tor-relays

tor-relays@lists.torproject.org

36 participants
4815 discussions

relayor: automation for relay operators (ansible)
by Nusenu 02 Mar '15

02 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, computers are better at doing repeatable things over and over again so let them take care of boring tasks. Based on David's ansible-tor [1] I created an ansible role to make relay operations more convenient (see the initial commit message for a longer list of changes). https://github.com/nusenu/relayor Core features: - - configure multipe tor instances on a server automatically generates two instances per available IP address (Memory auto detection is not implemented yet) - - take care of MyFamily automatically - - user configurable Nickname prefix - - easy Exit/Non-Exit setting (boolean) - - alpha vs. stable releases (boolean) Supported platforms: - Debian - CentOS - OpenBSD Everything is still fresh, so I would NOT recommend to use this on production relays. Testing and review is appreciated. There is still a crucial piece missing (init scripts), but I hope tor packagers are willing to incorporate multi-init support patches (see issues). I also have parts that adds monitoring (munin+vnstat+webserver) but that will go into a separate role. If you have never heard of ansible, it speaks to your servers using SSH and does not require an agent or a central management server - just run it from you client machine. http://www.ansible.com/resources (not entirely torbrowser friendly) http://docs.ansible.com If you are planing to run this role over tor when connecting to your servers, make sure you have the following set in your ~/.ansible.cfg: ssh_args = -o ControlMaster=auto -o ControlPersist=60s This ansible role is not about bridges or hidden services, but I'd like to add "management HSes" (SSH and monitoring) in the future. Nusenu [1] https://github.com/david415/ansible-tor -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJU8OdxAAoJEFv7XvVCELh0Aw0P/AiiprSbE5apWUtrCoyrO5GN MKRfwpvy/BGrKjOjBZAtIs+8+AMaRQXV54CUIG0QlewnVgWRUyXA635OIAY43hFR BY/In1IiSXcqKyjaTsM4No/Nh+tvdj2rt+MoYvrMTVQVl8i+CYQKt4ypHjRN1cGS OIdP/AWi9tt/eAl+IgUNf4/pud94UbruDfGHtDQ4xGeReNdo64Q92c2QicFOdwNc fIqrhb/aWydfgQehmjSAXM9i9WfBi5vMSh7D5lUxheqhEmjSiV1bw8mvQML+kXse nwv7AZj0MkoBYqTd0t3h1JJwPXt0Vjfi3ZZNPlOTx6gZmPfbgrezya+TrWHQy65M rw6B3E3L5UDjkJ1k3cyJWvtpUSyYCqzcUDIq6+gQxZhGH0pWQhutxqdt5C5S+qn7 9hWJcDUyjeSFwxRfhLphiSrPQEue6Eox+EWzcSh4YQh8hol/P8Ev5C4P/yavWF0m w0jGbQoVIwz0jMhZwW9w6KxmaZO68/3aEfWUXjLFg/DCp/nLXqR1kHxuiLgO/sd6 QumoOjxqu9KwV9crQX86dl9oMFFvUb7l1WqidMVZIR81WQkDIVWoypvxCnG2QhDo Z4Nily3qg3I3nW+QLTIY8XjUkVMLV/1kky9ETDb2Vvz0uR2H5tyZR6I9hQ4FaGHt Xjm7kZ9JgRZjixqyAhTz =/jyQ -----END PGP SIGNATURE-----

