- tor-relays - lists.torproject.org

relayor 0.1.0-alpha released
by nusenu 14 Feb '16

14 Feb '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, relayor is an ansible [1] role for tor relay operators. relayor makes use of tor's "OfflineMasterKey" feature [2] to help protect your ed25519 master keys by not exposing it to the relay at all. Since that requires regular key renewals (default: every 30 days, configurable) this role aims to make this step easy by reducing it to a single command. https://github.com/nusenu/ansible-relayor Main benefits for a tor relay operator ====================================== * security: ed25519 master keys are kept offline * easy key renewal with a single command * security: every tor instance is run with a distinct user * automatically makes use of IPv6 IPs (if available) * automatic MyFamily management * automatic multi-instance setup (configurable) Supported Platforms =================== * FreeBSD * Debian 8 * CentOS 7 * Ubuntu 15.10 * Fedora 23 * OpenBSD (starting with OpenBSD's next release: 5.9) Installation ============ relayor is available via galaxy: ansible-galaxy install nusenu.relayor https://galaxy.ansible.com/nusenu/relayor/ Documentation ============== https://github.com/nusenu/ansible-relayor/blob/master/README.md https://github.com/nusenu/ansible-relayor/wiki playbook examples: https://github.com/nusenu/ansible-relayor/wiki/relayor-playbook-examples migration steps https://github.com/nusenu/ansible-relayor/wiki/Migration-Steps git tags are signed with: pub 4096R/4D705DE9 2016-02-11 Key fingerprint = A7B5 DB91 CE04 C9E0 BE66 446B 8CBE 52BD 4D70 5DE9 uid ansible-relayor signing key (https://github.com/nusenu/ansible-relayor) feedback is appreciated. regards, nusenu [1] https://docs.ansible.com/ansible/intro_getting_started.html [2] https://trac.torproject.org/projects/tor/wiki/doc/TorRelaySecurity/Offli neKeys -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJWv3qoAAoJEFv7XvVCELh0H9IP/i7rRh3zrGRiru4uSOjZKUtB Fni5jqCxS29V2GKNIXt075M/osd/ZEcTeBPieHvsfQn1t1Ju4e2HwIt9yjENNycM Hg2VDkJt2wRxIg7hOHihGRqqxY7f85FLOpj4y11EskZMKFosOWJ8DrfBCGxYgLLf vVbPEyS454Kj3ezX5BXQsmMAm97tCWeMLwG1BBLnkA+ift0A+/SHU85vYYLGUdPw htZfxe83+WteziNhm8qOVw0sYlJwU8GAghFGeK/y1oPAUb0SjK9D2UHvldM6YNs8 +9359V2kHLMdqWZawellxxnbMNxjpEoHUlMDLpvmuN/S/MtBOkRGeST8bwVM1kRM NHWn3NfmoKDt1NVBqTHY8RfmG+ODr9AXzyP9q9khNlN+R72r60kPgX8+vGR06g9j 7oFi5t+0SlWK+vExEyl+bLTA74ps3GBpk+w9zM2rhX9hms3pn5AAEDzHANY6YxB7 YCpvd/cpykQFQKo6fvmuk0Igdy91rvVPh21eV2boD8qTQ2eVazNj5NLju+9gpUiW oRBN44v23KBXx+lgGb3FeNbSuzlh63MgQ6W9l7A985mfjyo0Xzw71NT5EjbC0eyM t0rdKY2byjUNOFNzb1emYVeujVIpyZqbyU/9opQGPWo7gDtDm4LwZLLBE/fD01ej F0rvBB9VpGIEp+hrWit+ =+F/t -----END PGP SIGNATURE-----

1 0

Re: [tor-relays] Re-Install Tor on raspberry, keep torrc and fingerprint
by Volker Mink 08 Feb '16

08 Feb '16

Thanks!! I will try this! ==== Message: 3 Date: Sun, 7 Feb 2016 14:58:19 +0100 From: ZEROF <security(a)netmajstor.com> To: tor-relays <tor-relays(a)lists.torproject.org> Subject: Re: [tor-relays] Re-Install Tor on raspberry, keep torrc and fingerprint Message-ID: <CANkaMAkdWFS7zLmgvjO8_b8aigDMeC6QniWq8vtBTEva9Qjb-A(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Hey Volker, Indeed, like Pierre said, backup all keys not only private key, backup torrc as well. Then you can reinstall your Pi. And about ControlPort, read: https://www.reddit.com/r/TOR/comments/2haw9s/having_some_issues_with_arm_and _tor_relay/ Cheers! ************

