dhcpcd[496]: eth0: no IPv6 Routers available Feb 14 14:05:14 raspberrypi systemd[1]: Time has been changed Feb 14 14:07:15 raspberrypi systemd[1]: Starting LSB: Starts The Onion Router daemon processes... Feb 14 14:07:16 raspberrypi tor[586]: Starting tor daemon...Feb 14 14:07:16.092 [warn] Could not bind to 0.0.0.0:9001: Address already in use. Is Tor already running? Feb 14 14:07:16 raspberrypi tor[586]: Feb 14 14:07:16.098 [warn] Failed to parse/validate config: Failed to bind one of the listener ports. Feb 14 14:07:16 raspberrypi systemd[1]: tor.service: control process exited, code=exited status=1 Feb 14 14:07:16 raspberrypi tor[586]: Feb 14 14:07:16.103 [err] Reading config failed--see warnings above. Feb 14 14:07:16 raspberrypi systemd[1]: Failed to start LSB: Starts The Onion Router daemon processes. Feb 14 14:07:16 raspberrypi systemd[1]: Unit tor.service entered failed state. Feb 14 14:07:16 raspberrypi tor[586]: failed. > On 14 Feb 2016, at 23:05, Volker Mink <volker.mink(a)gmx.de> wrote: > > Hey there. > > I recently updated my working TOR Exit from Raspian Wheezy to Jessie and also updatet my TOR-Version. > > Now I got the problem, that the TOR-service wont start when I have the ORPort in the torrc-file enabled. > Port 9001 is forwarded at my router and the Pi is also in the DMZ. Can you please send us the Tor log messages? They usually say why Tor won't start. Tim Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP 968F094B teor at blah dot im OTR CAD08081 9755866D 89E2A06F E3558B7F B5A9D14F

3 2

TOR service wont start with ORPort enabled
by Volker Mink 14 Feb '16

14 Feb '16

Hey there. I recently updated my working TOR Exit from Raspian Wheezy to Jessie and also updatet my TOR-Version. Now I got the problem, that the TOR-service wont start when I have the ORPort in the torrc-file enabled. Port 9001 is forwarded at my router and the Pi is also in the DMZ. ## Required: what port to advertise for incoming Tor connections. ORPort 9001 pi@raspberrypi:~ $ sudo /etc/init.d/tor start [....] Starting tor (via systemctl): tor.serviceJob for tor.service failed. See 'systemctl status tor.service' and 'journalctl -xn' for details. failed! pi@raspberrypi:~ $ pi@raspberrypi:~ $ systemctl status tor.service * tor.service - LSB: Starts The Onion Router daemon processes Loaded: loaded (/etc/init.d/tor) Active: failed (Result: exit-code) since So 2016-02-14 13:03:51 CET; 43s ago Process: 18693 ExecStop=/etc/init.d/tor stop (code=exited, status=0/SUCCESS) Process: 10377 ExecReload=/etc/init.d/tor reload (code=exited, status=0/SUCCESS) Process: 18777 ExecStart=/etc/init.d/tor start (code=exited, status=1/FAILURE) pi@raspberrypi:~ $ ) pi@raspberrypi:~ $ journalctl -xn No journal files were found. pi@raspberrypi:~ $ Any ideas what to do? Best, volker

