- tor-relays - lists.torproject.org

Relay is down
by Giovanny Andres Gongora Granada 01 Jan '15

01 Jan '15

Hi, My relay was up during 4 days, but now it's down. In the log it says: Dec 30 21:19:51.000 [warn] http status 400 ("Authdir is rejecting routers in this range.") response from dirserver '128.31.0.39:9131'. Please$ Dec 30 21:19:51.000 [warn] http status 400 ("Authdir is rejecting routers in this range.") response from dirserver '208.83.223.34:443'. Pleas$ Dec 30 21:19:51.000 [warn] http status 400 ("Authdir is rejecting routers in this range.") response from dirserver '131.188.40.189:80'. Pleas$ Dec 30 21:19:51.000 [warn] http status 400 ("Authdir is rejecting routers in this range.") response from dirserver '86.59.21.38:80'. Please c$ What could be happening? I restart it but it says the same on the log. Regards, Gio -- Mozilla Hispano: http://mozilla-hispano.org Mentor en mozilla-hispano.org: Gioyik <https://www.mozilla-hispano.org/documentacion/Usuario:Gioyik> Mozilla Colombia: Miembro en MozillaColombia <http://mozillacolombia.org/our-contributors/> twitter: Gioyik <https://twitter.com/Gioyik> Blog: gioyik.wordpress.com irc: gioyik

8 11

OT: folding@home
by Sebastian Urbach 28 Dec '14

28 Dec '14

Dear list members, I would like to invite any operator, who has some idle Cores (CPU or GPU) left,to join the folding@home distributed computing project: http://folding.stanford.edu/ There is now a brandnew team called Tor Project (Unofficial) with the id 227615. Hope to see some of you there :-) -- Sincerely yours / Sincères salutations Sebastian Urbach ----------------------------------------- Definition of Tor: 10% luck, 20% skill, 15% concentrated power of will, 5% pleasure, 50% pain and 100% reason to remember the name! -----------------------------------------

6 10

boost CPU on a Tor relay
by s7r 28 Dec '14

28 Dec '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, A Tor relay currently going 33MB/s could go a lot faster but CPU is at 93% usage - this is the bottleneck. Here is the output of /proc/cpuinfo processor : 0 vendor_id : GenuineIntel cpu family : 6 model : 26 model name : Intel(R) Core(TM) i7 CPU 950 @ 3.07GHz stepping : 5 microcode : 0x11 cpu MHz : 3068.000 cache size : 8192 KB physical id : 0 siblings : 8 core id : 0 cpu cores : 4 apicid : 0 initial apicid : 0 fpu : yes fpu_exception : yes cpuid level : 11 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf pni dtes64 monitor ds_cpl vmx est tm2 ssse3 cx16 xtpr pdcm sse4_1 sse4_2 popcnt lahf_lm ida dtherm tpr_shadow vnmi flexpriority ept vpid bogomips : 6132.24 clflush size : 64 cache_alignment : 64 address sizes : 36 bits physical, 48 bits virtual power management: it also goes down to processor 1 - processor 7 Any ideas how this could be boosted? OS is Debian wheezy. No aes-ni hardware acceleration, no openssl benchmarking or customization currently. advices? Thank you. - -- s7r PGP Fingerprint: 7C36 9232 5ABD FB0B 3021 03F1 837F A52C 8126 5B11 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) iQEcBAEBAgAGBQJUDuRTAAoJEIN/pSyBJlsRLqYH/iSCtC9r/7/DBCG2qqUGPEgY TELvt+UMGyMP6ncNJH+vDEdHO4BBlSMzFQdj2sKyO3hOT5492cIOaT3gGokaDApL W913yqUkIfiUT6FUWJ6g4/LUt25pMG25Ednr/ZJJXR/pR+Ym3T3ytg+MSwRBmpEe +h26Q7qvd/p4f6VhTR0sEsxQfDLVXrEsj3kn0BL0rLklN5zH/bqmIsK2hio5Nl3H KBvbvyt+JbLhA/4+jygT6AygHDH9arpXWEh3ZcJVn7mE0OmPAvukdlLUj70K5F7r cCeMakcGBbSzit5tY7jUmSvkUewVBhAxAZmv1hgNnuCoSrGPtQZseCbM06cry+k= =TyKF -----END PGP SIGNATURE-----

