- tor-relays - lists.torproject.org

[Fwd: Re: a line "enable IPv6 on your relay"]
by tor-server-creator＠use.startmail.com 25 May '15

25 May '15

sorry, i confused something. "relay should show in the consensus as an "a" line." does not mean a "a" is required in torrc. i got confued cause of the headline "1.1 Ordinary relays" stupid me, pardon -------------------------- Original-Nachricht -------------------------- Betreff: Re: [tor-relays] a line "enable IPv6 on your relay" Von: yl <tor(a)yl.ms> Datum: Sonntag, 24. Mai 2015 19:54 An: tor-relays(a)lists.torproject.org Am 24.05.2015 um 19:25 schrieb tor-server-creator(a)use.startmail.com: > shouldnt there be a "a" in the first line? how important ist the > letter > a? i guess some operators just added the lines without "a" like > above. > additional: how many ipv6 relays are up NOW? and are there plans to > include a button into torbrowser to enable/disable ipv6? Not sure where the a should be put, so maybe someone can just past a sample config with the IPv6 enabled, I think from that we can substitute easily. One question also, is this for relay servers or ONLY for exit enabled servers? yl _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 1

a line "enable IPv6 on your relay"
by tor-server-creator＠use.startmail.com 24 May '15

24 May '15

hi, about that following lines in the mail from Moritz Bartl. [tor-relays] Please enable IPv6 on your relay! > In short, you add: > ORPort [IPv6::address]:port > IPv6Exit 1 > ExitPolicy reject6 *:* shouldnt there be a "a" in the first line? how important ist the letter a? i guess some operators just added the lines without "a" like above. additional: how many ipv6 relays are up NOW? and are there plans to include a button into torbrowser to enable/disable ipv6? thanks

2 1

Complaint being on a tor dnsbl..
by 0x23 23 May '15

23 May '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hey guys, Today I got a complaint from my vServer hoster that has received an abuse email The company who accused the usage of my system is called sectoor http://www.sectoor.de/tor Here's the abuse message: More Information About Sectoor Listing on the Sectoor TOR DNSBL indicates that this IP address is a tor node or a subnet (/24) containing a tor node. This listing *does not* indicate that your IP address has been blacklisted by Sectoor, as this list also contains subnets that contain a tor node. The subnet listing is not designed to block connections, but rather for use as a scoring mechanism. Your IP will only be blacklisted if it is the tor node itself and listed by Sectoor Exitnodes. Sectoor TOR DNSBL lists every IP address which is known to run a tor server and allow their clients to connect to one of the following ports: * Port 25 * Port 194 * Port 465 * Port 587 * Port 994 * Port 6657 * Ports 6660-6670 * Port 6697 * Ports 7000-7005 * Port 7070 * Ports 8000-8004 * Port 9000 * Port 9001 * Port 9998 * Port 9999 More information about SECTOOR can be found at their website: http://www.sectoor.de/tor.php *Reason for listing - **TOR Server Network detected (TOR Node on ip xxxxxxxxxxx) - see http://www.sectoor.de/tor.php for more information.* What would you reply on that accusation? I tried to convey that this isn't true and that this company only tries to alienate me as a customer cause there also running vServer offers. For now I reject using these ports..:-( Regards - -- -----BEGIN PGP SIGNATURE----- Version: APG v1.1.1 iQIzBAEBCgAdBQJVYGegFhwweDIzIDxydXNoMjNAZ214Lm5ldD4ACgkQF7zsyb8G Yjgxwg//c4+j6BNmr7wzyxuH3C0T3iQMrF9gK5vfdU2nyRBSV4Hqbb8zIIc1+eQy 9XMqD+tZ0uUKtT6Q+Ket1y6zqCvX1fX4NpEMN6DWMyyRCnDa1m/AOU04PQpr6VIS TzZc93BYCv+Sw8Rdt24XyRRJ9u05vehY4fkjX4qgiGp9zZDgkpZsO06qzDa4zBXb 5oHRMlO2Q2ePYAsl53E78JUMD7+rphBdUmogGU0xpEWysBSFMGCMqQt6g5+zwqtB HABL95S85UKj1mZ3vj0kbi3/jMJYG0vL5+zqBvzUFIU5NlOrz0DFKG/O8uG8h6gA avyxzdpwtBIox/FYkNG2TWeJ00RscKJ/1u33WATwOTL0x5VkIehP9Njl7pnz4cO4 4SkpV7SSGAhqPVnVPvEcYLPBGuqZAyNV/0r0GZZUdQEC0J8+BsQgf77vr5vC4yTz P2/Fj5BVzhT2UxpNtRfFnhGu+KNmXbyiVJ17jDxNfeEl7uuDRgFCMc+Vg0fvl2LY mAOZuTwUyxbl+6Gyeob66RdSmhNERr8vGvGCv1TKvFuwry2hrQI5HFRiQpssGsHX k19Z4S999jBe8fdz4EevYMMwI1phWnT3eOoSJDc4jKkClrrYgTXqU1w0riMcyPGP wMo4gHv2Ie9dBki4VC4JXDGXCqehp9dyNjKwmEp5UTzPwO45bZE= =K+EM -----END PGP SIGNATURE-----

