tor-relays

tor-relays@lists.torproject.org

36 participants
4815 discussions

Re: [tor-relays] multi-instance Tor support for *BSD packages
by Nusenu 03 Apr '15

03 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi Pascal, thanks for your feedback. Pascal Stumpf: >> Multi-instance support isn't something that's provided by >> OpenBSD's rc.d(8) subsystem, and I doubt it ever will be. Too >> much complexity for something that's more of a crutch to work >> around few applications' limitations than something universally >> needed and useful. Ok, my take away here is that I won't be able to get any multi-instance support into OpenBSD's tor rc.d script. So I guess the next best option for ansible-relayor will indeed be to configure multiple services and copy the rc.d script of your package once per tor instance tor0,tor1,... plus one line per tor instance in /etc/rc.conf.local as described previously here: https://lists.torproject.org/pipermail/tor-relays/2015-March/006526.html >> Btw, aren't there locking problems with the files in >> DataDirectory? Or does every single tor instance need its own? >> And the ControlPort? One for each instance? How do you >> distinguish tor instances when doing syslog logging? ansible-relayor takes care of this and generates torrc files accordingly (separate datadir, separate logfiles, ...). regards, Nusenu -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVHuGbAAoJEFv7XvVCELh0nz0P/i0KffWajNLbBv0cHF5BB5V2 BgQAIDyy/UpSGXNkiUShOBvQIW1GhjvpX9UJeAVzBy2nJuAN8v+AEKp+9A7w4fLt qBxsgul0iaWSalrzlzGFu85QRrc31MV4MKUMW6HmBoINKwMZ71cbWqcmWwykzhOr VPjxrEzCcIw2FF42G2rd65ivWJVWueJLUlbN4KvhzP0clYbOMlgAZ4smstdIksbp pd13/AdA1aJGdCs+i4pXgd19Jq+7WG6Eqj7+YSEpk3LOxqiaVBAi0MhHH5J8be57 GKyI/9QI4yfgAYhtDyEZOVaslafgSAaMzniYYfmGDAPzZobKBbhwmXxtmnok7A30 4TMpUPiqYpVvhBu+NHqlhngYDvKJj/KoZb3lySyN5wMpi5gTtUIt1QxxQ6ofP0eW LuCQSJhinTuLehWx2Ib/gx+J2g+BqJeHkBZRt2BjL63RxHMiRJ3qy7Xd0mJlsh5t DPPPzovk6yaNRUNv7GDTTaq4vRSwJzfUikm9upUi+J37CJ1L3wo/xYqcqLHKWz/w 3NtoMi9mkJfjJ0Bx5ORDzeWJ6LtTKPmhQuWP+5PiK0CxEiu/ZVuReElKyz0Pnypa qrIji5vpu+w/ITw4E/IpMZYS/p/SZV+HYG/ffLUZNgJ6i6vHNqc7om6c+0Qp9qut Eax3QbcU8mCR+F8d2WmL =YcuY -----END PGP SIGNATURE-----