6 10

Re: [tor-relays] OT: folding@home
by teor 27 Dec '14

27 Dec '14

Some thoughts on the security of crowdsourced computing: Installing additional software increases the attack surface of your relay, even more so when the new software access the network. (Not to mention any additional libraries.) There is also the issue of the security of automatic updates to the any executables - Folding@home may have less of an issue with this than BOINC, as there is only one project involved. If you're willing to accept the additional risk, it seems like a worthy cause. (There's also a minor additional power cost, which really only impacts your provider and the environment…) > Date: Sat, 27 Dec 2014 12:54:24 +0100 > From: mikael <mikael(a)gutanet.sk> > > Hi, > some years ago I contributed to https://secure.worldcommunitygrid.org/ > via BOINC (https://boinc.berkeley.edu/) but stoped. > Forgive my paranoia, but I couldn't find proof that it really helps what > they write, that the provided cpu power could doesn't land at NSA for > example :/ > > Any different experience? > >> On 12/26/14 6:55 PM, Sebastian Urbach wrote: >> Dear list members, >> >> I would like to invite any operator, who has some idle Cores (CPU or >> GPU) left,to join the folding@home distributed computing project: >> >> http://folding.stanford.edu/ >> >> There is now a brandnew team called Tor Project (Unofficial) with the >> id 227615. Hope to see some of you there :-) >

3 2

News reporting exit node attacks
by Austin Bentley 27 Dec '14

27 Dec '14

Anyone have any more information on any of this stuff? They claim it's a 0day but I have yet to see proof.

3 4

Possible DDoS
by Christian Burkert 26 Dec '14

26 Dec '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi *, I'm running a non-exit Tor node for a few months now on a virtual server hosted in a professional datacenter. That's the node: https://globe.torproject.org/#/relay/4C246EA9C950B872FD77F761CEAAB41D93D976… Yesterday, December 25th, the support wrote me, that my server is under a DDoS attack with 2GBit/s lasting over more than two hours. So, the hoster black holed my traffic to protect the other customers. The hoster wanted to know which services I'm running and told me that if I continue running Tor and further attacks will happen, then I would have to bear the costs. Eventually, I took down the Tor node to avoid further confrontation. Now I seek for your interpretation of this event: - - Has there been more recent incidents against Tor nodes? - - How can I investigate it? - - How should one react to a hoster? I mean they could have made up the whole thing... Looking forward to your comments Chris -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Icedove - http://www.enigmail.net/ iQIcBAEBCgAGBQJUnUdDAAoJEHAzZ6ooPDSy0nMP/1lyHPPFBxpAOvEiWL+ijrvA SPViJvZH/cPUS/11M7qm+bsZa/fbiRk6kY8ADcY8abe1Z8lHzMYPGwZvKaIijiZG M8hjCHtMWLipO6iLmVfFskDtRn37Ga2ibEhGkVesDV53kPcotgg4i7tIqIuNb11X Gnkk+WpYwkrS9nPZjYNLmce093s4lux/N5GyRY/gQii+h9mfDJ++W+1ueNU94UQ0 bvK1wF7MdicWlu0kR49hCgFtDFh7uUjP87MPZmmQYHI82qWhTJxqOuuImrnJew2k pCFSzn03x/hXg1QFNPNLsqHU9OhUob3/z17Azcpbir15mY4/YE7Gq14/LBM+FKh0 LqGjzaVbQo0hs0kE2yFk5sEP0Dsv5aiOUItqFIMTG52FYZ6cUh/eTxMd6vblHwfU ujil0rFCRqtmbF6wIDBuXDxc0fmdaRMWTDfSlPxYGkfUaq1tSea1OAvjFpheOcNM wu9QiTSq9BTLY010iHSYQDknSr+gFkc/ooNLsPV1AAZFyMlG0epLww6tqR7C9hZq RyEX9piqGal7mU56gETxhDrD0Z/aKgXMbS+KvYfZhopGWEVg5vbWPGxAId53nhr6 hjvLyFmy68hBdbOB/pvp8qvw8veQR3niiHIxhxAl+BIQzXX45x0uVCPHFUpbbLp5 POIwpEJ46oaz7+cddAHf =TcPt -----END PGP SIGNATURE-----

