- tor-relays - lists.torproject.org

Re: [tor-relays] tor-relays Digest, Vol 53, Issue 12
by Victor Victoe 08 Jun '15

08 Jun '15

U,koo On Jun 6, 2015 5:00 AM, <tor-relays-request(a)lists.torproject.org> wrote: > Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > > > Today's Topics: > > 1. Re: Updating tor to get fix for #15083? (Elliott Jin) > (AlexK (Tor lists)) > 2. Re: Keeping an exit node off of blacklists due to botnet > activity. (tor(a)t-3.net) > 3. BWAUTH weightings too volatile. . ."twitchy" > (starlight.2015q2(a)binnacle.cx) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 05 Jun 2015 14:32:05 +0200 > From: "AlexK (Tor lists)" <tor-relays(a)kalex.nl> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Updating tor to get fix for #15083? (Elliott > Jin) > Message-ID: <557196C5.7000103(a)kalex.nl> > Content-Type: text/plain; charset=windows-1252 > > tor-relays-request(a)lists.torproject.org schreef op 05/06/15 om 14:00: > > > Updating tor to get fix for #15083? (Elliott Jin) > > > > - Is Tor 0.2.5.10 (git-43a5f3d91e726291) actually the newest stable > > version, or did I mess something up when trying to update tor? > > - Would it be a good idea to upgrade to an experimental version? > > Assuming you're running 'standalone' on *Nix, this is a good place to > check: > > https://www.torproject.org/download/download-unix.html.en > > Here you'll find the latest source (stable/unstable) and the latest > packages for several *Nixes, including simple install instructions. > > Latest and greatest is 0.2.6.8, even if you rely on your package > manager's updates this is what you should have, e.g. on my relay: > > $rpm -qa tor > tor-0.2.6.8-tor.1.rh6_6.x86_64 > > Good luck! > Alex > > > > ------------------------------ > > Message: 2 > Date: Fri, 05 Jun 2015 09:21:24 -0400 > From: tor(a)t-3.net > To: <tor-relays(a)lists.torproject.org> > Subject: Re: [tor-relays] Keeping an exit node off of blacklists due > to botnet activity. > Message-ID: <5571a254.4b95.8816c700.4c72f93d(a)t-3.net> > Content-Type: text/plain; charset=us-ascii; format=flowed > > > > I have a fairly high bandwidth exit node running for about a month > now > > that I'm having difficulty keeping off of the > http://cbl.abuseat.org/ > > blacklist and have been informed of this listing by the VPS > provider. > > The relay is running with a reduced exit policy -- and additionally > I've > > blocked common mail ports, etc via IPFW so I know that no spam is > > actually being sent out of the relay. Still, various botnets > connections > > are connecting to abuseat.org botnet sinkholes via port 80 > > Command&Control connection attempts. I'm at a loss at how to stop > this > > or somehow detect and filter botnet traffic. > > > > I've informed the VPS provider that I'm on top of it and have the > > machine configured to not actually allow this sort of malicious > traffic > > out and they seem to be generally happy with that explanation, but > a > > better solution if one exists would be appreciated. > > > > Thanks, > > > > Julian Plamann > > > > julian (at) amity.be > > GPG: 0x96881D83 > > Don't know if this will help, but maybe: > > ExitPolicy reject 85.159.211.119 # Cryptolocker > ExitPolicy reject 212.71.250.4 # Cryptolocker > ExitPolicy reject 54.83.43.69 # Cryptolocker > ExitPolicy reject 192.42.116.41 # Cryptolocker > ExitPolicy reject 192.42.119.41 # Cryptolocker > ExitPolicy reject 198.98.103.253 # Cryptolocker > ExitPolicy reject 208.64.121.161 # Cryptolocker > ExitPolicy reject 142.0.36.234 # Cryptolocker > ExitPolicy reject 173.193.197.194 # Cryptolocker > > In general, I see complaints about abuse from the exit relays we run > due to someone using Tor to try to exploit remote web server scripts > and databases and the like. I don't think there's anything that can be > done about it? I would say that it's just part of what you get coming > out out of Tor exit nodes. > > If anyone else has any better advice feel free to correct me but, I > think it might be accurate to explain to the upstream that Tor exits > will generate certain kinds of abuse complaints as part of normal > operation. They open proxy web-related ports out, and some people > abuse Tor for web hacking types of activity. > > I would say that it is normal for Tor exits to live permanently on > certain kinds of blacklists. They do not need to be on the spam email > related ones (reject *:25 and other email ports), but they will land > on other types of blacklists, and I don't think it can be helped. > > > > > > > > ------------------------------ > > Message: 3 > Date: Sat, 06 Jun 2015 02:43:09 -0400 > From: starlight.2015q2(a)binnacle.cx > To: tor-relays(a)lists.torproject.org > Subject: [tor-relays] BWAUTH weightings too volatile. . ."twitchy" > Message-ID: <6.2.5.6.2.20150606020527.04dbce00(a)flumedata.com> > Content-Type: text/plain; charset="us-ascii" > > I'm back to complain further about > erratic bandwidth authority behavior, > previously > > [tor-relays] BWauth kookiness > https://lists.torproject.org/pipermail/tor-relays/2015-May/007039.html > > Allowing that BWauths are in a bit of flux, > with tor26 replaced by maatuska and > moria1 dropping the GuardFraction > calculation, the bandwidth calculations > evidence wildly erratic swings. > > Specifically my relay, which is perfectly > stable, reliable, fast (9.375 Mbyte/sec) > has been assigned a jaggedly random > series of consensus weights. > > > https://atlas.torproject.org/#details/4F0DB7E687FC7C0AE55C8F243DA8B0EB27FBF… > > earlier, fairly sane > > *gabelmoo Bandwidth=7701 Measured=9960 > tor26 Bandwidth=7701 Measured=9340 > moria1 Bandwidth=7701 Measured=18000 GuardFraction=66 > longclaw Bandwidth=7701 Measured=12800 > > later, bit high, nutty > > gablemoo Bandwidth=9375 Measured=17100 > moria1 Bandwidth=9375 Measured=77900 GuardFraction=75 > *longclaw Bandwidth=9375 Measured=23000 > > now, sane but undervalued > > gablemoo Bandwidth=8925 Measured=14900 > maatuska Bandwidth=8925 Measured=17200 > moria1 Bandwidth=8925 Measured=5330 > *longclaw Bandwidth=8925 Measured=7440 > > moria1 here is downright schizophrenic > but other BWauths regularly double > and halve the bandwidth value they > assign. Graph shows it a more vividly. > > What the graphs and numbers do not show is > that the effective difference between > the consensus values of ~7000 and ~23000 > is staggering. At the low end > of this range the relay shows roughly > 2500 active circuits and a average > load factor of about 20% of actual > bandwidth, while an assignment of 23000 > results in almost 8000 circuits > and a load factor of more like 50% > (both per Blutemagie.de). > > My point is that BWauths should not > be arbitrarily flipping stable, well > run relays from the top to the bottom > of this steeply sloped sweet-spot of > the weighting curve. Perhaps the > sweet-spot range has moved over the > last couple of years as the price of > bandwidth has dropped and faster > connections become more prevalent, > and this has been overlooked in > the algorithm. > > Regardless, it seems BWauth measurement > should be more nuanced in this > particular range, such that relays are > not slammed constantly between "rather > popular" and a "bit boring" irrespective > of their actual available capacity. > > One reason this vexes is that I > would like to see how well the relay > runs with Address Sanitizer active. > ASAN provides obvious benefits > w/r/t security, but entails a > performance trade-off. With the > BWauths throwing darts, eyes closed, > when choosing weighting, it's > impossible to gauge the performance > impact of various adjustments. > > In the bigger picture view, erratic > BWauth weighting can't be adding > clarity to the performance, > capacity and utilization situation. > > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > ------------------------------ > > End of tor-relays Digest, Vol 53, Issue 12 > ****************************************** >