2 1

relayor 0.1.0-alpha released
by nusenu 13 Feb '16

13 Feb '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, relayor is an ansible [1] role for tor relay operators. relayor makes use of tor's "OfflineMasterKey" feature [2] to help protect your ed25519 master keys by not exposing it to the relay at all. Since that requires regular key renewals (default: every 30 days, configurable) this role aims to make this step easy by reducing it to a single command. https://github.com/nusenu/ansible-relayor Main benefits for a tor relay operator ====================================== * security: ed25519 master keys are kept offline * easy key renewal with a single command * security: every tor instance is run with a distinct user * automatically makes use of IPv6 IPs (if available) * automatic MyFamily management * automatic multi-instance setup (configurable) Supported Platforms =================== * FreeBSD * Debian 8 * CentOS 7 * Ubuntu 15.10 * Fedora 23 * OpenBSD (starting with OpenBSD's next release: 5.9) Installation ============ relayor is available via galaxy: ansible-galaxy install nusenu.relayor https://galaxy.ansible.com/nusenu/relayor/ Documentation ============== https://github.com/nusenu/ansible-relayor/blob/master/README.md https://github.com/nusenu/ansible-relayor/wiki playbook examples: https://github.com/nusenu/ansible-relayor/wiki/relayor-playbook-examples migration steps https://github.com/nusenu/ansible-relayor/wiki/Migration-Steps git tags are signed with: pub 4096R/4D705DE9 2016-02-11 Key fingerprint = A7B5 DB91 CE04 C9E0 BE66 446B 8CBE 52BD 4D70 5DE9 uid ansible-relayor signing key (https://github.com/nusenu/ansible-relayor) feedback is appreciated. regards, nusenu [1] https://docs.ansible.com/ansible/intro_getting_started.html [2] https://trac.torproject.org/projects/tor/wiki/doc/TorRelaySecurity/Offli neKeys -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJWv3qoAAoJEFv7XvVCELh0H9IP/i7rRh3zrGRiru4uSOjZKUtB Fni5jqCxS29V2GKNIXt075M/osd/ZEcTeBPieHvsfQn1t1Ju4e2HwIt9yjENNycM Hg2VDkJt2wRxIg7hOHihGRqqxY7f85FLOpj4y11EskZMKFosOWJ8DrfBCGxYgLLf vVbPEyS454Kj3ezX5BXQsmMAm97tCWeMLwG1BBLnkA+ift0A+/SHU85vYYLGUdPw htZfxe83+WteziNhm8qOVw0sYlJwU8GAghFGeK/y1oPAUb0SjK9D2UHvldM6YNs8 +9359V2kHLMdqWZawellxxnbMNxjpEoHUlMDLpvmuN/S/MtBOkRGeST8bwVM1kRM NHWn3NfmoKDt1NVBqTHY8RfmG+ODr9AXzyP9q9khNlN+R72r60kPgX8+vGR06g9j 7oFi5t+0SlWK+vExEyl+bLTA74ps3GBpk+w9zM2rhX9hms3pn5AAEDzHANY6YxB7 YCpvd/cpykQFQKo6fvmuk0Igdy91rvVPh21eV2boD8qTQ2eVazNj5NLju+9gpUiW oRBN44v23KBXx+lgGb3FeNbSuzlh63MgQ6W9l7A985mfjyo0Xzw71NT5EjbC0eyM t0rdKY2byjUNOFNzb1emYVeujVIpyZqbyU/9opQGPWo7gDtDm4LwZLLBE/fD01ej F0rvBB9VpGIEp+hrWit+ =+F/t -----END PGP SIGNATURE-----

1 0

Re: [tor-relays] Re-Install Tor on raspberry, keep torrc and fingerprint
by Volker Mink 08 Feb '16

08 Feb '16

Thanks!! I will try this! ==== Message: 3 Date: Sun, 7 Feb 2016 14:58:19 +0100 From: ZEROF <security(a)netmajstor.com> To: tor-relays <tor-relays(a)lists.torproject.org> Subject: Re: [tor-relays] Re-Install Tor on raspberry, keep torrc and fingerprint Message-ID: <CANkaMAkdWFS7zLmgvjO8_b8aigDMeC6QniWq8vtBTEva9Qjb-A(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Hey Volker, Indeed, like Pierre said, backup all keys not only private key, backup torrc as well. Then you can reinstall your Pi. And about ControlPort, read: https://www.reddit.com/r/TOR/comments/2haw9s/having_some_issues_with_arm_and _tor_relay/ Cheers! ************

1 0

Re: [tor-relays] Re-Install Tor on raspberry, keep torrc and fingerprint
by Volker Mink 08 Feb '16