1 0

multi-instance Tor support for *BSD packages
by Nusenu 02 Apr '15

02 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Dear Tor package maintainers for FreeBSD and OpenBSD, I wrote/I'm writing an ansible [1] role for tor relay operators [2]. Besides supporting Linux I'm also aiming to supporting OpenBSD and FreeBSD. Tor does not scale well across multiple CPU cores, to work around this issue relay operators frequently choose to run multiple tor instances on a single host. To better support tor relay operators with this common task tor's official RPM packages recently got multi-instance support [5] and a ticket for the official debian package has been filed [6]. To better know how to proceed with my ansible role - where multi-instance support is a core feature - I'd like to know how you think about adding easy multi-instance support to your packages as well? One way to configure a BSD system to run multiple tor instances would be to defined multiple services tor0, tor1, ... [3], but that doesn't strike me as a particular clean solution [4]. What do you think about supporting multiple tor instances with a single rc.d script that starts one tor process per available *.torrc file in (/usr/local)/etc/tor/enabled/ ? looking forward to your comments, Nusenu [1] http://docs.ansible.com/ [2] https://github.com/nusenu/ansible-relayor [3] https://lists.torproject.org/pipermail/tor-relays/2015-March/006526.html [4] https://lists.torproject.org/pipermail/tor-relays/2015-March/006527.html [5] https://trac.torproject.org/projects/tor/ticket/14996 [6] https://trac.torproject.org/projects/tor/ticket/14995 -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVHZZ6AAoJEFv7XvVCELh04/IQAKZfuYvXUM4xkc3cS3GJciGg NsbkyL483NLM7un/gd0HNkUTzOVLMwI6gkzUERg5uYiwWD1ZHEnudrOk47N19FHR 7WjDTQQuKDfDBpMCBiAywFXsJKKnRk0Cg01+zmMlCmPZ5kEk1hyaE64sZNmjBLyQ 7ydLMV9/xy7h/qm7OfOjU9djoPQTbnd5Ky8+V15ZyTwr65IkWI6vX5KlIfhdTvHh sl3PlRppCE1aYPF5jbwSwpICOSd4diLWToFfOSDFRfvpc4FdMiJfIdAXj37FktMA RdI4MTJXRanLj7WVwKua8Gf2Za8my2t2mCTD3loFR1tRPE30uA1xul9eii+zp27n NBvSsSIhdVKcn1qK7lUfHIxa0v2ArzIjgBczHh6KzlS0U5Fd6LYqx+Y7sRSkjBlr nULJ2Bs+EqcjBF3OTjQFNG+dg/96QgIK+f7nVp/pvoGPKCDxiIdnuT7wlueguI9r Ys/7wCTOSTyrk7+q6IxYrliPReahTlK80HkMtba5m4JpBlGlikMtZcgVYeEuyeac fVfe/TcLjOkqFIomVpkhbtRDHJafu9Q5cMm/6eydXAH4y9GhM/Q6N+zEp4nXuSP3 /LzNFhwuFSabTwlnDx/5VpSXVYP+cmMoK9tWQjORNM//1zRONOea43eXeyhuwipo mTv/uEMpR9eDdPAJseod =ft3h -----END PGP SIGNATURE-----

1 0

Re: [tor-relays] Keep smiling only - i dont expect any answer
by Teófilo Couto 01 Apr '15

01 Apr '15

Same old, same old story, again and again... "They" operate badly developed, badly implemented "sites", full of well known vulns, but the issue, the "bad guy on set," is a tor relay... Typical... -------- Original Message -------- Subject: [tor-relays] Keep smiling only - i dont expect any answer Time (GMT): Apr 01 2015 14:02:00 From: cmar433(a)yandex.com To: tor-relays(a)lists.torproject.org nice abuse :) From: isac(a)kftc.or.kr To: abuse(a)wedos.com Date: 01.04.2015 08:42:07 Subject: [KF/ISAC] Warning! Unauthorized Access Trial! Dear Network Manager : I am a network security manager of Korea Financial Telecommunications and Clearings Institute(KFTC). My job is to protect Korean financial organizations from illegal intrusion attacks. We have received a report of unauthorized access trial originating from your site as shown below. -------------------------------------------------------------------------------- Date/Time(GMT+9): 2015-04-01 12:47:46 ~ 2015-04-01 12:47:46 Source IP : 37.157.192.208 Destination IP : 59.11.68.197 Attack Type : FCKeditor_Vul -------------------------------------------------------------------------------- We are seriously considering notifying these illegal attempts to the related authorities of both your and our countries and requesting proper legal actions. So, please take appropriate measures to identify and stop the attacker. And, please inform us of the results. (isac(a)kftc.or.kr) Thank you for your cooperation. p.s. : If you are not the correct person to deal with this incident, please forward this to the proper person and inform us for future convenience.

2 1

(no subject)
by Franck Marcel 01 Apr '15

01 Apr '15

3 2

New relay not recognised by weathermap
by Sharif Olorin 30 Mar '15

30 Mar '15

Hi all, I configured a new relay[0] yesterday, and recently tried to sign up for the Weathermap[1], wherein I get a "could not locate a Tor node with that fingerprint" error message. The node's definitely been up for more than an hour, and Atlas can see it[2]. Is this expected behaviour, or might it indicate an issue with my configuration? I've checked everything on the "potential problems" list - the node does exist, the fingerprint is correct, it's been up for more than an hour, hasn't been down for over a year, and running a recent (0.2.5.11) version of Tor. Thanks, Sharif [0] dendrocyte.wiredlaboratories.com.au/03B5C7B81CA56DF3CCC31FDA8032A7763B8B50B4 [1] https://weather.torproject.org/subscribe/ [2] https://atlas.torproject.org/#details/03B5C7B81CA56DF3CCC31FDA8032A7763B8B5… -- PGP: 6FB7 ED25 BFCF 3E22 72AE 6E8C 47D4 CE7F 6B9F DF57

2 4

New relay not recognised gy weathermap
by Sebastian Urbach 30 Mar '15

30 Mar '15

Sharuf, I completely forgot to welcome you and thank you for running a relay ! So, welcome and i hope you stay for quite a while :-) -- Sincerely yours / Sincères salutations / M.f.G. Sebastian Urbach ----------------------------------------- Religion is fundamentally opposed to everything I hold in veneration - courage, clear thinking, honesty, fairness, and, above all, love of the truth. ----------------------------------------- Henry Louis Mencken (1880 - 1956), American journalist, essayist, magazine editor, satirist and critic.

