- tor-relays - lists.torproject.org

New tor relay, some questions
by Tobias Markus 17 Mar '14

17 Mar '14

Hi, I've been running a new tor relay for about a week now and I've got some questions. 1) I plan on running other services than tor on my server, including a (private) mail system. Other than the general possibility of tor having security holes and my server (and its IP address) being public and thus possibly target of attacks, are there security implications I should consider? 2) I would be interested to eventually run a directory/bandwith authority, so I read about them in [1] and [2], but the places seemed a bit odd (hidserv-perf branch in tor svn/torflow repo) so I thought I better ask here: Would I really just have to follow the steps in [1] to become a dirauth? Is there currently a need for auths, would contribution be welcomed? Thanks for your answers! Regards Tobias [1] https://svn.torproject.org/svn/tor/branches/hidserv-perf/doc/v3-authority-h… [2] https://gitweb.torproject.org/torflow.git/blob/HEAD:/NetworkScanners/BwAuth…

6 10

Re: [tor-relays] Setting up Tor Bridge
by Sebastian Urbach 17 Mar '14

17 Mar '14

Hi, First things first. 0.2.2 is quite old, you should consider 0.2.4 if possible. Next thing is that you have multiple SocksPort entries in your torrc. You just need one, remove the others. Is it just ServerTransportPlugin without any further specification ? On March 17, 2014 7:02:30 PM Eric Giannini <eric.giannini(a)yahoo.com> wrote: > Hi I would like to set up a Tor Bridge but I have run into a few problems. > Can anyone give me a few recommendations on what to do? Raising maximum > number of filedescriptors (ulimit -n) to 32768. > Starting tor daemon: tor... > ABORTED: Tor configuration invalid: > Mar 17 10:56:35.546 [notice] Tor v0.2.2.35 (git-73ff13ab3cc9570d). This is > experimental software. Do not rely on it for strong anonymity. (Running on > Linux i686) > Mar 17 10:56:35.548 [warn] Option 'SocksPort' used more than once; all but > the last value will be ignored. > Mar 17 10:56:35.548 [warn] Failed to parse/validate config: Unknown option > 'ServerTransportPlugin'. Failing. > Mar 17 10:56:35.548 [err] Reading config failed--see warnings above. > > > > > ________________________________ > От: Tobias Markus <tobias(a)markus-regensburg.de> > Кому: Sebastian Urbach <sebastian(a)urbach.org> Копия: > tor-relays(a)lists.torproject.org Отправлено: понедельник, 17 марта 2014 10:37 > Тема: Re: [tor-relays] New tor relay, some questions > > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi Sebastian, > > now that you say it -- yes, it seems we both choose the same quote :D > (Really, I didn't copy you. I've read it somewhere else a while ago > and adopted it because I liked it. But really, you didn't read > hundreds of quote books just to suddenly stumble on Franklin's quote, > did you?) > > But another thing: Do you still need participating relays for TTTT? > > Tobias > > Am 17.03.2014 16:24, schrieb Sebastian Urbach: > > Hi, > > Great that it finally worked out, welcome to thd > > brother/sisterhood. And btw. what are you doing with my mail > > signature ? That seems to be the more important issue to me ;-))) > > > Hi, > > just wanted to inform you that I could resolve the issue simply by > deleting the tor data folder (thus getting a new fingerprint). > > PS: I actually replied to Bryan, but forgot to CC tor-relays. Sadly > > I can't find the message anymore, otherwise I would have resent > > it. > > On 03/13/2014 11:08 PM, Tobias Markus wrote: > >> Hi, sorry for replying rather late! In response to 1): Thinking > >> about it, I think the main (possible) problem is that my MTA is > >> rejected by SMTP servers it connects to because of a Tor > >> blacklist. Is this probable? Has someone got experience running a > >> complete mail system and a (public) Tor relay on the same > >> host/IP? About 2): That is indeed very unfortunate, but at the > >> same time a reason to start contributing to Tor! (Sadly, I am > >> presently occupied by various other projects, but I think Tor is > >> definitely worth a 'visit'.) Now about something else. I recently > >> had to restart my server for unrelated reasons. (The relay had > >> the Guard and Stable flag at that time.) I sadly forgot to add > >> the Tor service to the default runlevel, so it was not started at > >> boot time. I went to bed thinking everything was OK and was only > >> able to start Tor about 12 hours later. Unfortunately, my relay > >> got no flags since then -- not even "Running"! The Tor consensus > >> website confirms this: Three Auths voted for all previous/normal > >> flags except Guard, the others only for Valid and V2Dir leading > >> to my relay getting no flags! I cannot really explain this to myself. > What is going on here? Tobias On Sun, Mar 02, 2014 at > >> 07:32:17PM +0100, Moritz Bartl wrote: > >>> On 03/02/2014 04:06 PM, Tobias Markus wrote: > >>>> I've been running a new tor relay for about a week now > >>> Great. Thank you! > >>> >>>> 1) I plan on running other services than tor on my server, > >>>> including a (private) mail system. Other than the general > >>>> possibility of tor having security holes and my server (and > >>>> its IP address) being public and thus possibly target of > >>>> attacks, are there security implications I should consider? > >>> Unfortunately, many sites block Tor relay IPs regardless of > >>> their exit policy. So, if you share one IP between the relay > >>> and other services, your might be impacted. This is especially > >>> true for exit relays. > >>> >>>> 2) I would be interested to eventually run a > >>>> directory/bandwith authority, so I read about them in [1] and > >>>> [2], but the places seemed a bit odd (hidserv-perf branch in > >>>> tor svn/torflow repo) so I thought I better ask here: Would I > >>>> really just have to follow the steps in [1] to become a > >>>> dirauth? Is there currently a need for auths, would contribution be > welcomed? > >>> The offer is well appreciated. In the current design, > >>> directory authorities and bandwidth authorities play a very > >>> special role. There are several ideas on how to improve the > >>> situation and then open participation to the broader community, > >>> but for the time being, authorities can only be run by people > >>> very close to the core dev team. > > - -- Tobias Markus > > "They who would give up essential Liberty, to purchase a little > temporary Safety, deserve neither Liberty nor Safety." > -- Benjamin Franklin (1706-1790) > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v2.0.20 (MingW32) > > iEYEARECAAYFAlMnMtoACgkQAO6N0EYmC9a66QCfSE+zXecw9aFJpOx7NNwnBnhZ > imoAn0rbxsbu+NeiiJnxz82TUFe3vlWg > =ZBIk > -----END PGP SIGNATURE----- > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

