- tor-relays - lists.torproject.org

Re: [tor-relays] Keeping an exit node off of blacklists due to botnet activity.
by tor＠t-3.net 05 Jun '15

05 Jun '15

> I have a fairly high bandwidth exit node running for about a month now > that I'm having difficulty keeping off of the http://cbl.abuseat.org/ > blacklist and have been informed of this listing by the VPS provider. > The relay is running with a reduced exit policy -- and additionally I've > blocked common mail ports, etc via IPFW so I know that no spam is > actually being sent out of the relay. Still, various botnets connections > are connecting to abuseat.org botnet sinkholes via port 80 > Command&Control connection attempts. I'm at a loss at how to stop this > or somehow detect and filter botnet traffic. > > I've informed the VPS provider that I'm on top of it and have the > machine configured to not actually allow this sort of malicious traffic > out and they seem to be generally happy with that explanation, but a > better solution if one exists would be appreciated. > > Thanks, > > Julian Plamann > > julian (at) amity.be > GPG: 0x96881D83 Don't know if this will help, but maybe: ExitPolicy reject 85.159.211.119 # Cryptolocker ExitPolicy reject 212.71.250.4 # Cryptolocker ExitPolicy reject 54.83.43.69 # Cryptolocker ExitPolicy reject 192.42.116.41 # Cryptolocker ExitPolicy reject 192.42.119.41 # Cryptolocker ExitPolicy reject 198.98.103.253 # Cryptolocker ExitPolicy reject 208.64.121.161 # Cryptolocker ExitPolicy reject 142.0.36.234 # Cryptolocker ExitPolicy reject 173.193.197.194 # Cryptolocker In general, I see complaints about abuse from the exit relays we run due to someone using Tor to try to exploit remote web server scripts and databases and the like. I don't think there's anything that can be done about it? I would say that it's just part of what you get coming out out of Tor exit nodes. If anyone else has any better advice feel free to correct me but, I think it might be accurate to explain to the upstream that Tor exits will generate certain kinds of abuse complaints as part of normal operation. They open proxy web-related ports out, and some people abuse Tor for web hacking types of activity. I would say that it is normal for Tor exits to live permanently on certain kinds of blacklists. They do not need to be on the spam email related ones (reject *:25 and other email ports), but they will land on other types of blacklists, and I don't think it can be helped.

1 0

Re: [tor-relays] Updating tor to get fix for #15083? (Elliott Jin)
by AlexK (Tor lists) 05 Jun '15

05 Jun '15

tor-relays-request(a)lists.torproject.org schreef op 05/06/15 om 14:00: > Updating tor to get fix for #15083? (Elliott Jin) > > - Is Tor 0.2.5.10 (git-43a5f3d91e726291) actually the newest stable > version, or did I mess something up when trying to update tor? > - Would it be a good idea to upgrade to an experimental version? Assuming you're running 'standalone' on *Nix, this is a good place to check: https://www.torproject.org/download/download-unix.html.en Here you'll find the latest source (stable/unstable) and the latest packages for several *Nixes, including simple install instructions. Latest and greatest is 0.2.6.8, even if you rely on your package manager's updates this is what you should have, e.g. on my relay: $rpm -qa tor tor-0.2.6.8-tor.1.rh6_6.x86_64 Good luck! Alex

1 0

How to use our own TOR relay as entry node for local network hosts
by Tor User 05 Jun '15