1 0

Re: [tor-relays] Installing obfs4 on Raspberry Pi bridge
by jchase 30 Mar '15

30 Mar '15

Thanks for your answer. Your instructions were good and explicit, but you hit on two of the problems I run into. I installed tor 0.2.5.11-1 from torproject.org and got two error messages that I couldn't solve. I would have to go back and re-install 0.2.5.11-1 to tell you what they were. In any case they weren't configuration problems. I had pretty much the same problem months ago when I installed a tor 0.2.5.x on Pi. Which leads me to want to use a raspbian repo. only I am unable to get /etc/apt/sources.list to recognize http://archive.raspbian.org/raspbian/pool/main/t/tor/ (or variations thereof) as a repository. And in my main raspian repo tor doesn't go any higher than 0.2.4.26 . So simply updating tor does not work. How do I add http://archive.raspbian.org/raspbian/pool/main/t/tor/ http://archive.raspbian.org/raspbian/pool/main/o/obfs4proxy/ http://archive.raspbian.org/raspbian/pool/main/libc/libcap2/ as one or more alternative repositories or force an install? Thanks, J. Chase tor-relays-request(a)lists.torproject.org: > Message: 4 > Date: Sun, 29 Mar 2015 00:19:14 +0200 > From: s7r <s7r(a)sky-ip.org> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Installing obfs4 on Raspberry Pi bridge > Message-ID: <551728E2.4030705(a)sky-ip.org> > Content-Type: text/plain; charset=windows-1252 > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA256 > > Hi, > > obfs4 will not run on 0.2.4.x , you need at least 0.2.5.x or 0.2.6.x > > First, upgrade your Tor. > > You can use torproject.org repositories. If you are running wheezy: > > 1. Add the repository: > # echo "deb http://deb.torproject.org/torproject.org wheezy main" >> > /etc/apt/sources.list > > 2. Add the signing key: > # gpg --keyserver keys.gnupg.net --recv 886DDD89; gpg --export > A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add ? > > 3. Install keyring: > # apt-get update && apt-get -y install deb.torproject.org-keyring > > Now upgrade your Tor, an apt-get -y install tor would upgrade to 0.2.5.1 > 1. > > You can install obfs4proxy from deb.torproject.org too: > > # echo "deb http://deb.torproject.org/torproject.org obfs4proxy main" >>> >> /etc/apt/sources.list > # apt-get update && apt-get -y install obfs4proxy > > Now, modify your torrc to enable the obfs4 transport. Make sure you > also add ExtORPort auto in torrc so it will report some useful > statistics. obfs4proxy also supports obfs3, and some users still use > that, so if you can be an obfs3 and obfs4 bridge at the same time > (requires just one more open port) it would be great. > > Sample torrc entry for enabling obfs4 and obfs3: > ExtORPort auto > ServerTransportPlugin obfs3,obfs4 exec /usr/bin/obfs4proxy > ServerTransportListenAddr obfs3 [::]:port > ServerTransportListenAddr obfs4 [::]:port > > To make the bridge even better, you can bind obfs3 and obfs4 to lower > ports (< 1024), if you have them free, such as obfs3 on 80 and obfs4 > on 443 (for example). This will help users behind really restrictive > firewalls who only allow connections on few ports. You can easily do > this with libcap2-bin package: > > # apt-get -y install libcap2-bin > # setcap 'cap_net_bind_service=+ep' /usr/bin/obfs4proxy > > To make this persistent after a reboot, edit the /etc/rc.local file > and add this line before 'exit 0': > setcap 'cap_net_bind_service=+ep' /usr/bin/obfs4proxy > > Hope this helps. If you don't want to use deb.torproject.org, > everything required is also included in raspbian main repo: > > http://archive.raspbian.org/raspbian/pool/main/t/tor/ > http://archive.raspbian.org/raspbian/pool/main/o/obfs4proxy/ > http://archive.raspbian.org/raspbian/pool/main/libc/libcap2/ > > If you want to use raspbian repo, simply ignore the lines where you > add deb.torproject.org to your sources.list file and just upgrade, > install the required packages and modify your torrc file. > > Thanks for running a bridge.