log: DNS servers not contactable (but only for a few seconds)
by Zenaan Harkness 17 Mar '14

17 Mar '14

Notwithstanding the short DNS outage as shown in the logs, I added a couple of extra Australian DNS servers to resolv.conf since previously I only had the primary and secondary DNS servers as assigned by the ISP. Just wondering if there's anything else I should do to increase robustness on this front. TIA Zenaan

2 1

tip: when running relay in domestic situation, have server be DHCP dependency
by Zenaan Harkness 16 Mar '14

16 Mar '14

Otherwise, others in the household might turn off everything to save power, and have no idea that this effects their local Free Speech Server (TM) (C) (R). If stopping the server from connecting to the modem, or powering down the server, stops all internet access, local fauna quickly notice said loss of internet access and appeal with relative urgency to the local Free Speech Server Guru. Disconnection problems rapidly reduce in frequency. Sincere apologies in hindsight to all anonymous clients to gracemissionstor, which went down again this evening due to a depressingly monotonously similar reason to the last few times. But Good News: a report came, via txt message, rapidly followed by personal phone support personnel (said internet users), whom, and who would have thought it, said "urgent: our internet connection is down" Wonder of wonders, awareness can be raised. :) Oh happy days! I get multiple personal contacts in almost real time, from on-site specialists no less (and with direct personal knowledge of the problem at hand), when our wholesome Free Speech Server Services stop working! You'd find it hard to find such service even if paid for :) TECH Notes: Put ADSL modem into bridge mode. Run pppoe (or as appropriate) client on server. Configure NAT, dhcpd and dnsd on server. Test all these services work after a reboot. For bonus points, install upnpd server. Prophet (for the Guru).

