- tor-relays - lists.torproject.org

Reminder: exit nodes probably shouldn't be using Google's DNS servers
by Nick Mathewson 25 Feb '16

25 Feb '16

Hi, all! While looking into a bug report, I noticed that an exit node was using one of Google's well-known public DNS servers for its own DNS server. No disrespect to the operators of Google's fine public DNS service, but my sense is that using it for a Tor exit node might not be the greatest idea for users' privacy, having one DNS provider that gets to see so many requests. It's probably a better idea to have your own local cacheing DNS server. Would anybody like to share a guide about how to set one of those up safely and migrate correctly? best wishes, -- Nick

23 38

CVE-2015-7547 Tor network stats
by nusenu 23 Feb '16

23 Feb '16

Hi, if we assume for simplicity that every relay running Linux that has not rebooted since 2016-02-16 is vulnerable to CVE-2015-7547, than these are the current stats (optimistic, because we assume that everyone that rebooted did also update). Vulnerable relays: +------------+------------------+-----------------+ | cwfraction | guardprobability | exitprobability | +------------+------------------+-----------------+ | 0.586 | 0.639 | 0.518 | +------------+------------------+-----------------+ (1=100%) Apply patches and reboot. Debian https://www.debian.org/security/2016/dsa-3481 RHEL/CentOS https://rhn.redhat.com/errata/RHSA-2016-0176.html Ubuntu http://www.ubuntu.com/usn/usn-2900-1/

9 10

does the Tor network scale well ?
by Toralf Förster 22 Feb '16

22 Feb '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Given the numbers of https://torstatus.blutmagie.de/index.php there are about 40 Tor exits which covers 1/3 of the whole bandwidth of all exit relays. I do wonder if under-weighting the big relays in favour of many smaller relays would make it harder for an adversary to de-anonymize the traffic ? Bandwidth (KB/s) percent cumulated IP Address Hostname 0.00% 37188 1.52% 1.52% 197.231.221.211 exit1.ipredator.se 33608 1.38% 2.90% 94.242.246.24 orion.enn.lu 30720 1.26% 4.16% 77.247.181.166 77.247.181.166 30720 1.26% 5.42% 77.247.181.164 rainbowwarrior.torservers.net 30294 1.24% 6.66% 94.242.246.23 destiny.enn.lu 28732 1.18% 7.84% 176.126.252.11 chulak.enn.lu 28721 1.18% 9.02% 185.65.135.227 torproxy02.31173.se 26364 1.08% 10.10% 85.248.227.164 tollana.enn.lu 25927 1.06% 11.16% 176.126.252.12 aurora.enn.lu 22973 0.94% 12.10% 89.234.157.254 marylou.nos-oignons.net 22579 0.93% 13.03% 85.248.227.163 ori.enn.lu 22551 0.92% 13.95% 192.42.116.16 tor-exit.hartvoorinternetvrijheid.nl 21765 0.89% 14.84% 5.79.68.161 Relay-J.tor-exit.network 21280 0.87% 15.72% 93.115.95.204 lh28409.voxility.net 20768 0.85% 16.57% 5.79.68.161 Relay-J.tor-exit.network 20413 0.84% 17.40% 176.61.147.146 176.61.147.146 19993 0.82% 18.22% 65.19.167.130 65.19.167.130 19966 0.82% 19.04% 207.244.70.35 207.244.70.35 19689 0.81% 19.85% 195.154.56.44 tor-exit.gansta93.com 19685 0.81% 20.66% 46.166.170.6 tor-exit-2.netdive.xyz 19662 0.81% 21.46% 171.25.193.132 tor-exit6-readme.dfri.se 19253 0.79% 22.25% 77.247.181.165 politkovskaja.torservers.net 18905 0.77% 23.03% 89.234.157.254 marylou.nos-oignons.net 18319 0.75% 23.78% 93.115.95.206 lh28409.voxility.net 18066 0.74% 24.52% 142.4.213.25 heaven.tor.ninja 18033 0.74% 25.26% 62.210.129.246 relay1.tor.openinternet.io 17932 0.73% 25.99% 188.138.9.49 atlantic480.us.unmetered.com 17904 0.73% 26.72% 65.19.167.132 65.19.167.132 17695 0.73% 27.45% 109.163.234.5 hessel3.torservers.net 17507 0.72% 28.17% 46.165.230.5 tor-exit.dhalgren.org 17171 0.70% 28.87% 194.150.168.95 kaputte.li 16262 0.67% 29.54% 79.172.193.32 toreador.webenlet.hu 14726 0.60% 30.14% 109.163.234.2 hessel0.torservers.net 14637 0.60% 30.74% 85.214.98.239 h2343030.stratoserver.net 14181 0.58% 31.32% 171.25.193.78 tor-exit4-readme.dfri.se 14164 0.58% 31.90% 193.171.202.146 tor2e.ins.tor.net.eu.org 14022 0.57% 32.48% 188.214.129.85 hst-188-214-129-85.balticservers.eu 13987 0.57% 33.05% 171.25.193.131 tor-exit7-readme.dfri.se 13962 0.57% 33.62% 193.90.12.86 tor-1.multisec.no - -- Toralf PGP: C4EACDDE 0076E94E, OTR: 420E74C8 30246EE7 -----BEGIN PGP SIGNATURE----- iF4EAREKAAYFAlbLd4QACgkQxOrN3gB26U43/AD+NDFTPFv2XJiq1WetnsYKl7/i P/M5OTj7Vzmmr17GnV4A/3s4/TEVya5OPjXUTl7IRdBRldSuvZ8X06i++TbdSOCK =CxqX -----END PGP SIGNATURE-----