05 Jun '15

Hello, We have been operating a moderately successful public tor relay for a while now. Having read about how TOR works back a couple of years ago, I was more or less sold on the idea that if traffic originating on your local network uses your own TOR relay as the first hop (entry node), then by the time your traffic has left your tor relay, people in the middle can't tell the difference between traffic originating from your network and other (relayed) traffic passing through your TOR relay. I also understand that this still doesn't protect you from an exit node being able to see your traffic (and why you should use HTTPS with a high-quality cipher if it's really important), and that there are other ways your traffic can be analyzed -- but all in all, I would rather our TOR traffic enter the TOR network through a relay I *KNOW* I can trust (mine!) than leave it to chance. We have polipo running on our public TOR relay, configured to accept traffic from our local subnets. We've basically followed the info in this TOR doco: https://trac.torproject.org/projects/tor/wiki/doc/CentralizedTorServer The TOR browser bundle appears to function correctly, ie, it is able to start up, open circuits, etc. and we get the expected Congratulations! page opening a new browser window. But when clicking the green onion to show the circuit of relays handling the browser's connection, our relay is never the first hop. I'm using TBB 5.01a on one particular system, and for an example, it shows this for the circuit: - This browser - Austria (aa.bb.cc.dd) - Germany (ee.ff.gg.hh) - Guatemala (ii.jj.kk.ll) - Internet I have tried defining an EntryNodes statement with the $fingerprint of our TOR relay and setting StrictNodes 1 in the TBB's torrc file, but it can't ever establish a circuit when I try this. We get messages like this logged on the browser's tor: 05/20/2015 04:21:20.700 [WARN] Failed to find node for hop 0 of our path. Discarding this circuit. 05/20/2015 04:21:20.700 [WARN] Failed to find node for hop 0 of our path. Discarding this circuit. 05/20/2015 04:21:20.900 [NOTICE] Closing no-longer-configured Socks listener on 127.0.0.1:9150 05/20/2015 04:21:20.900 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 05/20/2015 04:21:20.900 [NOTICE] Closing old Socks listener on 127.0.0.1:9150 05/20/2015 04:21:21.700 [NOTICE] Delaying directory fetches: DisableNetwork is set. Is it possible to define your desired entry node via IP address and port, or some other way that does not require a successful directory connection/circuit first? (so it can find the relay by its fingerprint)? It seems like a chicken vs. egg problem... Or what about defining a directory for the client to use by its IP/port? We are operating a public directory as well. I can't find any info about this or other approaches anywhere. So I always end up removing the EntryNodes and StrictNodes statement from TBB's torrc file, leaving only the HTTPSProxy aa.bb.cc.dd:<polipo-listen-port> statement in there with the DataDirectory, GeoIPFile, and GeoIPv6File statements. It gets the TBB's on our network to the local polipo proxy, which in turn forwards the traffic to our public TOR relay. TBB works fine, but I don't think our TOR relay is the one getting to see our traffic with the original source address with this setup. It is definitely possible, likely even, that I am misunderstanding parts of how this is supposed to work or how a central TOR relay/proxy is supposed to be configured. But it doesn't seem to me that proxying our local network's TBB clients' traffic through the polipo instance on our public TOR relay means that our TOR traffic is being "anonymized" as to where it originated from before it gets to the first node in the circuit - or we would be seeing our TOR relay as the first hop when we look at the circuit in "the green onion button". If I'm wrong about this, that's great - I'd love to see some documentation to explain it better if you have any links handy. But if I'm right, how can I configure our TBB clients to actually MAKE them use our TOR proxy as their entry node? Thanks, Tor User

3 5

Relay traffic triggering snort ftp rules
by Paul Pearce 05 Jun '15

05 Jun '15

Hey everyone, I've encountered tor relay traffic over port 21 is triggering some (overly aggressive?) snort rules. Our ISP recently sent us a slew of snort warnings that were triggered by our obfsproxies creating circuits with tor relays that run on port 21 (I've confirmed this). The warnings are of the form: ftp_pp: Telnet command on FTP command channel [**] [Classification: Generic Protocol Command Decode] [Priority: 3] ftp_pp: FTP response length overflow [**] [Classification: Attempted User Privilege Gain] [Priority: 1] {TCP} ftp_pp: Evasive Telnet command on FTP command channel [**] [Classification: Potentially Bad Traffic] [Priority: 2] (Lawl.) They described the quantity as "overwhelming." I have no idea if this rule is enabled by default or configurable in some way. I am not familiar with snort. Has anyone ever encountered this before? If encrypted relay traffic to port 21 does indeed trigger these widely distributed warnings, it might be a good idea for "best practices" to suggest avoiding relays on this port. Thanks.

