- tor-relays - lists.torproject.org

Webtropia threatening with penalty of 5.100€
by spriver 13 Dec '15

13 Dec '15

Hi, I am (or was) running a Tor Exit Node with about 200-250bmit/s on a VPS at Webtropia for several months with the common reduced exit policy (https://globe.torproject.org/#/relay/D218DF2C542CD1FB57FCF36DB6672A0DE6A8CB…) They never had a problem with the fact of running an exit, from time to time I got an abuse mail to which I responded with the "usual thing" (that I'm running an exit and the connections are not initiated by me. If some party wishes not to be contacted I would restrict acces [exit policy]). On Monday morning my server got shut down. I contacted them by asking, why the server was shut down, they responded that some spam was sent (abuse mailing from courbis.fr, axmo12.de claimed a brute force on SSH and the usual stuff from Webiron) and thus my server was blocked by them. They now claim that they are entitled to contractual penalty of 5.100,- € to be charged because I violate their Terms of Use. Their Terms do not forbid Tor itself, but spamming and other illegal things such as port scanning and DoS-attacks (https://www.webtropia.com/de/unternehmen/agb.html) They also told me that they cannot monitor if the traffic is really Tor traffic and that I should configure my server to prevent such abuse. How should I proceed there? Cheers!

3 3

authority signatures consensus-health
by tor-server-creator＠use.startmail.com 10 Dec '15

10 Dec '15

hi, wondering what happened to consensus lately? weight-drops, list says was missing authority signatures ? thanks

3 2

Crash and obfs error
by Geoff Down 10 Dec '15

10 Dec '15

Hello all, a couple of quick questions. Tor exited with this error: Dec 09 06:35:34.000 [err] descriptor at 0x62ee080 begins with unexpected string "". Is another process running in our data directory? Exiting. I've a vague feeling it's happened once before - anything to worry about? Also, on restarting Tor with Obfsproxy already running, I got Dec 09 14:14:43.000 [warn] Server managed proxy encountered a method error. (obfs3 Could not set up listener (0.0.0.0:xx) for 'obfs3' (Address already in use).) Dec 09 14:14:43.000 [warn] Managed proxy at '/usr/bin/obfsproxy' failed the configuration protocol and will be destroyed. does this mean that Tor is running without obfsproxy now, and I need to stop both and restart? It's quite annoying that Tor doesn't remember its auto-picked port, and I have to change the port-forwarding rule every time. Thanks, GD -- http://www.fastmail.com - IMAP accessible web-mail

3 3

Bridge Accounting Period Resets Stats
by akashic＠sigaint.org 10 Dec '15

10 Dec '15

I'm running some bridges on VPS where I set 10GB monthly limit. I never come close to the quota, but the bridges reset with a new port and new stats every accounting period. This is undesirable because it means people who wrote down my bridge and port will no longer be able to connect. And Atlas take 6 more days to mark the bridge as fast again. I like port diversity, but monthly switch seems excessive if 25% of every month is spent resetting stats. Can I set a longer accounting period, like 6 months? Failing that, what's the risk if I just get rid of the quota? Throttle rate of 200KB/s could add to 4TB/mo in worst case, which will get a VPS account killed. What's a more realistic worst case if I keep 200KB throttle with no monthly accounting?

2 1

VPS/Tor Final Thoughts
by Kurt Besig 09 Dec '15

09 Dec '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I thought it might be helpful to any other volunteer that may have been silently following this thread to quickly post the issues with my VPS Tor server that were resolved. 1. Setting up iptables allowed connections to my server. 2. Adding my server's [ip address] to the /etc/torrc resolved the problem of tor attempting to connect to the "node" my server is on rather than the actual ip my server is on. 3. Checking the user groups and permissions necessary to allow access to tor files. Other thoughts: As mentioned numerous times arm is a comfy frontend, but certainly not necessary after investigating system tools such as lsof and utilizing nload or munin. Also having ntp installed and running is helpful I think. Again thanks for all the help and have a very happy holiday season! -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) iQEcBAEBAgAGBQJWaDXxAAoJEJQqkaGlFNDPGh4H/0uDGiSIq9dYjDBNSIrVRoBQ sBGjLdFhvdFSJ4dsTRPspAKC+6zg4FnGSj1isBFBmJOLIN71oIo6qXkrXoQgyS+Q crnNYucyC6Vo8vQdK72QabuAJZGE2+VXfwTw/82NhldIQnKJzyfnjNKZYamR486y KQJGzPHls2abZPu0zyx/ay7pZRUZWzGvfc1yShQ6yTsiVqCJk456aPRd0/rbkLMQ dG/TOHHSOAJzMsZXk92rzk0JNBBYhwkOTiNyPQDd+S68IWyLXp5wC0hE4KTdRmf/ Osa8NIB3FQyYeg6XAjxZ1PhYSc8Lp91+K220znS/2lXStxjrdUFY4TU7119iYpA= =a7HY -----END PGP SIGNATURE-----

1 0

Mozilla11
by tor-server-creator＠use.startmail.com 08 Dec '15

08 Dec '15

seems like one instance didnt made it from 02510 to 0275: Mozilla11 - probably the other instances will handle the unused bandwidth but its a bit of a pity isnt it... if its running some hundret days we should poke now still its known by consensus otherwise its waste of electricity. thanks Mozilla <3