4 4

Re: [tor-relays] Possible DDoS
by Sebastian Urbach 26 Dec '14

26 Dec '14

On December 26, 2014 12:41:51 PM Christian Burkert <post(a)cburkert.de> wrote: Hi, > I'm running a non-exit Tor node for a few months now on a virtual server > hosted in a professional datacenter. Thank you ! > Yesterday, December 25th, the support wrote me, that my server is > under a DDoS attack with 2GBit/s lasting over more than two hours. So, > the hoster black holed my traffic to protect the other customers. I've seen this behaviour from some ISP's before and it's rather sad. If something like this happens my ISP is taking care of it without disabling my systems. I'm just getting a note with all the technical information and that's it. > The hoster wanted to know which services I'm running and told me that > if I continue running Tor and further attacks will happen, then I > would have to bear the costs. > Eventually, I took down the Tor node to avoid further confrontation. That's interesting, they gave you some infos like the time and the amount but nothing else ? Seems to me that they're pretty clueless and are fishing in the dark. Another reason for their behaviour could be that they want to get rid of you / your Tor node. Threatening customers is really sad, sounds like they heard the word Tor from you and then concluded "oh, than he basically asked for the attack". > > Now I seek for your interpretation of this event: > - - Has there been more recent incidents against Tor nodes? Nothing with that magnitude on my end for weeks. > - - How can I investigate it? You can ask your ISP for their logs regarding that attack. Do you have any logs on your system, maybe from a intrusion detection or anything else ? > - - How should one react to a hoster? I mean they could have made up the > whole thing... If you are already considering this than i would recommend changing to another ISP, sounds like there is already some distrust. > > Looking forward to your comments > Chris > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.12 (GNU/Linux) > Comment: Using GnuPG with Icedove - http://www.enigmail.net/ > > iQIcBAEBCgAGBQJUnUdDAAoJEHAzZ6ooPDSy0nMP/1lyHPPFBxpAOvEiWL+ijrvA > SPViJvZH/cPUS/11M7qm+bsZa/fbiRk6kY8ADcY8abe1Z8lHzMYPGwZvKaIijiZG > M8hjCHtMWLipO6iLmVfFskDtRn37Ga2ibEhGkVesDV53kPcotgg4i7tIqIuNb11X > Gnkk+WpYwkrS9nPZjYNLmce093s4lux/N5GyRY/gQii+h9mfDJ++W+1ueNU94UQ0 > bvK1wF7MdicWlu0kR49hCgFtDFh7uUjP87MPZmmQYHI82qWhTJxqOuuImrnJew2k > pCFSzn03x/hXg1QFNPNLsqHU9OhUob3/z17Azcpbir15mY4/YE7Gq14/LBM+FKh0 > LqGjzaVbQo0hs0kE2yFk5sEP0Dsv5aiOUItqFIMTG52FYZ6cUh/eTxMd6vblHwfU > ujil0rFCRqtmbF6wIDBuXDxc0fmdaRMWTDfSlPxYGkfUaq1tSea1OAvjFpheOcNM > wu9QiTSq9BTLY010iHSYQDknSr+gFkc/ooNLsPV1AAZFyMlG0epLww6tqR7C9hZq > RyEX9piqGal7mU56gETxhDrD0Z/aKgXMbS+KvYfZhopGWEVg5vbWPGxAId53nhr6 > hjvLyFmy68hBdbOB/pvp8qvw8veQR3niiHIxhxAl+BIQzXX45x0uVCPHFUpbbLp5 > POIwpEJ46oaz7+cddAHf > =TcPt > -----END PGP SIGNATURE----- > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays -- Sincerely yours / Sincères salutations Sebastian Urbach ----------------------------------------- Definition of Tor: 10% luck, 20% skill, 15% concentrated power of will, 5% pleasure, 50% pain and 100% reason to remember the name! -----------------------------------------

2 1

Tor Weather doesn't register my fingerprint
by Giovanny Andres Gongora Granada 26 Dec '14

26 Dec '14

Hi, Today I decided to run a Tor Relay and contribute to Tor Project on a Rackspace that I have free for it. I want to use Tor Weather to get notifications about my relay, but when I try to register my fingerprint it doesn't accept it. What could be needed to register it? My fingerprint is: 4C90453B94DAC00BE356283F427CECE024B9D224 This is the info about my relay: https://globe.torproject.org/#/relay/4C90453B94DAC00BE356283F427CECE024B9D2… Regards, Gio -- Mozilla Hispano: http://mozilla-hispano.org Mentor en mozilla-hispano.org: Gioyik <https://www.mozilla-hispano.org/documentacion/Usuario:Gioyik> Mozilla Colombia: Miembro en MozillaColombia <http://mozillacolombia.org/our-contributors/> twitter: Gioyik <https://twitter.com/Gioyik> Blog: gioyik.wordpress.com irc: gioyik