1 0

Re: [tor-relays] Re-Install Tor on raspberry, keep torrc and fingerprint
by Volker Mink 08 Feb '16

08 Feb '16

Thanks, i will try this! === Message: 1 Date: Fri, 5 Feb 2016 13:41:07 +0100 From: "Pierre L." <petrus(a)miosweb.mooo.com> To: tor-relays(a)lists.torproject.org Subject: Re: [tor-relays] Re-Install Tor on raspberry, keep torrc and fingerprint Message-ID: <56B49863.2090506(a)miosweb.mooo.com> Content-Type: text/plain; charset="windows-1252" Hey Volker, Never tried this, but there's something in the FAQ about this... https://www.torproject.org/docs/faq.html.en#UpgradeOrMove I remember some people saying you need to save every keys (and not only 1 as said in the FAQ), if I'm not wrong, in Raspbian you can find them in /var/lib/tor/keys And in the torrc, check this/// //DataDirectory /var/lib/tor/ I'm not sure, and I'm sadly noob with Tor, but this easy solution can be tried quickly I think... + when I check on my Raspbian (Jessie), debian-tor is the user/group by default on the directory /var/lib/tor I always launch arm with this command : sudo -u debian-tor arm Your /etc/tor/torrc config file has been overwritten by the upgrade ? Have you check it ? Good luck!

1 0

How to prevent netscan usage?
by Roland 'ValiDOM' Jungnickel 08 Feb '16

08 Feb '16

hi, I'm operating a tor exit with a relatively high bandwith rate for more than 3 years. My ISP receives more and more abuse tickets about my server regarding netscans. These netscans are executed with dest. port 80 so I'm not able to block them easily. Any idea how to prevent netscans using my exit node? Below you find an extract of such an abuse mail. Thanks a lot! ValiDOM Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 41518 => 46.20.92.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 41545 => 46.20.92.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 41575 => 46.20.92.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 45219 => 59.192.63.xx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 45218 => 59.192.63.xx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 45217 => 59.192.63.xx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 42460 => 59.203.179.x 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 42517 => 59.203.179.x 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 42569 => 59.203.179.x 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 57564 => 59.211.15.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 57596 => 59.211.15.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 57631 => 59.211.15.xxx 80 Wed Nov 18 12:55:27 2015 TCP 88.198.14xxx 58022 => 59.228.86.xxx 80 Wed Nov 18 12:55:27 2015 TCP 88.198.14xxx 58046 => 59.228.86.xxx 80 Wed Nov 18 12:55:27 2015 TCP 88.198.14xxx 58081 => 59.228.86.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 37123 => 64.238.74.xx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 37178 => 64.238.74.xx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 41003 => 65.20.53.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 45785 => 65.186.130.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 45850 => 65.186.130.xxx 80 Wed Nov 18 12:55:26 2015 TCP 88.198.14xxx 45907 => 65.186.130.xxx 80 Wed Nov 18 12:55:12 2015 TCP 88.198.14xxx 60607 => 66.87.185.xxx 80 Wed Nov 18 12:55:12 2015 TCP 88.198.14xxx 60611 => 66.87.185.xxx 80 Wed Nov 18 12:55:12 2015 TCP 88.198.14xxx 60613 => 66.87.185.xxx 80 Wed Nov 18 12:55:14 2015 TCP 88.198.14xxx 52693 => 69.191.200.xxx 80 Wed Nov 18 12:55:14 2015 TCP 88.198.14xxx 52740 => 69.191.200.xxx 80 Wed Nov 18 12:55:14 2015 TCP 88.198.14xxx 52783 => 69.191.200.xxx 80 Wed Nov 18 12:55:27 2015 TCP 88.198.14xxx 35453 => 71.54.215.xx 80 Wed Nov 18 12:55:27 2015 TCP 88.198.14xxx 35464 => 71.54.215.xx 80 Wed Nov 18 12:55:12 2015 TCP 88.198.14xxx 39263 => 101.249.145.xxx 80

6 9

Re-Install Tor on raspberry, keep torrc and fingerprint
by Volker Mink 08 Feb '16