1 0

Re: [tor-relays] BWAUTH weightings too volatile. . ."twitchy"
by teor 08 Jun '15

08 Jun '15

> Date: Sat, 06 Jun 2015 14:37:01 -0400 > From: starlight.2015q2(a)binnacle.cx > > At 04:12 6/7/2015 +1000, teor wrote: > >Please let me know how you go - the 0.2.6.x > >series should also be relatively ASAN > >and UBSAN clean, as Tor has been tested > >with them since late 2014. > > I've run 0.2.4.x and 0.2.5.x with ASAN > live in production with no problems > when the relay had less bandwidth. > Performance hit is something like > 30% extra CPU. Also had it on > libssl.so and libevent.so, but > was too expensive to run on > libcrypto.so. > > UBSAN seems expense and doesn't seem > it would run other than test, but > I didn't work on it long and am not > 100% certain. Was trying ASAN extra > stack checking at the time, which may > have been the culprit. As I said in my previous email, if you're running releases before 0.2.6.6 (2015), Tor won't run under UBSAN due to issues that have been fixed in subsequent releases. If you're running on architectures other than x86_64, Tor won't run under UBSAN due to a known issue in the donna C code. teor teor2345 at gmail dot com pgp 0xABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR D5BE4EC2 255D7585 F3874930 DB130265 7C9EBBC7

1 0

avira exits as24875
by tor-server-creator＠use.startmail.com 07 Jun '15

07 Jun '15

hey seems like avira is joining us running 24 exits through as24875. seems to be about double the size of mozillas relays. Yay!

3 3

Help with my first relay.
by janarkopunk＠riseup.net 07 Jun '15

07 Jun '15

Hi, i want to check if the relay has a good configuration. Also i have another question, why the speed of the relay is so slow, i have a VPS with a connection of 100mb/s, the relay is new. This is torrc: ORPort 443 Exitpolicy reject *:* Nickname Freedom4Anarchists ContactInfo nomail@... RelayBandwidthRate 85 MB RelayBandwidthBurst 90 MB DisableDebuggerAttachment 0 Thanks to all :)

2 1

False exit abuse from server4you
by Dr. Who 07 Jun '15

07 Jun '15

Fun fact of the week, I got this abuse email on friday: "Dear Customer, we've detected that you're running a TOR Exit Node on your machine. Please understand, that we cannot tolerate such a service on our infrastructure. Please ensure, that this service is disabled as soon as possible. Best Regards Your Intergenia Abuse Team" followed by over 6000 IPv4 numbers including one of my relay server. First I find it a privacy violation for those other users who might run any form of tor beeing found on an abuse email to me. It should have listed only my own IP number. Secondly I think they should be able to differate between exit and relay servers. I'm eager to hear their response on Monday. Either they keep relays running or I quit, monthly payment is a good idea in that case. Just letting you know...

