- tor-relays - lists.torproject.org

Re: [tor-relays] Undiagnosable Crashes in Relays
by teor 21 Apr '15

21 Apr '15

> Date: Wed, 25 Mar 2015 17:21:50 +0800 > From: Vincent Yu <v(a)v-yu.com> > > On Wed, Mar 25, 2015 at 4:26 PM, skyhighatrist <skyhighatrist(a)tfwno.gf> > wrote: >> I am wondering if anyone has had their relay randomly crash in the >> past >> week or so. Three of mine (I run 6, nonexits) have fallen over. One of >> them ~5 days ago, one of them ~4 days ago, and one of them earlier >> today >> . > > This also happened to my two relays about three weeks ago. They are: > > https://globe.torproject.org/#/relay/C309A31AD772FFDD0805C9FECB6D4748A7CBF6… > https://globe.torproject.org/#/relay/18BE989663CF3351F73D33C672BB1C985E0EA5… > > They are both middle/guard relays (about 200 Mbps each) on the 0.2.6 > branch and are on the same dedicated server. They went down at > different times, and as far as I can remember, there was nothing > notable in the Tor and system logs. No issues prior to this over the > past 12 months. I haven't had time to investigate this. > This also happened to my EC2 relay a few weeks ago, but I never had time to investigate. It's quite possible it was a bad nightly tor version, or some sort of misconfiguration on my end, but the timing matches. I didn't manage to get it to come back up in the limited time I had to try and fix it. https://globe.torproject.org/#/relay/425E55A8FA145ACFC01FA58CD4E6F46DD7762A… (No record, it's been down for a while.) teor teor2345 at gmail dot com pgp 0xABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR C3C57B23 349825DE 929A1DEF C3531C25 A32287ED

2 3

Tor and Freenode
by Markus Hitter 20 Apr '15

20 Apr '15

Hello all, after yesterday watching "State of the Onion", a speech held at 31C3 recently, I spontanuously decided to also run a Tor relay. After some back and forth it appears to be running fine on my OpenWRT based router. The only ORPort is 9001, which is also the only hole punched into the firewall, I hope I did this right. Today I wanted to continue at Freenode IRC, like I did for years, not even using an anonymous connection. But they wouldn't let me in: [12:02] * You are banned from this server- Your tor exit node must not allow connections to freenode (tor exit node (chat.freenode.net:8000)). Email tor-kline(a)freenode.net when corrected. (2015/1/24 09.41) I understand that my router and my PC share the same IP address to the remaining internet and IRC operators try to identify users by their IP address (which isn't possible). Reading up on the matter I found two texts: http://www.freenode.org/policy.shtml "The freenode network welcomes Tor users" http://www.freenode.org/irc_servers.shtml#tor "If you do want to be a Tor exit node and still use freenode, you will have to configure your exit policy to block all of the IRC ports we use, in addition to ports 80 and 443 as these are used for webchat." To me this sounds like "We welcome it, but please block all of its usage". They recommend to add a "reject *:*" rule, but that means the relay is no longer a relay, right? And blocking port 80 and 443 means Tor to become useless. As I can't find much on the matter by googling: is this actually a misalignment of Freenodes' statement to freedom as bad as it looks? If yes, what could I do about it? I'm a fairly experienced hobbyist hacker and admin, so I wouldn't fear writing some code. Cheers, Markus -- - - - - - - - - - - - - - - - - - - - Dipl. Ing. (FH) Markus Hitter http://www.jump-ing.de/

14 27

many hundreds connections to the same ip address + port
by Toralf Förster 19 Apr '15

19 Apr '15

Since few days (or since 0.2.6.7 ?) I do observe this behaviour at y exit node, eg. to port 81, 110, 636 and other non-http ports. Didn't saw this before - any hints ? -- Toralf pgp key: 7B1A 07F4 EC82 0F90 D4C2 8936 872A E508 0076 E94E -- "; the past is all dirty and cruel in the modern popular imagination, with the exception of the Romans, who are just cruel" Ian Mortimer, 2008, "The Time Traveller's Guide to Medieval England"

