- tor-relays - lists.torproject.org

Suggestion to make Tor usage more disguised
by Raúl Martínez 16 Jan '16

16 Jan '16

Hi, I am writing this message to make a simple suggestion that could help driving more adoption to Tor by making using tor less obvious for a network administrator. This suggestion tries to address the user case of a common Tor usage, in which the user is not being attacked nor mitm, he is just using tor in his work for example. The network admin of the office is not searching actively for Tor users in his network but one day he log-in in the router panel and he sees this: - Current conexions - WORKSTATION-98 38.29.00.2 [torproxy10.teaxxcu.com] Is obvious that is using tor. The network admin was not looking for Tor usage in his network but it saw this without looking for it. Now this worker can be in serious trouble for using Tor. So my suggestion is to set-up a custom hostname an a Tor-explaining html index ONLY in TOR EXIT nodes. They are the only nodes that can get in trouble and its helpful to advertise that they are tor nodes. ENTRY GUARD nodes should not advertise neither in the hostname nor in a HTML-index-page that they are Tor nodes. This way the network admin would only see an IP and a common hostname, that is a normal behaviour for a HTTPS request. So, having said that *I encourage all Entry-Guard owners to unset his hostname and to disable the HTML-index-page*. That could help a lot of Tor users to not draw unwanted attention. Obviously a network-admin can get a list of Tor relays and check if you are connecting to one of them but most of network-admins just take a look at his router info page without further investigation. Thanks for your time. TL;DR: I encourage all Entry-Guard owners to unset his hostname and to disable the HTML-index-page.

5 5

Re: [tor-relays] [tor-dev] How many exits exit from an IP address different than their OR address? (10.7%)
by grarpamp 14 Jan '16

14 Jan '16

On Wed, Jan 13, 2016 at 10:05 PM, Virgil Griffith <i(a)virgil.gr> wrote: > In our quantifications of relay diversity, knowing the IP addresses that > traffic exits from is important. Ways to have this information correctly > reported would be very helpful. Which is exactly why free to connect back through them and make your quanta and know for yourself or for some research statisticals. But it is the apparent disappreciation for and implied calls to remove them or to publish consensusify their would be formerly stealthy feature use that is a problem from this view. Users use them to access things around censorship, there is no higher purpose of Tor.

1 0

avoid exclusion from FallBack Dir list: do not start during minute 49
by starlight.2016q1＠binnacle.cx 14 Jan '16

14 Jan '16

See comment 6 in Bug #18050: Relay submitted a descriptor with 0 DirPort due to a self-test race condition https://trac.torproject.org/projects/tor/ticket/18050

1 0

probable FallbackDir relay determination bug
by starlight.2016q1＠binnacle.cx 12 Jan '16

12 Jan '16

Dug into the situation Aeris reported where his kitten1 relay was nixed off the fallback directory list due to a single consensus where the dir-port was published as zero. Quickly found three additional very fast very stable relays where the same thing happened: BF0FB582E37F738CD33C3651125F2772705BB8E8 12-28:17 quadhead C43FA6474A9F071E9120DF63ED6EB8FDBA105234 12-25:03 ArachnideFR5 5665A3904C89E22E971305EE8C1997BCA4123C69 11-15:18 GermanCraft In each case the V2Dir flag and DirPort are removed for a single consensus interval and then restored on the next consensus. Appears that a daemon restart is the trigger. Version update not required. Several possible causes, but the one that comes to mind is the daemon could be briefly pushing a descriptor with V2Dir inactive while completing the reacahability test for that port. This deserves to be researched further and mitigated. A possible solution is to have the script tolerate a single consensus with V2Dir removed and a reset uptime. Alternately the daemon could not push a non-V2Dir descriptor during restart and wait for the reacahability determination. I don't know enough about it to be sure the problem isn't something else. At 19:20 1/12/2016 +0100, Aeris wrote: >> Are you *absolutely* certain that the config >> was not fiddled with at the time of this event? > >After grepping some logs, seems 13/12 was the day >of a Tor upgrade: > >2015-12-13 10:47:31 upgrade tor:amd64 0.2.7.5-1~d80.jessie+1 0.2.7.6-1~d80.jessie+1 >2015-12-13 10:48:39 configure tor:amd64 0.2.7.6-1~d80.jessie+1 > >Timing is good compare to the 10:48:46 of the consensus ! > >But I don't remember a config change after that, >perhaps only on /usr/share/tor/tor-service-defaults-torrc >or on a default config param change ? > >And perhaps the Tor reboot cause the DirPort to >be temporarily disabled (seems not human, only >2s duration) ? > >Regards, >-- >Aeris

1 1

Traffic on a small Middle Relay, Advertised Bandwidth 1 MB/s
by pa011 12 Jan '16

12 Jan '16

Since about 3 months i am running a small middle relay with Advertised Bandwidth of 1 MB/s. The ISP cuts the line every night as its common on most German private DSL. The relay therefore doesn't get a stable-flag :-( What is the amount of traffic i could/should possibly generate? Is a utilization between 10 and 20 percent not too small, with 15% RAM, 0-20% CPU used only? Could i do any better? Rgds Paul