4 4

Bridge Usage and Setup
by Tom Ritter 07 Jun '15

07 Jun '15

Earlier this month I set up an obfs3/obfs4 bridge that (as far as I can tell) has never been used. Is this normal? My bridge is at https://atlas.torproject.org/#details/C184F644B9D39B26647779282003ACAF59E80… During this exercise I ran across a few pain points for setting up a bridge. Maybe I completely ignored some existing resource for this, but the bottom of https://www.torproject.org/docs/bridges is out of date, BridgeDB doesn't have a link anywhere, and trac's search isn't that good but I couldn't find anything on that either. 1) Setup I followed https://gitweb.torproject.org/pluggable-transports/obfs4.git/tree/README.md to set up the obfs3/obfs4 As good as this is, it would be great if it included a minimal and complete torrc for an obfs4 bridge, and perhaps also for an obfs3/obfs4 bridge and an IPv6 setup. My torrc is SocksPort 0 ControlPort 9051 HashedControlPassword ... CookieAuthentication 1 ORPort 9001 ORPort [<public ipv6 addr>]:9001 BridgeRelay 1 ExtORPort auto ServerTransportPlugin obfs3,obfs4 exec /usr/local/bin/obfs4proxy ServerTransportListenAddr obfs3 [::]:80 ServerTransportListenAddr obfs4 [::]:443 2) Testing How do I (easily) confirm my bridge is correctly configured? Especially if I don't have an IPv6 connection for TBB? netstat seems to say that things are good. The tcp6 connections on 80 and 443 also apply to ipv4 though; right? $ netstat -lpn tcp 0 0 127.0.0.1:9051 0.0.0.0:* LISTEN 479/tor tcp 0 0 0.0.0.0:9001 0.0.0.0:* LISTEN 479/tor tcp 0 0 127.0.0.1:55346 0.0.0.0:* LISTEN 479/tor tcp6 0 0 :::443 :::* LISTEN 480/obfs4proxy tcp6 0 0 <public ipv6 addr> :::* LISTEN 479/tor tcp6 0 0 :::80 :::* LISTEN 480/obfs4proxy I can put my bridge line into TBB and try and use it for obfs4; seems to work. But actually finding that bridge line wasn't straightforward (cat /var/lib/tor/pt_state/obfs4_bridgeline.txt and then edit the fields, right?) And it doesn't help for obfs3. Some external validation would be nice. 3) Usage Can do I figure out if my bridge is being used? I've identified the following: $ cat /var/lib/tor/stats/bridge-stats bridge-stats-end 2015-05-31 18:58:43 (86400 s) bridge-ips bridge-ip-versions v4=0,v6=0 bridge-ip-transports $ zgrep unique /var/log/tor/* (a bunch of lines of "0 unique clients") Atlas graphs, showing virtually no traffic I feel like #2 might be addressed by Weather (if it was working), but all of these might be a good subject for a wiki page on how to run a bridge, if my understanding of everything is correct. -tom

8 9

Re: [tor-relays] BWAUTH weightings too volatile. . ."twitchy"
by teor 06 Jun '15

06 Jun '15

> Date: Sat, 06 Jun 2015 02:43:09 -0400 > From: starlight.2015q2(a)binnacle.cx > > … > One reason this vexes is that I > would like to see how well the relay > runs with Address Sanitizer active. > ASAN provides obvious benefits > w/r/t security, but entails a > performance trade-off. With the > BWauths throwing darts, eyes closed, > when choosing weighting, it's > impossible to gauge the performance > impact of various adjustments. > … Good timing! Tor 0.2.7.1-alpha on x86_64 is currently Address Sanitizer and Undefined Behavior Sanitizer clean. I've just submitted a branch with instructions for building, running, and testing Tor with ASAN and UBSAN. https://trac.torproject.org/projects/tor/ticket/15817#comment:8 The following known issues exist: Two of the tests deliberately invoke undefined / illegal behavior, the instructions provide a blacklist file and an environmental variable to exempt them from ASAN/UBSAN. Architectures without (x86?) 64-bit assembler use donna C code that left-shifts 1 bits into and past the sign bit of signed integers. Until https://trac.torproject.org/projects/tor/ticket/13538 is resolved, this particular file can be exempted from UBSAN. Please let me know how you go - the 0.2.6.x series should also be relatively ASAN and UBSAN clean, as Tor has been tested with them since late 2014. teor teor2345 at gmail dot com pgp 0xABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR D5BE4EC2 255D7585 F3874930 DB130265 7C9EBBC7