1 0

Re: [tor-relays] simple relay setup
by tor-server-creator＠use.startmail.com 18 Apr '15

18 Apr '15

thanks do i have to install something in first line to perform this gpg lines? you say "| apt-key add -" torproject.org says "| sudo apt-key add -" doesnt sudo matter cause im useing root? is it possible to just deactive login/ssh to be save or is it just better/necessary to deal with rsa key? will tor be utoupdated at new release with "apt-get -y upgrade" or how to manage automated actuality? On Saturday, April 18, 2015 3:46 PM, Julien ROBIN <julien.robin28(a)free.fr> wrote: > Hi ! > > You can try a mix between this (ultra simple), from > https://www.torproject.org/docs/debian.html.en : > > > > You need to add the following entry in /etc/apt/sources.list or a new > file in /etc/apt/sources.list.d/: > > deb http://deb.torproject.org/torproject.org wheezy main > deb-src http://deb.torproject.org/torproject.org wheezy main > > > gpg --keyserver keys.gnupg.net --recv 886DDD89 > gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add - > > apt-get update > apt-get install tor deb.torproject.org-keyring > > > > This will make your "apt-get" using the last table version of Tor > from the Tor Project servers, with signatures check making sure that > no one "car jacked" the server before you download from it ;) > > > > You will have to find a way to make your "apt-get update" and > "apt-get -y upgrade" automatic, may be "reboot" too (when kernel have > been updated for example, but here I cannot say precisely how to > know if you have to reboot !) > > > > > And a second link, that can give you a lot of tips also > > http://www.torservers.net/wiki/setup/server > > Including disabling password authentification, but if you want to > completely lock your server, a good way could be to make > "/etc/init.d/ssh" unable to run (you delete the "x" permission for > example) > > After the reboot, you will not be able to connect anymore using SSH > on your server, and you will have to use tools from your ISP if you > want to drive your server again ! > > Personnaly, I always do a minimalist installation in order to have > nothing else than OpenSSH listening (and Tor, of course !). Because > if others things that I don't know (rpc bind port 111 etc) are > listening I'm not sure that I have everything into control. > > > > > ----- Mail original ----- > De: tor-server-creator(a)use.startmail.com > À: tor-relays(a)lists.torproject.org > Envoyé: Samedi 18 Avril 2015 12:06:07 > Objet: [tor-relays] simple relay setup > > > I need some help. > My dedicated server is running debian and is new, set up by my > serverhoster. > > I want to run a TOR-Relay: > - It should always update to latest stable automatically. > - It should be save. > > > I will edit the torrc by myself. What i need is simple copy+paste > codeline for: > - isntall and run functional auto-update for tor (is it libevent?) > just simply @root user without user/pgp dealing stuff. pgp stuff is > confusing me! > - deactivate complete access (ssh disable?) to ensure savety (i have > to reinstall the system by serverhoster-website if change needet) i > want to lock out even myself. > > Is this a practical idea to most easy set-up and let run without > struggle? > Please help, thanks. > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

2 1

simple relay setup
by tor-server-creator＠use.startmail.com 18 Apr '15

18 Apr '15

I need some help. My dedicated server is running debian and is new, set up by my serverhoster. I want to run a TOR-Relay: - It should always update to latest stable automatically. - It should be save. I will edit the torrc by myself. What i need is simple copy+paste codeline for: - isntall and run functional auto-update for tor (is it libevent?) just simply @root user without user/pgp dealing stuff. pgp stuff is confusing me! - deactivate complete access (ssh disable?) to ensure savety (i have to reinstall the system by serverhoster-website if change needet) i want to lock out even myself. Is this a practical idea to most easy set-up and let run without struggle? Please help, thanks.