1 0

(no subject)
by 海洋 08 Dec '15

08 Dec '15

1 0

Custom bandwith for different time ranges
by Zalezny Niezalezny 08 Dec '15

08 Dec '15

Hi All, this is my first post on this list so warm welcome to every one a specialy to Tor developers. On my servers I`m running paralllel prod servers with tor relays on the separate IP. I`m supporting tor network for free with high speed tor relays but I need to customize the time when my server will share 100% of its resources for tor and when traffic will be limited. Is it possible to schedule the time when bandwith will looks as follow: 8:00 - 18:00 - Tor relay bandwith 250kb/s 18:00 - 8:00 - Tor relay bandwith 10 000kb/s How may I schedule this in tor relay ? Is it possible to limit traffic on the client or I need to do it on my firewall ? Thanks in advance for any feedback.

6 7

ANN: TCP injection attack detection tool - honeybadger
by David Stainton 07 Dec '15

07 Dec '15

Dear Golang community, Edward Snowden, cypherpunks, Tor-relay operators, low-level network hackers and TCP abolitionists, I was inspired by the Snowden documents to write a TCP injection attack detection tool. Powerful entities world wide are stock piling zero-days. TCP injection attacks can be used to deliver many of these attacks. source: https://github.com/david415/HoneyBadger docs: https://honeybadger.readthedocs.org/en/latest/ tasty pcap for "integration testing": https://github.com/david415/honeybadger-pcap-files HoneyBadger does bidirectional TCP stream reassembly... temporarily storing segments in ring buffer for comparison to later received overlapping stream segments. In other words it doesn't rely on simply matching duplicate sequence numbers but compares the actual overlapping stream segment contents. This more thorough approach is needed to account for TCP's retransmission which can send various segments sizes that can differ from the original dropped segment length. Furthermore we also detect the other injection types such as handshake hijack. The literature (go ahead and scour the Internet) does NOT mention all of the TCP injection attacks that are possible. I assert that there are 5 possible types of TCP injection attack. I describe them here: https://github.com/david415/HoneyBadger_docs/blob/hackpad1/source/how-to-de… https://github.com/david415/HoneyBadger_docs/blob/hackpad1/source/how-to-de… current honeybadger project status: - honeybadger seems mostly useable for use in the wild, though we are pretty sure that bugs exist and probably some false positive bugs at that. - active development halted several months ago when the implementation seemed good enough to deploy and sniff packets in the wild. - if in the future the gopacket dev team releases a new "sufficient" TCP reassembly API then I could severely reduce HoneyBadger's code size. - pull requests and github issue comments will inspire me to contribute feature additions and fixes It runs on Linux but does honeybadger work on *BSD? Of course it does... I wrote the gopacket BSD BPF sniffer API ;-p and tested honeybadger on NetBSD, FreeBSD and OpenBSD. I'd like to explore the possibility of writing a similar TCP injection attack detector in rust using libpnet as soon as libpnet is sufficiently mature to use for TCP analysis: https://github.com/libpnet/libpnet So what? 1. So... all TCP analyzers need to be rewritten to account for TCP injection attacks, otherwise you are doing it wrong. 2. So feel free to use HoneyBadger to analyze your own traffic over the wire or sketchy pcap files that you acquire; perhaps our data collection efforts will result in responsible disclosure of 0-days... and publicly reporting that in fact these TCP injection attacks do happen as targeted attacks against real people to violate their human rights. 3. So use my design in your software; The description of how to detect the 5 possible TCP injection attacks can serve as a part of a design document for other software projects to implement their own TCP injection attack detection. cheers from the Internet, David Stainton

2 1

VPS/Tor
by Kurt Besig 07 Dec '15

07 Dec '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I want to thank everyone for the multitude of great suggestions regarding getting my relay up on a VPS. I reviewed every email and all the input was useful. The relay is up and running: E65D 300F 11E1 DB12 C534 B014 6BDA B697 2F1A 8A48 As well as my home relay: F527 3098 A711 F845 E5D1 A24F 9D38 F93B 86A0 F220 While all the information culminated in a successful outcome the suggestion of installing ufw as a means of setting up iptables was exceptionally valuable, thank you. Hopefully in the future I can return the kindness. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) iQEcBAEBAgAGBQJWZZzuAAoJEJQqkaGlFNDPifYIAIGF6EZIxvuRCz2pTQa9+vg1 6OX1YJ/Z/fP4sGhhS+VtpGzhjewFf4Yv1FYXvWdRQWVW204Ms6wR6ibul4jLd58u ENr75uDqK/ro8kLWQpWsLeJoh3zp8cAc5dpH/u9Itftj0o/td8fGVeV6YIOw9q3L oA90pIVRNXun49Tb4cZjYm71+KBRwSekyXUoXccAcFzw+1WvLkW9TD8Xtd25/D7E 2VBfsYZinqia+7kqcCfUzoO4Ekg4JTkgBt/PkQ9eONz3w5g6+e52hh3kNurW3wfO 61BQ5Nq/0Q2u+cmgp+DItkD5+XSLPop8HZnwJM17M1nGxZ+/cBFYGZQmrlXpFUs= =nGYI -----END PGP SIGNATURE-----

1 0