- tor-relays - lists.torproject.org

Crash and obfs error
by Geoff Down 10 Dec '15

10 Dec '15

Hello all, a couple of quick questions. Tor exited with this error: Dec 09 06:35:34.000 [err] descriptor at 0x62ee080 begins with unexpected string "". Is another process running in our data directory? Exiting. I've a vague feeling it's happened once before - anything to worry about? Also, on restarting Tor with Obfsproxy already running, I got Dec 09 14:14:43.000 [warn] Server managed proxy encountered a method error. (obfs3 Could not set up listener (0.0.0.0:xx) for 'obfs3' (Address already in use).) Dec 09 14:14:43.000 [warn] Managed proxy at '/usr/bin/obfsproxy' failed the configuration protocol and will be destroyed. does this mean that Tor is running without obfsproxy now, and I need to stop both and restart? It's quite annoying that Tor doesn't remember its auto-picked port, and I have to change the port-forwarding rule every time. Thanks, GD -- http://www.fastmail.com - IMAP accessible web-mail

3 3

Bridge Accounting Period Resets Stats
by akashic＠sigaint.org 10 Dec '15

10 Dec '15

I'm running some bridges on VPS where I set 10GB monthly limit. I never come close to the quota, but the bridges reset with a new port and new stats every accounting period. This is undesirable because it means people who wrote down my bridge and port will no longer be able to connect. And Atlas take 6 more days to mark the bridge as fast again. I like port diversity, but monthly switch seems excessive if 25% of every month is spent resetting stats. Can I set a longer accounting period, like 6 months? Failing that, what's the risk if I just get rid of the quota? Throttle rate of 200KB/s could add to 4TB/mo in worst case, which will get a VPS account killed. What's a more realistic worst case if I keep 200KB throttle with no monthly accounting?

2 1

VPS/Tor Final Thoughts
by Kurt Besig 09 Dec '15

09 Dec '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I thought it might be helpful to any other volunteer that may have been silently following this thread to quickly post the issues with my VPS Tor server that were resolved. 1. Setting up iptables allowed connections to my server. 2. Adding my server's [ip address] to the /etc/torrc resolved the problem of tor attempting to connect to the "node" my server is on rather than the actual ip my server is on. 3. Checking the user groups and permissions necessary to allow access to tor files. Other thoughts: As mentioned numerous times arm is a comfy frontend, but certainly not necessary after investigating system tools such as lsof and utilizing nload or munin. Also having ntp installed and running is helpful I think. Again thanks for all the help and have a very happy holiday season! -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) iQEcBAEBAgAGBQJWaDXxAAoJEJQqkaGlFNDPGh4H/0uDGiSIq9dYjDBNSIrVRoBQ sBGjLdFhvdFSJ4dsTRPspAKC+6zg4FnGSj1isBFBmJOLIN71oIo6qXkrXoQgyS+Q crnNYucyC6Vo8vQdK72QabuAJZGE2+VXfwTw/82NhldIQnKJzyfnjNKZYamR486y KQJGzPHls2abZPu0zyx/ay7pZRUZWzGvfc1yShQ6yTsiVqCJk456aPRd0/rbkLMQ dG/TOHHSOAJzMsZXk92rzk0JNBBYhwkOTiNyPQDd+S68IWyLXp5wC0hE4KTdRmf/ Osa8NIB3FQyYeg6XAjxZ1PhYSc8Lp91+K220znS/2lXStxjrdUFY4TU7119iYpA= =a7HY -----END PGP SIGNATURE-----

1 0

Mozilla11
by tor-server-creator＠use.startmail.com 08 Dec '15

08 Dec '15

seems like one instance didnt made it from 02510 to 0275: Mozilla11 - probably the other instances will handle the unused bandwidth but its a bit of a pity isnt it... if its running some hundret days we should poke now still its known by consensus otherwise its waste of electricity. thanks Mozilla <3

