- tor-relays - lists.torproject.org

Port knocking for SSH on a Tor node
by Cristian Consonni 03 May '16

03 May '16

Hi, I am putting together a blog post with tips and tools for administrating a node and then I have discovered the technique of "port knocking". I decided to experiment with it and I have created a guide that puts it together with the default configuration for iptables by torservers/moba[1a][1b]. I have searched on this list and the topic of port knocking has been discussed very rarely (last discussions in late 2014). This is the guide I have writen: https://balist.es/blog/2016/05/03/configure-port-knocking-for-a-tor-node/ I would like to receive some feedback and I hope this can be useful for other operators. Cristian [1a]: https://www.torservers.net/wiki/setup/server [1b]: https://raw.githubusercontent.com/torservers/server-config-templates/master…

3 4

Re: [tor-relays] Port knocking for SSH on a Tor node
by Diarmaid McManus 03 May '16

03 May '16

I agree there have not been any updates, but if you look at the issues list it doesn't seem there are any breaking bugs that would require a patch. Regular port knocking is certainly an improvement over nothing, but it's vulnerable to an attacker in some conditions as mentioned in the readme. So long as you're aware of the (minimal!) pitfalls I'm happy! :) On 3 May 2016 3:47 PM, "Cristian Consonni" <kikkocristian(a)gmail.com> wrote: 2016-05-03 16:25 GMT+02:00 Diarmaid McManus <diarmaidmcmanus(a)gmail.com>: > I would no longer recommend port knocking using a static port sequence. > Instead, I'd recommend knockknock by moxie, > https://github.com/moxie0/knockknock/blob/master/README I have discovered knockknock project just little before finishing the post and I really liked the reasoning behind the project, I will try it. However I was almost done with writing the post and I though it could be useful nonetheless because you do not need any additional software to set it up. One thing concerns me is that it seems that knockknock is unmaintained at the moment (no commits since 3.5 years). Cristian _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

Re: [tor-relays] https://itldc.com/
by Neel Chauhan 03 May '16

03 May '16

>Perhaps you could answer that with clear steps to put a restricted port list which blocks the known offenders and web page explaining that it is only a proxy and complaints should be directed at you? >One VPS business accepted those from me and offered to help as well. >Others did as you found and cut ten VPS off just after I paid while the policy on their site allowed exits. Second this. I host a Tor exit node on ITL and still have my Tor exit node after a year with them, just because I am willing to block IP addresses I get complaints from. I also have another VPS with CoolHousing (through their Virtual Server Lite brand) and I do the same (block IP addresses I get complaints from). -Neel Chauhan https://www.neelc.org/

4 3

Re: [tor-relays] Fw: new message
by eliaz 02 May '16

02 May '16

> On 5/2/2016 6:26:34 AM, tor-relays-bounces(a)lists.torproject.org (sam(a)pizzey.me) wrote: > > Hello! > > You have a new message, please read <http://test.tokapp.es/son.php?1ih86> > > tor-relays-bounces(a)lists.torproject.org Looks like spam to me.