2 3

Re: [tor-relays] tor exit node, low bandwidth
by Volker Mink 27 Feb '15

27 Feb '15

2 1

Re: [tor-relays] tor exit node, low bandwidth
by Volker Mink 27 Feb '15

27 Feb '15

Fingerprint is E20FF09A9A800B16C1C7C16E8C0DF95F46F649B0 And its running for about 6-7 weeks now. Any ideas? ------------------------------ Message: 2 Date: Fri, 20 Feb 2015 14:16:41 +0100 From: Sebastian Urbach <sebastian(a)urbach.org> To: <tor-relays(a)lists.torproject.org> Subject: Re: [tor-relays] (no subject) Message-ID: <14ba721fef0.27ae.e04ee758f2dadc1889b5b423dda555f9(a)urbach.org> Content-Type: text/plain; charset="iso-8859-1"; format=flowed Hi, >I have these settings in my torrc-file >RelayBandwidthRate 10000 KB? # Throttle traffic to >1000KB/s (800Kbps) >RelayBandwidthBurst 20000 KB # But allow bursts up >to 2000KB/s >(1600Kbps) MaxAdvertisedBandwidth 10000 KB ? >I have a decent cable-based internet-connection at >home and want to >share lots of bandwith. ?> >Unfortunately my exit node only does about 220kb/sec ?>avg: 219.2 Kb/sec, total: 18.4 GB?????? avg: 224.7 Kb/>sec, total: 18.5 GB ?> >What do i have to change to speed this up? Thank you for running a Relay. Please provide your fingerprint if you want other people to look into this matter. -- Sincerely yours / Sinc?res salutations / M.f.G. Sebastian Urbach ----------------------------------------- Religion is fundamentally opposed to everything I hold in veneration - courage, clear thinking, honesty, fairness, and, above all, love of the truth. ----------------------------------------- Henry Louis Mencken (1880 - 1956), American journalist, essayist, magazine editor, satirist and critic. On February 20, 2015 1:36:43 PM "Volker Mink" <volker.mink(a)gmx.de> wrote: > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > ------------------------------ Message: 3 Date: Fri, 20 Feb 2015 09:25:33 -0500 From: Speak Freely <when2plus2is5(a)riseup.net> To: tor-relays(a)lists.torproject.org Subject: Re: [tor-relays] (no subject) Message-ID: <e9992411d4355c951426baf31003cd52(a)riseup.net> Content-Type: text/plain; charset=US-ASCII; format=flowed Hi! Welcome to the club! Doing some quick math based your avg speed and your total transfer, it looks like you've been running an exit relay for about a day. It takes some time to build consensus within the network, others can explain it better and in more detail.Don't worry, it takes some time for the network to give you much love, but it will! Take a look at one of my newest relays on atlas to see the ramp-up time. It's only been up for a couple of days. https://atlas.torproject.org/#details/E0FE2E053843F09480EFF75F0A27D095F96FFF 82 Here's an another relay, that shows once love starts, it stays. This one has been up for over a month... One of my first. https://atlas.torproject.org/#details/BDE26705D49CB8AC3297953BCC2070FED9C611 53 Don't forget to provide the fingerprint for others to investigate. :) Matt -- Speak Freely ***

2 1

guard-failing message
by eliaz 27 Feb '15

27 Feb '15

My bridge's log showed: Feb 24 02:25:45.940 [Warning] Your Guard < guard name and fp > is failing a very large amount of circuits. Most likely this means the Tor network is overloaded, but it could also mean an attack against you or potentially the guard itself. Success counts are 129/259. Use counts are 38/38. 242 circuits completed, 0 were unusable, 113 collapsed, and 5 timed out. For reference, your timeout cutoff is 60 seconds. Globe showed no 3-day chart for the guard. For my bridge, the chart showed a lot of traffic, the peaks or less than a KB. This pattern has been going on for a few days. The bridge usage display shows the usual traffic, but more anemic the past several days. To be on the safe side I did the following: * shut down the bridge, * reset my gateway address, * restarted the bridge after about 1/2 hour. Have I overreacted? - eliaz

