- tor-relays - lists.torproject.org

are relays susceptible to the latest OpenSSL "freak" attack
by starlight.2015q1＠binnacle.cx 04 Mar '15

04 Mar '15

Cipher-downgrade CVE-2015-0204 fixed in OpenSSL 1.0.1k. usual sensational write-up courtesy of El-Reg http://theregister.co.uk/security For operators who don't obsess over "non-critical" OpenSSL releases, is it time to catch up?

2 1

7 relays gone because of spammers
by Speak Freely 03 Mar '15

03 Mar '15

Hello fellow relay runners, This morning OVH decided to kill 7 of my relays due to spamming, and block all access to all services. I ran the Reduced Exit policy for all of my relays. Due to heightened concerns about this affecting other unrelated services I have with OVH, I had to shut down the other 3 relays. They may eventually re-appear as middle-relays. This has cost me hundreds of dollars, as I foolishly decided to prepay on an annual basis. None of the servers were older than 2 months. Some were only a few weeks old. The Abuse department's rationale is as follows: "Your account was suspended because 100% of your IPs are blacklisted on multiples lists for Spam and other malicious activities. This case is closed and this decision is final." ---------------------------------------------------------------------- When I first contacted OVH regarding running Tor relays, this was the response that I received from them, which does not mesh with what just happened. "Good morning Matt, I'm very glad to here from you. It is very flattering to hear that you are very satisfied by our service at OVH! We do take our network speed and hardware performance very seriously here. We are proud of our infrastructure that we have built over the years. I do understand your concerns about setting up a Tor relay on one of our VPS. In a simple form, yes you can. We do let our customers use our VPS as Tor relays. We have no problem in letting you this. However, your are allowed to use Tor but it will be at your own risk. Rest assure that, in case of an abuse, we will not terminate your account without notice. In fact we may not even terminate your VPS. You will receive a warning from our Abuse department giving you a choice to resolve the abuse case. Like you said, we are in a world where free speech is constantly under attack and we are committed to help as much as possible to protect this fundamental right that we all have. We will absolutely not in any case share our customers information or data to authorities without a warrant. For any other questions or concerns, feel free to contact us at any time. We are available 24/7. Good luck with that privacy project of yours and keep on supporting the cause of free speech! Thank you for contacting OVH and have a wonderful day! Colin K. Customer Advocate" ---------------------------------------------------------------------- Not that it matters anymore, but each relay was dedicated to one of the victims of the Charlie Hebdo attack. https://atlas.torproject.org/#search/4charlie ---------------------------------------------------------------------- Eventually I will get back at this... But for now, my money is gone, and all my hard work is lost. ---------------------------------------------------------------------- So... I know I'm new. And it's possible this has happened (many times) before, but... You've been warned. Speak Freely

