- tor-relays - lists.torproject.org

Re: [tor-relays] Reminder: don't run transparent proxies at exits
by teor 12 Jan '15

12 Jan '15

> Date: Mon, 12 Jan 2015 01:04:58 -0500 > From: grarpamp <grarpamp(a)gmail.com> > To: tor-relays(a)lists.torproject.org > >>> On Fri, Jan 9, 2015 at 10:26 PM, Drake Wilson <drake(a)dasyatidae.net> wrote: >>> eric gisse wrote: >>> Plus the logic starts to get warped when you wonder "So do you BadExit >>> every node that runs on an ISP that caches traffic?" >>> <snip> > > As far as http caching, it would be relatively fine IF the cache > truly did good practice, and IF the site truly did good design > for the cache to follow. However those two necessary truths > are often false, whether by AND or XOR context. So to be > true, a cache shouldn't be deployed, but in the interest of > bandwidth they are, more commonly at small end-tier user > access ISPs (including exits) for that purpose. > > I'd suggest best practice is for > - users to use https to bypass > - caches to insert their tagline in http headers so > users can bitch to the owner. > - Tor exits? Well, they're volunteer paid diversity, so which is > more valuable to you? The IF's above, or TCP truth at > potential cost to diversity? > > I prefer TCP truth, but if I was a constrained operator > I'd do my best research into setting up a quality cache. > Provided caching images of ill repute on disk were not > an overriding concern. > <snip> I can imagine two strategies to avoid caching images on-disk: 1. Use an in-memory cache 2. Don't cache images While these strategies might not technically/legally offer much more protection (IANAL): 1. If the cache disappears as soon as the machine shuts down, it's much harder to prove the possession of anything illegal. (However, the proxy headers, live imaging, or an insecure/subverted server might give away what was being cached.) 2. And if images aren't being cached, while textual material could still be illegal, it's less likely to be specifically targeted by law enforcement. In my opinion, if you use HTTP over the internet, you are essentially consenting to caching, inspection, or worse. And most people know that by now. And if you use HTTP over Tor, you should be much more aware of this. teor teor2345 at gmail dot com pgp 0xABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR C3C57B23 349825DE 929A1DEF C3531C25 A32287ED

1 0

Re: [tor-relays] Simulate High Tor Load
by teor 11 Jan '15

11 Jan '15

Hi, chutney can be used to setup a large test tor network running solely on a single machine, with no outside network access required. The tor/src/test/test-network.sh script will configure an entire test tor network and verify connectivity from each client through the network. This works best with tor 0.2.6.2-alpha due to some bootstrap speed improvements, although with larger networks you may need to use --delay to increase the bootstrap time. I suggest you start with --flavour basic-min, and move through the sizes to --flavour basic-100 (my machine can barely run