3 2

Hello Everyone
by Jeffrey Hathaway 17 Apr '15

17 Apr '15

Hey Everyone, I have been a big supporter of the Tor Project, and I have finally been able to work with my upstream providers and get an Exit bridge online. https://atlas.torproject.org/#details/DFBD4AD44C2EC14EA921C639859CE432A3554… Based on the exit policy, does anyone suggest any changes i should make to keep abuse to a minimum?

1 0

Re: [tor-relays] Installing obfs4 on Raspberry Pi bridge
by jchase 16 Apr '15

16 Apr '15

Hello, When I run either ./obfs4proxy or obfs4proxy.go I get: ./obfs4proxy: line 1: /bin: Is a directory ./obfs4proxy: line 2: syntax error near unexpected token `(' ./obfs4proxy: line 2: ` * Copyright (c) 2014-2015, Yawning Angel <yawning at torproject dot org>' Regards, J Chase >> Hello, >> Thanks to you I have tor 0.2.5.11 running on a Raspberry Pi2 and obfs4 >> installed from git. I have good news and bad news. >> The largest problem is that I get the warning "could not launch >> managed proxy executable at '/path/obfs4proxy'('Permission denied')" >> In the past this used to be a problem with apparmor, but apparmor >> isn't installed. Any idea where I can start looking for a solution? >> Here are a couple of details and small problems: >> I didn't install obfs4 directly (due to problems), but installed it to >> another laptop and copied it to the Pi2 using scp. > > Oh dear. What happens when you run the obfs4proxy executable in a > shell directly (on the pi2)? > > It should look something like: > $ ./obfs4proxy > 2015/04/12 20:13:02 [ERROR]: obfs4proxy - must be run as a managed > transport > > If not, what does 'file /path/obfs4proxy' say? > > Regards, >

2 1

Re: [tor-relays] Installing obfs4 on Raspberry Pi bridge
by jchase 12 Apr '15

12 Apr '15

Hello, Thanks to you I have tor 0.2.5.11 running on a Raspberry Pi2 and obfs4 installed from git. I have good news and bad news. The largest problem is that I get the warning "could not launch managed proxy executable at '/path/obfs4proxy'('Permission denied')" In the past this used to be a problem with apparmor, but apparmor isn't installed. Any idea where I can start looking for a solution? Here are a couple of details and small problems: I didn't install obfs4 directly (due to problems), but installed it to another laptop and copied it to the Pi2 using scp. I have ORPort somewhere above 9000. When I set it to auto, I got a late warning that the port chosen by tor was presenting problems, had I arranged port forwarding, etc.? ExtORPort is "auto" and I get no complaints (probably because obfs4 isn't working). And I have ServerTransportListenAddr obfs3 0.0.0.0:90xx because a lower port, like 80, with port forwarding, received a warning (and didn't work). One thing at a time... Like I asked, where can I look for answers to the obfs4proxy permission denied problem? If I get that fixed, I assume I can play around with the rest until I can use lower ports. Thanks, J Chase

