- tor-relays - lists.torproject.org

(no subject)
by 海洋 04 Dec '15

04 Dec '15

1 0

webiron requesting to block several /24 subnet
by WubTheCaptain 03 Dec '15

03 Dec '15

This will be my lengthy opinion on Webiron to get everything out of my mind without redactions. > Webiron's system sends notifications to both the abusix.org contact > for the IP and to abuse at base-domain.tld for the reverse-DNS name of > the relay IP. This doesn't seem to be the case for us. Our rDNS is set to tor-exit.se.partyvan.eu. Back when I received our first abuse complaint from Webiron, the WHOIS for the Tor exit IP-address had an abuse-mailbox contact for us but the abuse-c was still pointed at our data center. Webiron emailed three email addresses: - abuse(a)portlane.com (abuse-c, mnt-by for all of our /29) - info(a)partyvan.eu (unlisted, unused RFC 2142 address) - abuse(a)partyvan.eu (abuse-mailbox) By the time I had received a second or third abuse report from Webiron, I had made some voluntary changes to get the abuse-c assigned to us after registering to RIPE database. Despite this, Webiron's system still contacted two addressses: - abuse(a)portlane.com (mnt-by for netnum) - abuse(a)partyvan.eu (abuse-c and abuse-mailbox) More accurately, Webiron may employ caching of results or go for the netnum abuse-c/abuse-mailbox instead. Other abuse complaints we've received such as one from the Brazilian Army have contacted our abuse@ role only and never bothered our data center. For what it's worth, abuse.net also lists our abuse@ contact for the domain. > I'm currently in the middle of a somewhat heated e-mail debate with > their vice-president. > Pasting the e-mails below would be indelicate, but their position is > that the Tor network is responsible for the abuse it generates and > should take measures to prevent/block malicious traffic. > They also state that according to their measurements, 99% of the > traffic coming out of Tor is hostile, and they're going to release a > report on the matter soon. Webiron's policies are dodgy at best. They even claim that Tor exit operators are legally liable for the traffic they route [1], which is obviously false given our real legislative liability protection for service providers. I immediately lost sense of their credibility. They say: > Groups hosting exit nodes are responsible for the abuse that comes out > of exit nodes. By refusing to take action to stop attacks originating > from your proxies it can make you legally responsible to international > law as well as laws in most regions (IE EU) as it shows a willingness > to facilitate further attacks. Our data center doesn't seem to mind Webiron's abuse reports regarding our Tor exit, and while they also get copies of the abuse complaints they've never bothered us about it. (For the curious, Portlane used to house Serious Tubes which housed The Pirate Bay until a raid on December 2014.[2]) After receiving six or so abuse complaints from Webiron [3] and acknowledging each to support(a)webiron.com explaining it's a Tor exit, I've not heard back from them again for a while. Banning /32 or /24 seems out of question for us to keep the limited liability protection. It wouldn't solve the issue anyway due to 1000+ other exits available, so the best solution remains to block Tor temporarily from the other end or implement CAPTCHAs for Tor users to slow down or defeat bruteforce attacks. As an example, CloudFlare implements CAPTCHA for visitors from Tor. Webiron could do something similar if they wished to act on these as a reverse proxy service. Their requests are too unreasonable for Tor exit operators. By their ideology, I understood they're saying stores selling ski equipment for skiing should be held liable for crimes commited by their customers who bought their skiing masks: > You chose to allow this to run from the network you are responsible > for. Proxing attacks is translatable to providing the mask before an > assault or robbery. At this point we feel your company is complicit in > these attacks by allowing them to continue. For me this does not sound credible, and I didn't bother trying to give their argument more credibility with a reply. They wished me "good luck" [4] after mentioning my Tor exit will be on their blacklist and referencing to IBM's research on "recommending a blanket ban on Tor".[5] At least I still remain to have some sense of credibility in SpamCop and Spamhaus, despite few controversies involved with the latter. This is why we can't have nice things and why I've given up with most hosting providers. PS: Portlane is not yet listed on GoodBadISPs [6] wiki page. -Wub [1]: https://archive.is/Obhnk [2]: http://www.bbc.com/news/technology-30411782 [3]: https://partyvan.eu/transparency/emails/abuse/ [4]: https://partyvan.eu/transparency/emails/abuse/2015-11-13-webiron-tor-exit.m… [5]: http://www.techweekeurope.co.uk/security/ibm-companies-tor-175468 [6]: https://trac.torproject.org/projects/tor/wiki/doc/GoodBadISPs

1 0

PASSWORD
by John favino 29 Nov '15

29 Nov '15

I NEVER RECEIVED A PASSWORD.