2 1

[WARN]Failing because we have 4063 connections already. Please read doc/TUNING for guidance
by tor-admin＠torland.me 21 Feb '16

21 Feb '16

Hi all, since I upgraded the torland relay from 2.6.7 to 0.2.7.6 I get the following warnings: 09:20:30 [WARN] Failing because we have 4063 connections already. Please read doc/TUNING for guidance. [101144347 similar message(s) suppressed in last 21600 seconds] Google only spits out https://trac.torproject.org/projects/tor/ticket/16929 which does not help me. I don't find the mentioned branch bug16929 in git. Can someone please advise what has to be done to avoid the warning, or point me where I find can the file "doc/TUNING". Thanks torland

4 6

routing script
by Markus Koch 19 Feb '16

19 Feb '16

Hi, after having four entry/middle nodes online I would like to help out with an exit node. Unfortunately you will get in a lot of trouble in Germany for hosting an exit node. I spoke with an VPN provider and they are okay with routing tor traffic over their VPN as long I have exit rulez etc. The only thing I need is a routing script for Debian to route all the Tor traffic over the VPN. Anyone can help me out with this? Markus

5 8

Mexico ISP blocking authority nodes and preventing exit relays.
by Ricardo Malagon Jerez 18 Feb '16

18 Feb '16

I don't know how and why, but since January is impossible to have an exit relay in Telmex ISP. And is harder to reach authority nodes. Someone wrote about this, but is mid February and is the same. Tor 2.8 alpha works pretty good with the authority fallback measures, but I can't implement the exit relay or publish the relay.

3 5

CVE-2015-7547
by starlight.2016q1＠binnacle.cx 17 Feb '16

17 Feb '16

Could someone with a solid understanding of how the Tor daemon interacts with DNS comment on whether and how CVE-2015-7547 (glibc DNS response buffer overflow, remotely exploitable) the bug impacts relay running under Linux?

