- tor-relays - lists.torproject.org

exit policy to reflect country-wide ban
by Vladimir Ivanov 07 Dec '14

07 Dec '14

hi. Recently, github was blocked in Russia (see discussion here: https://news.ycombinator.com/item?id=8692584) The ban is executed by all major ISPs (comply with this regulation is necessary to keep the telecom license so no ISP is risking to disobey), this means that if your exit node happens to be in Russia, you're out of luck when you try to connect to github. Some suggest marking exit nodes in Russia as bad exits because connecting via them leads to various problems (like node provider doing MitM on all github https connections). Here is an example: https://twitter.com/wiretapped/status/539934125293961216 I think, if Russian exits operators implement reduced policy rejecting github, that would be better solution: they're still usefull for all other sites and a client would access github using a tor exit elsewhere. Do I miss something here? Are any disatvantages of this? More general, if a network, a particular exit node is connected to, blocks some IP addresses, is it wise to reflect those changes in the node's ExitPolicy? BR, Vladimir

4 5

No obfs3 traffic at all on bridge
by Marco Gruß 07 Dec '14

07 Dec '14

Hello, my obfs3 bridge has now been up for > 20 days. I have iptables rules in place to count packets. To date, I have not seen a single packet to either the obfs3 or the scramblesuit port. Both are working though, I just tried them with the Tor Browser. Is this a good sign (i.e. the bridge is still in reserve) or a bad sign (something's wrong)? Thanks for any help! Marco

1 0

According to globe and atlas, bridges have guard flags, while they actually don't have them at all...
by Justaguy 06 Dec '14

06 Dec '14

What is the cause for this behavior? https://globe.thecthulhu.com/#/bridge/286FD249840142D1C7536C2D12FDBE5EA63AD… https://atlas.thecthulhu.com/#details/286FD249840142D1C7536C2D12FDBE5EA63AD… -- Contact: Irc, justaguy @ Freenode or OFTC OTR fingerprint: FF6D1AC2 13F38B15 EDB21522 D3530A6F 6EE01996

2 1

Re: [tor-relays] Guard flag and some irregularities
by Sebastian Urbach 06 Dec '14

06 Dec '14

On December 6, 2014 9:41:34 PM Rafael Rodriguez <rafaelr(a)icctek.com> wrote: Hi, > https://atlas.thecthulhu.com/#details/48ADFCC561402D7EBB1CDE233F206B01D8FA0… > > > 1- Is it ok for the Guard flag to come and go so often? I do not see > anything wrong with my relay and it is pushing up to 12MBs at times. >From what i can see the numbers are way lower than that. Recently the criterias to qualify as a guard changed, i assume that you drop out of the guard position because you don't make the cut all the time. If im not mistaken the number of guards dropped roughly 50 % after the changes were implemented. > Most of the time, my relay pushes between 3-7MB/s constantly and that's > fine. But there are occasions in which I see it spike and send out as > much as 12MB/s I'm struggling with the numbers, if you take a look at the graphs you are not getting this much traffic. Maybe your system is under attack (DoS, DDoS) ? It does not look like it's regular Tor traffic ... -- Sincerely yours / Sincères salutations Sebastian Urbach ----------------------------------------- Definition of Tor: 10% luck, 20% skill, 15% concentrated power of will, 5% pleasure, 50% pain and 100% reason to remember the name! -----------------------------------------

2 1

Guard flag and some irregularities
by Rafael Rodriguez 06 Dec '14

06 Dec '14

https://atlas.thecthulhu.com/#details/48ADFCC561402D7EBB1CDE233F206B01D8FA0… 1- Is it ok for the Guard flag to come and go so often? I do not see anything wrong with my relay and it is pushing up to 12MBs at times. Most of the time, my relay pushes between 3-7MB/s constantly and that's fine. But there are occasions in which I see it spike and send out as much as 12MB/s when I have set a limit of @6MB/s. 2- Is Tor not respecting the limits? If it doesn't respect the limits consistently it might as well overkill my budget which translates into me killing the relay.

