- tor-relays - lists.torproject.org

27 Mar '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Suddenly my relay lost all it's flags plus weird bandwidth drops while the network is fully intact. Tor version 0.2.7.6 - Ubuntu server 14.04 - -- PGP : 29A4CE52 -----BEGIN PGP SIGNATURE----- iQI4BAEBCgAiGxxEbyA8eWFuZGVyZXNvbkByaXNldXAubmV0PgUCVvaCxAAKCRBI of/XNyszStdfD/9KFIGLcxSUS0gmfHjJFPEgxHqBYunI4wSehrSve+ZcA5D66u7J FaYDaA3BB3+q2OuDsz4/3yb2ArGObkzV6sTZi4ti1zT3knU11Zw7zYvtZ7kFnfjD BFz6N7wY1tu+crrBLmM53ycyURlZxMYQieK5bpgUdz4S8WBm9LIGN1A2uV6Ifnjc Hn7cke64b0iij5QVIp0v04CjzhhxywvYqcu5U/1Z/nnxt53bGW5gtaaacz4y0fVf qFVUaBXiJR0usxoX0yvE3t+qfGVyUNAHbbB4nO3tVxQJqqaOiGcqwLoMVDCbmQlm 2ZXnbC0dgA12votJVHthZ0EGNH75+IthGic/+3LvcDoalVruohNVhXNj5WJhe5w8 J8G8KDJ+ZgnOstDwd3yJnogX0BuFB3fovopMzuWf+AJB3MVODzDbTE2md4bk1/QT If1jLLLWxhVCJJg3f7WzM1+L8glo7NUVCS6rL1DXKiFpEHP2Gw9fo8HKYxwiPar/ wvVchOL3FimbphMqKBd9o1o8CeYB9VZFUMt+cm3tfRimpotn3WNgNOWJw2Udlvpu 9l+582Vs1Y6ebZ7KfKETmsbF6iI00tA/kX9MBJu0X6TICDK31vXHR77d5HvZ1Ql6 bv7u/QBeBmGiUCy/w5utq1RZ7MxO9MDtY22dkakim4nYw8fpJL3fgWjn1g== =Bo8A -----END PGP SIGNATURE-----

3 4

Tor Exclude Nodes Misbehaving
by stealth＠nym.mixmin.net 26 Mar '16

26 Mar '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have edited my torrc file on my Tor Client to exclude several countries, but I keep getting the United Kingdom in my pathway. My torrc file is below: DataDirectory C:\Users\Myname\Tor Browser\Browser\TorBrowser\Data\Tor GeoIPFile C:\Users\Myname\Tor Browser\Browser\TorBrowser\Data\Tor\geoip GeoIPv6File C:\Users\Myname\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6 ExitNodes {PL}, {RO}, {LU}, {DK}, {CH}, {NO}, {AN}, {LI}, {IS}, {FI}, {NL}, {HU}, {BG} ExcludeNodes {US}, {CN}, {FR}, {UK}, {ES}, {IT}, {AU}, {HK}, {RU}, {PT}, {IL}, {IE}, {DE}, {CA}, {BE}, {NZ}, {PR}, {MX}, {KP}, {KR}, {GR}, {DJ}, {JP} StrictExitNodes 1 When I click on the green onion after selecting a web site, I keep getting the United Kingdom as one of my nodes. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (MingW32) iQIcBAEBAgAGBQJW9uefAAoJEH1gNwhiMDZuNNMQAIXhg1yq0Fq4pC2PsQ5jrOSh AtI3CnsUYg1+CtzAQtqksfb7PDwhTVAXFu7l2Ap1PrPBc+LcFrzZ4HAbqTPpGaYP DPokmhIlTgAzgAmu0n7RDJPSJmFXRJWdW6wULI4GsAPFHE9gU036Hd+1R9agIxrt oleizTVRAXpFqQgjLtGfiIYGQUh5vlWIiVCWOr6CGE5GkWLOC5oYPU7wKDzIE25o 7L56y6AyiUcA7abRMCDQCnVQ2AAY4dZwJ8ESK+j+ZJMGZIK2CbBeJF2QwlkjSFdn Mtjbctl4qwQqgcBhcVKuK3dMsdVnpj1YqEa8mGeMVTje74R1E2HULsJHq1UPLvkr /h8HTspIf45KvcDL1F1PoHpr9B2zWW/LJxvBL2VJiNIDRjZscuIQdzNJe2GE3P51 ImUozWR1+BHhn0h+y9zq/Pcq0dlmHGdrf7v/QgSLPq9g5RbNsyRKA6j0KhIC9efX 71DVclpgwAVC9itgpEnc1wHMkZZwcs+JWYJjvgcJ2UFR/CY79ZWfQePAn2bCledN AOkBfDclPvKZMXy9cXh9SgPWTesonOp4CubhvFXH6ReBBWfU9RYjCRhqy9w6XPaB OiYObQEYgoodftNZoqo8HVDdHLq0S+mwUPEM2x1UQDga40F8LqR3SB0BKySalG6K Mlc+6qOy65PvE6OGt94Z =kUjp -----END PGP SIGNATURE-----

