- tor-relays - lists.torproject.org

Abuse messages from IPs marked as rejected in the exit policy
by tor-admin＠torland.me 19 Nov '15

19 Nov '15

Hi all, I am receiving abuse messages for the Torland1 relay for IPs that are blacklisted in the exit policy. For example as https://atlas.torproject.org/#details/E1E922A20AF608728824A620BADC6EFC8CB8C… shows, 62.67.194.0/24 is blocked. But I am getting abuse messages out of this IP range. Can someone explain me how this can happen? Thanks/regards Torland

2 1

New security feature in upcoming tor 0.2.7.x: OfflineMasterKey
by nusenu 19 Nov '15

19 Nov '15

Hi, I'd like to highlight a "new" security feature in the expected upcoming tor stable release: offline master keys I'm posting this here now - before the actual release - because if you upgrade without thinking about this feature your ed25519 master key will be generated the first time tor 0.2.7.x starts up and at that point in time it might be already to late for the - 'master key never touched my online relay' - option. Why are offline master keys better then online master keys? - you can keep the key under your control while using (semi-trusted) hosting providers - impact of relay compromise or seizure is less fatal and limited in time (default worst case: 30days) - the bad guys have to come back every 30 days to steal your keys again The default expiry for signing keys is 30 days but can be configured (torrc). It is also important to note that if you enable this feature your relays need more care (depending on how you configure key expiry). If you forget about it and the signing key expires your relay will shutdown. Something that will be noticed by a relay operator monitoring its relays and bw usage. Even if you are running 0.2.7.x already you can make use of this feature by moving your master key from the relay to an offline system + torrc configuration. Documentation is currently a bit light but s7r is working on improving it. https://trac.torproject.org/projects/tor/ticket/16645 related tor-dev thread: https://lists.torproject.org/pipermail/tor-dev/2015-November/009905.html ansible-relayor will eventually support offline master keys but it will take some time until tor 0.2.7.x reaches all platforms including OpenBSD. A first (unreviewed) poc has been committed in a dedicated branch. https://github.com/nusenu/ansible-relayor/commit/2c4040df7848f382ced02b43f3… Automation is key in making this feature usable (with short key expiry). You might want to consider this feature - especially if you run a significant portion of the tor network.

1 0

unlisted exit relay
by Green Dream 17 Nov '15

17 Nov '15

While visiting https://torstatus.blutmagie.de/ in Tor Browser, I noticed it wasn't detecting the exit node I was being routed through as a relay. Curious, I tried looking up the same IP in both Atlas and Globe, but neither knows of a relay at this IP. The IP of this exit is 104.156.228.115. What scenarios might cause this situation? As a Tor user, should I care? At the very least, it seems desirable to always be able to research the nodes you are using.

2 1

Tor exit node companion
by Eran Sandler 17 Nov '15

17 Nov '15

Hi guys, I had a thought about writing a small Tor exit node companion app. This would be a single executable that does 2 things: - Serve HTTP port 80 traffic on a specific host name and show the standard Tor web page for exit nodes - Serve port 25 (SMTP) and forwards abuse(a)mydomain.com to an address of your choosing Bonus points would be to make sure the HTTP requests serve the latest version of the Tor disclaimer page (so it will automatically take the latest and periodically check that its the latest). It will then replace the various parts (email of the operator etc). I can write it in Go so that its a single rather small executable so that the exit node will only need to run it instead of web server (nginx or something lighter) and an SMTP server (for those pesky automated posts that, like in the case of webiron, are also sent to abuse(a)mydomain.com based on the reserve DNS). Do you think it would be useful? I would sure be happy to run as little processes as possible. Eran

3 4

webiron requesting to block several /24 subnet
by yl 16 Nov '15

16 Nov '15

Hello, I received an abuse email today from my hoster (several emails from webiron in one email), typical automated abuse emails, not much information. However, they request, if the origin IP is a Tor exit, to block the full /24 subnet. As they also state, they will not provide the full IP of there customer and request to block the exit to the /24. Any thoughts on this? I don't like to block the whole /24, just because one idiot using one of the IPs is using some snake oil service like webiron, the collateral damage is to big in my eyes. All other IPs in the same range will be blocked as well. Why should I even care about blocking such IPs given by webiron? In my opinion the blocking is useless from my side and in the worst case the users of webiron will block my exit node IP. Would it be better for the tor network if I'd block the IPs? Is there any bad consequences if I don't for the Tor network? Let me know your thoughts. The services URL is https://www.webiron.com, don't need to go there, I didn't because such services are just useless. Better use fail2ban or something similar. Greeting yl