2 2

Running a New Relay
by Abhiram Chintangal 06 Dec '14

06 Dec '14

Hello, About two days ago, I started running my first tor relay using a digital ocean vps instance. Yesterday, I found this nice article[1] about the life-cycle of a tor relay. It was a great read and I think I understanding of how tor works has improved quite a bit. Currently, my relay[2] whose up-time is roughly 2 days 18 hours doesn't have any active circuits ( via tor-arm). Since its in the unmeasured phase( days 0-3) shouldn't it be making circuits back to itself? I believe the number that was mentioned in the article was four. I apologize if my question seems silly. Thanks! -- Abhiram Chintangal I guess we agree with reason, but now it's a matter of disposition [1]https://blog.torproject.org/blog/lifecycle-of-a-new-relay [2]: https://atlas.thecthulhu.com/#details/0D63999A202B34EF1CD9669BC45B0A697D9BF…

2 1

Atlas slow/not working?
by Abhiram Chintangal 06 Dec '14

06 Dec '14

Hello, I am not able to check my relays status via Atlas for the last two days. Any ideas? Thanks -- Abhiram Chintangal I guess we agree with reason, but now it's a matter of disposition.

5 5

ArchWiki article about fast relay configuration
by usprey 06 Dec '14

06 Dec '14

Hi List I have written my own notes into https://wiki.archlinux.org/index.php/Tor#.2B100Mbps_Exit_Relay_configuratio… . All and any feedback will be appreciated! Are there any privacy concerns about using pdnsd to cache DNS locally?

1 0

Planning a relay
by TT 06 Dec '14

06 Dec '14

I'm thinking of running a relay, and i've a few questions regarding the requirements and the general setup. So far this is just planning. The hardware would be clean and in my possession, but the connection would go through a Swedish-based VPN provider because i'm not interested in running it through my own IP address. The provider endorses Tor and places no limits whatsoever on the services run through their connection, has port forwarding and allows exits, so no issues there. They also have a strict no-logging policy, but words are cheap so you never know. I guess the first question should be whether such a relay would be welcome on the Tor network in the first place? I am aware that connecting to Tor through a VPN isn't generally recommended, but what about running a relay through one? Better idea, or a ridiculously bad one? Second, while it would run on a (nearly) dedicated 100mbit connection, i do not have dedicated equipment. The machine needs to be taken offline between every 2-4 weeks, for some days at a time. Frequent OS updates also often require reboots in addition to this downtime. So much for a stable flag, but more importantly i need to know if this behavior is undesirable for running middle/exit relays? If so, would a bridge be better suitable with the tools i have at hand? Third, regarding running bridges. The Tor Project FAQ states running your own bridge might improve your own anonymity. I assume this means you would manually set up your TBB to connect to *your own* bridge, is this correct? And finally, since the bridge would run on a separate (VPN) IP address, would this make a difference (re:anonymity) for better or worse if you connected through it yourself? I'm likely missing something here because it seems it would basically be the same as simply connecting to Tor through the VPN client alone. Thanks.