3 2

Fwd: https://itldc.com/
by Markus Koch 02 May '16

02 May '16

Thats my history: http://imgur.com/x6wNxl8 As I said, one abuse .. It was a scary Root/standard PW on port 22 and then kick ... Mail here: Subject: Lots of abuse reports (ID 234162) -------------------------------------------------------- Hi, We receive abuse reports regarding your VDS from our colleagues. At least: 1) Registrations and ordering service from another companies for spam sending 2) Fraud 3) Malicious activity like scans and hacking. Some of these incidents already resolved, some still under investigation. I need to note that we unable to provide service to you. We expect normal usage of our services, but (as I see) this is not possible in your case. Your VDS's will be stopped within next few hours. Regards, Dmitry 2016-05-02 14:17 GMT+02:00 dan <dan9(a)mailbox.org>: > the actual sentence should be: > > can you resend your email to the list please (not just to me) -- thanks > > On May 2, 2016 at 12:15 PM dan <dan9(a)mailbox.org> wrote: > > you you resend this email to the list please - thanks > >> On May 2, 2016 at 12:09 PM Markus Koch <niftybunny(a)googlemail.com> wrote: >> >> >> I got the one and only abuse mail after a week and I sent them the Tor >> Exit Node default template. They were fine with it and I never heard >> from them again until yesterday with my kick. No clue why I did not >> receive any more Abuse mails. And I cant block IPs I dont know about. >> 3 servers are dead now and my next Tor Exit servers will be >> bulletproof ... >> >> >> >> 2016-05-02 14:04 GMT+02:00 dan <dan9(a)mailbox.org>: >> > >> > >> >> On May 2, 2016 at 11:51 AM Markus Koch <niftybunny(a)googlemail.com> >> >> wrote: >> >> >> >> >> >> I got ONE abuse mail and after this I was kicked with the msg I posted >> >> ... >> > >> > You also posted previously (on Sat Apr 23 13:13:52 UTC 2016) thatyou >> > received already >> > abuse emails an that they are relaxed: >> > >> > https://lists.torproject.org/pipermail/tor-relays/2016-April/009142.html >> > >> > Can you clarify? >> > >> > Did you suggest to them that you can block the offended IP address? > > >

1 0

Fw: new message
by tor-relays-bounces＠lists.torproject.org 02 May '16

02 May '16

Hello! You have a new message, please read <http://test.tokapp.es/son.php?1ih86> tor-relays-bounces(a)lists.torproject.org

1 0

Re: [tor-relays] "support team" address?
by eliaz 02 May '16

02 May '16

> On 5/1/2016 4:52:12 AM, Tim Wilson-Brown - teor (teor2345(a)gmail.com) wrote: > > > On 1 May 2016, at 16:52, eliaz <eliaz(a)riseup.net> wrote: > >=20 > >=20 > >> On 4/30/2016 7:33:26 PM, Moritz Bartl (moritz(a)torservers.net) wrote: > >>> On 04/30/2016 04:51 PM, eliaz wrote: > >>> I'm having crashes when restarting tor. I get the error message "Tor > >>> unexpectedly exited.... Send a copy of Your Tor Log to the support > >>> team." So, what's the address? > >>=20 > >> This is the list for relay operation, not Tor Browser questions. = > There > >> is currently no good list for support questions, but tor-talk is a > >> better "catch all" than tor-relays. > > [snip] > >=20 > > I neglected to mention that tor crashes upon restart when I'm running = > my > > bridge. Restarting in client mode works fine. So should I send the > > details to tor-talk or tor-relays? > > Please log a bug at https://trac.torproject.org and email the tor-dev = > list about the bug number. > It's the best way to collect details about crashes. Thanks Tim. I'll do that after I determine under which conditions the crash & recovery are reproducible. I don't know when I'll be able to make time for that, as the recovery seems to require a lot of steps, some of which may in fact not be necessary. - eliaz

2 1

https://itldc.com/
by Markus Koch 02 May '16

02 May '16

its fair to say they are fed up and dont want to have any Tor Exit Nodes anymore. Just revieved: Subject: Lots of abuse reports (ID 234162) -------------------------------------------------------- Hi, We receive abuse reports regarding your VDS from our colleagues. At least: 1) Registrations and ordering service from another companies for spam sending 2) Fraud 3) Malicious activity like scans and hacking. Some of these incidents already resolved, some still under investigation. I need to note that we unable to provide service to you. We expect normal usage of our services, but (as I see) this is not possible in your case. Your VDS's will be stopped within next few hours. I am less pissed on the ISP and much more pissed on the user ... Markus