20 28

relayor: automation for relay operators (ansible)
by Nusenu 02 Mar '15

02 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, computers are better at doing repeatable things over and over again so let them take care of boring tasks. Based on David's ansible-tor [1] I created an ansible role to make relay operations more convenient (see the initial commit message for a longer list of changes). https://github.com/nusenu/relayor Core features: - - configure multipe tor instances on a server automatically generates two instances per available IP address (Memory auto detection is not implemented yet) - - take care of MyFamily automatically - - user configurable Nickname prefix - - easy Exit/Non-Exit setting (boolean) - - alpha vs. stable releases (boolean) Supported platforms: - Debian - CentOS - OpenBSD Everything is still fresh, so I would NOT recommend to use this on production relays. Testing and review is appreciated. There is still a crucial piece missing (init scripts), but I hope tor packagers are willing to incorporate multi-init support patches (see issues). I also have parts that adds monitoring (munin+vnstat+webserver) but that will go into a separate role. If you have never heard of ansible, it speaks to your servers using SSH and does not require an agent or a central management server - just run it from you client machine. http://www.ansible.com/resources (not entirely torbrowser friendly) http://docs.ansible.com If you are planing to run this role over tor when connecting to your servers, make sure you have the following set in your ~/.ansible.cfg: ssh_args = -o ControlMaster=auto -o ControlPersist=60s This ansible role is not about bridges or hidden services, but I'd like to add "management HSes" (SSH and monitoring) in the future. Nusenu [1] https://github.com/david415/ansible-tor -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJU8OdxAAoJEFv7XvVCELh0Aw0P/AiiprSbE5apWUtrCoyrO5GN MKRfwpvy/BGrKjOjBZAtIs+8+AMaRQXV54CUIG0QlewnVgWRUyXA635OIAY43hFR BY/In1IiSXcqKyjaTsM4No/Nh+tvdj2rt+MoYvrMTVQVl8i+CYQKt4ypHjRN1cGS OIdP/AWi9tt/eAl+IgUNf4/pud94UbruDfGHtDQ4xGeReNdo64Q92c2QicFOdwNc fIqrhb/aWydfgQehmjSAXM9i9WfBi5vMSh7D5lUxheqhEmjSiV1bw8mvQML+kXse nwv7AZj0MkoBYqTd0t3h1JJwPXt0Vjfi3ZZNPlOTx6gZmPfbgrezya+TrWHQy65M rw6B3E3L5UDjkJ1k3cyJWvtpUSyYCqzcUDIq6+gQxZhGH0pWQhutxqdt5C5S+qn7 9hWJcDUyjeSFwxRfhLphiSrPQEue6Eox+EWzcSh4YQh8hol/P8Ev5C4P/yavWF0m w0jGbQoVIwz0jMhZwW9w6KxmaZO68/3aEfWUXjLFg/DCp/nLXqR1kHxuiLgO/sd6 QumoOjxqu9KwV9crQX86dl9oMFFvUb7l1WqidMVZIR81WQkDIVWoypvxCnG2QhDo Z4Nily3qg3I3nW+QLTIY8XjUkVMLV/1kky9ETDb2Vvz0uR2H5tyZR6I9hQ4FaGHt Xjm7kZ9JgRZjixqyAhTz =/jyQ -----END PGP SIGNATURE-----

2 3

Re: [tor-relays] tor exit node, low bandwidth
by Volker Mink 27 Feb '15

27 Feb '15

2 1

Re: [tor-relays] tor exit node, low bandwidth
by Volker Mink 27 Feb '15

27 Feb '15

Fingerprint is E20FF09A9A800B16C1C7C16E8C0DF95F46F649B0 And its running for about 6-7 weeks now. Any ideas? ------------------------------ Message: 2 Date: Fri, 20 Feb 2015 14:16:41 +0100 From: Sebastian Urbach <sebastian(a)urbach.org> To: <tor-relays(a)lists.torproject.org> Subject: Re: [tor-relays] (no subject) Message-ID: <14ba721fef0.27ae.e04ee758f2dadc1889b5b423dda555f9(a)urbach.org> Content-Type: text/plain; charset="iso-8859-1"; format=flowed Hi, >I have these settings in my torrc-file >RelayBandwidthRate 10000 KB? # Throttle traffic to >1000KB/s (800Kbps) >RelayBandwidthBurst 20000 KB # But allow bursts up >to 2000KB/s >(1600Kbps) MaxAdvertisedBandwidth 10000 KB ? >I have a decent cable-based internet-connection at >home and want to >share lots of bandwith. ?> >Unfortunately my exit node only does about 220kb/sec ?>avg: 219.2 Kb/sec, total: 18.4 GB?????? avg: 224.7 Kb/>sec, total: 18.5 GB ?> >What do i have to change to speed this up? Thank you for running a Relay. Please provide your fingerprint if you want other people to look into this matter. -- Sincerely yours / Sinc?res salutations / M.f.G. Sebastian Urbach ----------------------------------------- Religion is fundamentally opposed to everything I hold in veneration - courage, clear thinking, honesty, fairness, and, above all, love of the truth. ----------------------------------------- Henry Louis Mencken (1880 - 1956), American journalist, essayist, magazine editor, satirist and critic. On February 20, 2015 1:36:43 PM "Volker Mink" <volker.mink(a)gmx.de> wrote: > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > ------------------------------ Message: 3 Date: Fri, 20 Feb 2015 09:25:33 -0500 From: Speak Freely <when2plus2is5(a)riseup.net> To: tor-relays(a)lists.torproject.org Subject: Re: [tor-relays] (no subject) Message-ID: <e9992411d4355c951426baf31003cd52(a)riseup.net> Content-Type: text/plain; charset=US-ASCII; format=flowed Hi! Welcome to the club! Doing some quick math based your avg speed and your total transfer, it looks like you've been running an exit relay for about a day. It takes some time to build consensus within the network, others can explain it better and in more detail.Don't worry, it takes some time for the network to give you much love, but it will! Take a look at one of my newest relays on atlas to see the ramp-up time. It's only been up for a couple of days. https://atlas.torproject.org/#details/E0FE2E053843F09480EFF75F0A27D095F96FFF 82 Here's an another relay, that shows once love starts, it stays. This one has been up for over a month... One of my first. https://atlas.torproject.org/#details/BDE26705D49CB8AC3297953BCC2070FED9C611 53 Don't forget to provide the fingerprint for others to investigate. :) Matt -- Speak Freely ***

