- tor-relays - lists.torproject.org

Running an exit? Please secure your DNS with DNSCrypt+Unbound
by Jesse V 05 Jan '16

05 Jan '16

Hey everyone, This is an advisory for anyone running an exit node, but it also applies to any Linux setup where you don't trust your DNS server. TL;DR: this is a guide for switching unsecured DNS to DNSCrypt + Unbound, which prevents a network host from monitoring DNS lookups, thus increasing privacy for everyone using Tor. A few weeks ago I set up some exits and I recently discovered that the host was using 8.8.8.8, Google's DNS, as a resolutions service. As in, they had "nameserver 8.8.8.8" in /etc/resolv.conf. Convenient for them, but it meant that every request was sent to Google for resolution. This is bad because Google can then track DNS lookups and so can anyone watching unencrypted DNS as it travels across the country. In fact, DNS is specifically mentioned in the "Tor Sucks" NSA slides. Compounding this, most Linux boxes don't use a DNS cache, so literally every lookup is sent to Google, so this didn't exactly inspire confidence. After talking with cacahuatl, ncl, and pskosinski on IRC, I switched to DNSCrypt, a FOSS protocol that encrypts DNS lookups across the wire. I also set up the Unbound DNS cache, thus accelerating queries while also preventing the DNSCrypt server from observing every lookup. Then I redirect /etc/resolv.conf to use Unbound, which itself used DNSCrypt. This protected Google or my host from watching DNS lookups. Here's how I did it: 1) I installed "unbound". I have confirmed that this package is available in the Ubuntu and Fedora repositories, so most distributions probably have it. 2) I installed "dnscrypt-proxy". I installed the libsodium-dev dependency then used https://download.dnscrypt.org/dnscrypt-proxy/ to compile and install dnscrypt-proxy from source. https://github.com/jedisct1/dnscrypt-proxy#installation may be helpful here. 3) I modified Unbound's configuration per the instructions in https://www.dnscrypt.org/#dnscrypt-proxy. For the sake of convenience, you can find my configuration here: https://gist.github.com/Jesse-V/675b7ec87eca864887e6 I then reloaded Unbound to apply the updated configuration. 4) I reviewed https://github.com/jedisct1/dnscrypt-proxy/blob/master/dnscrypt-resolvers.c… to find a provider geographically close to me. I recorded the resolver's address, provider name, and provider public key for use in the next step. 5) I ran "/usr/local/sbin/dnscrypt-proxy --resolver-address=<address> --provider-key=<publicKey> --provider-name=<name> --ephemeral-keys --local-address=127.0.53.1" in a terminal, where <address>, <publicKey>, and <name> were substituted for the information I found in step 4. 6) I ran "host torproject.org 127.0.53.1" to confirm that dnscrypt-proxy was working. 7) I ran "host torproject.org 127.0.53.53" to confirm that Unbound + dnscrypt-proxy was working. 8) I then ran the command from step 5 with the --daemonize flag so that the proxy ran in the background. 9) I added the command from step 8 to crontab, with the @reboot macro. 10) I modified /etc/resolv.conf to "nameserver 127.0.53.53". At this point "host torproject.org" should work out of the box using DNSCrypt + Unbound and nobody but you and the DNSCrypt resolver can see your query. Be sure to review https://gist.github.com/Jesse-V/675b7ec87eca864887e6 to avoid any SERVFAIL headaches. Enjoy! -- Jesse V.

9 15

Re: [tor-relays] tor hidden services & SSL EV certificate
by Manager Bahia del Sol LLC 01 Jan '16

01 Jan '16

3 2

Re: [tor-relays] Problem starting tor after upgrading to ubuntu
by Manager Bahia del Sol LLC 01 Jan '16

01 Jan '16

2 1

What are the exact requirements for HSDir flag?
by Dimitar Milkov 01 Jan '16

01 Jan '16

Hello, and Happy New Year! I have a question regarding the HSDir flag. According to dir-spec.txt : "A router is a v2 hidden service directory if it stores and serves v2 hidden service descriptors, has the Stable and Fast flag, and the authority believes that it's been up for at least 96 hours (or the current value of MinUptimeHidServDirectoryV2)." However, if you browse the consensuses, you will find a lot of relays that meet the requirements above, but doesn't have HSDir. You will also notice that almost every relay with HSDir is also a conventional v2 directory mirror (e.g. with active DirPort). Is there any non-documented requirement, like minimum bandwidth or something?

3 2

problem with new and old exit relays
by Larry Brandt 01 Jan '16

01 Jan '16

Recently I have been receiving warnings on notices.log shown below. Today I started a new exit relay and immediately received a similar message. Is this familiar to anyone? What's my problem? Dec 31 03:26:35.000 [warn] Malformed IP "???" in address pattern; rejecting. Dec 31 03:26:35.000 [warn] Couldn't parse line "[???]:*". Dropping Dec 31 03:26:35.000 [warn] Malformed policy 'reject [???]:*'. Discarding entire policy list. Dec 31 03:26:35.000 [warn] append_exit_policy_string(): Bug: Unable to parse internally generated policy reject [???]:* (on Tor 0.2.7.6 ) L Brandt

2 1

Problem starting tor after upgrading to ubuntu 15.10 / tor 0.2.7.6
by James Moore 31 Dec '15

31 Dec '15

Hello all, I've been running two exits for quote some time now and today I decided to update my OS and tor version but it didn't go too well. I was updating from ubuntu 15.04 / 0.2.6.10 to 15.10 / 0.2.7.6. I'm using the apt feed from deb http://deb.torproject.org/torproject.org wily main It appears that something about the AppArmor configuration is incorrect but I don't know enough about systemd/apparmor to properly diagnose it. Here are some log snippets: http://pastebin.com/8jzEiz3T It seems to come down to this tor(a)default.service: Failed at step EXEC spawning /usr/bin/tor: Operation not permitted I discovered that commenting out the Hardening section of /lib/systemd/system/tor(a)default.service get's it working again but I'd prefer not to run out-of-band configuration files. Can anyone shed light on this problem? I'm happy to provide more info. James

1 0

tor hidden services & SSL EV certificate
by Benoit Chesneau 31 Dec '15

31 Dec '15

I was at the talk this afternoon at the 32c3 and <i am wondering where can get a certificate for a .onion. Any service to suggest? Also where I should see to configure it correctly? - benoit

9 14

Tor Relay Meetup at 32c3 moved to 18:00
by Moritz Bartl 31 Dec '15

31 Dec '15

Sorry, due to some scheduling conflicts the meetup had to be moved to day 2 18:00. https://events.ccc.de/congress/2015/wiki/Session:Tor_Relay_Operators_Meetup Starts at 2015/12/28 18:00 Ends at 2015/12/28 20:00 Location Hall 13 See you! -- Moritz Bartl https://www.torservers.net/

2 1

'bug' bounty for weaknesses in Tor announced
by I 31 Dec '15

31 Dec '15

2 1

Delete
by Terry Mitchell 30 Dec '15

30 Dec '15

Please delete me from this list!! I probably should never have joined. Many thanks T.N.Mitchell -- T.N.Mitchell Binixica 195 07712 Mahon Menorca Spain Tel. 0034 971 153312 Mobile 0034 971153312

4 3