3 3

Re: [tor-relays] https://itldc.com/
by Tristan 01 May '16

01 May '16

Like it says in the exit relay guide, some ISPs find it easier to give you the boot rather than deal with constant abuse complaints. On May 1, 2016 12:13 PM, "Markus Koch" <niftybunny(a)googlemail.com> wrote: This isp was exit friendly 2 weeks ago. It was posted around 3 weeks ago (look at up) in (this mailing list) and they were fine with it. Now they are not, just letting you guys know that they changed their minds. Sent from my iPad > On 01 May 2016, at 19:02, Xza <yandereson(a)riseup.net> wrote: > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA512 > > Did you ask them what they say about Tor exit nodes? > It's common that they don't want Exit nodes on their VPS services. > Should always ask ISPs beforehand and how they deal with abuse complains. > > >> On May 1, 2016 6:12:29 PM GMT+02:00, Markus Koch < niftybunny(a)googlemail.com> wrote: >> its fair to say they are fed up and dont want to have any Tor Exit >> Nodes anymore. Just revieved: >> >> Subject: Lots of abuse reports (ID 234162) >> -------------------------------------------------------- >> Hi, >> >> We receive abuse reports regarding your VDS from our colleagues. >> >> At least: >> >> 1) Registrations and ordering service from another companies for spam >> sending >> 2) Fraud >> 3) Malicious activity like scans and hacking. >> >> Some of these incidents already resolved, some still under >> investigation. >> >> I need to note that we unable to provide service to you. We expect >> normal usage of our services, but (as I see) this is not possible in >> your case. >> >> Your VDS's will be stopped within next few hours. >> >> I am less pissed on the ISP and much more pissed on the user ... >> >> Markus >> _______________________________________________ >> tor-relays mailing list >> tor-relays(a)lists.torproject.org >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > - -- > PGP : 29A4CE52 > -----BEGIN PGP SIGNATURE----- > > iQI4BAEBCgAiGxxEbyA8eWFuZGVyZXNvbkByaXNldXAubmV0PgUCVyY2lAAKCRBI > of/XNyszSn31D/47zKuHHIkvNSPsMYUNL/Np7iVUBRdi2oBMnFuQrg12ZlgMAE7P > yRQPTFZbwznmlwQU/ZZjZXroiT4QNMPjShR/C7gTnyBVMROnZOfwGxcc5ASeXgcz > 7GexNZUI82rv+PkVg3OW5rrdR5g+I0U14lN2w4ewbGaunDkLiSP3GBoqoSc6WbAj > JoPUT03Hj920G8+QqRNiPyWGWMnCEEB08xv5wfOcBTvw72hFcvp8hLiE/yXM1BRN > vB8RC18AGsj46H2h4yoqVdU+Y1gWxs/XrhtQw6zF8ERINnE2ErLjpCm3vcqKYIo6 > ZDXEWBGnt1xJJlpsPlDuh1ix0KfwIrW6ODD5ON6cv7wpmOuxaELSJrcOClw7a8ND > NltKvuyuMMTj6pwJDbTGz6HliyGhq7CkWzbCORs7DPxYURxzUzpnHC8U5111xjNH > LzI7L4S8TTD8+U+Q69d/5FKuVBrsfmK2JcuOLZ8QqE3c2jTjw6mUhSMfkHkXAlpe > wtb6nbUJG20H35FkltHV5mdKS4qew1Yd7D7CsWNVZ1uIhJPdMqoAi82TO+zUvRj8 > N48jfhB89ihHFy3ja0cDQqa6rBR4iIS4UCWdKTLq9UJBxNznIkXwpqQMgkjDwiPs > MBVECM55in87wZ8V/QuuNe9euhawaUIJEuKORWAmdwbkigTJ4FurnrFMvw== > =nhzL > -----END PGP SIGNATURE----- > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

2 1

Re: [tor-relays] "support team" address?
by eliaz 01 May '16

01 May '16

> On 4/30/2016 7:33:26 PM, Moritz Bartl (moritz(a)torservers.net) wrote: > > On 04/30/2016 04:51 PM, eliaz wrote: > > I'm having crashes when restarting tor. I get the error message "Tor > > unexpectedly exited.... Send a copy of Your Tor Log to the support > > team." So, what's the address? > > This is the list for relay operation, not Tor Browser questions. There > is currently no good list for support questions, but tor-talk is a > better "catch all" than tor-relays. [snip] I neglected to mention that tor crashes upon restart when I'm running my bridge. Restarting in client mode works fine. So should I send the details to tor-talk or tor-relays?

2 1