- tor-relays - lists.torproject.org

Hash of session info was not as expected
by Logforme 14 Jun '14

14 Jun '14

My tor log file is usually quite boring but today it looks like this: Jun 14 13:42:46.000 [warn] Hash of session info was not as expected. Jun 14 13:57:56.000 [warn] Hash of session info was not as expected. Jun 14 14:11:58.000 [warn] Hash of session info was not as expected. A new line about every 10 minutes since 04:14:53 (CET) Is it a user with problems, an attack on my relay or a sign that my relay have some kind of hardware/software issues?

1 0

Torservers herngaard issues
by grarpamp 12 Jun '14

12 Jun '14

Seems to be consistently delivering random length web pages (if they are artificially slowed such as https://berlin.craigslist.org/) and its bandwidth is tanking on globe.tpo. 3B486DEC5A22694C0960B4A97A3665C617C89B1C

2 1

Sinkhole IPs to block for Cryptolocker and Gameover Zeus
by Adam Brenner 11 Jun '14

11 Jun '14

As you know, the Tor network can be used for mischievous and in some countries illegal activity hurting the reputation of Tor. Two of these activities include Cryptolocker[1] and Gameover Zeus[2]. Recently my exit node was inserted into a few block lists due to this two issues mentioned above and I would guess this hinders 'good' traffic within the Tor network using an exit node. I have complied a list of Sinkholes from CBL for both Cryptolocker and Gameover Zeus. Consider adding these IPs to your ExitPolicy reject list. ExitPolicy reject 85.159.211.119 # Cryptolocker ExitPolicy reject 212.71.250.4 # Cryptolocker ExitPolicy reject 54.83.43.69 # Cryptolocker ExitPolicy reject 192.42.116.41 # Cryptolocker ExitPolicy reject 192.42.119.41 # Cryptolocker ExitPolicy reject 198.98.103.253 # Cryptolocker ExitPolicy reject 208.64.121.161 # Cryptolocker ExitPolicy reject 142.0.36.234 # Cryptolocker ExitPolicy reject 173.193.197.194 # Cryptolocker [1]: http://www.us-cert.gov/ncas/alerts/TA13-309A [2]: https://www.us-cert.gov/ncas/alerts/TA14-150A -- Adam Brenner <adam(a)aeb.io>

2 1

Exit policies pointing to IP blocks not appearing on Globe
by Mendelson Gusmão 10 Jun '14

10 Jun '14

Hi! I just setup a tor relay, encouraged by EFF's Tor Challenge. All I have is a domestic connection. I've read my TOS and my ISP seems to be very friendly to this case. Although I have a little suspicion about traffic shaping, my exit node seems to be running very well! I'm worried about one thing, though. I remember that a while ago, when I tried to access Facebook using a tor client, I saw a message telling that I was blocked for using the network. To avoid the other users of my network to be blocked due to the traffic in my exit node, I managed to add exit policies rejecting every IP block that belongs to Facebook. However, these exit policies don't appear in neither globe.torproject.com nor any site that provides information about nodes. Are these addresses being scrubbed? How do I make sure that these policies being applied? Thanks!

4 4

Running relays at consortia networks [was: JANET/edu]
by grarpamp 10 Jun '14

10 Jun '14

On Thu, Jun 5, 2014 at 3:50 PM, Iain R. Learmonth <irl(a)fsfe.org> wrote: > I'm wondering if anyone knows anything about JANET's (the UK academic ISP) > views on running a Tor relay? > > It's probably not worth putting together a proposal for running one in a UK > University if the ISP is going to have problems with it. Has anyone tried approaching these networks themselves to see about running relays there? Their bandwidth for sponsored things is often free. In the US you might try internet2.edu and all its various connecting regional networks. On a second further approach, once all the risks and pro-reasons have been discussed and accepted, the consortia backing of many Uni's within would be bulletproof.