1 0

Re: [tor-relays] [tor-dev] How many exits exit from an IP address different than their OR address? (10.7%)
by grarpamp 12 Jan '16

12 Jan '16

On Tue, Jan 12, 2016 at 12:44 AM, Jesse V <kernelcorn(a)riseup.net> wrote: > This is quite interesting, thanks for the report. I'm not sure why it > would be advantageous to set up a server or network this way, but I > guess they have their reasons. 1) They may or may not be aware of their routing, or the routing applied to them. 2) Having this feature in the network doesn't break anything, except for maybe check.torproject.org, and a handful of clearnet sites that attempt and often fail to redirect you to their onion, no big deal, hit the new circuit button and try again. 3) Having this feature in the network greatly enhances Tor user's ability to select an exit and get around silly Tor blocks that rely on various consensus, RBL, DNS, whatever lists. Whether it's censorship of the source or destination, it's still censorship. And getting around censorship is one key features and critical use cases of Tor. There is no specification that says exits must exit from their OR IP, or any other IP. I seriously don't know why people continue to get their panties in a bunch over this. Please stop. Nice stats though. cc tt tr because relavance

1 0

Re: [tor-relays] Opt-In Trial: Fallback Directory Mirrors
by starlight.2015q3＠binnacle.cx 12 Jan '16

12 Jan '16

At 14:24 1/12/2016 +1100, you wrote: >I've reviewed this patch and it looks good. >I updated it for the latest version of the script in the tor git repository, as it was based on an old version. great, thanks! >I've also logged the more general issue with OnionOO and date ranges as #18036. ><https://trac.torproject.org/projects/tor/ticket/18036>https://trac.torproject.org/projects/tor/ticket/18036 I looked at it more closely and I think that OnionOO does not support time-ranges in the retrieved data --one seems to always get everything. Posted a follow-up to the original forum message about this shortly after the original.

1 0

Re: [tor-relays] Opt-In Trial: Fallback Directory Mirrors
by starlight.2015q3＠binnacle.cx 12 Jan '16

12 Jan '16

Found a serious bug in the updateFallbackDirs.py script used to generate the fallback relay candidate list. The OnionOO retrieval used to pull flag history returns the entire history of each relay rather than the 120 days requested. This results in 145 relays left off the list as too-old history is averaged into the percentages. While this bug appears to be in either OnionOO or in the constructed request URL (not sure which), I opted to add a maximum history age to the script. The result is 558 relays instead of the original 413. (My relay Binnacle now easily makes the cut with guard flag at 97.4 percent.) In addition several data validation bugs were discovered empirically and corrected. Changes: * support maximum history age in _avg_generic_history() * create and apply MAX_AGE_DAYS=120 in calls to _avg_generic_history() * fix division-by-zero trap in _avg_generic_history() * skip missing (i.e. null/None) intervals in _avg_generic_history() * Python timedelta.total_seconds() function not available in 2.6; replace with equivalent expression * set DEBUG logging level to make relay exclusion reasons visible * move CUTOFF_GUARD test to end in order to expose more exclusion reasons Attached to this message are 1) revised script 2) script patch Posted to PasteBin (one month expire): 3) fallback_dirs.inc as-of 2016/01/11 http://pastebin.com/8cxKCEP6 4) debug output showing causes of relay exclusions http://pastebin.com/raw/3SBpgECm

2 3

How to update tor on my raspberry
by Volker Mink 10 Jan '16

10 Jan '16

Hey there. My exit is still running on tor 0.2.4.27. How can i update it to 0.2.7.6 ? Apt-get offers no package with apt-get update and upgrade. Any hints? Best, Volker