3 2

Re: [tor-relays] webiron requesting to block several /24 subnet
by Dhalgren Tor 28 Nov '15

28 Nov '15

>. . .I have to understand how my ISP reacts to this kind of things. >For the moment I will keep a low profile and I will block the >mentioned IP range for a month. Webiron's system sends notifications to both the abusix.org contact for the IP and to abuse(a)base-domain.tld for the reverse-DNS name of the relay IP. So if you can configure abuse@ for the relay domain to forward to you, you will see their notices at the same time as the ISP abuse desk. Might be helpful to know about it before they contact you and/or to see if they become familiar enough with the notices to ignore them. Automated abuse complaints from other sources do not always go to the domain-based address. http://multirbl.valli.org/ is a handy resource that shows the abuseix.org and abuse.net information, as well as how many DNSBLs the relay has racked up. You can change the abuse.net contact but Webiron appears to ignore this source and simply construct the abuse@ from the rDNS domain name.

7 8

Any experience with Pulse Servers?
by Jesse V 28 Nov '15

28 Nov '15

Hi everyone, I've been looking around for a new host for my Tor infrastructure, which includes exits, relays, and a bridge. I've been reviewing https://trac.torproject.org/projects/tor/wiki/doc/GoodBadISPs and ran across Pulse Servers, which seems Tor friendly. They have VPSs in Canada and the UK and have really low prices on VPSs, which I'm trying to understand. I've been trying to learn more but I think they have a pretty small setup (apparently the owner does tech support) and documentation is limited. Does anyone have any experience or opinions on them? -- Jesse V

4 3

Arm thinks Tor is not running as a Daemon?
by Jannis Wiese 27 Nov '15

27 Nov '15

Hi, I’m a bit confused right now. I’ve upgraded my relay to Debian Jessie yesterday and since then, arm keeps telling me > [ARM_WARN] The torrc differs from what tor's using. You can issue a > sighup to reload the torrc values by pressing x. > - configuration value is missing from the torrc: RunAsDaemon I’m running the same configuration as before (running Debian Wheezy), where it worked without any warning. RunAsDaemon is set to 1 in tor-service-defaults-torrc, still arm is showing me on the Tor configuration page “RunAsDaemon False”. Putting RunAsDaemon into torrc as well triggers this: > [ARM_WARN] The torrc differs from what tor's using. You can issue a > sighup to reload the torrc values by pressing x. > - torrc value differs on line: 17 The problem here: There is no line 17 in my torrc… I’ve already read tickets like #16459[1] and #2501[2] but it didn’t help much. Damian says in Ticket #16459 > […] This message is meant to help people who edit their torrc, forget to restart tor, and are then confused why the settings didn't take effect. [...] I did restart tor (a couple times) and apparently it is running as a Daemon (service --status-all). So I hope this is “just” an issue with arm… Maybe someone of you has an idea? I’m running arm 1.4.5.0 and tor 0.2.7.5 (from deb.torproject.org <http://deb.torproject.org/>) Cheers, Jannis [1] https://trac.torproject.org/projects/tor/ticket/16459 [2] https://trac.torproject.org/projects/tor/ticket/2501