08 Feb '16

Hello there. I recently updated my Raspberry to the Jessie-Release. During this procedure TOR updated to 0.2.7.x (?). Now I have the problem that TOR is running as a new process and I cannot access it via ARM. Everytime I start ARM, any user, it show the "Menu" where I can choose as what the TOR should work. I say "last config". In the status screen it says: 22:32:37 [ARM_WARN] Connection refused. Is the ControlPort enabled? arm - raspberrypi (Linux 4.1.13+) Tor Disconnected (press r to reconnect) On page 4: page 4 / 5 - m: menu, p: pause, h: page help, q: quit Tor Configuration File: 1 ### Unable to load the torrc ### ==== What to do? For me it looks the best to remove TOR completely and reinstall it clean. But how to keep my Fingerprint and the Stats? Or anyone has a idea how to fix this. Im not so deep into linux to fix this error. https://atlas.torproject.org/#details/E20FF09A9A800B16C1C7C16E8C0DF95F46F649 B0 Anyone can help me? Best regards, volker

3 2

Bandwidth measured is low
by Pierre L. 08 Feb '16

08 Feb '16

Hey, In arm console, there's since few days a very low bandwidth measured. Something like 10% : *Bandwidth (limit: 720 Kb/s, burst: 960 Kb/s, measured: 96.0 b/s) *There are some topics about this on the www, and I've understood it can be a bug, but only 1 or 2 years ago and nothing really new. This is a home little relay contribution, with 900 to 1000 kb/s upload available, no bandwidth server killer inside my LAN... So do this bug is today solved, so I got a problem ? Is there something to do to solve it, on my config ? ps: RPi v1, Raspbian v8 Jessie Thx for your light :)

2 3

Issues with offline master key functionality
by Riccardo Mori 06 Feb '16

06 Feb '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi everyone, Two months ago I decided to try the new ed25519 key introduced in Tor 2.7 with OfflineMasterKey set so I can keep the master key in a different place and just upload the medium-term signing key every month. Last month everything went ok: I renewed the key and Tor accepted it. This time instead after generating the new signing key with # tor --datadirectory path_to_my_master_key --signingkeylifetime '1 months' --keygen and uploading ed25519_signing_cert and ed25519_signing_secret_key and fixing the permission, Tor keep saying Feb 03 07:27:40.000 [notice] It looks like I need to generate and sign a new medium-term signing key, because the one I have is expired. To do that, I need to load the permanent master identity key. Feb 03 07:27:40.000 [warn] We needed to load a secret key from /var/lib/tor/keys/ed25519_master_id_secret_key, but couldn't find it. Did you forget to copy it over when you copied the rest of the signing key material? Feb 03 07:27:40.000 [warn] Can't load master identity key; OfflineMasterKey is set. Feb 03 07:27:40.000 [err] Error initializing keys; exiting That raises two questions to me: - why does Tor think the new keys are already expired? - why is Tor searching ed25519_master_id_secret_key? With OfflineMasterKey set it shouldn't care about the master secret key Thank you, patacca -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWsgVWAAoJEE1LNuolWAxg12QP/iy/rd0cPPt8WhzXXCmlRwRi vNFZ2PO6ltpS9uu0HRgUExpDGG1QY8eLUZxRUPCg1lFPbu/tsfHo+Rz3RB6iAg0Q rkqkSen4vjAboA2PTfyu6oLQEqX4zHyJ4RaFZcdemgYdm4/B1pbZVMYOgI1EiJQj bX/WSyjPlAF5gXhWW+F1UH/ucCLcue8LumWdd2qGSILVInzEcXfM2myTi4NRZJry pearKYlMMSt70+qM7ivBKelYp3iMpZjUZOQa4rDmNEvWncWmHDi+QxggsKBGJ/Kf ZqwVuatCQT56B10GNGZrc5bUx1cbBjdXj4wMLh3D/8wxMIJztPB9rEI2+C2GzP3d asG054o2GHQ5HISQqFuFTZ4dzyjudV/g3HbA78kXcLXrTuSVSV0vZ8cEqACiaYSI dFfIjNTevr9WgWbXPfKFzILAGlBS6gUWJflh8eQY539Jg0LnJI4XpSbSFlvAU8dQ fzZSLnUGdPC0w8dcPpSeS+ojxiQ1cv7qQoeubpyXvO16ATlxDZ6SW9WwFDKEN72N xUOwIBGBpj6Onq8UuieMRTqolcd5jc96/4Y1rVCUeegRts+0RloW+ftODf5MjcyR 5uvbvyrm9J9AsAzFkK+ZI7Xi+Fad4lR1rsdM7t9jWndHFb83DEKDOJPyq+aFgk+r 00IxrkcEOwzQUf68QLcP =xN1c -----END PGP SIGNATURE-----

3 5

Should Onionoo consider relays with the same ip# to be part of the same family?
by Virgil Griffith 05 Feb '16