basic-100). You can also manually modify the amount of random data sent while verifying connectivity (look for "Octets" in chutney's TorNet.py). It would be nice if this amount was configurable (patches gladly accepted). It would also be nice if these connections were done in parallel, but I don't think that's the case (clarification or patches gladly accepted). teor > Date: Sun, 11 Jan 2015 14:18:01 +0100 > From: webmaster <webmaster(a)defcon-cc.dyndns.org> > > Hi Julien, > > thats exactly the setup I'm actually using. I use my relay as a client. > From my point of view it seems that the relay is used as a entry point > (without guard flag) in this constellation (correct me if I'm wrong). > > Torsocks could solve my problem. > > My goal is to examine the influence of a high traffic load on my relay > to perhaps adjust my server settings (number of open file descriptors, > ...). > > > >> Am 11.01.2015 um 13:05 schrieb Julien ROBIN: >> Hi, >> >> If you are on a dedicated high Bandwidth server you can maybe use your relay as client, an idea could be to open a lot of "wget" commands. >> >> sudo apt-get install torsocks >> usewithtor wget URL >> >> But it's not guaranteed that the selected circuits will be super-fast (first reason to open lot of wgets simultaneously) >> >> Of course, doing that you consume some useful bandwidth for users (but if it's quick, after all you're a Tor user like another!) >> >> And it's not totally the same that relaying data as server, since it's using the client part of the tor process (but starting from here, I cannot help you anymore since I don't know what is written in the code ;) >> >> So if anybody have another better idea >> Something that would generate a full customized circuit for example, or reduce the amount of used hop for the test. >> >> It already exists "EntryNodes" and "ExitNodes" commands for your torrc file, but no server can be used as EntryNode if it's not Guard already, and I'm not sure that some "MiddleNodes" command exists. >> >> >> Last things, you can also make you machine's CPU working hard on a lot of threads simultaneously, and watch if Tor is suffering or not (like "too many circuit creation request!" in the log). >> >> Or make some tests with Iperf for high bandwidth load in parallel ("iperf -s" on a fast machine, "ipers -c Ip -t TimeInSeconds -p port -P ParallelsTcpConnexions" on the other machine - this one will send data (chains of 1234567890123...) to the server) >> >> Good luck ! By curiosity, I'm interested also, but I would understand if this kind of easiness in creating bandwidth statistics and degraded path (for analysis, for example) is not really sought by developers. >> >> Best regards, >> Julien ROBIN >> >> >> >> ----- Mail original ----- >> De: "webmaster" <webmaster(a)defcon-cc.dyndns.org> >> ?: tor-relays(a)lists.torproject.org >> Envoy?: Dimanche 11 Janvier 2015 11:59:12 >> Objet: [tor-relays] Simulate High Tor Load >> >> Hey Folks, >> >> is there a common procedure for testing a tor server for a high load? >> >> Thanks in advance >