2 1

Re: [tor-relays] Manual Relay Guide for OS X
by teor 12 Apr '15

12 Apr '15

Hi Zach, I had plans for updating the guide for OS X on the Tor wiki, but never got around to it. Thanks for making it happen! If you're interested in putting the StackExchange content on the website, the wiki link and the trac task with a sample LaunchDaemon plist for OS X are below: https://trac.torproject.org/projects/tor/wiki/doc/MacRunOnBoot https://trac.torproject.org/projects/tor/ticket/13412 > Date: Sat, 4 Apr 2015 16:36:26 -0700 > From: Zachary Alberico <fossuser(a)gmail.com> > > I ended up putting it up on stack exchange since it'll probably be > helpful there anyway. > > http://tor.stackexchange.com/questions/6567/how-do-i-manually-setup-a-relay… > > Thanks, > Zach > > On Fri, Apr 3, 2015 at 8:47 PM, Zachary Alberico <fossuser(a)gmail.com> wrote: >> Hi Tor-Relays, >> >> I wrote the following documentation after figuring out how to get my >> Tor relay working with a manual install. The goal is to give easy to >> follow and concise instructions that explain just enough to understand >> what you're doing. >> >> I'm trying to find out the best way to make this available - would it >> be possible to add it to the externally facing documentation? I'd >> also really appreciate it if someone looks it over and sees if I made >> any typos/forgot something. >> >> I can help with whatever needs to be done. >> >> Thanks, >> Zach >> >> ### >> Manually configuring a Tor Relay on OS X (Yosemite, Tor 0.2.5.11) >> >> This guide walks you through the process of configuring your very own >> tor relay explaining each step along the way. >> >> First install homebrew which will allow us to install the most recent >> version of Tor (http://brew.sh) >> The following command pasted into a terminal will download and install homebrew. >> {code} >> ruby -e "$(curl -fsSL >> https://raw.githubusercontent.com/Homebrew/install/master/install)" >> {code} >> >> Once that completes we'll use homebrew to install tor with the >> following command. >> {code} >> brew install tor >> {code} >> >> At this point tor should be installed and the homebrew command should >> have printed the following: >> {quote} >> You will find a sample `torrc` file in /usr/local/etc/tor. >> It is advisable to edit the sample `torrc` to suit your own security needs: >> https://www.torproject.org/docs/faq#torrc >> After editing the `torrc` you need to restart tor. >> >> To have launchd start tor at login: >> ln -svn /usr/local/opt/tor/*.plist ~/Library/LaunchAgents >> Then to load tor now: >> launchctl load ~/Library/LaunchAgents/homebrew.mxcl.tor.plist >> {quote} >> >> Notice that it mentions the location of the torrc file (we're going to >> edit that next). It also explains how to have tor run at startup and >> how to start it now. Before we go ahead and run those commands let's >> create the location logging is supposed to go since for some reason it >> doesn't already exist. >> These commands are creating directories. >> {code} >> mkdir /usr/local/Cellar/tor/0.2.5.11/var >> mkdir /usr/local/Cellar/tor/0.2.5.11/var/log >> mkdir /usr/local/Cellar/tor/0.2.5.11/var/log/tor >> {code} >> >> Similarly create the following for the DataDirectory if it doesn't >> already exist. >> {code} >> mkdir /usr/local/Cellar/tor/0.2.5.11/var/lib >> mkdir /usr/local/Cellar/tor/0.2.5.11/var/lib/tor >> {code} >> >> Next let's edit the torrc.sample file and save it as torrc. >> To open its location in a finder window use the following command: >> {code} >> open /usr/local/etc/tor >> {code} >> Then open the torrc.sample file in your chosen editor (text edit works fine). >> >> Read through the file and try to understand what each of the options >> are, at a minimum we're going to want to uncomment and use the >> following options. >> {code} >> #Sets the logging location >> Log notice file /usr/local/Cellar/tor/0.2.5.11/var/log/tor/notices.log >> >> #Sets the DataDirectory >> DataDirectory /usr/local/Cellar/tor/0.2.5.11/var/lib/tor >> >> #If you're only configuring this as a relay >> SocksPort 0 >> >> #Your main ORPort >> ORPort 9001 >> >> #Name of your relay >> Nickname supercoolrelay >> >> #Bandwidth limits >> RelayBandwidthRate 5000 KB >> RelayBandwidthBurst 10000 KB >> >> #Way for the tor project to conact you >> ContactInfo Random Person <a special email you should make just for >> this>@gmail.com >> >> #What port to advertise for