3 2

Auto-detect and enable IPv6 // Re: Please enable IPv6 on your relay!
by Roman Mamedov 22 May '15

22 May '15

Hello, > We still have a depressingly low number of relays that support IPv6 > (currently only ~120 of ~1900 relays). If your host supports IPv6, > please enable it, especially if you run an exit! This has to be done > explicitly. If you (supposedly) care so much, then can you please make it automatic? There is no need to explicitly put the ____IPv4____ address into the torrc. And there is no need to explicitly put the IPv6 address into the config file of virtually any other IPv4+IPv6 supporting software I can think of: web, mail, NTP, XMPP servers, those are all capable of automatically figuring out which IPs the host has. Can't think of any reason of why this has to be otherwise in Tor, aside from perhaps a certain lack of understanding of best IPv6 implementation practices from the Tor developers side and/or nobody simply giving much thought to this yet. I currently run 15 Tor relays, 14 of those IIRC are IPv6 capable. But since you did not bother to make enabling IPv6 in Tor anywhere near user-friendly [1], I am simply not going to bother pecking the IPs into each torrc individually. [ One of the practical reasons being that I sometimes need to migrate the Tor 'identity' (torrc + /var/lib/tor/*) between machines and providers with v4/v6 addresses obviously changing. ] Aside from migrations between providers, the requirement to specify the IP is also impractical in many other situations, e.g. my ISP at home provides only a __dynamic__ IPv6 subnet which changes to a different one with each new PPPoE session. [1] Ideally there should be no 'enabling' at all!!! IPv6 should be active by default, IF the relay has determined it is able to make a successful IPv6 connection with a dir-authority -- oh and also that's how you can discover the actual working IPv6 address to use; or at least with a simple "IPv6Relay 1, but certainly with no requirement of specifying the IP address in the config file. -- With respect, Roman

2 2

Leaseweb exit relay notice
by blaatenator 21 May '15

21 May '15

Hi all, FYI: Yesterday I got the notice below from Leaseweb. I picked them because Leaseweb is mentioned in the Good/Bad ISP <https://trac.torproject.org/projects/tor/wiki/doc/GoodBadISPs> post. Apparently a blacklist named SECTOOR added a whole IP block of Leaseweb to block my Exit relay. Since this list is used by some bigger corporations, it got some other customers in trouble and they asked me to restrict the mentioned ports. I understand the reasoning and can't blame them for asking my I guess (and since most relevant ports are not mentioned I guess it is not too bad), but I found it a bit weird that a whole subnet is being listed. On 05/20/2015 03:20 PM, Lesley Koomen wrote:> Dear sir, madam, > > It appears you are hosting a TOR node on your LeaseWeb IP address. > This has resulted in the block of a (part) LeaseWeb IP subnet. (/24) > As the subnet is added on the SECTOOR blacklist > (http://www.sectoor.de/tor.php) this is affecting customers in the same > range as yourself. > > The SECTOOR blacklist is e.g. implemented by Hotmail, Live and Gmail. > This results in other customers not being able to longer use the mail > services of these companies. > Sectoor TOR DNSBL lists every IP address which is known to run a tor > server and allow their clients to connect to one of the following ports: > > * Port 25 > * Port 194 > * Port 465 > * Port 587 > * Port 994 > * Port 6657 > * Ports 6660-6670 > * Port 6697 > * Ports 7000-7005 > * Port 7070 > * Ports 8000-8004 > * Port 9000 > * Port 9001 > * Port 9998 > * Port 9999 > > > Therefore, we kindly, yet urgently ask you to disable the connection to > the mentioned ports within 24 hours. Failure to comply and respond > (confirm) to this warning, will result in a block of your involved IP > address(es). > > Thank you for your co-operation and understanding. > > > > Kind regards, > > Lesley Koomen > Team Manager Abuse Prevention

8 10

HOWTO: deliver tor-exit-notice_DE.html over ipv6 port 80 too
by Toralf Förster 21 May '15

21 May '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 B/c ipv6 of Tor implements currently no DirPort I copied+pasted together the following solution to deliver a Tor exit notice over HTTP port of ipv6 too : The python snippet runs under a non-privileged user w/o login shell : $ cat ipv6-httpd.py import socket from BaseHTTPServer import HTTPServer from SimpleHTTPServer import SimpleHTTPRequestHandler class MyHandler(SimpleHTTPRequestHandler): def do_GET(self): return SimpleHTTPRequestHandler.do_GET(self) class HTTPServerV6(HTTPServer): address_family = socket.AF_INET6 def main(): server = HTTPServerV6(('::', 8181), MyHandler) server.serve_forever() if __name__ == '__main__': main() The ip6table rules to redirect fort 80 from outside to the local non-privileged port : from=80 to=8181 $IPT -t nat -A PREROUTING -i enp3s0 -p tcp -m tcp --destination-port $from -j REDIRECT --to-ports $to $IPT -A INPUT -p tcp -m tcp --destination-port $to -j ACCEPT And finally the script to start it during boot : $> cat /home/simplehttp/ipv6-httpd.sh #!/bin/sh # d=$(mktemp -d /tmp/XXXXXX) &&\ cd $d &&\ cp /etc/tor/tor-exit-notice_DE.html ./index.html &&\ nice python ~/ipv6-httpd.py 1>./log 2>&1 :-) - -- Toralf pgp key: 7B1A 07F4 EC82 0F90 D4C2 8936 872A E508 0076 E94E -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAlVeC48ACgkQxOrN3gB26U59HwD8CwnBIpZOkq8tN01ciWsZQh7c FO42AGmkkhCI/CbucnYA/j3zSq1wJzuHgMdWZUbQCQvHt+KEYkobdNkcHqkK3mWE =FA7E -----END PGP SIGNATURE-----