2 1

OrNetRadar spots botnet joining the tor network? (79 relays, 38 countries, 67 ASes)
by nusenu 26 Mar '16

26 Mar '16

Hi, this smells like a botnet to me: http://article.gmane.org/gmane.network.onion-routing.ornetradar/1073 http://article.gmane.org/gmane.network.onion-routing.ornetradar/1074 all relays with that bitcoin adress: https://gist.githubusercontent.com/nusenu/fb19034a7860dba6c203/raw/5531768e…

4 10

Starting an exit node from spain
by f4aRelay 24 Mar '16

24 Mar '16

Im spanish and i want to start a tor exit relay. I have thoght about using this hosting: Pulse Servers (http://www.pulseservers.com/) Also i would like to know if there is any legal thing i should know for running a relay in spain Thanks -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v2 mQENBFb0BYIBCADE1jSLjOOb0sVZBAHpbItjWoqJamG+mlrR4936upHz2m2r7D2L pzOoYF/Gn4Iytk3IGVZT3Hfci18+nymidYl0L9guGLYGU1Z/T+v7wFKMOJCbty6p TNm9lOYDc1d8AVEGMMj2rmcHwP2ON98CRxKgGJscVgA7xno2PVeQSGqBgLv2UB/0 rqZsJnbsSHPH9+qxfxNuNh8DoByClf2S/Fx/WYbqyaoJBofv7FAVjWSVJTB/KSBO 2rDt9IRD3cLnFjGsGS7MBPvimPPgJQRkPrXPTWP3v5RNvUhd03PkLcPEcKF1fans MR1ywzxGxMQninSLw4oxpTm5H5xfqDfmRH/tABEBAAG0IkY0QXJlbGF5IDxmNGFy ZWxheUBwcm90b25tYWlsLmNvbT6JATkEEwEIACMFAlb0BYICGwMHCwkIBwMCAQYV CAIJCgsEFgIDAQIeAQIXgAAKCRCG6H1KC64jxZOhCADEHjEI+XkhmsNd67NjywIw aiaIfClVOrr5qnwhmZ77Wz7cmOcUsVJCNiKeYcG7WSOhNLeVEg7F6qeLyne5VHnJ Ncbb7+6YeD2bz04PcwDAyrkWRYdKhjIuNxbx1qoMzTkuenXa6qd+hj4yObYJlful 3zw5x49Vky6lxU3rHL+pKq2F2Hb6fyOkJd9uXP/I1muk98GMWK3WcLXGGY0TRo+7 CrlCvZBCtJ6laOo9hmt25KiuYq8xctT5Y7G3W+xc8yva0rQ+7D3wrCjFZIZAk6qt isn65zKBaGaTeMn+OfzWAsLsNyXCqvUT3BqQ4gd6Iu4VFtpWgetc1CehMkgaptYW uQENBFb0BYIBCACu2eXrkf+E1OE3zzXlJkG8GSL16F7qlOSqmezYGyJiPjLCSSiS WhG5s/7vbP90iM/LT9MRWExeae4JFesobPjt3TWF6vJflIL168uc6H8uKoncFET8 yN6eaayGNnhLYNef4dd+2qvU91qKZke1rRkBb7KQRUN7lTmFGOdsbYXk1OcUfS/p uZeF2QfdKhanWuDl42oQz+aB69UcDwwPbwplb329wR/I7AV+KFr1qTIIilq6qRek xOQOqzVF8mBMVS5EMjr3SQZaK9Ch21njZJr3pQ+hLI5RAx8a6k8vHn8muJEFxDTo hcPuOJ1Z8eBNKs7HA/XypJr56DCYt9nHE6GhABEBAAGJAR8EGAEIAAkFAlb0BYIC GwwACgkQhuh9SguuI8VNuQgAnuAN6UfxN55bCaTNWwJA0hietSNjKlM1TEzmjHmR 4Ch18lW2o4DT2dxCyoC+tRCjrLOxeKl7+MxGRF3mVl1tHSasjFkWFd6BohFutlJd 8r52RvdR2cPgEY+R9VLw6onQFEyMiTKxypwrCMKrB+R5qH6AvrBkGMjfZDdTqybi 8Kq4ZpqomnIsK85X+Kvr9SKuk4j4dkh244kk/8GAsZqhSKyP8D4JnylAhD/ZTSiT nXsXs0QIi1fntt6xxVx72UgR0pKEyl2koN76Mvew8qSZBALyp+o1cqaFOQXsO+gt Ri2gEEfL7Eors/Nl2+BGCHcWHXhY9F4nNz6fsq5DN+2Wzw== =LfjJ -----END PGP PUBLIC KEY BLOCK-----