1 0

(no subject)
by 海洋 07 Dec '15

07 Dec '15

1 0

Custom bandwith for different time ranges
by Zalezny Niezalezny 07 Dec '15

07 Dec '15

Hi All, this is my first post on this list so warm welcome to every one a specialy to Tor developers. On my servers I`m running paralllel prod servers with tor relays on the separate IP. I`m supporting tor network for free with high speed tor relays but I need to customize the time when my server will share 100% of its resources for tor and when traffic will be limited. Is it possible to schedule the time when bandwith will looks as follow: 8:00 - 18:00 - Tor relay bandwith 250kb/s 18:00 - 8:00 - Tor relay bandwith 10 000kb/s How may I schedule this in tor relay ? Is it possible to limit traffic on the client or I need to do it on my firewall ? Thanks in advance for any feedback.

6 7

ANN: TCP injection attack detection tool - honeybadger
by David Stainton 07 Dec '15

07 Dec '15

Dear Golang community, Edward Snowden, cypherpunks, Tor-relay operators, low-level network hackers and TCP abolitionists, I was inspired by the Snowden documents to write a TCP injection attack detection tool. Powerful entities world wide are stock piling zero-days. TCP injection attacks can be used to deliver many of these attacks. source: https://github.com/david415/HoneyBadger docs: https://honeybadger.readthedocs.org/en/latest/ tasty pcap for "integration testing": https://github.com/david415/honeybadger-pcap-files HoneyBadger does bidirectional TCP stream reassembly... temporarily storing segments in ring buffer for comparison to later received overlapping stream segments. In other words it doesn't rely on simply matching duplicate sequence numbers but compares the actual overlapping stream segment contents. This more thorough approach is needed to account for TCP's retransmission which can send various segments sizes that can differ from the original dropped segment length. Furthermore we also detect the other injection types such as handshake hijack. The literature (go ahead and scour the Internet) does NOT mention all of the TCP injection attacks that are possible. I assert that there are 5 possible types of TCP injection attack. I describe them here: https://github.com/david415/HoneyBadger_docs/blob/hackpad1/source/how-to-de… https://github.com/david415/HoneyBadger_docs/blob/hackpad1/source/how-to-de… current honeybadger project status: - honeybadger seems mostly useable for use in the wild, though we are pretty sure that bugs exist and probably some false positive bugs at that. - active development halted several months ago when the implementation seemed good enough to deploy and sniff packets in the wild. - if in the future the gopacket dev team releases a new "sufficient" TCP reassembly API then I could severely reduce HoneyBadger's code size. - pull requests and github issue comments will inspire me to contribute feature additions and fixes It runs on Linux but does honeybadger work on *BSD? Of course it does... I wrote the gopacket BSD BPF sniffer API ;-p and tested honeybadger on NetBSD, FreeBSD and OpenBSD. I'd like to explore the possibility of writing a similar TCP injection attack detector in rust using libpnet as soon as libpnet is sufficiently mature to use for TCP analysis: https://github.com/libpnet/libpnet So what? 1. So... all TCP analyzers need to be rewritten to account for TCP injection attacks, otherwise you are doing it wrong. 2. So feel free to use HoneyBadger to analyze your own traffic over the wire or sketchy pcap files that you acquire; perhaps our data collection efforts will result in responsible disclosure of 0-days... and publicly reporting that in fact these TCP injection attacks do happen as targeted attacks against real people to violate their human rights. 3. So use my design in your software; The description of how to detect the 5 possible TCP injection attacks can serve as a part of a design document for other software projects to implement their own TCP injection attack detection. cheers from the Internet, David Stainton