08 Feb '16

Thanks, i will try this! === Message: 1 Date: Fri, 5 Feb 2016 13:41:07 +0100 From: "Pierre L." <petrus(a)miosweb.mooo.com> To: tor-relays(a)lists.torproject.org Subject: Re: [tor-relays] Re-Install Tor on raspberry, keep torrc and fingerprint Message-ID: <56B49863.2090506(a)miosweb.mooo.com> Content-Type: text/plain; charset="windows-1252" Hey Volker, Never tried this, but there's something in the FAQ about this... https://www.torproject.org/docs/faq.html.en#UpgradeOrMove I remember some people saying you need to save every keys (and not only 1 as said in the FAQ), if I'm not wrong, in Raspbian you can find them in /var/lib/tor/keys And in the torrc, check this/// //DataDirectory /var/lib/tor/ I'm not sure, and I'm sadly noob with Tor, but this easy solution can be tried quickly I think... + when I check on my Raspbian (Jessie), debian-tor is the user/group by default on the directory /var/lib/tor I always launch arm with this command : sudo -u debian-tor arm Your /etc/tor/torrc config file has been overwritten by the upgrade ? Have you check it ? Good luck!

1 0

How to prevent netscan usage?
by Roland 'ValiDOM' Jungnickel 07 Feb '16

07 Feb '16

hi, I'm operating a tor exit with a relatively high bandwith rate for more than 3 years. My ISP receives more and more abuse tickets about my server regarding netscans. These netscans are executed with dest. port 80 so I'm not able to block them easily. Any idea how to prevent netscans using my exit node? Below you find an extract of such an abuse mail. Thanks a lot! ValiDOM Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 41518 => 46.20.92.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 41545 => 46.20.92.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 41575 => 46.20.92.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 45219 => 59.192.63.xx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 45218 => 59.192.63.xx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 45217 => 59.192.63.xx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 42460 => 59.203.179.x 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 42517 => 59.203.179.x 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 42569 => 59.203.179.x 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 57564 => 59.211.15.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 57596 => 59.211.15.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 57631 => 59.211.15.xxx 80 Wed Nov 18 12:55:27 2015 TCP 88.198.14xxx 58022 => 59.228.86.xxx 80 Wed Nov 18 12:55:27 2015 TCP 88.198.14xxx 58046 => 59.228.86.xxx 80 Wed Nov 18 12:55:27 2015 TCP 88.198.14xxx 58081 => 59.228.86.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 37123 => 64.238.74.xx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 37178 => 64.238.74.xx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 41003 => 65.20.53.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 45785 => 65.186.130.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 45850 => 65.186.130.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 45907 => 65.186.130.xxx 80 Wed Nov 18 12:55:12 2015 TCP 88.198.14xxx 60607 => 66.87.185.xxx 80 Wed Nov 18 12:55:12 2015 TCP 88.198.14xxx 60611 => 66.87.185.xxx 80 Wed Nov 18 12:55:12 2015 TCP 88.198.14xxx 60613 => 66.87.185.xxx 80 Wed Nov 18 12:55:14 2015 TCP 88.198.14xxx 52693 => 69.191.200.xxx 80 Wed Nov 18 12:55:14 2015 TCP 88.198.14xxx 52740 => 69.191.200.xxx 80 Wed Nov 18 12:55:14 2015 TCP 88.198.14xxx 52783 => 69.191.200.xxx 80 Wed Nov 18 12:55:27 2015 TCP 88.198.14xxx 35453 => 71.54.215.xx 80 Wed Nov 18 12:55:27 2015 TCP 88.198.14xxx 35464 => 71.54.215.xx 80 Wed Nov 18 12:55:12 2015 TCP 88.198.14xxx 39263 => 101.249.145.xxx 80

6 9

Re-Install Tor on raspberry, keep torrc and fingerprint
by Volker Mink 07 Feb '16

07 Feb '16

Hello there. I recently updated my Raspberry to the Jessie-Release. During this procedure TOR updated to 0.2.7.x (?). Now I have the problem that TOR is running as a new process and I cannot access it via ARM. Everytime I start ARM, any user, it show the "Menu" where I can choose as what the TOR should work. I say "last config". In the status screen it says: 22:32:37 [ARM_WARN] Connection refused. Is the ControlPort enabled? arm - raspberrypi (Linux 4.1.13+) Tor Disconnected (press r to reconnect) On page 4: page 4 / 5 - m: menu, p: pause, h: page help, q: quit Tor Configuration File: 1 ### Unable to load the torrc ### ==== What to do? For me it looks the best to remove TOR completely and reinstall it clean. But how to keep my Fingerprint and the Stats? Or anyone has a idea how to fix this. Im not so deep into linux to fix this error. https://atlas.torproject.org/#details/E20FF09A9A800B16C1C7C16E8C0DF95F46F649 B0 Anyone can help me? Best regards, volker

