- tor-relays - lists.torproject.org

important DNS tuning for high volume exit relays, fix for Unbound DNS DOS problem
by Dhalgren Tor 11 Apr '16

11 Apr '16

I believe I now understand the cause of exit relay failure when Unbound is the resolver and GoDaddy null-routes the exit. Both to prevent this DOS from taking out your relay if Unbound is running and to maximize DNS performance: with a local instance of Unbound running /etc/resolv.conf should look like options timeout:5 attempts:1 max-inflight:16384 max-timeouts:1000000 nameserver 127.0.0.1 with a local instance of 'named' running /etc/resolv.conf should look like options timeout:5 attempts:2 max-inflight:16384 max-timeouts:1000000 nameserver 127.0.0.1 background material for the above recommendations found at https://trac.torproject.org/projects/tor/ticket/18580#comment:11 https://unbound.net/pipermail/unbound-users/2016-April/004301.html

1 0

First (positive) experiences with a Tor Relay on Raspberry Pi3
by fr33d0m4all 11 Apr '16

11 Apr '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, I've just moved my Tor relay installation from my alix1.c embedded system (500Mhz CPU with 256Mb ram) which was able to offer only 4Mbps (100% CPU utilization) to a new Raspberry Pi3 (quad-core 1.2Ghz 64-bit cpu with 1 GB ram). Some days ago I've seen some messages on the ML about Pi2 performance (if I remember well) and I'd like to share my first experiences with Pi3. I have only 20Mbps connection in the uplink direction, so I'm offering about 15Mbps for Tor relay and I've just seen that it is able to offer 14Mbps with 40% of a single core utilization.. In conclusion, I think that a single relay on Pi3 can offer about 30-40 Mbps, and if you run 4 tor relays on the same Pi3 you can offer more than 100Mbps which is definitely not bad for such a small system. The only drawback is that you need to find a good way for keeping it cold, since after 1 hour of 1 core at 100% I've reached about 70°C with heatsinks on the CPU. I just wanted to share my experience with you, hope you find it interesting :) Have a nice week Fr33d0m4All - -- _____________________________________________________________ PGP Key: 0DA8 7293 D561 3AEE A3C0 7F63 101F 316A F30E ECB4 IRC Nick: fr33d0m4all (OFTC & Freenode) _____________________________________________________________ -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJXCpLUAAoJEBAfMWrzDuy0KpQQAKG1Su24A3O1keFdPGk2zdzw lwEk+pSvRzfoHfmocv5ia9PQ8ZtBws3QfaxfZOYIA0DxdKVK7Rcs+r0ekL6VtAdp y3HU3SlAoCxFDsHycsPhuXZPmQqU/+OAS0lrzo2KrKk/lN/K+b2YYzLfJ+9SWzE1 kg4dcCnWfQrMsLLK72R9qIjSmDsXDGzzNRq0qM3nDjDmE5GPmMJajSbWsHP12v/q BnA786RdB/CDiFVifGPYsKEuughpJ1ryVSRm3LdmTdIjZ+u/sxz0/TQrmj7idgdr TenFk4rf0NbiLU/7sruNJNYPFHvUMUOC8Xu7wBJU2LTF/8fcjYOaQp2UWch4aGQa nM4tMetvhEmoGxcEmJSsi2CHdLkMZ8G67gfufb7Gmsmd59q0KvRQktPxqnJ0GJIs 20x2PX2qzXX7P4mKL8nO0aX32OP+1xScuSH/85Lu6Nnh1jL+T81QPjk/CUHB86ho gbuGt154KEnMoKx+w3aXrzSKVH5kRMgWhIcbRt/xELWprx2zsxGM+gIOCdLQ/vXi PugDblYL8sa8Uds6cz0fjNsuCBI19X0NlnmGFAbU9qOHEhUzYpuF4VlH7sOkL0n2 HWkJTSIjizjZCS0PDPeaqj3lOtoFJiYcAxef+HnGEI/5dameIBB/MDJyOrf+oRfL 1kNo6Zd5KqJesnljCac5 =pk6h -----END PGP SIGNATURE-----