1 0

Relays not listed
by Felix 11 Jan '15

11 Jan '15

Hi most of my relays are no longer listed on Torstatus* and Consensus**. But they perform like they should. out $E388F7BD196F5195AEF114552585152EA6942329 out $2691AE47D3E1D5702520F2792951927C9FE82C67 out $8d1a618c523a8cc761b7253e96c6d19285c47029 out $05d54acea361a57b16cd461340bd32f39383470e out $1E64DACE137A4A6223E7A4A73060A22ECA46D7B3 out $772C86361E276271665579621815F43311A29DA6 out $A53F5920B86F8190569BDFD59F7818BA73966CC3 out $9FBD26A8EB88126FCEF76205255571E450170949 out $BF4FFC4EE4D56AD6506D6FA96BA9EBD8001744BB in $5B3B9A0EA1DC16F6348C57FCC83BBB43D1013F4A I found Atlas was down between 21:30 ans 01:30 yesterday night. Any ideas ? Cheers, Felix * http: jlve2y45zacpbz6s.onion/index.php ** https: consensus-health.torproject.org/consensus-health.html

3 2

Simulate High Tor Load
by webmaster 11 Jan '15

11 Jan '15

Hey Folks, is there a common procedure for testing a tor server for a high load? Thanks in advance -- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v2.0.17 (MingW32) mQENBFHMmT8BCAC0smvU7Bq1ABxAhvBRn7d4ekkk95aCE4TTQo4wy1z/rGLhQfdt dhiD+Vy61vGrsdK3ei5sW6rBvX2m8+YmBi+8AAgSiZmS0JM3Zz3cmTi5oh0D/yM8 4aDj7wQYfJyzSmYN8InAQ5eA77lwIdqG27kR9wga2szeJwCnWReta0R+7YFkpUW+ zUlf4SWcUx5SmBsaiELQpm+Qcn+fyopo12RX6YVmoNPBvN2nDXDnRhUCKGc+0xhD UrBpCHrApK6sTnMsD34ClCLTL2L1gckQ0AsQqY3PJlx3R8kIJxlmr6R3WnjPMIG0 lqrukB9PcOrHM1MZXK1gK6AtypHBN98lr8Z9ABEBAAG0KndlYm1hc3RlciA8d2Vi bWFzdGVyQGRlZmNvbi1jYy5keW5kbnMub3JnPokBPgQTAQIAKAUCUcyZPwIbIwUJ CWYBgAYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQcN1vxvRQl+0SEwf+KXjf YtiSUSVS11uqeQ/8g46NwmNa91P3toZvEd7vhLSbjnL9bi/vApzNnUTGT3VP4/NA dg9SbR4qKlSr8T+YikRMV3tiuiVq8m7g00qM9y8MIomwJTounz8VdO/aJXFSOxAK Bb6ElREADspCzr2qSZCnozWUzbd+b8owbGeRRq3e33Aa5Nlm/xDRxGDWANbaIA8q Gkibvy3vWEwrxiwsakvHGaEZnPEtlNm3M1xcmFAuyl73qzUMkLN0u9E/2igo4EB5 EdMb5Ab5hfWdljxBqJr0tsvMfSK4VkzMCbKYkTqHZIRPQnhiSBE6Yo1Q6RCl/Hht bkvU4RA0J+NkXMZljrkBDQRRzJk/AQgA0HojJnK0uhEkAnbmszYsf477DV+LD02s ZEAlLGhJlf9qYaDiPMPwaZ3nK8/PYKzPpBWfHgRQP97rLHPIVJYl3BHDa/nWeZ2b e/HzYhpX0djbK9qe6W/CTfGbXmC/y+4dDGB8dvtTAW3JILm7xEdwiWtywozEVy7V lnMK4JQvlfOh+3XO6qv71FXyuRkObvkYzqvxUYHewtvvObcVxXHP0C0O6LB44iAW 2boZVVuiHdudnyNAezJajPMUT8SnI0bwL6+0TgnHL4cKNUEPQljIrrvi+9nCkq7V uBtnsYtyoo2reoxmCbX/Z1zZsxdUcKpeJHlc5AypyN8DUJ+APJ9NnwARAQABiQEl BBgBAgAPBQJRzJk/AhsMBQkJZgGAAAoJEHDdb8b0UJftOY0H/1TChmQrJC/qzefW PK7EqFlBg3TIEXdu8JHjF42ZOgzQRfp7E2wWzEx0Y45lNXMs6Yg15hWCEDaUDF6F 5WZKNrP8xIldyR9Aw7fyKqjZ9UuKovqofHsCiaSO7nWzGM6GF3nBDNI9NcFve/wN wggyjAbohOJrJGal3N0HlG3cakqjEmjBe1gQEMC0ZPlWstb/cqqr49TNPrRmQc4P SyGffh8Xqhw94m1LDBXFEaYe7AxjNk1sPAVfO1rOdLF6GOun/UwgbhDQX/Rb9C3t AhjSgyFEiR/gfrUZ7R6SY51qOUf1lN5ZN85C/x27XoZWYlsNaH3Ei6nG+yeswBMk ZRMbezQ= =Med3 -----END PGP PUBLIC KEY BLOCK-----

2 2

Atlas / Globe backend appears to be down
by starlight.2015q1＠binnacle.cx 11 Jan '15

11 Jan '15

Can't pull anything up on either Atlas or Globe.