7 9

Tor Server - DDOS or High Load
by webmaster 04 Dec '14

04 Dec '14

Hello Folks, I'm running a relay tor server since several years. Last week (24 Nov) I noticed a high load on the tor server (cpu load 100%). After some investigation i found out that tor causes the high load. After killing the process the load decreases to a normal level, but after restarting the tor process again the load increases again. Arm log: Could not open "" for writing: To many open files. or Failing because because we have 1017 connections already. Please raise your ulimit -n Tor's file descriptor usage is at 91%. If you run out Tor will be unable to continue functioning. At first I thought: Fuck, someone intruded into my machine. But after some looking through Arm I found many (>100) INBOUND connections. After one hour and some iptables tuning the cpu load decreases. Could the high load caused by an attack on my machine or is this just some small load peak? Hope for some reply -- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v2.0.17 (MingW32) mQENBFHMmT8BCAC0smvU7Bq1ABxAhvBRn7d4ekkk95aCE4TTQo4wy1z/rGLhQfdt dhiD+Vy61vGrsdK3ei5sW6rBvX2m8+YmBi+8AAgSiZmS0JM3Zz3cmTi5oh0D/yM8 4aDj7wQYfJyzSmYN8InAQ5eA77lwIdqG27kR9wga2szeJwCnWReta0R+7YFkpUW+ zUlf4SWcUx5SmBsaiELQpm+Qcn+fyopo12RX6YVmoNPBvN2nDXDnRhUCKGc+0xhD UrBpCHrApK6sTnMsD34ClCLTL2L1gckQ0AsQqY3PJlx3R8kIJxlmr6R3WnjPMIG0 lqrukB9PcOrHM1MZXK1gK6AtypHBN98lr8Z9ABEBAAG0KndlYm1hc3RlciA8d2Vi bWFzdGVyQGRlZmNvbi1jYy5keW5kbnMub3JnPokBPgQTAQIAKAUCUcyZPwIbIwUJ CWYBgAYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQcN1vxvRQl+0SEwf+KXjf YtiSUSVS11uqeQ/8g46NwmNa91P3toZvEd7vhLSbjnL9bi/vApzNnUTGT3VP4/NA dg9SbR4qKlSr8T+YikRMV3tiuiVq8m7g00qM9y8MIomwJTounz8VdO/aJXFSOxAK Bb6ElREADspCzr2qSZCnozWUzbd+b8owbGeRRq3e33Aa5Nlm/xDRxGDWANbaIA8q Gkibvy3vWEwrxiwsakvHGaEZnPEtlNm3M1xcmFAuyl73qzUMkLN0u9E/2igo4EB5 EdMb5Ab5hfWdljxBqJr0tsvMfSK4VkzMCbKYkTqHZIRPQnhiSBE6Yo1Q6RCl/Hht bkvU4RA0J+NkXMZljrkBDQRRzJk/AQgA0HojJnK0uhEkAnbmszYsf477DV+LD02s ZEAlLGhJlf9qYaDiPMPwaZ3nK8/PYKzPpBWfHgRQP97rLHPIVJYl3BHDa/nWeZ2b e/HzYhpX0djbK9qe6W/CTfGbXmC/y+4dDGB8dvtTAW3JILm7xEdwiWtywozEVy7V lnMK4JQvlfOh+3XO6qv71FXyuRkObvkYzqvxUYHewtvvObcVxXHP0C0O6LB44iAW 2boZVVuiHdudnyNAezJajPMUT8SnI0bwL6+0TgnHL4cKNUEPQljIrrvi+9nCkq7V uBtnsYtyoo2reoxmCbX/Z1zZsxdUcKpeJHlc5AypyN8DUJ+APJ9NnwARAQABiQEl BBgBAgAPBQJRzJk/AhsMBQkJZgGAAAoJEHDdb8b0UJftOY0H/1TChmQrJC/qzefW PK7EqFlBg3TIEXdu8JHjF42ZOgzQRfp7E2wWzEx0Y45lNXMs6Yg15hWCEDaUDF6F 5WZKNrP8xIldyR9Aw7fyKqjZ9UuKovqofHsCiaSO7nWzGM6GF3nBDNI9NcFve/wN wggyjAbohOJrJGal3N0HlG3cakqjEmjBe1gQEMC0ZPlWstb/cqqr49TNPrRmQc4P SyGffh8Xqhw94m1LDBXFEaYe7AxjNk1sPAVfO1rOdLF6GOun/UwgbhDQX/Rb9C3t AhjSgyFEiR/gfrUZ7R6SY51qOUf1lN5ZN85C/x27XoZWYlsNaH3Ei6nG+yeswBMk ZRMbezQ= =Med3 -----END PGP PUBLIC KEY BLOCK-----

5 9