2 1

guard-failing message
by eliaz 27 Feb '15

27 Feb '15

My bridge's log showed: Feb 24 02:25:45.940 [Warning] Your Guard < guard name and fp > is failing a very large amount of circuits. Most likely this means the Tor network is overloaded, but it could also mean an attack against you or potentially the guard itself. Success counts are 129/259. Use counts are 38/38. 242 circuits completed, 0 were unusable, 113 collapsed, and 5 timed out. For reference, your timeout cutoff is 60 seconds. Globe showed no 3-day chart for the guard. For my bridge, the chart showed a lot of traffic, the peaks or less than a KB. This pattern has been going on for a few days. The bridge usage display shows the usual traffic, but more anemic the past several days. To be on the safe side I did the following: * shut down the bridge, * reset my gateway address, * restarted the bridge after about 1/2 hour. Have I overreacted? - eliaz

1 0

Same relay (identity key) on two IPs
by catchthemall 26 Feb '15

26 Feb '15

Hi all, tl;dr: Due to a config error my relay [1] was running on two different IPs at the same time for about half a day. Now the traffic has dropped. I just wanted to make sure that it is not flagged as malicious or something ... Additionally I am curious about the policy in such a case. What happens if a relay shows up in the network with the same identity key but on different IP addresses? long-version (kinda funny): I am using webtropia [2] as a service provide which is, as far I can tell, is a good choice for running a relay. Some time ago I decided to change the hosting plan and switch to another offer at the same provider. For that reason I let my old contract run out until they notified me that my server will be shut down and deleted. After receiving this notification I checked that indeed my relay server was no longer reachable. Some time passed by until I had time to setup my old relay (same identiy key) on the new server. Done so I launched it and was happy to enjoy the increased bandwidth. What I missed was that in the meantime the old server was reactivated by the hosting provider without notifying me and as a result was running at the same time as the new one for about half a day. After I recognised this, I tried to ssh to the old server - which still worked perfectly and indeed confirmed that everything was as I left it. I shut down the relay running on the old server and wrote an e-mail to the hosting provider checking if they are going to charge me the reactivation and why the hell reactivated it. Up until now I only got an response that my old server was "shut down" and that the "hard disk was deleted on the 29.01.2015" ... .. I thought well ... since I can still ssh to that server I kinda doubt that this is the case. So since I still had ssh access to the "shut down server" I decided to setup another relay on the "deleted hard disk" of this machine until they believe me that there exists a small possibility that this thing is still running ... The "ghost" relay [2] is running fine up until now. [1] https://atlas.torproject.org/#details/5A9B5923F4937C3ED76B0AD4CF1030C11FCAF… [2] http://www.webtropia.com/index.php [3] https://atlas.torproject.org/#details/23C31DBBEB898145D6E090D6DD8C06D72E55F…

3 5

Relay Node not acquiring Guard Flag.
by Sebastian Urbach 24 Feb '15

24 Feb '15

Hi, On 02/23/2015 06:44 PM, Sebastian Urbach wrote: > Because the criterias changed a while ago, only the fastest 25% of the > Relays are Guards anymore. >BTW, what's about minimum uptime ? Details for all the flags can be found here: https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt -- Sincerely yours / Sincères salutations / M.f.G. Sebastian Urbach ----------------------------------------- Religion is fundamentally opposed to everything I hold in veneration - courage, clear thinking, honesty, fairness, and, above all, love of the truth. ----------------------------------------- Henry Louis Mencken (1880 - 1956), American journalist, essayist, magazine editor, satirist and critic.