3 2

Secure secure Shell update protocols
by 0x23 10 Jan '15

10 Jan '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hey guys, wanna share some current insights regarding secure shell(ssh) on how to harden sys after the German 'Der Spiegel' disclosed documents.h https://stribika.github.io/2015/01/04/secure-secure-shell.html Greet#z - -- -----BEGIN PGP SIGNATURE----- Version: APG v1.1.1 iQIzBAEBCgAdBQJUsD4TFhwweDIzIDxydXNoMjNAZ214Lm5ldD4ACgkQF7zsyb8G YjiPyRAAkta8iRmORYJeKdLUzo9Bi4arEqCIjMNaOaZmn+2fTNv3j3nqeyC+r+Sy rLEVXOW5Zcb4QdcSSsU3l3oZCx2bc7hKC4ysCRnEfT03XSwc/acGVHd3FDePF2GB ypqOIJjwZ0T/11DZfJo2zfk18G6FVEKWGa1WTjKkpylvyHLE5Y3FlrqvhJMhql37 Vm4SpF4HncXgJl8njJeQayLr10O/Kcq+FI4d+jHarByU6p9Ry4Lx6EjflfQirb+T UJtZi5mmZyPI01RUnu+HM3aEvRetEj4IpPdjdsA8NESKOBlOxX39cPtPz6HOPiKD BDymO1ZrXfzohjnMMj3FVHZOqS79wc4wq0M7PKPSsxuWL7gI/HepO724Wm6q62ml nPnLRoUc9Gpq9bhRZmRshMjU1zs3eDYR54WnRPf1TQy4JRpThbeHlsIGHQQc9yVD BdP7U5zCuVgVPmn9uKho/6rpxSigMSpdsYSB4UF0n056yiQ1JolRPpOKPYkVSp6U 3xfbWNBdQ0aFD3TuXrj19SYe9KhSE7N07mDgU2KngXz/oVyMXxEKuVxtxTF00k/g JKg+AcwNvjD5LOa27N6bePR+tPHydnvlWkonBwsuaYBvPZvWbocZFuMyRPjmWzh4 PuAmja/SiSiFbQzSqlv53BY2krCMdbZb93i3xQTqgDiA5JmOdd4= =IZOD -----END PGP SIGNATURE-----

2 2

please put jego00X relays in a "family"
by Nusenu 10 Jan '15

10 Jan '15

Dear Tor relay operator, thanks for running your relays with such a great diversity (not two relays in the same network). Please be so kind to put all your relays [1] into a so called family to tell Tor clients that these relays are managed by one entity and should not be used toghther in one circuit. thanks! Nusenu The relevant configuration option is: > MyFamily node,node,… > > Declare that this Tor server is controlled or administered by a group > or organization identical or similar to that of the other servers, > defined by their identity fingerprints. When two servers both declare > that they are in the same 'family', Tor clients will not use them in > the same circuit. (Each server only needs to list the other servers > in its family; it doesn’t need to list itself, but it won’t hurt.) Do > not list any bridge relay as it would compromise its concealment. > When listing a node, it’s better to list it by fingerprint than by > nickname: fingerprints are more reliable. [1] https://atlas.torproject.org/#search/jego

1 0

Tor in Spain
by Torizen 09 Jan '15

09 Jan '15

Hello, I've been running a non-exit relay on a EDIS VPS located in Spain for 5 months. Yesterday, without warning, I received an email because apparently I was abussing the network and my VPS was suspended. I was asked to reduce the amount of traffic Tor is allowed to use and after that I received another email where they claimed running a Tor relay, or any other "anonymization software", is now forbidden. I'm from Spain and this is the first time I've heard of this. Does anyone know if this is true? Torizen.

7 13

Re: [tor-relays] new VPS bridge bandwidth under-reported
by starlight.2015q1＠binnacle.cx 09 Jan '15

09 Jan '15

> Bridge relays . . . Isis, Thank you very much for your description of how it works and the references to the specifications. More and more I've come to realize one should start there. >> It just popped to 700KB, presumably because >> I used it to browse and then download >> the TBB bundle as a test. >I believe that client activity shouldn't >effect your reported bandwidth (but >I'm not entirely sure, actually). Just tested it again the same way except using obfs3 and the self-reported bandwidth from getinfo dir/server/authority shot from 60 Kbytes/sec to 950 Kbytes/sec instantantaneously. Will show up in Atlas shortly I presume. Based on the description you provided this seems sane enough. Thanks again!

1 0

Re: [tor-relays] new VPS bridge bandwidth under-reported
by starlight.2015q1＠binnacle.cx 09 Jan '15

09 Jan '15

Whoa wow. . . It just popped to 700KB, presumably because I used it for to browse and then download the TBB bundle as a test. So I guess that means the bandwidth measurement for a bridge is strictly passive? Presumably that also means that it is not used as a criteria for dissemination?

3 11