3 2

First Relay
by KAW 11 Apr '16

11 Apr '16

Got my first relay running for 4 days now :D -KAW

1 0

Re: [tor-relays] NPR story: When A Dark Web Volunteer Gets Raided By The Police
by Tristan 10 Apr '16

10 Apr '16

In this instance, it was local authorities, and the guy bought all-new hardware, so I'd say this specific problem is solved. For future reference, how would we even find these incidents? This time it was on the news, but if it wasn't, nobody would have known. On Apr 8, 2016 12:54 PM, "Green Dream" <greendream848(a)gmail.com> wrote: Who said Tor was against the police? The fact is, in the United States, the FBI and other law enforcement agencies have been known to plant malware, modify hardware, etc., in order to maintain persistent access to machines they wish to monitor. Whether or not you think this is valid in some cases or all cases is really beside the point. The question is whether exit node hardware can be trusted after a search warrant is served and the police are given full and unmonitored access to said hardware. As a matter of due diligence, I'd argue the hardware and OS can no longer be trusted in such cases. _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

3 2

Re: [tor-relays] Relays by AS Names
by Tor-Node.net 10 Apr '16

10 Apr '16

Hi! Here is a list from ExoticVPS that you can use to search for and contact various VPS hosters: http://www.filehosting.org/file/details/558944/ExoticVPS.ods http://www.filehosting.org/file/details/558945/ExoticVPS.xlsx http://www.filehosting.org/file/details/558946/ExoticVPS.txt (Tab separated txt file) Kind regards tor-node.net

7 9

Private Tor Research Network
by Nicholas R. Parker (RIT Student) 09 Apr '16

09 Apr '16

Hi all, I've got an issue that I'm seeking help with. I'm with a small group out of RIT that's trying to construct a private TOR network for research purposes, but we've hit a bit of a snag. I've worked with both liu fengyun's ( http://liufengyun.chaos-lab.com/prog/2015/01/09/private-tor-network.html) and Ritter's write up (https://ritter.vg/blog-run_your_own_tor_network.html) but when trying to set up authority directories the whole thing really falls apart. Trying to edit the torrc file gives errors where it doesn't attempt to bind to the correct ports and trying to set --dirserver or --datadirectory results in errors that there isn't permission to access /var/lib/tor regardless of the owner of the directory (we've tried leaving it as being owned by _tor, tried changing ownership to root, etc) so we can't get the authority directories off the ground. I'd really appreciate any thoughts Nicholas R. Parker Rochester Institute of Technology 5thYear, BS/MS Computing Security

2 1

NPR story: When A Dark Web Volunteer Gets Raided By The Police
by Greg 09 Apr '16

09 Apr '16

http://www.npr.org/sections/alltechconsidered/2016/04/04/472992023/when-a-d… A Seattle exit node operator is visited by local police over a child pornography warrant... Is this out of the ordinary or is this to be expected when running an exit from your home IP address?

9 17

Guard flag?
by Clément Février 08 Apr '16

08 Apr '16

Hello, I run a relay for almost 10 days. I wonder if my configuration is correct as I don't see the expected behavior from https://blog.torproject.org/blog/lifecycle-of-a-new-relay Indeed, my consensus weight and the number of connections dropped after 8 days, from 0.0040% to 0.0012% and from 2000 to 300 connections respectively. Since then, I've such messages in arm: [NOTICE] Have tried resolving or connecting to address '[scrubbed]' at 3 different places. Giving up. [4 duplicates hidden] [NOTICE] We tried for 15 seconds to connect to '[scrubbed]' using exit <fingerprint> at <ip>. Retrying on a new circuit. I was expecting to get a guard flag with an increasing consensus weight involving a drop of the number of connections. So far, I have the following flags: Fast, HSDir, Running, Stable, V2Dir, Valid. Is that an evidence something is not running properly? Best, Clèm