1 0

Same relay (identity key) on two IPs
by catchthemall 26 Feb '15

26 Feb '15

Hi all, tl;dr: Due to a config error my relay [1] was running on two different IPs at the same time for about half a day. Now the traffic has dropped. I just wanted to make sure that it is not flagged as malicious or something ... Additionally I am curious about the policy in such a case. What happens if a relay shows up in the network with the same identity key but on different IP addresses? long-version (kinda funny): I am using webtropia [2] as a service provide which is, as far I can tell, is a good choice for running a relay. Some time ago I decided to change the hosting plan and switch to another offer at the same provider. For that reason I let my old contract run out until they notified me that my server will be shut down and deleted. After receiving this notification I checked that indeed my relay server was no longer reachable. Some time passed by until I had time to setup my old relay (same identiy key) on the new server. Done so I launched it and was happy to enjoy the increased bandwidth. What I missed was that in the meantime the old server was reactivated by the hosting provider without notifying me and as a result was running at the same time as the new one for about half a day. After I recognised this, I tried to ssh to the old server - which still worked perfectly and indeed confirmed that everything was as I left it. I shut down the relay running on the old server and wrote an e-mail to the hosting provider checking if they are going to charge me the reactivation and why the hell reactivated it. Up until now I only got an response that my old server was "shut down" and that the "hard disk was deleted on the 29.01.2015" ... .. I thought well ... since I can still ssh to that server I kinda doubt that this is the case. So since I still had ssh access to the "shut down server" I decided to setup another relay on the "deleted hard disk" of this machine until they believe me that there exists a small possibility that this thing is still running ... The "ghost" relay [2] is running fine up until now. [1] https://atlas.torproject.org/#details/5A9B5923F4937C3ED76B0AD4CF1030C11FCAF… [2] http://www.webtropia.com/index.php [3] https://atlas.torproject.org/#details/23C31DBBEB898145D6E090D6DD8C06D72E55F…

3 5

Relay Node not acquiring Guard Flag.
by Sebastian Urbach 24 Feb '15

24 Feb '15

Hi, On 02/23/2015 06:44 PM, Sebastian Urbach wrote: > Because the criterias changed a while ago, only the fastest 25% of the > Relays are Guards anymore. >BTW, what's about minimum uptime ? Details for all the flags can be found here: https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt -- Sincerely yours / Sincères salutations / M.f.G. Sebastian Urbach ----------------------------------------- Religion is fundamentally opposed to everything I hold in veneration - courage, clear thinking, honesty, fairness, and, above all, love of the truth. ----------------------------------------- Henry Louis Mencken (1880 - 1956), American journalist, essayist, magazine editor, satirist and critic.

2 1

Relay Node not acquiring Guard Flag.
by Beagle Bone 23 Feb '15

23 Feb '15

Hey folks. 3xBT here, admin of the node of the same name. I was wondering why my node has yet to pick up the Guard flag: Fingerprint: D937161730610A5D66BDED6CF4D5C9692566D9FE Feb 23 06:25:05.000 [notice] Tor 0.2.4.24 (git-e3c61213fb2dc49a) opening new log file. Feb 23 06:25:05.000 [notice] Configured to measure directory request statistics, but no GeoIP database found. Please specify a GeoIP database using the GeoIPFile option. Feb 23 06:27:22.000 [notice] Your DNS provider gave an answer for "lya67fieutqf6", which is not supposed to exist. Apparently they are hijacking DNS failures. Trying to correct for this. We've noticed 1 possibly bad addre$ Feb 23 09:57:31.000 [notice] Heartbeat: Tor's uptime is 59 days 6:02 hours, with 153 circuits open. I've sent 414.64 GB and received 394.25 GB. Feb 23 09:57:31.000 [notice] Average packaged cell fullness: 97.080% Feb 23 09:57:31.000 [notice] TLS write overhead: 3% Feb 23 09:57:31.000 [notice] Circuit handshake stats since last time: 4059/4059 TAP, 3977/3977 NTor. Feb 23 15:02:49.000 [notice] New control connection opened. Feb 23 15:57:31.000 [notice] Heartbeat: Tor's uptime is 59 days 12:02 hours, with 158 circuits open. I've sent 416.55 GB and received 396.07 GB. Feb 23 15:57:31.000 [notice] Average packaged cell fullness: 97.087% Feb 23 15:57:31.000 [notice] TLS write overhead: 3% Feb 23 15:57:31.000 [notice] Circuit handshake stats since last time: 6032/6033 TAP, 4055/4055 NTor. Feb 23 17:23:54.000 [notice] New control connection opened. Additional info: When traffic is 4Mbit/sec, CPU and memory load is at ~50%. I'm also wondering why the log is only being written when I'm looking at it, and if there was anything I could do to increase usage of allotted bandwidth. -3xBT