1 0

non exit relay shows up as exit in arm connections
by Maximilian Kaul 04 Jun '15

04 Jun '15

Hi, I just set up my first relay and as I'm living in Germany it needs to be a non exit relay :-( However in arm -> connections it shows up as "exit" in the last column. >From my configuration /etc/tor/torrc ExitPolicy reject *:* This is also confirmed by the head row of arm which contains the entry exit policy: reject *:* So the only thing that confuses me is the arm connections view. Is this a bug or do I simply misunderstand the tool? I googled for this but I only found another unanswered question. The relays fingerprint is 1FF50B543DC87A6F0D1F3B44BDCCAF39B07C91AC And globe.torproject.org says that it is not a exit relay but the information there is old (I changed the ORPort and DirPort listing several hours ago). Sorry for the noise but I really want to be sure. Thanks

3 4

Keeping an exit node off of blacklists due to botnet activity.
by Julian Plamann 04 Jun '15

04 Jun '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I have a fairly high bandwidth exit node running for about a month now that I'm having difficulty keeping off of the http://cbl.abuseat.org/ blacklist and have been informed of this listing by the VPS provider. The relay is running with a reduced exit policy -- and additionally I've blocked common mail ports, etc via IPFW so I know that no spam is actually being sent out of the relay. Still, various botnets connections are connecting to abuseat.org botnet sinkholes via port 80 Command&Control connection attempts. I'm at a loss at how to stop this or somehow detect and filter botnet traffic. I've informed the VPS provider that I'm on top of it and have the machine configured to not actually allow this sort of malicious traffic out and they seem to be generally happy with that explanation, but a better solution if one exists would be appreciated. Thanks, Julian Plamann julian (at) amity.be GPG: 0x96881D83 -----BEGIN PGP SIGNATURE----- Version: Mailvelope v0.13.1 Comment: https://www.mailvelope.com wsFcBAEBCAAQBQJVcKatCRB9wOTqlogdgwAAgdYP/268o2gs1nSKVcNKQfJR gnKQyBsduy2DZCGlSCnEmj4JJ0E9jiOsh+aBrZBknnbbwYPtwMBuctHTblXD czQAy5DxMNUE+E9wofLQJHLUe3W43hueKGuKzVjBnnSgxKhsUS+7dH1q4dLt KHzYdxUqQQYmmX4P9uY43/6tWeratdUF7w93cevatRpDbULMTb0j09+aeUyE MfU2i3KK6CZXIij6oo2pndwrglHywcasFwXpmEN058SYrHlB/4QDQBl7xgyU eELb71jxmz+vwZOyfEyj10ffwVtT/TcYKi5wOT1viDqQV9orNmlu8UOvu3xE 47zsb8M1Bt8JU19AsKmJNVS3YLH+2J5ertyi2mFM2PpSRIAQ6NzGA/zd/+Qr MJ7pilIBpozauf/iqiZH3UFDU5UUSezqR62fSkUDuTNaSIV5Inz0gWJnqK8w ZUMLM5xovCvWg/SqrZo0Qbry2AxOZ/l5zyhW4Jn2uioOoP+Z763FP04LcRm9 gVqfvVDNHyaAvdgKR8PSPXi2PrnNb0uEKDZLea76deWN8f2DBgfqp5hRAUOf Mk2BD9Fk30F1RC0QH0DLm/hsgTnxDEyq+XDtD6LJiGkfiHtwPkye6pH+Qf3K ZuonkypZqdfccY68lb2hMkLW7N/hsOf4hjUVQri/TL8V6eUMoEw0OAZLzhtZ gv2S =HitE -----END PGP SIGNATURE-----

1 0

amount of unmeasured relays continuously rising since 2 weeks
by nusenu 03 Jun '15