1 1

[warn] Tried to establish rendezvous on non-OR or non-edge circuit.
by Cmar433 21 May '15

21 May '15

Hi people .. i yesterday started IPV6 but now i see in log following messages periodically part of my torrc below. I only add ipv6 lines. Any idea ? or its normal ? Thanks Cmar ORPort 37.157.192.208:443 ORPort [2a02:2b88:2:1::3a62:1]:9050 ## If you want to listen on a port other than the one advertised in ## ORPort (e.g. to advertise 443 but bind to 9090), you can do it as ## follows. You'll need to do ipchains or other port forwarding ## yourself to make this work. #ORPort 443 NoListen #ORPort 127.0.0.1:9090 NoAdvertise ## The IP address or full DNS name for incoming connections to your ## relay. Leave commented out and Tor will guess. Address 37.157.192.208 ## If you have multiple network interfaces, you can specify one for ## outgoing traffic to use. OutboundBindAddress 37.157.192.208 info from log: May 19 22:42:03.000 [notice] Average packaged cell fullness: 99.082% May 19 22:42:03.000 [notice] TLS write overhead: 3% May 19 22:42:03.000 [notice] Circuit handshake stats since last time: 118791/118793 TAP, 161141/161141 NTor. May 19 23:13:45.000 [warn] Tried to establish rendezvous on non-OR or non-edge circuit. May 20 03:08:03.000 [warn] Tried to establish rendezvous on non-OR or non-edge circuit. May 20 03:33:54.000 [warn] Tried to establish rendezvous on non-OR or non-edge circuit. May 20 04:42:03.000 [notice] Heartbeat: Tor's uptime is 18:00 hours, with 4375 circuits open. I've sent 211.07 GB and received 203.24 GB.

3 2

BWauth kookiness
by starlight.2015q2＠binnacle.cx 20 May '15

20 May '15

Some possible fallout related to the earlier discussion [tor-relays] amount of unmeasured relays continuously rising since 2 weeks https://lists.torproject.org/pipermail/tor-relays/2015-May/007003.html My relay Binnacle 4F0DB7E687FC7C0AE55C8F243DA8B0EB27FBF1F2 has 9375 Kbyte (75 Mbit) of unfuzzy (no ISP traffic shaping) bandwidth, but in the last few days the BWAuths' opinion went from # gabelmoo # tor26 # moria1 # longclaw bw1-w Bandwidth=7382 Measured=7100 *bw2-w Bandwidth=7382 Measured=9330 bw3-w Bandwidth=7382 Measured=13700 GuardFraction=69 bw4-w Bandwidth=7382 Measured=23700 to bw1-w Bandwidth=9375 Measured=17100 bw3-w Bandwidth=9375 Measured=77900 GuardFraction=75 *bw4-w Bandwidth=9375 Measured=23000 * selected for consensus While it's flattering to be promoted to double the actual capacity, with the potential to go 8x, I suspect it's may not a great idea in the grand scheme of things. And to think at one time I was feeling short-changed. . . FYI BWauths Regards

2 2

Tor Consensus Weight Stuck at 20 (Even on Relay with "Stable" Flag)
by Neel Chauhan 19 May '15

19 May '15

Hi, I have a Tor relay (https://atlas.torproject.org/#details/342587A287603040A49BB364D72EAC0B6BC3D…) running from a FreeBSD server at my house on with a 5 megabit upstream connection. I have seen that lately, Tor's "Consensus Weight" value on this relay has not been going anywhere above (or below) 20. My relay has gotten the "Stable" flag, but yet didn't see it's consensus weight value rise. I decided to look at https://consensus-health.torproject.org/, and saw that two of the four bandwidth consensus servers, namely tor26 (86.59.21.38) and longclaw (199.254.238.52) don't seem to be calculating any consensus value for Tor relays in the last few days. Has anyone else been having this problem? And if the Tor consensus operators are reading this, (approximately) when would this problem get resolved? Thanks, Neel Chauhan

8 17

Tor relay/btc node script
by torelay 18 May '15

18 May '15

I've written my first script. It is to automate the process of setting up a tor relay/bridge (published or not) and a bitcoin full node (with hidden service url and/or clearnet ip) on a fresh debian os. The script is at https://github.com/mktx-code/relay-node. To write it I used a combination of the sky-ip tuts and random github codes for syntax and structuring. Please give me any comments criticisms. Appreciated.

2 1