2 1

VPS/Tor
by Kurt Besig 07 Dec '15

07 Dec '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I want to thank everyone for the multitude of great suggestions regarding getting my relay up on a VPS. I reviewed every email and all the input was useful. The relay is up and running: E65D 300F 11E1 DB12 C534 B014 6BDA B697 2F1A 8A48 As well as my home relay: F527 3098 A711 F845 E5D1 A24F 9D38 F93B 86A0 F220 While all the information culminated in a successful outcome the suggestion of installing ufw as a means of setting up iptables was exceptionally valuable, thank you. Hopefully in the future I can return the kindness. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) iQEcBAEBAgAGBQJWZZzuAAoJEJQqkaGlFNDPifYIAIGF6EZIxvuRCz2pTQa9+vg1 6OX1YJ/Z/fP4sGhhS+VtpGzhjewFf4Yv1FYXvWdRQWVW204Ms6wR6ibul4jLd58u ENr75uDqK/ro8kLWQpWsLeJoh3zp8cAc5dpH/u9Itftj0o/td8fGVeV6YIOw9q3L oA90pIVRNXun49Tb4cZjYm71+KBRwSekyXUoXccAcFzw+1WvLkW9TD8Xtd25/D7E 2VBfsYZinqia+7kqcCfUzoO4Ekg4JTkgBt/PkQ9eONz3w5g6+e52hh3kNurW3wfO 61BQ5Nq/0Q2u+cmgp+DItkD5+XSLPop8HZnwJM17M1nGxZ+/cBFYGZQmrlXpFUs= =nGYI -----END PGP SIGNATURE-----

1 0

Re: [tor-relays] Custom bandwith for different time ranges
by starlight.2015q3＠binnacle.cx 06 Dec '15

06 Dec '15

>Is it possible to schedule the time when bandwith . . . >How may I schedule this in tor relay? >Is it possible to limit traffic on >the client or I need to do it on my firewall ? As suggested in an earlier reply, configuring 'cron' jobs to adjust the rate usually makes sense. As an alternative to modifying 'torrc' and sending SIGHUP to the daemon, you could use a control-channel script similar to: nc 127.0.0.1 9151 <<EOF AUTHENTICATE "passphrase" SETCONF BandwidthRate=Y BandwidthBurst=Y QUIT EOF An even better way is to use the 'tc' or "traffic control" command to limit ingress traffic to the relay via a 'police' filter, as rate-limiting through discarding of packets result in better performance from daemon during overload conditions than the daemon rate-limit algorithm. But 'tc' only works if an interface or alternate IP on an interface can be dedicated to the Tor router, and it's more technical to configure. If the firewall is an Cisco ASA, an ingress rate 'police' policy can be constructed with results similar to the 'tc' approach. However one must dedicate an entire ASA Ethernet port to the relay as this type of filter cannot be applied to a limited set of flows. A problem with altering bandwidth significantly on a schedule is that the BWauths that measure and rate relays will produce erratic results for the relay. BWauths are erratic when rating stable relays due to some issues with the implementation, and the results for a moving target is even worse.

1 0

VPS/Tor Almost There
by Kurt Besig 06 Dec '15

06 Dec '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Thanks again for all the support everyone has bee extremely helpful. So, I reinstalled the OS on the VPS: lsb_release -d Description: Ubuntu 14.04.3 LTS uname -r 2.6.32-042stab102.9 Finally solved all the permissions problems, paths are correct, tor and arm open properly. The problem now boils down to this: The VPS isn't allowing Ports 9001 and 9030 Should I investigate further getting my iptables up and running or just contact the admin and have them allow the ports? As I mentioned previously even after saving the tables upon reboot iptables -L shows no rules, the file is empty. :~$ iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Any further suggestions would be appreciated. Thanks -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) iQEcBAEBAgAGBQJWZF8qAAoJEJQqkaGlFNDPO18H/2Axj4EeGf5joYQ3n2SH1cgs HhDAawaiMaSKMcfC/Oc9TudwKAxkoY+QkhegZr5senNKXrXjNPeLucfejkRBiUoJ 8KLOZabSGH2Uf89JNa4ZFbf9QVIiU8GdNJ0vSGy55iAuJQl14ZUpDRQeNnGkmwb5 uhADchwTVjK7Pq+ELyG6OI6l0jlQ69TWCpgH4lnMjQ5U+Nr1QKyApxXqr1ap5Heb KJmlwchTv4zAxX2eBc1DPqAXdc9OsvEsPG/r/zp4Z/wPWxsUTGoZWoXsWv4xyjPQ xzAzUKD+b+AvqGQ3ehQbdXtg423kO7/amVidAzux8mDmMeZuFoP3tpfqLd8cH+s= =uoin -----END PGP SIGNATURE-----

5 4