12 16

Limiting Bandwidth
by Billy Humphreys 12 Nov '15

12 Nov '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi all, does anyone know how to make a tor relay only use x bandwidth, then stop? I have a 1100GB/month max limit (100GB free) and I don't want it automatically suspending. Any ideas? Regards, Billy. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWQ8hDAAoJECGBE+89M6jOfSkQAJk/WtNbHWtDNZ+uBRVr6aCA 89OQ0xudFzz8oxWYkvgnEiSJFdHy+I5tzVVMjVGGl2dXOWN1QB4irWXkQ0xtE5bi 8t27YsWCNT71CMvvBhbeVEU8KMTwnRaW/pnpdbSY3082DljORLpioK+N4R3fyyXR F6xFmPZQtw4X2SruZNZX3TzPjgKuL7p3VTE6WEP9t/A0G3zX+yNi7A5jNSpwVak2 TMMlvQglgoM5TY/HHInXHS4tNPIBhORGNJoGw2mf+fFk6O/LgOnfNRt4FjaHZqBO NNQKtNicaJgqR5hC7+xojog/3quB7WvvqDtzfoJa3VGqtILMM7y3MKx0R81DzZ3l zOsUguYDpjUkxqd/QWdwtmzMeDB5yjh91QCFFfdR56D6bIedWjubYBLUDEXHchSH bstdWTD5ZAePYFgp//hnH2gX5D8X/cC1Kho0S8FLf9uuKKI4Bdmt0UaPmZW8rn2M nf6zIQB7vPLWY/RbA2/tJq1TB2w1JDMtn911uheCrX6H3OiTXLrxTjBz3yTyCzYM Oag6Jpv/991Ir56cBzS8jOHi7Vxr56QuW2S/Cgae8yewJy4St7ISah19dtIU1PGB 66rwK2MmQJ3DynhMqfkompsQNfvugXiC+KXqGoQH2zwAcI0vnsJAn4efpGLaoVcN V2Jcy26OnSvFlBLI3GVx =k9GQ -----END PGP SIGNATURE-----

3 3

TorFlow
by Kenneth Freeman 11 Nov '15

11 Nov '15

A gorgeous visualization of the Tor's data traffic. Feast your eyes! https://torflow.uncharted.software/

5 9

graphing 3 months of onionoo data (2015-08-01 - 2015-10-31)
by nusenu 11 Nov '15

11 Nov '15

Hi, here are a few graphs, that - unlike metrics.tpo - do not focus on relay count but consider CW fraction or exit/guard probabilities. OS share by CW fraction https://raw.githubusercontent.com/nusenu/tor-network-observations/master/pn… I didn't known about Tor 0.2.8 until I saw this graph https://raw.githubusercontent.com/nusenu/tor-network-observations/master/pn… ONLINE SAS taking over OVH SAS's position on the AS marked? https://raw.githubusercontent.com/nusenu/tor-network-observations/master/pn… France hosts 1/3 of the network's guard capacity https://raw.githubusercontent.com/nusenu/tor-network-observations/master/pn… and has become the biggest country when it comes to exit probability as well: https://raw.githubusercontent.com/nusenu/tor-network-observations/master/pn…

1 1

Is this bridge worth running?
by eliaz 10 Nov '15

10 Nov '15

I'm running a bridge in Tor Browser 5.0.4 on Win7x86; torrc is fine, and I'm connecting to circuits. However my mean written/read bandwidth is reported in globe to be in the hundreds/tens range. The advertised bandwidth also jumps around, from about 10 to 51 kB/s. And a previous run over five months of continuous running the written/read bytes reached 7K only once. Is this data telling me that the bridge is not carrying much traffic at all? Is there anything I can do to improve performance? And is there any way that I can get some idea of the actual traffic load?- eliaz

1 0

Exit relay seized by police
by Kevin Beranek 10 Nov '15

10 Nov '15

Is there a procedure I should follow if a relay has been seized by the police? Do DirAuths typically do something in cases where a relay is seized? I just got a message from NQHost stating that "We have received several police inquires and court order to seize your VPS. ". This affects relay A1E0245862C707F977DF0EC79257C49CD5DA99FE. Thanks, Kevin

10 21