2 1

Updating tor to get fix for #15083?
by Elliott Jin 06 Jun '15

06 Jun '15

Hello, Over the last few days, my relay (D28D32015D9723E6C50827BFD9D19200901E19D1) has been going down quite often. When I checked the logs, I saw this message: tor_assertion_failed_(): Bug: ../src/or/buffers.c:2627: assert_buf_ok: > Assertion ch->data < &ch->mem[0]+ch->memlen failed; aborting. It looks like this issue has already been observed and addressed: https://trac.torproject.org/projects/tor/ticket/15083 However, when I tried to update tor, I got the message "tor is already the newest version". I have two questions for this list: - Is Tor 0.2.5.10 (git-43a5f3d91e726291) actually the newest stable version, or did I mess something up when trying to update tor? - Would it be a good idea to upgrade to an experimental version? Thanks! -Elliott -- Anonymous Feedback <http://www.admonymous.com/eyjin>

2 2

Re: [tor-relays] Keeping an exit node off of blacklists due to botnet activity.
by tor＠t-3.net 05 Jun '15

05 Jun '15

> I have a fairly high bandwidth exit node running for about a month now > that I'm having difficulty keeping off of the http://cbl.abuseat.org/ > blacklist and have been informed of this listing by the VPS provider. > The relay is running with a reduced exit policy -- and additionally I've > blocked common mail ports, etc via IPFW so I know that no spam is > actually being sent out of the relay. Still, various botnets connections > are connecting to abuseat.org botnet sinkholes via port 80 > Command&Control connection attempts. I'm at a loss at how to stop this > or somehow detect and filter botnet traffic. > > I've informed the VPS provider that I'm on top of it and have the > machine configured to not actually allow this sort of malicious traffic > out and they seem to be generally happy with that explanation, but a > better solution if one exists would be appreciated. > > Thanks, > > Julian Plamann > > julian (at) amity.be > GPG: 0x96881D83 Don't know if this will help, but maybe: ExitPolicy reject 85.159.211.119 # Cryptolocker ExitPolicy reject 212.71.250.4 # Cryptolocker ExitPolicy reject 54.83.43.69 # Cryptolocker ExitPolicy reject 192.42.116.41 # Cryptolocker ExitPolicy reject 192.42.119.41 # Cryptolocker ExitPolicy reject 198.98.103.253 # Cryptolocker ExitPolicy reject 208.64.121.161 # Cryptolocker ExitPolicy reject 142.0.36.234 # Cryptolocker ExitPolicy reject 173.193.197.194 # Cryptolocker In general, I see complaints about abuse from the exit relays we run due to someone using Tor to try to exploit remote web server scripts and databases and the like. I don't think there's anything that can be done about it? I would say that it's just part of what you get coming out out of Tor exit nodes. If anyone else has any better advice feel free to correct me but, I think it might be accurate to explain to the upstream that Tor exits will generate certain kinds of abuse complaints as part of normal operation. They open proxy web-related ports out, and some people abuse Tor for web hacking types of activity. I would say that it is normal for Tor exits to live permanently on certain kinds of blacklists. They do not need to be on the spam email related ones (reject *:25 and other email ports), but they will land on other types of blacklists, and I don't think it can be helped.

1 0

Re: [tor-relays] Updating tor to get fix for #15083? (Elliott Jin)
by AlexK (Tor lists) 05 Jun '15

05 Jun '15

tor-relays-request(a)lists.torproject.org schreef op 05/06/15 om 14:00: > Updating tor to get fix for #15083? (Elliott Jin) > > - Is Tor 0.2.5.10 (git-43a5f3d91e726291) actually the newest stable > version, or did I mess something up when trying to update tor? > - Would it be a good idea to upgrade to an experimental version? Assuming you're running 'standalone' on *Nix, this is a good place to check: https://www.torproject.org/download/download-unix.html.en Here you'll find the latest source (stable/unstable) and the latest packages for several *Nixes, including simple install instructions. Latest and greatest is 0.2.6.8, even if you rely on your package manager's updates this is what you should have, e.g. on my relay: $rpm -qa tor tor-0.2.6.8-tor.1.rh6_6.x86_64 Good luck! Alex

1 0