3 3

suspicious exit?
by JB 08 Jun '14

08 Jun '14

Hi All, FP! :) I just setup my relay node today, and am keeping a hawkish(ish) eye on traffic.... And noticed a flurry of activity from SSH port (22) at 5.104.224.5 - which is listed as an exit. But it's also listed on http://cbl.abuseat.org/lookup.cgi?ip=5.104.224.5 as infected (or NATting for a computer that is infected) with the Conficker botnet. I've black-holed it in the meantime, but am wondering if I'm being overly cautious... Any advice/response/input appreciated. TIA Jeff.

2 2

Unblocking blacklisted exits [was: suspicious]
by grarpamp 07 Jun '14

07 Jun '14

> But it's also listed on http://cbl.abuseat.org/lookup.cgi?ip=5.104.224.5 as If you find exits on blacklists, you could try to contact the operator via their descriptor contact, exit http banner, etc so that they can try to have it removed. Usually a few clicks on an assertion of ownership/cleanliness and an email ack is all that's needed for removal. Since ownership of IP's is always in flux from perspective of BL's such that any 'real' owner could always do it too, absent exit contact info, many users could probably submit removal for them without issues. There's a project covering this on the wiki: https://trac.torproject.org/projects/tor/wiki/org/projects/DontBlockMe

1 0

Tor bridges with AWS
by CD 06 Jun '14

06 Jun '14

I've signed up to AWS with Tor's instructions for bridges. I've intalled Tor on my PC. Wondering how to proceed. Am obviously an illiterate newbie, so any links for a basic knowledge-base would be greatly appreciated. Thanks in advance.

3 3

Re: [tor-relays] Update your OpenSSL, several high-risk CVEs
by Jesse Victors 06 Jun '14

06 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Thanks. I saw the OpenSSL update, but thanks for explaining what it was about. Is it necessary to restart Tor to apply the update? Jesse V. On 06/06/2014 04:00 AM, tor-relays-request(a)lists.torproject.org wrote: > Message: 1 > Date: Thu, 05 Jun 2014 16:36:06 +0200 > From: Jeroen Massar <jeroen(a)massar.ch> > To: tor-relays(a)lists.torproject.org > Subject: [tor-relays] Update your OpenSSL, several high-risk CVEs > Message-ID: <53908056.50209(a)massar.ch> > Content-Type: text/plain; charset=ISO-8859-1 > > See for the details: > > https://www.openssl.org/news/secadv_20140605.txt > > Debian etc all have packages available. > > Greets, > Jeroen -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQF8BAEBCgBmBQJTkdiSXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQxMjgyMjhENjEyODQ1OTU1NzBCMjgwRkFB RDk3MzY0RkMyMEJFQzgwAAoJEK2XNk/CC+yABpUIAJ9ZSohmGuH3r4UEg//FrYRF 3IJc6UPJx22FU0pdplN09I5L0LRzH7SehJly62niid6XNS/8bKByzjkvrnik0qRP Hjo8Rq4C/2wbRJU0w8MHvpCRLFhTRdCHdGI2+HkUaYbp7abwIZVWbTMdXB0T5lGx KvSgMeQfmlWzkwEb3WqDUqcc2NJG5D3K5WFV4WOsAi+KerBUiNyJKUqwGRd21PgS VV6S4JLQy0PVKdCAIbeEeOy2xclRfwKjBfe8RVD9b8fOmBY6ty7v1k6Org54PceA hLtJXDQXg9XQfe1u2T+peEYxf1bYIZMu+DI/7DJ0xFDr6naxJ4ttQabE2WmN6lE= =FOEn -----END PGP SIGNATURE-----

3 3

Sign up for the Tor Challenge
by Adam Brenner 05 Jun '14

05 Jun '14

If you have not already, you should consider signing up for EFF's tor challenge https://www.eff.org/torchallenge/ Today also marks the Reset the Net event https://www.resetthenet.org/ -- Adam Brenner <adam(a)aeb.io>

1 0