03 Jun '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Dear Tor BW Authories, we'd like to bring the following issue to your attention. Since the last two weeks the amount of unmeasured relays is steadily rising [1]. unmeasured relays on 2015-05-01: 387 unmeasured relays today: 1087 (and growing) Graph showing the last 5 months: https://trac.torproject.org/projects/tor/attachment/ticket/13450/unmeasured… Data: https://trac.torproject.org/projects/tor/attachment/ticket/13450/2015-01-01… Would be great if you had some time to look into this: https://trac.torproject.org/projects/tor/ticket/13450 (follow ups should probably go to trac) ..so bw doesn't go wasted. A contributed but unused relay doesn't make relay ops happy. thanks! [1] https://lists.torproject.org/pipermail/tor-relays/2015-May/006946.html -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVVP8PAAoJEFv7XvVCELh03bwP/1NQi99IweePw+o/Mj4nWieE yRLDmTt2J8IeJXp8tMQPcqJIZSEzSOW7u7J9o7McNR+n2lm2Mx9x9IMKQPCX6CFh /v5JJ2/aZyfu7JnkTLr7sNKw6DqkAODnKHbyALuc20zsc1oQmu56VZpY6orwC3RG n4qhbXxyD7+TXCv5iZF5CZsnlrVojHevK6tKkivOem/qMVSwshFHCUSnYVi/YK+R CcLIGllT5fx8msYEWDnnTdIBi9PoIl2gO7SE4Y3TKEpkFhGeU8FEsGmIV9LQi8O1 XcaIeU2BVup4PJMDBSgtB9BlSuKGQAq1ICiVx3OnVUVPleTYsFATFUQxW83irfu9 o8Q3ns3srj3tmtLHE0LA9c2gCuE4NiWA++t72sCc+tiqCy9+X4f5BKsqsem7bT5o 89PfZijjuR4ZI3531e+PCjZDokNY9Gx7lCjIlnrGDeGKSIPqPz9N53bYYIXB+d4r uKDeRaRjv3iz/yKjXFYSra3p70HcQmx+CM4aws035LSCTLg/zFyARXb+hf8/NeKn JzXaVoURRiRX3gzeyiznQ7EVNXTyQmr1ppGJVZAXhtfAuiCrqS5JsPJ8BTzxcylI hZBkcwyQzkV3cCeBFMABQFy3AtQ2SZSOuLzS1vyH1oAHPPWd5K1bgHcSMvOqIEPh LspnH0QSv8ICnU1uhbTZ =rNB9 -----END PGP SIGNATURE-----

14 33

Updated: Running Tor When OS X Boots
by teor 02 Jun '15

02 Jun '15

I've recently updated the OS X launchd instructions for OS X Yosemite: https://trac.torproject.org/projects/tor/wiki/doc/MacRunOnBoot <https://trac.torproject.org/projects/tor/wiki/doc/MacRunOnBoot> They were starting to show their age - they were originally written in 2011, and were based on Vidalia, tor 0.2.2, and OS X 10.6 or 10.7. If you're running Tor on OS X, please try these instructions, fix any mistakes, and add missing steps. In particular, we've moved away from Vidalia to nyx (arm), so the nyx sections could do with some more detail. teor teor2345 at gmail dot com pgp 0xABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR D5BE4EC2 255D7585 F3874930 DB130265 7C9EBBC7

1 0

Re: [tor-relays] Improving Node Connection Testing
by teor 02 Jun '15

02 Jun '15

> > Date: Tue, 02 Jun 2015 11:58:25 -0400 > From: 12xBTM <12xbtm(a)gmail.com> > > This is a little write-up on the quality of data connections involving > nodes, and some thoughts on that. So, as of today, the quality of nodes > is determined by their bandwidth, uptime, and not being malicious. There > are two major missing factors from this, and I wanted to bounce some > ideas around: Latency and Packet Loss. These are fairly simple tests > that can be performed on nodes, albeit, it would increase the resource > load on the bwauths. However, nodes with high latency or packet loss > should be identified, and nodes should be measured with these two > important factors. > > High latency will increase the delay of the circuit, but will not appear > in the consesus at all. A node can have enormous latency and hamper that > circuit without anyone knowing. The same could be said for a node that > drops a lot of packets, or drops a lot of packets at a certain time of > day (peak usage). Do the bwauths only measure the time to transmit the data, or do they include the time to connect as well? Including the time to connect would be a measure of latency, particularly for smaller file transfers. Are the bwauths only using one size of file transfer to measure bandwidth? Using a small and large size would allow measurement of mostly-latency and mostly-throughput with the current infrastructure. Since, as far as I know, Tor connections are in-order delivery, dropping packets will cause retransmits, and back up (parts of) the transmission. This will reduce the bandwidth as a side-effect. This reduction in bandwidth is currently measured by the bwauths - but, as you say, it isn't a direct measurement. In future, it would be great to have separate statistics for latency and packet loss - but this is perhaps a job for something more like Ooniprobe? teor teor2345 at gmail dot com pgp 0xABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR D5BE4EC2 255D7585 F3874930 DB130265 7C9EBBC7

3 2

IPv6 slows BW?
by torelay 02 Jun '15

02 Jun '15

I have two relays that I set up last night to test. They're at the same datacenter, same spec server, and configured identically. The only difference is one is set up for IPv6 and the other isn't. With IPv6 BW is at: 75kB/s Without IPv6 BW is: 110kB/s Is this normal behavior or has anyone else experienced this loss of bandwidth? -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

2 1