2 1

iptables
by mikael 24 Dec '14

24 Dec '14

Hi, I don't know what to do. Please help. I'm getting the following warnings in arm: 16:13:15 [WARN] Your server (MY_PUBLIC_IP:9030) has not managed to confirm that its DirPort is reachable. Please check your firewalls, ports, address, /etc/hosts file, etc. 16:13:15 [WARN] Your server (MY_PUBLIC_IP:443) has not managed to confirm that its ORPort is reachable. Please check your firewalls, ports, address, /etc/hosts file, etc. My iptables rules are: mike@host:~$ sudo iptables -nL Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 REJECT all -- 0.0.0.0/0 127.0.0.0/8 reject-with icmp-port-unreachable ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED REJECT all -- 62.210.140.93 0.0.0.0/0 reject-with icmp-port-unreachable REJECT all -- 62.210.151.213 0.0.0.0/0 reject-with icmp-port-unreachable REJECT all -- 103.41.124.106 0.0.0.0/0 reject-with icmp-port-unreachable REJECT all -- 103.41.124.112 0.0.0.0/0 reject-with icmp-port-unreachable REJECT all -- 109.230.220.135 0.0.0.0/0 reject-with icmp-port-unreachable REJECT all -- 115.84.179.148 0.0.0.0/0 reject-with icmp-port-unreachable REJECT all -- 117.21.225.176 0.0.0.0/0 reject-with icmp-port-unreachable REJECT all -- 188.116.19.109 0.0.0.0/0 reject-with icmp-port-unreachable REJECT all -- 219.232.239.40 0.0.0.0/0 reject-with icmp-port-unreachable REJECT all -- 221.235.188.214 0.0.0.0/0 reject-with icmp-port-unreachable ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:53 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:53 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:9001 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:9030 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpts:6881:6999 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpts:6881:6999 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg 5/min burst 5 LOG flags 0 level 7 prefix `iptables denied: ' REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable Chain FORWARD (policy ACCEPT) target prot opt source destination REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0

2 2

Whitelist
by Thomas White 24 Dec '14

24 Dec '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Directory Authorities, Can you please remove the following fingerprints/IP's from the blacklist as per my previous updates in tor-talk. D78AB0013D95AFA60757333645BAA03A169DF722 6F545A39D4849C9FE5B08A6D68C8B3478E4B608B 5E87B10B430BA4D9ADF1E1F01E69D3A137FB63C9 0824CE7D452B892D12E081D36E7415F85EA9988F 35961469646A623F9EE03B7B45296527A624AAFD 1EA968C956FBC00617655A35DA872D319E87C597 E5A21C42B0FDB88E1A744D9A0388EFB2A7A598CF 5D1CB4B3025F4D2810CF12AB7A8DDDD6FC10F139 1324EC51FBFA5FD1A11B94563E8D2A7999CD8F57 93CD9231C260558D77331162A5DC5A4C692F5344 IPs: 77.95.229.0/24 5.104.224.15 77.95.224.187 89.207.128.241 128.204.207.215 Authorities who haven't signed yet: gabelmoo tor26 maatuska moria1 urras Regards, T - -- Activist, anarchist and a bit of a dreamer. PGP Keys: key.thecthulhu.com Current Fingerprint: E771 BE69 4696 F742 DB94 AA8C 5C2A 8C5A 0CCA 4983 Key-ID: 0CCA4983 Master Fingerprint: DDEF AB9B 1962 5D09 4264 2558 1F23 39B7 EF10 09F0 Key-ID: EF1009F0 Twitter: @CthulhuSec XMPP: thecthulhu at jabber.ccc.de XMPP-OTR: 4321B19F A9A3462C FE64BAC7 294C8A7E A53CC966 -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJUmfi/AAoJEFwqjFoMykmDLpwP/iRLkxYXMGzW4ohr/sG2nvYX Fitv6242N0NuGEFkwZgjaYEdiab4Afdg5xacu5r3+tzdccKawZX9w7NOpx1w8iXS IxO4i/nU5DhA2hyn/67/J/JBOqjVY7V0nXVtEOAK3NUGjiRK+uaSojfZ/y3iXgvv MHdr5eGM5Rj7/sZ2eqLsCdzSr0atGQXxyz2JhlVim5rZfG9ikzvGcv8PbDl67Fgp e5l/aq3NAHv8EiMAML1Wpah+hi7fDuyX4QcSLfrrwK2sv+oetbPSa6Kue26PP2Fr UKQLB412hJ4gtLFL5LiQXWvs1cuQO4Yw7tBOJ3qsh4kWpDtVUD7OTIDZRCK+FkwF FuH2XHwN8IVhIcQcTZ+I7dKqWi9vMxaJPWi15osah5rW48ozqCCSqFO9xICOyMDH V1JSeHTVzWCKpkpocUYzIMJvjuqADtAyuR9CX0hgEgUdGf9kMYdo+zGsiXomHO02 1iuWsq1HjwNxL2nAZJpCNsNetcHSvRtwGXbWx2Fr6P/T3tBh7gYfTSD2KwNnw+yE X0IDz5J02Xqz1nU2kiKr+IkZDXI+0aKzkD0KI6Uia0LEcZmjKNEePccHd+PcwIY/ YnH55rVyilUsLBvgQKZwGBVk+9kNmXjwiH1JJbUrGcfsCvZb+E05n5WMcbNYRwW2 N+2CQDnmN8aHLErrs5RU =zOpP -----END PGP SIGNATURE-----

2 1