3 2

Relays with misconfigured MyFamily (declared vs. effective)
by nusenu 17 Feb '16

17 Feb '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, the following relays have misconfigured MyFamily settings. 'misconfigured' is defined by declared family does not match effective family (as computed by onionoo's new effectiv_family field [1] - thanks Karsten). Maybe we will see future versions of globe or atlas displaying a diff of the two family sets to make such misconfigurations more visible. Please let me know if you find any errors (I did not fact check the output). +------------------------------------------+----------+ | Contact (truncated) | Fingerpr | +------------------------------------------+----------+ | +1 303-265-9283, rdump@OFTC | 09683D5D | | 0x3AEE83BB539036CA <bb AT symvaro DOT co | 6FDF2D3B | | 0x6F6D60C1 Security Dept <hello@brasshor | 445F1C85 | | 0x6F6D60C1 Security Dept <hello@brasshor | 6BC82EBA | | 0x6F6D60C1 Security Dept <hello@brasshor | 254EB51B | | 0x6F6D60C1 Security Dept <hello@brasshor | B3515F16 | | 0xDE731050 Gareth Llewellyn <gareth@netw | 5CAECF26 | | 0xFD78BCE1 Fruity Oaty Tor Exit <torexit | 1ECD73B9 | | 1024D/1DFBA164 Bernhard M. Wiedemann <to | 172DC95F | | 1024D/39B9820C admin at perfect minus pr | B897826E | | 1024D/39B9820C admin at perfect minus pr | 5FCC8306 | | 1024D/39B9820C admin at perfect minus pr | 2421E10D | | 1024D/39B9820C admin at perfect minus pr | AC7AE98C | | 1024D/39B9820C admin at perfect minus pr | E8B7D19C | | 1024D/39B9820C admin at perfect minus pr | ED9F582E | | 1024D/39B9820C admin at perfect minus pr | B1843B40 | | 1MTUwHFknUyUgRYqpNDYiA2j7sXTYoCe2P | E799227D | | 4096R/8BA2371C Fabian Keil <fk@fabiankei | 34A5FBA4 | | 8192R/0xB431B67770E4AA38 Mikal Villa <me | FE305F8E | | <hneal AT imalazybastard dot com> | CF9E4605 | | <hneal AT imalazybastard dot com> | D12F66D6 | | <periplanetaamericanus AT gmail dot com> | 5B5213C4 | | <periplanetaamericanus AT gmail dot com> | 47D04EC4 | | <periplanetaamericnaus AT gmail dot com> | F19106D7 | | <support at gkware dot com> | E754AA99 | | <support at gkware dot com> | 868A253C | | <support AT gkware dot com> | 48674035 | | <tech AT dana dot io> - 1AgYtavutLAMxUYM | 752DA4A4 | | <tor .AT. jgjtech .DOT. com> BTC: 1QHXLy | 0DA71D95 | | <tor .AT. jgjtech .DOT. com> BTC: 1QHXLy | 31A40828 | | <tor AT 1d4 dot us> - 1N7sBLKvekRD4EUL2b | F1107CB0 | | Abuse Department <abuse AT hartvoorinter | 81B75D53 | | Abuse Department <abuse AT hartvoorinter | 89E3170B | | abuse<__aT>icetor{_DoT===}is - 1GDerBXAJ | 1D9D1C1D | | anders.io | 91361C96 | | anders.io | D56AA4A1 | | anders.io | 3A2192F5 | | Bauruine <torcontact aatt tuxli.ch> - 1C | 63C1904F | | Bauruine <torcontact aatt tuxli.ch> - 1C | 52F7C67B | | BFC62AD3 johannes <tor (@) kontrollappar | 750941D5 | | Big Jim Slade <sysop AT bigjimslade dot | 9AFA555B | | Big Jim Slade <sysop AT bigjimslade dot | ACDC9C49 | | DFRI <tor AT dfri dot se> | A10C4F66 | | DFRI <tor AT dfri dot se> | DD8BD730 | | DFRI <tor AT dfri dot se> | EC84E232 | | DFRI <tor AT dfri dot se> | A478E421 | | Fabian Keil <fk(a)fabiankeil.de> 8BA2371C | 5CE3AD8A | | General Zod <zod(a)kdf.mil> | 556D59FA | | General Zod <zod(a)kdf.mil> | CBABC09D | | GetReal <x50 AT riseup dot net> | 51529D02 | | http://www.onion.network/ <info at onion | F89A5238 | | http://www.privacyfoundation.ch/abuse/ | DC41244B | | http://www.privacyfoundation.ch/abuse/ | 0111BA9B | | http://www.privacyfoundation.ch/abuse/ | DE7DE889 | | http://www.privacyfoundation.ch/abuse/ | 487092BA | | http://www.privacyfoundation.ch/abuse/ | AD86CD1A | | http://www.privacyfoundation.ch/abuse/ | 95DA61AE | | http://www.privacyfoundation.ch/abuse/ | B060482C | | http://www.privacyfoundation.ch/abuse/ | 88487BDD | | https://www.torservers.net/donate.html < | 4E021F36 | | https://www.torservers.net/donate.html < | F657ACB3 | | https://www.torservers.net/donate.html < | 64D500C4 | | iggs <tor.20.iggs AT spamgourmet dot com | 2F557D48 | | jvictors at jessevictors com, PGP 0xC20B | C6DC982A | | jvictors at jessevictors com, PGP 0xC20B | 4B8C39A5 | | jvictors at jessevictors com, PGP 0xC20B | BFA0E9F3 | | jvictors at jessevictors com, PGP 0xC20B | 40DF7E2E | | Kevin <tor AT kberanek dot com> - 14BTbA | 92EA887F | | Kevin <tor AT kberanek dot com> - 14BTbA | A1E02458 | | kingbiskit(a)gmail.com - 18gEJokSQ3uwo3QTM | C921704A | | kingbiskit(a)gmail.com - 1CoXRRwDt6YVTZmJ3 | 3246AF7B | | M.K. Nitrox <mk DOT reg AT