2 2

Re: [tor-relays] Faravahar messing with my IP address
by SiNA Rabbani 26 Nov '15

26 Nov '15

Dear Relay Operator, I am the operator of Faravahar, It has been having some network issues, specifically very long latency. But this is the first time I hear of an issue like this. 154.35.32.5 is Faravahr's older IP addresses which was replaced with and 154.35.175.225 is the new IP (current). There are iptable rules forwarding the traffic from OLD IP to the new one for the clients that have not updated yet. Are you running the latest version of tor software? I'll be sure to keep an eye on this email and open a ticket as needed. Thank you for reporting the issue and running a relay. All the best, Sina "Be the change that you wish to see in the world." - Mahatma Gandhi ----- On Oct 22, 2015, at 11:22 AM, Logforme m7527(a)abc.se wrote: > I run the relay Logforme (855BC2DABE24C861CD887DB9B2E950424B49FC34) > > Saw this in yesterday's log file: > Oct 22 03:17:55.000 [notice] Our IP Address has changed from > 84.219.173.60 to 154.35.32.5; rebuilding descriptor (source: > 154.35.175.225). > Oct 22 03:17:55.000 [notice] Self-testing indicates your ORPort is > reachable from the outside. Excellent. Publishing server descriptor. > Oct 22 03:17:56.000 [notice] Performing bandwidth self-test...done. > Oct 22 03:26:55.000 [notice] Our IP Address has changed from 154.35.32.5 > to 84.219.173.60; rebuilding descriptor (source: 194.109.206.212). > > 84.219.173.60: <- My real IP address > 154.35.32.5: faravahar.rabbani.jp <- No idea > 154.35.175.225: faravahar.redteam.net <- Authority server > 194.109.206.212: tor.dizum.com <- Better authority server > > So if I read it right my relay asked the authority server Faravahar what > my IP address is and got the wrong answer. 9 minutes later my relay > asked another authority server and got the right answer. My relay show > an uptime starting from this time and if the relay did a full restart it > meant all the circuits got dropped? Inconvenient for users. > > My relay have "restarted" like this a few times the last weeks (only Tor > daemon "restarting", not the machine). Don't know if Faravahar is behind > the other "restarts". This time I just caught it in the log file before > it got archived. > > Is this a know issue with Faravahar? If so, should it be fixed? > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

7 12

Nagios/Icinga plugin check_tor_bandwidth for gathering bandwidth data
by Josef Stautner 26 Nov '15

26 Nov '15

Hello @all, (I'm not sure if you guys are interested in a topic like this) I wrote a perl script to gather bandwidth data from my Tor exit relay. The script connects to the Tor control socket, fetches the running config to extract the bandwidth limits and the reject rule count. Afterwards the last 60 bw-cache entries are fetched and average values are built for bandwidth in and out. All this performance data is then forwarded to Nagios/Icinga where you can do anything with that values. Every 30 minutes a cronjob renders the graph showing the datapoints of the last 6 houres and uploads the resulting image to my website. You can find the image here (Hint: The values for in and out are stacked): https://blog.veloc1ty.de/bandwidth-large.png The source of the script can be found here on GitHub: https://github.com/vlcty/check_tor_bandwidth It's released under the GPLv3 Maybe somebody will find it usefull :-) ~Josef

4 4

(no subject)
by 海洋 24 Nov '15

24 Nov '15

1 0

keypair issue after backing up relay
by Matlink 23 Nov '15

23 Nov '15

Hi, I'm running a tor relay. I once had some trouble about running it, and I decided to reinstall tor via apt-get. Of course, it did erased all my private and public keys, that I missed to backup before reinstalling tor. Then I ran tor again, with the new identity. As I have a container backup running every day, I was able to recover the erased private and public keys, that I put them back. I can run tor with my original identity, but the directory server is saying me '[WARN] http status 400 ("Looks like your keypair does not match its older value.")'. How can I fix it ? I would like to keep the original identity, since I had all the convenient flags and don't want to wait another couple of weeks to get them back with a new identity. Sincerly, -- Matlink - Sysadmin matlink.fr Sortez couverts, chiffrez vos mails : https://café-vie-privée.fr/ XMPP/Jabber : matlink(a)matlink.fr Clé publique PGP : 0x186BB3CA Empreinte Off-the-record : 572174BF 6983EA74 91417CA7 705ED899 DE9D05B2

2 2