3 2

drop in bandwith - because of fail2ban rule?
by tor＠viisauksena.de 23 Feb '15

23 Feb '15

hi i am wondering , because i constantly becoming less and less traffic / or given Bandwidth for a Tor exit relay with a bunch of flags .. the exit is on a debian, vserver with quit a lot of machine power behind, has it own IPv4 and there is also enough bandwidth (i checked this regulary with speedtests or fake downloads of whatever distros) https://atlas.torproject.org/#details/2AC2306BD625A9DD75532886842C268C3CDBB… i didnt change anything in configuration, beside one small thing after getting dozens of apache errorcode 504 port 80 and 443 to the Tor-IPv4.. and so i startet to make a fail2ban rule, because this doesnt make sense, also this comes often from a variety aof IPv4 en block from russia, china, korea (mostly) - so i optet for fail2ban more than ignoring these errors. This is the only thing i could imagine which connects to the network drop (ok some internet police whitehat watchers argue there is bad traffic here and than .. but this is "normal" i guessed for tor-exit) So i turned my rule of some 2-3 days, to see if this makes the drop in bandwidth - no effect. So i restartet back the fail2ban rule. So my question - tor hides in port 80 / 443 traffic - is this what i mistakingly block / or interfere .. or how this drop from near 14 Mb to 1,9 Mb is explainable? (while normal traffic on server goes well) thx, viisauksena (for completeness example of logoutput and fail2ban-regex ) # basicly i want to stop these lines # default-178_254_XXXXXX:443 104.245.96.249 - - [10/Feb/2015:16:52:07 +0100] "GET /" 400 549 "-" "-" [Definition] failregex = [^ ]+ <HOST>.*"GET /" 400 5[0-9][0-9]

1 0

Strong bumps in traffic with 0.2.6.3
by Christian Sturm 22 Feb '15

22 Feb '15

Hello, I noticed on my Tor relay that deploying 0.2.6.3 resulted in the bandwidth going up an down a lot which can be seen here: https://globe.torproject.org/#/relay/CE75BF0972ADD52AF8807602374E495C815DB3… It looks like I am not the only one. This CCC hosted relay (different OS, provider, etc.) appears to have the same thing happening: https://globe.torproject.org/#/relay/9BDF3EEA1D33AA58A2EEA9E6CA58FB8A667288… It is hard to filter relays per version right now (maybe something onionoo could support?). Are others experiencing the same problems?

3 3

Running obfs4proxy on Debian Stable
by isis 22 Feb '15

22 Feb '15

Hello, I requested that the obfs4proxy package in Debian jessie be ported to wheezy-backports, [0] however, it seems this is extremely unlikely to happen because it would mean backporting pretty much every Golang package in existence. I would be super stoked if we could make it as easy and seamless as possible for the Bridge operators who are still running obfs2 (!!) to move to supporting better, newer Pluggable Transports. Currently recommended PTs to run are: obfs3, obfs4, scramblesuit, and fteproxy. When Tor Browser 4.5 becomes stable (probably in mid-April 2015), we'll want lots more obfs4 Bridges! For the super adventurous sysadmins who'd like to try Yawning's experimental new post-quantum PT, Basket [1] is one of the newest PTs. We should probably come up with some easy instructions for operators of Tor Bridge relays who are running Debian stable, such as adding an Apt pin to pull in only the obfs4proxy package and its dependencies from Debian jessie and keep everything else pinned to stable. If someone has done this, or has another simple solution, would you mind writing up some short how-to on the steps you took, please? [0]: http://lists.alioth.debian.org/pipermail/pkg-anonymity-tools/Week-of-Mon-20… [1]: https://github.com/yawning/basket -- ♥Ⓐ isis agora lovecruft _________________________________________________________ OpenPGP: 4096R/0A6A58A14B5946ABDE18E207A3ADB67A2CDB8B35 Current Keys: https://blog.patternsinthevoid.net/isis.txt

5 10

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-relays