t-online DOT | BD912646 | | montanisemperliberi <a> safe-mail.net | E8B6E46B | | Nicholas Merrill <nick AT calyx dot com> | 51BFE90C | | Nicholas Merrill <nick AT calyx dot com> | 0B5E5E70 | | Nicholas Merrill <nick AT calyx dot com> | 84D361B7 | | Nicholas Merrill <nick AT calyx dot com> | E4D1F25D | | Pascal666 at Users dot SourceForge dot N | C9437269 | | Pascal666 at Users dot SourceForge dot N | 5B7AEB14 | | Peter Palfrader | 847B1F85 | | R P <edschlonz AT yahoo dot de> | FF06E7A0 | | Samuel Whited 0x54083AE104EA7AD3 <sam AT | CA54C9F2 | | Sebastian <tor(a)sebastianhahn.net> - 12Nb | EBE718E1 | | snIP3r <sniper(a)restricted-area.de> | 3EE8D536 | | tor TA fejk tod se | 2AFE9201 | | torelay [ANTISPAM at] ruggedinbox [ANTIS | 0559A3D3 | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | BAACCB29 | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 0B454C7E | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 5A551BF2 | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 4436A57F | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 6D3A3ED5 | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 75C4495F | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 6A29FD8C | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 0C77421C | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 8073670F | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | B35C5739 | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | E6E18151 | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 6A37488D | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | E11B6AE1 | | torpids AT yahoo dot com - 1JYHfzVFVD7n2 | 70C55A11 | | Torservers.net <support .AT. torservers | 488239E0 | | Torservers.net <support .AT. torservers | 6B1E0019 | | Torservers.net <support .AT. torservers | C46524E5 | | Torservers.net <support .AT. torservers | 770BE0CD | | Torservers.net <support .AT. torservers | 5C84C359 | | Torservers.net <support .AT. torservers | 20B0038D | | Torservers.net <support .AT. torservers | 5714542D | | Torservers.net <support .AT. torservers | B4F883DB | | Torservers.net <support .AT. torservers | 78213EC8 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 4E918B21 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | A494237E | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 35FEEA5F | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 2576BFB0 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | A1025D32 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | C8D44E91 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | B7EC0C02 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | FFD6C2CE | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 4C6F66B1 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 43D0AB1B | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | A57B43E1 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 9030DCF4 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 3A5F08D0 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 5C1E076A | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 482A381B | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 2D671A4A | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 66CFF345 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 55F5CF9D | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | FEF59210 | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | B4A553CB | | TvdW <tor AT tvdw DOT eu> - bitcoin 1NKK | 92506510 | +------------------------------------------+----------+ ..based on onionoo.thecthulhu.com's data from 2015-07-15 18:00 [1] https://trac.torproject.org/projects/tor/ticket/16276 -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVprfXAAoJEFv7XvVCELh0/FcP/28/dhefuPNQaBNSY59NTZTs snwb9vRlAzhDDm0XmWEMIaawFlNjV8shJD8dWvzSvynWHYQySfrStmDdfkpe5CSC lu9ceE6qhhZe+RkyDPM3PdxLhz29XVK+KvQcDcCeWp6nIHzXIOJL+Xk7v7FoU75S Vx8GjhVQd/aiHJQg96zlpdzkAsU000jG2E3Z2EH+gd4Uypl94wgqd0482LSSehiQ LVbhPt6C8NlX32kZ4yAD3W5cHRoyhg30x076X8XHZ16H6F2l801hhON5X32VmXdv vd/kJ7R9JKo4Uig1Y9hq3qpsRsO8aJaN2JOXMsGw2A+6eNFA2OPFLg3/sNKLgiLV N/CPqDlMVsotMDcXX4iBYSHW0Y+J7vyc5ezxE/rKWzBCBZSnK9Sb5UzcrDnOfJRO ABFv+ZtGxSQYVPcnICVdMr+3Kuk0FnKMm7z2ufYriRxDK573LQgNJQnjZ3Tc3JG+ PIVZun0IN/+1gZmQif57xIjW1OFDbDYbhMtYFYbK9zRd7PidIr5NHcYCkEY4whfP 2vhN4jbtYQZZY/hDAMLZVBKDJ42tOYG/8EaWZeMJ8y/pd+F8EvT7ceWzXwuhYm77 WiK4VsgFU7PR7ETi/DJL+ajmFEjpRJ8QOy3J5E/dq/eumkkzL/eBTPL7ydnTmD/u 9271J4DjQYPfjzVtVqdl =ecVW -----END PGP SIGNATURE-----

