- tor-relays - lists.torproject.org

'relay early' attack detection at the infrastructure level
by Nusenu 02 Aug '14

02 Aug '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 [moved to tor-relays] Hi relay ops, please consider having a regular look at your logs after upgrading to the latest tor releases to spot relay_early attacks (even if the attack origin is not directly attributable from a relays point of view). searching your logs for 'Received an inbound RELAY_EARLY cell' should do it. https://gitweb.torproject.org/tor.git/commitdiff/68a2e4ca4baa595cc4595a511d… >>> It doesn't have to decrypt … [View More]

4 5

More attack traffic against Tor detected on exit relay
by tor＠t-3.net 01 Aug '14

01 Aug '14

IPTables rule involved: -A INPUT -p tcp -m string --hex-string "|00002800390038008800870035008400160013000a00330032009a009900450044002f00960041000500ff020100000400230000|" --algo kmp -j LOG --log-prefix "IPTables-GFC-new " -A INPUT -p tcp -m string --hex-string "|00002800390038008800870035008400160013000a00330032009a009900450044002f00960041000500ff020100000400230000|" --algo kmp -j DROP Logs generated Wednesday from hits against these rules: Jul 30 13:44:38 Libero2-vserver kernel: … [View More]

2 1

don't worry (to much) if your relay is loosing the guard flag
by Nusenu 31 Jul '14

31 Jul '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 I guess it makes sense to make this change a bit more visible on the tor-relays mailing list since relay ops will notice the change eventually and not everyone is reading changelogs closely. A lot of relays will loose their guard flag (and probably see less traffic?) once enough dir auths [1] upgraded to 0.2.5.6-alpha. For the background see the changelog [2]: >> o Minor features: - Authorities now assign the Guard flag to the >> … [View More]

1 0

tor daemon problem with obfsproxy
by Fereydoon Sepehri 31 Jul '14

31 Jul '14

Hi All, I install and configure tor to set up a obfs3 bridge. If I use command "tor", everything is fine and clients could connect to server buf if I use "service tor start", the connection will be refused. I checked the log file. the problem is: [warn] The communication stream of managed proxy '/usr/bin/obfsproxy' is > 'closed'. Most probably the managed proxy stopped running. This might be a > bug of the managed proxy, a bug of Tor, or a misconfiguration. Please > enable logging on … [View More]

1 0

Re: [tor-relays] obfsproxy issue
by Mike Patton 31 Jul '14

31 Jul '14

On 01/08/2014 3:00 am, Fereydoon Sepehri <fereydoonsepehri(a)gmail.com> wrote: > > Dear All, > > I want to set up tor Bridge. the bridge is up and working normally. > I decided to use obfsproxy to set up obfs3 bridge. > > I installed Python, python-pip and obfsproxy. > the obfsproxy is in "/usr/bin/" directory. The "obfsproxy which" command did not show this directory but this: > -bash: /usr/local/bin/obfsproxy: No such file or directory > > … [View More]

2 1

obfsproxy issue
by Fereydoon Sepehri 31 Jul '14

31 Jul '14

Dear All, I want to set up tor Bridge. the bridge is up and working normally. I decided to use obfsproxy to set up obfs3 bridge. I installed Python, python-pip and obfsproxy. the obfsproxy is in "/usr/bin/" directory. The "obfsproxy which" command did not show this directory but this: -bash: /usr/local/bin/obfsproxy: No such file or directory could you please advise me on this issue. Best Regards Fereydoon

1 0

Auto Response
by bbzxrmy wowman 31 Jul '14

31 Jul '14

1 0

how sensitive is relay 'state' file?
by starlight.2014q3＠binnacle.cx 30 Jul '14

30 Jul '14

Can anyone comment on how sensitive the information in the relay 'state' is? In particular, if entry guards are recorded in the file should one be concerned about protecting the file via a) encrypting the file system where it resides b) making a point of not backing up the file I suppose it comes down to how likely it is that an adversary can use entry guard information for correlation attacks against past and present tor-client traffic originating from a targeted client-relay.

1 0

Finding relay Sybils / Groups [re: relay_early/blackhat]
by grarpamp 30 Jul '14

30 Jul '14

As a project then to production development, someone should go back through the entire history of descriptors and look for groups coming online... dates, IP's, contacts, tor/OS versions, nicknames, ISP's, geoip, numbers coming online over sliding timeframes, correlation to 'news events', etc. There may be more questionable relays to be found. We were talking about such influxes around july 4 09, ironically, or not.

2 1

German company Webtropia: Terminated contract without notice because of abuse
by tor＠t-3.net 30 Jul '14

30 Jul '14

You somewhat made a mistake here - you've got to have an exit policy that (minimally) rejects ports 25 and 465, or else your relay becomes a giant abuse tool for spammers, scammers, and phishers instead of what you intended it to be (which was a standard-functioning Tor relay). You might try telling your ISP that you made a mistake in your configuration which allowed spam email to go out, and you're willing to correct that error and move forward. ExitPolicy reject *:25 ExitPolicy reject *:465

4 3