3 2

Re: [tor-relays] Minimum Relay/Bridge Bandwidth
by Michael Armbruster 24 Mar '16

24 Mar '16

> Our family recently downgraded our internet connection, which limited > our upload speed to 1Mbps. According to the Tor relay doc, a minimum of > 2Mbps is recommended, yet a relay is considered "fast" if it has 1Mbps. I think you misread the documentation. 2Mbps is a recommended minimum, but a relay is considered fast if it has 1 Megabyte/sec and Megabit (Mb) and Megabyte (MB) are not the same. > Will I be hurting more than helping if I run a relay on this connection > speed? Should I run a bridge instead? With 1Mbps, you have 125 Kilobytes/sec upload rate. I would say yes, run a bridge instead. But let's see what other pepole say, eventually. Michael Armbruster

2 2

intense DDOS of exit relay from China
by Dhalgren Tor 23 Mar '16

23 Mar '16

FYI tor-relays Exit was DDOSed yesterday at 18:00 UTC. The attack was intense enough that the ISP null-routed the server for 16 hours, which has never happened before. Have seen a handful of brief DDOS attacks (about 15 minutes) in the past but none were so intense as this one. All traffic originated from China.

4 3

Running 5000 relays...
by nusenu 22 Mar '16

22 Mar '16

Moritz wrote: > Maybe this is better taken to tor-relays. Ok. url to the tor-dev thread: https://lists.torproject.org/pipermail/tor-dev/2016-March/010473.html Brian didn't say anything about planed deployment locations, but if _all_ relays are within a single /16 network you might skip MyFamily altogether, but I assume they are not. > In my case machines have a lifecycle. They come and they > go out of curiosity: What percentage of them do you expect to be online concurrently? (starting when) Are planing to rekey when "coming back" or resume with the former? > On 03/05/2016 10:31 PM, Brian "redbeard" Harrington wrote: >> "Lets say you are about to deploy 100 relays within the next week." - >> Take this an order of magnitude greater and we're on the right track >> with the correct scale. It is a regular occurrence for our users to >> deploy 500 to 5000 nodes at a time. This is why I said "and maybe set yourself an upper boundary as to how big you want to grow" A single entity deploying 5000 relays isn't very sane at the current network size I guess, but instead of speaking of relay counts using CW fraction/exit/guard probability as upper boundaries makes more sense. <10% might be a worthy upper boundary for exit/guard probability. The biggest (known) exit operator is currently at 7-8% exit probability. teor wrote: > And there's likely some limit on MyFamily or on descriptor size that would stop > you listing 1000 fingerprints. That is actually another good use-case for replacing the current MyFamily design with something that scales better with family size like Mike's proposed design (#5565), but we did not see declared families that big so far. It was no problem in