3 2

Bandwidth measured is low
by Pierre L. 07 Feb '16

07 Feb '16

Hey, In arm console, there's since few days a very low bandwidth measured. Something like 10% : *Bandwidth (limit: 720 Kb/s, burst: 960 Kb/s, measured: 96.0 b/s) *There are some topics about this on the www, and I've understood it can be a bug, but only 1 or 2 years ago and nothing really new. This is a home little relay contribution, with 900 to 1000 kb/s upload available, no bandwidth server killer inside my LAN... So do this bug is today solved, so I got a problem ? Is there something to do to solve it, on my config ? ps: RPi v1, Raspbian v8 Jessie Thx for your light :)

2 3

Issues with offline master key functionality
by Riccardo Mori 05 Feb '16

05 Feb '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi everyone, Two months ago I decided to try the new ed25519 key introduced in Tor 2.7 with OfflineMasterKey set so I can keep the master key in a different place and just upload the medium-term signing key every month. Last month everything went ok: I renewed the key and Tor accepted it. This time instead after generating the new signing key with # tor --datadirectory path_to_my_master_key --signingkeylifetime '1 months' --keygen and uploading ed25519_signing_cert and ed25519_signing_secret_key and fixing the permission, Tor keep saying Feb 03 07:27:40.000 [notice] It looks like I need to generate and sign a new medium-term signing key, because the one I have is expired. To do that, I need to load the permanent master identity key. Feb 03 07:27:40.000 [warn] We needed to load a secret key from /var/lib/tor/keys/ed25519_master_id_secret_key, but couldn't find it. Did you forget to copy it over when you copied the rest of the signing key material? Feb 03 07:27:40.000 [warn] Can't load master identity key; OfflineMasterKey is set. Feb 03 07:27:40.000 [err] Error initializing keys; exiting That raises two questions to me: - why does Tor think the new keys are already expired? - why is Tor searching ed25519_master_id_secret_key? With OfflineMasterKey set it shouldn't care about the master secret key Thank you, patacca -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWsgVWAAoJEE1LNuolWAxg12QP/iy/rd0cPPt8WhzXXCmlRwRi vNFZ2PO6ltpS9uu0HRgUExpDGG1QY8eLUZxRUPCg1lFPbu/tsfHo+Rz3RB6iAg0Q rkqkSen4vjAboA2PTfyu6oLQEqX4zHyJ4RaFZcdemgYdm4/B1pbZVMYOgI1EiJQj bX/WSyjPlAF5gXhWW+F1UH/ucCLcue8LumWdd2qGSILVInzEcXfM2myTi4NRZJry pearKYlMMSt70+qM7ivBKelYp3iMpZjUZOQa4rDmNEvWncWmHDi+QxggsKBGJ/Kf ZqwVuatCQT56B10GNGZrc5bUx1cbBjdXj4wMLh3D/8wxMIJztPB9rEI2+C2GzP3d asG054o2GHQ5HISQqFuFTZ4dzyjudV/g3HbA78kXcLXrTuSVSV0vZ8cEqACiaYSI dFfIjNTevr9WgWbXPfKFzILAGlBS6gUWJflh8eQY539Jg0LnJI4XpSbSFlvAU8dQ fzZSLnUGdPC0w8dcPpSeS+ojxiQ1cv7qQoeubpyXvO16ATlxDZ6SW9WwFDKEN72N xUOwIBGBpj6Onq8UuieMRTqolcd5jc96/4Y1rVCUeegRts+0RloW+ftODf5MjcyR 5uvbvyrm9J9AsAzFkK+ZI7Xi+Fad4lR1rsdM7t9jWndHFb83DEKDOJPyq+aFgk+r 00IxrkcEOwzQUf68QLcP =xN1c -----END PGP SIGNATURE-----

3 5