4 3

MY IP adress on blacklist and then in exit relay policy
by Cmar433 30 Mar '15

30 Mar '15

https://globe.torproject.org/#/relay/9DCF76179FCF47224D235ECD4A6165FED22ECE… So, i am running exit node. My provider send me an email .. "This IP is infected with, or is NATting for a machine infected with s_downloaderbot-mxb" Any idea what can i do with this problem ? Now i can see my IP in my server exit policy ... After my "delist action" is clean .. http://www.senderbase.org/lookup/ip/?search_string=37.157.192.208 I need just wait ? And all outgoing packet from my server still droped ? Thanks ..

5 7

Fwd: MY IP adress on blacklist and then in exit relay policy
by Zack Weinberg 30 Mar '15

30 Mar '15

On Mon, Mar 30, 2015 at 12:45 PM, Roger Dingledine <arma(a)mit.edu> wrote: > On Mon, Mar 30, 2015 at 12:23:21PM -0400, Zack Weinberg wrote: >> The only way your exit node's own IP address could be in the exit >> policy is if someone put it there. > > No, this is fine and normal. Tor relays automatically add themselves to > their exit policy by default. Thanks for the correction.

1 0

comparing tor patch levels on different OSes
by Nusenu 30 Mar '15

30 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 I wanted to know whether a particular OS tends to be more likely running outdated* tor releases than another. In case others are interested as well, here is the answer. OSX, OpenBSD and Windows are more likely running outdated tor releases than FreeBSD or Linux. Probably not really surprising.. A more detailed answer: (ordered from bad to better) | OS | outdated_fraction | outdated relays | outdated_cw_fraction | +--------+-------------------+-----------------+----------------------+ | Darwin | 24.6154 | 16 | 0.03 | | NetBSD | 22.2222 | 2 | 0.00 | | OpenBSD| 21.8750 | 14 | 0.05 | | Windows| 17.2189 | 291 | 0.01 | | FreeBSD| 9.1743 | 20 | 0.15 | | Linux | 8.8392 | 597 | 4.29 | (based on onionoo data from 2015-03-27) If you are missing an OS (like SunOS) in the list, than this means that it does not run any outdated release at all (outdated_fraction=0%). *) actually it is about whether the relay uses a recommended version as defined by dir auths https://consensus-health.torproject.org/#recommendedversions I "added" tor 0.2.7.x to the list to avoid flagging bleeding edge relays as outdated. -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVGKLtAAoJEFv7XvVCELh00SwQAJ9KR0DsZ/SaeAJTjbHg2rkU yD7vuyxnJuenoQKkm2IYRTUwKbqPMgLcHqVWGp6y84qMQQMlqLcUnpu11D/6KgGY N6TtpK7qmfploA64/34whQjFUf5mh8++9LjsdyrY3DkCv/6izz01t9KCwev0S40r Ik/2o3bE/v6Yhwrs1jL1kzm+ekTHHj21y6HOQVt9Bbe0Myfqo6jaqcd6Ilt2PDAX FoM5MqWNtrOLbWs5wYesZv6OTAvFGKx5GG0/6sNu/t5R9Z6yk/kkQNWVg87EGyaQ PNIwhXI7lnou4tuYgekqBM9TAY94im6EC789Q3uLj2q/nGzWNcjPpHU+1XCVtSeH dFnAZ/LeKVWMkUr2k08xNegsiN32QizPYW+2EMLpPml9cubTvP+4Y/YVx6Z1RNA+ eg1y6kd5l3ht97WOTTEXe6Wvl1AjHHpW5wGrd36+wpy40Ac9IlJqx2Qei4XrmWDN is9PUDqWCiMRQJCs9WVOKh0dgrdKve2/ipJB4i3O8viN/yzh9VXmzaJXqYa7Dkct CTW90uzVOQ/zM8usGkVJEgef9ICjxKqsPWQnhK68reHPbxZasOVTJ9EsCQZhPBeI MoslvWS/VvgFQ/Wvgj2zjS4LXieNbZMoPnX/SLC5dHyjs6WjGeOFgNslQJwcBNGe Q29d8/zH8q4tKBU5RpI5 =bbrP -----END PGP SIGNATURE-----

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-relays