2 3

Re: [tor-relays] TOR service wont start with ORPort enabled
by Volker Mink 16 Feb '16

16 Feb '16

Hi ! Nope, that was my first idea. No old TOR process running. Best, volker > On 15 Feb 2016, at 00:10, Volker Mink <volker.mink(a)gmx.de> wrote: > > I think I found something..... > >>> could not bind to 0.0.0.0:9001: address already in use > > Where can i set the binding? Is your old Tor process still running? Tim Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP 968F094B teor at blah dot im OTR CAD08081 9755866D 89E2A06F E3558B7F B5A9D14F

2 1

Re: [tor-relays] TOR service wont start with ORPort enabled (SuperSluether)
by Volker Mink 15 Feb '16

15 Feb '16

Hi! This command brings no output. So no Port 9001 in use... Message: 3 Date: Sun, 14 Feb 2016 07:48:07 -0600 From: SuperSluether <supersluether(a)gmail.com> To: tor-relays(a)lists.torproject.org Subject: Re: [tor-relays] TOR service wont start with ORPort enabled Message-ID: <56C08597.10905(a)gmail.com> Content-Type: text/plain; charset="windows-1252"; Format="flowed" Try running "sudo lsof -i :9001" That should tell you what process is bound to the port, and also give you the PID so you can kill it. ***************************

1 0