practice. https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt#n364 > Server descriptors may not exceed 20,000 bytes in length; [...] If they do, the > authorities SHOULD reject them. So the max family size would be something around 400 relays? (20000 - 1250) / 42 = 446 (1250 bytes was the size of a non-exit sample descriptor without family) > generating 1000 relay keys and coordinating that key > distribution dance across the same number of nodes (more than likely in > highly distributed environments) seems to bring more questions than it > answers (securing the keys for those nodes, securely distributing them, > etc) What problems do you expect when generating and transferring 1000 relay keys? (besides the descriptor limit) ... but before trying to solve any problems it is probably best to answer the question whether a single entities should run >5% CW fraction at all. > There are about 7000 relays in > total, with over 1000 of them (almost 40% of the capacity) at only three > ASes. Top 3 ASes currently account for 32% cw fraction. https://compass.torproject.org/#?exit_filter=all_relays&links&sort=cw&sort_… but the top 1000 relays account for >72% cw fraction https://compass.torproject.org/#?exit_filter=all_relays&links&sort=cw&sort_…

7 18

TheOnionBox v2.1 released!
by Ralph Wetzel 20 Mar '16

20 Mar '16

1 0

Exitmap module to count CloudFlare CAPTCHAs
by Philipp Winter 20 Mar '16

20 Mar '16

I wrote an exitmap module [0] that can tell us how many exit relays see a CloudFlare CAPTCHA when connecting to a given site. First, I ran the module for coreos.com because it uses CloudFlare, but the owner configured it to whitelist Tor. Indeed, only one out of 864 exit relays saw a CAPTCHA: <https://atlas.torproject.org/#details/7DD29A65C370B86B5BE706EA3B1417745714C…> Next, I ran the module for cloudflare.com, which does not seem to whitelist Tor. 638 (75%) exit relays saw a CAPTCHA and 211 (25%) didn't. [0] <https://gitweb.torproject.org/user/phw/exitmap.git/tree/src/modules/cloudfl…> Cheers, Philipp

3 3

GoDaddy null-routing Tor Exit IPs
by Dhalgren Tor 20 Mar '16

20 Mar '16

FYI Tor-Relays GoDaddy AS26496 is null-routing selected Tor Exits, presumably in response to abuse originating from them. Know of two thus far FE67A1BA4EF1D13A617AEFB416CB9E44331B223A 2016/01/26 ashtrayhat3 A0F06C2FADF88D3A39AA3072B406F09D7095AC9E 2016/03/16 Dhalgren though probably more exist. Appears to affect faster relays. Affected relays running 'unbound' for DNS may experience total DNS request freeze and should switch to 'named' to mitigate the failure. Null-route seems to be manual and persist for indeterminate time. Null-routed IPs will not be able to ping or connect to address listed in the report at http://www.cidr-report.org/cgi-bin/as-report?v=4&as=AS26496 Information on how this was discovered can be found at #18580: exit relay fails with 'unbound' DNS resolver when lots of requests time-out https://trac.torproject.org/projects/tor/ticket/18580

1 0