2 1

Relay Node not acquiring Guard Flag.
by Beagle Bone 23 Feb '15

23 Feb '15

Hey folks. 3xBT here, admin of the node of the same name. I was wondering why my node has yet to pick up the Guard flag: Fingerprint: D937161730610A5D66BDED6CF4D5C9692566D9FE Feb 23 06:25:05.000 [notice] Tor 0.2.4.24 (git-e3c61213fb2dc49a) opening new log file. Feb 23 06:25:05.000 [notice] Configured to measure directory request statistics, but no GeoIP database found. Please specify a GeoIP database using the GeoIPFile option. Feb 23 06:27:22.000 [notice] Your DNS provider gave an answer for "lya67fieutqf6", which is not supposed to exist. Apparently they are hijacking DNS failures. Trying to correct for this. We've noticed 1 possibly bad addre$ Feb 23 09:57:31.000 [notice] Heartbeat: Tor's uptime is 59 days 6:02 hours, with 153 circuits open. I've sent 414.64 GB and received 394.25 GB. Feb 23 09:57:31.000 [notice] Average packaged cell fullness: 97.080% Feb 23 09:57:31.000 [notice] TLS write overhead: 3% Feb 23 09:57:31.000 [notice] Circuit handshake stats since last time: 4059/4059 TAP, 3977/3977 NTor. Feb 23 15:02:49.000 [notice] New control connection opened. Feb 23 15:57:31.000 [notice] Heartbeat: Tor's uptime is 59 days 12:02 hours, with 158 circuits open. I've sent 416.55 GB and received 396.07 GB. Feb 23 15:57:31.000 [notice] Average packaged cell fullness: 97.087% Feb 23 15:57:31.000 [notice] TLS write overhead: 3% Feb 23 15:57:31.000 [notice] Circuit handshake stats since last time: 6032/6033 TAP, 4055/4055 NTor. Feb 23 17:23:54.000 [notice] New control connection opened. Additional info: When traffic is 4Mbit/sec, CPU and memory load is at ~50%. I'm also wondering why the log is only being written when I'm looking at it, and if there was anything I could do to increase usage of allotted bandwidth. -3xBT

3 2

drop in bandwith - because of fail2ban rule?
by tor＠viisauksena.de 23 Feb '15

23 Feb '15

hi i am wondering , because i constantly becoming less and less traffic / or given Bandwidth for a Tor exit relay with a bunch of flags .. the exit is on a debian, vserver with quit a lot of machine power behind, has it own IPv4 and there is also enough bandwidth (i checked this regulary with speedtests or fake downloads of whatever distros) https://atlas.torproject.org/#details/2AC2306BD625A9DD75532886842C268C3CDBB… i didnt change anything in configuration, beside one small thing after getting dozens of apache errorcode 504 port 80 and 443 to the Tor-IPv4.. and so i startet to make a fail2ban rule, because this doesnt make sense, also this comes often from a variety aof IPv4 en block from russia, china, korea (mostly) - so i optet for fail2ban more than ignoring these errors. This is the only thing i could imagine which connects to the network drop (ok some internet police whitehat watchers argue there is bad traffic here and than .. but this is "normal" i guessed for tor-exit) So i turned my rule of some 2-3 days, to see if this makes the drop in bandwidth - no effect. So i restartet back the fail2ban rule. So my question - tor hides in port 80 / 443 traffic - is this what i mistakingly block / or interfere .. or how this drop from near 14 Mb to 1,9 Mb is explainable? (while normal traffic on server goes well) thx, viisauksena (for completeness example of logoutput and fail2ban-regex ) # basicly i want to stop these lines # default-178_254_XXXXXX:443 104.245.96.249 - - [10/Feb/2015:16:52:07 +0100] "GET /" 400 549 "-" "-" [Definition] failregex = [^ ]+ <HOST>.*"GET /" 400 5[0-9][0-9]

1 0