9 15

No Daily Digest Anymore
by stealth＠nym.mixmin.net 08 Apr '16

08 Apr '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 About 2 weeks ago I stopped getting a daily digest of this list. Is there a reason for this? -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (MingW32) iQIcBAEBAgAGBQJXBonvAAoJEH1gNwhiMDZu3iIQAJDQ8D+bZ3YG9He4rpQku+Le dHLgodjOckggKnbpfBScqGXQA+mcB9EDIgLQOMtqI3i2SHkjEL9qh5ci0MkZdA7b 0vVJ4Ccbqbn9aupXsbCkrgFA6UT2jz5rys0470FE5gnJiRpBXgAjllBSlZyP00s4 2St+ROqNUTE1chnJlDqTU2iehJWIGDONZUjb+amaUIfsC8MNiokrG0svJZfOsVE5 sRtZ0c+xu3gUnhcM2YaIIV9I+gbFGWTWJPOwZmSIbVoxUmE/Dqg1zHwXeLMSAKJv 5kALfyNZpDtCR62j+pLx1YX2iEHQdr6UaKemwW7HCsXp8ZkbKFwuC7HjP85OoON4 IjqK41KvMxoywD0nvlGbYPw6ssxR9JlMBtg5MqvjlsTPp/aUaUKP/OnjlNGxRwE3 N4fvO8hZPTa8zweykD7qa4RlmJwv0nE+dz/gO3arcz2tIAsC9D90RvD9JGJbeOxW o5yHbIo2h1aHdoelUWMgB5aVdDF30FDAoOZEoSG8DAs8vD6oKFtbWP98f1pVt2Nw dT8J2Q9d4iXe9IEZ8iTNJnyvLIykwqTl+aRJsRD50x7dd3EOzOxF9sKnf/Fq1vto ScNtBVva1fE7LB1kWV8J2LdGGwIwrtR4Af1Hy6rri//E4nvEU2HTnDfVk0dr7ReH uQP+mGr7nPCXLGbXEUp7 =LDGJ -----END PGP SIGNATURE-----

2 1

Getting drops with iptables "-m state --state INVALID" in INPUT and OUTPUT chains on relay
by fr33d0m4all 08 Apr '16

08 Apr '16

Hi… I've noticed that the iptables rule "-m state --state INVALID -j DROP" applied both to INPUT and OUTPUT chains on my raspbian Tor relay drops some connections… is it normal and should I avoid dropping "—state INVALID" connections when the destination or source is the Tor process on the relay? It's strange to have them also in the outgoing chain (i.e. produced by the relay), unless its is related to how Tor works (I'm almost sure that the connections dropped by the OUTPUT rule are related to the Tor process). It's not a matter of conntrack entries, it's using only 61 entries and has a lot of them free. Drop log in the OUTPUT direction => why is my relay sending a packet with ACK PSH FIN flags? iptables-OUT-INVALID-DENIED: IN= OUT=eth0 SRC=10.x.x.x DST=37.x.x.x LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=24372 DF PROTO=TCP SPT=33423 DPT=9001 WINDOW=321 RES=0x00 ACK PSH FIN URGP=0 Drop log in the INPUT direction => This could be a correct drop due to a new connection with RST flag, I think: iptables-IN-INVALID-DENIED: IN=eth0 OUT= SRC=91.x.x.x DST=10.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=TCP SPT=15754 DPT=9090 WINDOW=0 RES=0x00 RST URGP=0 Best regards, Fr33d0m4All -- _____________________________________________________________ PGP Key: 0DA8 7293 D561 3AEE A3C0 7F63 101F 316A F30E ECB4 IRC Nick: fr33d0m4all (OFTC & Freenode) _____________________________________________________________

1 0