directory connections >> DirPort 9030 >> >> #If you don't want to run an exit (if you're able to run an exit >> please use the file default!) >> ExitPolicy reject *:* # no exits allowed >> {code} >> >> Once you've uncommented/edited those lines save the file as torrc and exit. >> >> Now it's time for an oversimplified and possibly inaccurate lesson >> about Networking. >> You are probably sitting at a home network at a computer connected >> wirelessly or wired to a router which is connected to a modem which is >> connecting you to the outside Internet. >> >> Your entire network connection has one IPv4 address facing the outside >> world. Your router then uses NAT which stands for Network Address >> Translation to remap traffic to the unique IP addresses you have per >> device on your local intranet. When we configure 'port forwarding' >> we're telling your router to take the ports we need on your computer's >> local IP behind the router and forward them to the ports exposed to >> the real internet as part of this NAT process. In this case this >> allows the tor relay we've configured to receive incoming connections >> on the port we've specified. Unfortunately this process is different >> for every router, but in order to provide an example I'll show what >> the changes look like for an Apple Airport Extreme and hopefully >> you'll be able to translate them to your own router's settings. First >> though we need to know your computer's local IP. >> >> Open System Preferences >> Click Network >> Click Advanced >> Click TCP/IP >> In this window you should see "IPv4 Address: XX.X.X.X" >> >> That's the address we need. >> >> Next open Airport Utilty (this is to configure port forwarding on an >> Apple Airport Extreme router) >> Click on the Airport Extreme >> Click Edit on the tooltip that pops up >> Click Network >> Notice the Port Settings Box, Click + >> Add the following settings: >> Description: Tor Ports >> Public UDP Ports: 9001, 9030 >> Public TCP Ports: 9001, 9030 >> Private IP Address: XX.X.X.X (this is the IP we found in Network) >> Priave UDP Ports: 9001, 9030 >> Public TCP Ports: 9001, 9030 >> Click Save >> Click Update (note the router will reboot) >> >> Note: This example shows the default ports we configured in our torrc, >> if you need to or decide to use different ports you'd have to >> configure the forwarding differently. I think only the TCP settings >> matter here, but I ended up setting both while trying to get this to >> work. >> >> Now we can set tor to launch on startup as well as start it right now >> with these two commands. >> {code} >> ln -svn /usr/local/opt/tor/*.plist ~/Library/LaunchAgents >> launchctl load ~/Library/LaunchAgents/homebrew.mxcl.tor.plist >> {code} >> >> Note: If you make changes to torrc in the future you need to restart >> tor. You can restart tor with the following command. >> {code} >> pkill -sighup tor >> {code} >> >> Now let's check out the logs and verify things are working. This >> command will show the end of the log and any new lines as they appear. >> {code} >> tail -f /usr/local/Cellar/tor/0.2.5.11/var/log/tor/notices.log >> {code} >> >> In a few mintues you should see the following lines if things are working: >> 19:29:38 [NOTICE] Self-testing indicates your ORPort is reachable from >> the outside. Excellent. Publishing server descriptor. >> 19:29:36 [NOTICE] Self-testing indicates your DirPort is reachable >> from the outside. Excellent. >> >> If you see something like the following it's irrelevant: >> Apr 02 22:33:02.000 [notice] Have tried resolving or connecting to >> address '[scrubbed]' at 3 different places. Giving up. >> >> And if you see this it's not working (the X's here represent your >> public internet facing IPv4): >> Apr 03 17:10:41.000 [warn] Your server (XX.XXX.XXX.XXX:9001) has not >> managed to confirm that its ORPort is reachable. Please check your >> firewalls, ports, address, /etc/hosts file, etc. >> Apr 03 17:10:41.000 [warn] Your server (XX.XXX.XXX.XXX:9030) has not >> managed to confirm that its DirPort is reachable. Please check your >> firewalls, ports, address, /etc/hosts file, etc. >> >> If you're still having trouble try hopping on IRC. >> ### teor teor2345 at gmail dot com pgp 0xABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR C3C57B23 349825DE 929A1DEF C3531C25 A32287ED

1 0

help interpreting fault setting up exit
by I 12 Apr '15

12 Apr '15

3 4