6 6

Is Tor being blocked by ISP? (Mexico)
by Fabian Bustillos Vega 09 Jan '16

09 Jan '16

Been running a node (relay non-exit) for about 5 years. Since the new year, i noticed that my node went down, and that it did not appear on the usual places (http://torstatus.blutmagie.de/router_detail.php?FP=78382b769d5d3baa41e89e5d… and https://atlas.torproject.org/#details/78382B769D5D3BAA41E89E5D9D7FF88E1A96A…) with the last seen timestamp of 2015-12-31 20:00:00. I run my node on a dedicated server under my physical control. I checked the Tor process and in the system it was running, with the logs showing: [warn] connection_edge_process_relay_cell (at origin) failed. and [notice] Heartbeat: It seems like we are not in the cached consensus. I confirmed and double checked all my settings and restarted my Tor node, but still noticed that it was not appearing as running on globe https://globe.torproject.org/#/relay/78382B769D5D3BAA41E89E5D9D7FF88E1A96A6… or atlas https://atlas.torproject.org/#details/78382B769D5D3BAA41E89E5D9D7FF88E1A96A… after almost 6 hours. I noticed on the logs i was getting "[notice] Your network connection speed appears to have changed. Resetting timeout to 60s after 18 timeouts and 1000 buildtimes." after restarting the node. I tried to open Tor Browser on my personal use computer, and it stalls in "connecting to a relay directory" with "Connecting to a relay directory failed (no route to host - 86.59.21.38:443)". I was however able to connect with Orbot on my smartphone after several retries. That's when i tried to ping and do a trecepath to Tor directory authorities https://atlas.torproject.org/#search/flag:authority Of the ten Tor directory authorities i was not able to ping and tracepath any of them using my ISP Telefonos del Noroeste (telnor). But i was able to ping and tracepath all of the directory authorities using Riseup's Vpn servie https://black.riseup.net/ . I even tried to traceroute directly from within the ISP provided Internet Router and was still not able to get thru to any Tor directory authority or even a Tor node. traceroute to dannenberg directory authority with Telnor ISP: traceroute to 193.23.244.244 (193.23.244.244), 30 hops max, 60 byte packets 1 192.168.254.254 (192.168.254.254) 1.500 ms 1.650 ms 2.120 ms 2 dsl-servicio-l200.uninet.net.mx (200.38.193.226) 10.721 ms 10.758 ms 10.702 ms 3 * * * 4 * * * -snip- 30 * * * traceroute to dannenberg directory authority with Riseup Vpn: traceroute to 193.23.244.244 (193.23.244.244), 30 hops max, 60 byte packets 1 10.42.0.1 (10.42.0.1) 42.364 ms 42.342 ms 42.339 ms 2 wren.riseup.net (198.252.153.1) 43.103 ms 43.103 ms 43.101 ms -snip- 22 dannenberg.torauth.de (193.23.244.244) 205.293 ms 205.783 ms 204.446 ms Similar when i tracepath to a random Tor node in france (http://torstatus.blutmagie.de/router_detail.php?FP=7407277411041dc7bee802bf…) With Telnor ISP: tracepath 149.202.193.100 1?: [LOCALHOST] pmtu 1500 1: 192.168.254.254 1.500ms 1: 192.168.254.254 1.419ms 2: no reply 3: no reply 4: no reply 5: no reply 6: no reply C With Riseup Vpn: tracepath 149.202.193.100 1?: [LOCALHOST] pmtu 1500 1: 10.42.0.1 43.093ms 1: 10.42.0.1 39.373ms 2: wren.riseup.net 44.108ms 3: gi0-0-0-5.agr13.sea02.atlas.cogentco.com 42.399ms 4: multi-use.cogentco.com 44.246ms 5: be2288.ccr21.sea02.atlas.cogentco.com 44.367ms 6: level3.sea02.atlas.cogentco.com 41.783ms asymm 7 7: no reply 8: no reply 9: nwk-1-a9.nj.us 133.351ms asymm 15 10: ldn-1-a9.uk.eu 198.174ms asymm 17 11: rbx-g1-a9.fr.eu 202.478ms asymm 17 12: fra-1-a9.de.eu 206.248ms asymm 18 13: sbg-g1-a9.fr.eu 213.218ms asymm 20 14: sbg-4b-a9.fr.eu 215.017ms asymm 21 15: ns3015177.ip-149-202-193.eu 213.182ms reached Resume: pmtu 1500 hops 15 back 21 Before the new year, there used to be around 5 to 8 Tor nodes located in Mexico, right now, only one appears as online: http://torstatus.blutmagie.de/router_detail.php?FP=92dd0214bc72cb52777e2015… that i am not able to ping or traceroute to. I have a dynamic IP, so i rebooted the ISP provided router and tried with several IP's that where assigned by my ISP and all provided the same results. I plan on doing more testing and calling my ISP and asking directly about the IP's i am not able to reach and specifically if they block or plan on blocking Tor. UPDATE: Tech support chat with ISP - Jan 02 2016: http://pastebin.com/xZuWqAkX They confirmed that i can not access the IP's but don't have any info about why i am not able to access. They "escalated" the issue... Tech support chat with ISP - Jan 03 2016: http://pastebin.com/6MA2gj9e They said: Telnor connections to the rest of the world is thru the U.S. from Telnor no blocking is made to the rest of the world. I'm not seeing any Tor nodes with telnor/telmex/infinitum at http://torstatus.blutmagie.de/index.php only Axtel and Megared. I am sometimes able to connect to "longclaw" longclaw.riseup.net (199.254.238.53) but not always. Sometimes i get "Connecting to a relay directory failed (no route to host - directory_ip:port)" when using the Tor Browser, but if i try several times i am able to use the Tor browser. I would really like to keep running my Tor node, and i am willing to change ISP's, but i am still hoping that it's something on my end, but i am not seeing any more relays with Telmex/Telnor/Infinitum as ISP. Is there anyway to confirm that it's my ISP? any other reports from Mexico about similar issues?. In the meantime, i already donated $100 while my Tor node is down. (no t-shirt yet though :( ) Tor logs here: http://pastebin.com/4XQaQyLd torrc contents: ContactInfo fabian dot bustillos at riseup dot net ControlPort 9051 DirPort 9030 ORPort 9001 ExitPolicy reject *:* HashedControlPassword ------------------------------------------------ Nickname fbnaiaTorRelay SocksListenAddress 127.0.0.1 DisableDebuggerAttachment 0

1 0