1 0

IPV6 exit
by tor＠afo-tm.org 15 Mar '14

15 Mar '14

Hello, i run some exits they have IPV4 and IPV6 i did bind OR port to IPV4 and IPV6 which works good. I can connect to them using IPV6 but i can't exit to IPV6 destinations. I did set IPv6Exit 1 in torrc but it's not possible to exit to a ipV6 destination. Did i miss something? what else to do to be able to connect via tor to ipv6? Thanks for help

1 1

Are zealous connections to directory port common?
by Tora Tora Tora 14 Mar '14

14 Mar '14

I just recently allowed the directory ports of my relay to be listed and noticed that some IPs are a bit overzealous in connecting to the directory port. As in 108 connections within a minute zealous. Is this unusual?

5 10

Tor plugin for Nagios - Alpha release
by ramo＠goodvikings.com 11 Mar '14

11 Mar '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hiya List As I mentioned a few weeks ago, I am developing a tor plugin for nagios. Well, today, the first alpha release is out, available at https://github.com/goodvikings/tor_nagios/tree/v0.01 . Currently it supports 6 different checks: 1 - A page fetch through the socks proxy port 2 - Hibernation state 3 - Current bandwidth 4 - OR port reachability 5 - DIR port reachability 6 - Bytes remaining until hibernation If you're interested please give it a go, feedback is more than welcome. Additionally, if you want to see any additional checks implemented, give us a yell. Cheers Ramo -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.14 (GNU/Linux) iQEcBAEBAgAGBQJTH7neAAoJEAXQWoW8lug/ws8H/RxVSKi3Ft8Lr/a3DKi+JMIC HNpOWrGbJEY3RWaJAx/H2L32KC5lE1mJbHm7BI3H1JTmdGkXmkFkyM4pou2/XQg6 DfJO+Zd7LGuJlIzqED3fyH7jB+SA4Syu+eOD710kYF4zQKBmsOy/qqW7R6Ymgq8Q 88JUUuYveAWIDgqir8WwBe8SqJsIWriVd5bObzzB5GZXiZarfMG6dw/kmJicZgyG QUOrddU/9ndrO7B3PCM8JmlB9xHMMuH97up9jS0/kIQFDUiejN/NM62AyDApd+Ef 5jqG8+E6wYWli3mlsc0d3ge4Wix0HPLhllHMxsxrTK3A3quveyVT7pZiO7t1Yas= =awZI -----END PGP SIGNATURE-----

1 0

Ask Me Anything on Reddit about Tor
by Jesse Victors 11 Mar '14

11 Mar '14

I recently held an Ask Me Anything on Reddit about Tor. For those that don't know, Reddit is famous for its AMAs, wherein someone unique or otherwise interesting will introduce themselves and then the community gets a chance to ask questions and learn. Traditionally it's been used as an excellent way of asking the questions that you never get an opportunity to ask. We've seen everyone from Chris Hadfield to Barack Obama give AMAs. Since I run some relays and a couple of exits I figured I'd give it a shot, and there was quite the turnout! I got responses from all over the world, and I strongly feel that it was a very educational moment for everyone. The main thread was voted on by about a thousand people, but many Redditors don't log on so I'd say that many thousands of people read it. The thread is still ongoing and I'll continue to answer questions as they arrive, but I figured that I'd share it with everyone since it's winding down. Pretty cool news moment for Tor, and should help clear up some misconceptions and correct public perceptions. https://pay.reddit.com/r/IAmA/comments/20243q/iaman_operator_of_eight_tor_r… Thanks guys. Jesse V.

2 1

Re: [tor-relays] Is Kaspersky right to be concerned?
by grarpamp 10 Mar '14

10 Mar '14

> [oh the bad..., re: ] > http://cryptome.org/2013/09/tor-analysis-hidden-services.pdf Do you seriously think that reporters, aid workers, freedom fighters, investigators, whistleblowers, and simple chatfriends, etc are going to publish their onions for all to see, with all their data and logs and so on as some kind of stage show for you? The answere to that is no. They have better good and private things to do that do not concern you until it hits the AP wire. So of course all you're goin to see on the public onions are a bunch of channers, criminals, crazy loons and a growing scattering of real projects and clearnet multihomes. Unlike clearnet, any statistic over the onions you can see is simply not going to be representative of the whole of onionspace, quite a bit of which you cannot see. You need to both understand and come to terms with that. Lest you too could not use anonymous systems when you needed them because some other thoughtless crybaby banned them and your ability to communicate freely and securely out from under you. ps: please drop relays and take this tired subject to tor-talk.

1 0

botnets run on Tor
by I 10 Mar '14

10 Mar '14

8 9