05 Feb '16

For example, these two pairs of relays that came online yesterday: * https://atlas.torproject.org/#details/0ED2D734F295427E5A3719FA7B9985C335839… * https://atlas.torproject.org/#details/667C297D3EC6E1281D68F7F4C8C9BE8324D13… and * https://atlas.torproject.org/#details/667C297D3EC6E1281D68F7F4C8C9BE8324D13… * https://atlas.torproject.org/#details/2FF21F475C2E668C23DB7625A9D45B52591B3… (Hat-tip to Sean Saito for pointing these out.) No wrong answer---just wondering what is the community's vibe on this issue. I can go either way. -V

6 9

"Relay unresponsive (last heartbeat:...)" every hour or so?
by Deep Lodokus 03 Feb '16

03 Feb '16

Hi All! Running a TOR relay on a Raspberry Pi B+, not overclocked, over WiFi, running Raspbian. TOR is capped at RelayBandwidthRate 1000 KBytes and RelayBandwidthBurst 1500 KBytes While my /var/log/tor/log suggests that all is fine, my tor-arm logs suggest otherwise. See some copy/paste from logs below. Is something wrong with my setup? If there's indeed a loss of connectivity every hour or so, should I refrain from running this relay altogether? I haven't tried to connect the Raspberry Pi directly with a network cable, I could try that. Thanks! Snippet from /var/log/tor/log: *Jan 28 19:30:51.000 [notice] Circuit handshake stats since last time: 576/576 TAP, 1281/1281 NTor.Jan 29 01:30:51.000 [notice] Heartbeat: Tor's uptime is 1 day 12:00 hours, with 23 circuits open. I've sent 565.53 MB and received 604.21 MB.Jan 29 01:30:51.000 [notice] Average packaged cell fullness: 98.805%* Snippet from tor-arm logs: * │ 21:26:44 [ARM_NOTICE] Relay resumed │ 21:26:17 [ARM_NOTICE] Relay unresponsive (last heartbeat: Fri Jan 29 21:26:07 2016) │ 20:04:22 [ARM_NOTICE] Relay resumed │ 20:03:56 [ARM_NOTICE] Relay unresponsive (last heartbeat: Fri Jan 29 20:03:42 2016) │ 19:30:51 [NOTICE] Circuit handshake stats since last time: 639/639 TAP, 1104/1104 NTor. │ 19:30:51 [NOTICE] TLS write overhead: 3% │ 19:30:51 [NOTICE] Average packaged cell fullness: 98.954% │ 19:30:51 [NOTICE] Heartbeat: Tor's uptime is 2 days 6:00 hours, with 40 circuits open. I've sent 1.72 GB and received 1.76 GB. │ 19:18:33 [ARM_NOTICE] Relay resumed │ 19:18:12 [ARM_NOTICE] Relay unresponsive (last heartbeat: Fri Jan 29 19:17:57 2016) 21:26:07 2016) │ 18:21:37 [ARM_NOTICE] Relay resumed │ 18:21:15 [ARM_NOTICE] Relay unresponsive (last heartbeat: Fri Jan 29 18:21:00 2016) │ 17:22:44 [ARM_NOTICE] Relay resumed │ 17:22:16 [ARM_NOTICE] Relay unresponsive (last heartbeat: Fri Jan 29 17:22:02 2016) │ 16:14:26 [ARM_NOTICE] Relay resumed │ 16:14:10 [ARM_NOTICE] Relay unresponsive (last heartbeat: Fri Jan 29 16:13:55 2016) │ 15:19:40 [ARM_NOTICE] Relay resumed │ 15:19:13 [ARM_NOTICE] Relay unresponsive (last heartbeat: Fri Jan 29 15:19:02 2016) │ 14:04:23 [ARM_NOTICE] Relay resumed │ 14:04:01 [ARM_NOTICE] Relay unresponsive (last heartbeat: Fri Jan 29 14:03:48 2016) │ 13:30:51 [NOTICE] Circuit handshake stats since last time: 593/593 TAP, 895/895 NTor.*

2 3

tor middle node question
by Markus Koch 03 Feb '16

03 Feb '16

hi, as a good TOR support peon I got a dedicated server and set up TOR 3-4 weeks ago. Everything went great, I got my Guard, Fast and Stable etc. Flag and my little server was busy & happy. After restarting the TOR daemon I lost all my flags and even after 12 hours I only got Running and Valid back. What went wrong? My server is: https://torstatus.blutmagie.de/router_detail.php?FP=caf1eea0e8e8919dfc480a8… Markus

8 10