- tor-relays - lists.torproject.org

Avoiding sinkholes
by ramo＠goodvikings.com 28 Mar '14

28 Mar '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Heya List I currently run a VPS which hosts both my mailserver and my tor relay / exit. Recently I sent an email from this mailserver and had it bounce back. It seems the receiving mailserver subscribes to the spambot list CBL (http://cbl.abuseat.org) and denied it because my IP address was on that list. It's on that list since at some point a botnet talking through tor to its C&C server used my exit node to do so - The C&C server has since been replaced with a sinkhole. That was logged, my server was deemed infected and bam, I'm blacklisted. The site that did the blacklisting kindly has a good description of what happended (including the sinkhole IP address) and allowed an automatic delisting. I'm able to update my exit policy so it doesn't happen again, however I'd like a somewhat more proactive approach. So my question is - Does anyone know of a publicly available list of sinkholes created for botnets? If such a list exists I can dynamically update either my exit policy or firewall appropriately. Has anyone implemented such a system already? (obviosuly this only works for sinkholed botnets - but if anyone knows how to stop all botnets I'm all ears....) Cheers Ramo -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.14 (GNU/Linux) iQEcBAEBAgAGBQJTNQpGAAoJEAXQWoW8lug/mdkH/jqK5ndFWbVrRnNV7a8IqgYl 4iiR6TUYLjGEdcz8VDZ+cOkW0uCQkOvD6RWl/kWHKmA4iy7alFgbKE4Lkcg4QgBB 7EgNYww3zBbj1NX5rtRN7POge2n4ns7Y7whw0qbvHXE0ur74iLyy5H3hHZeWoosU g6t9mCsMpEpGAvbkzkDxo+idAdxYe+JiB3iaAAEUDtzeStOG5RJ/qrg8JM+U7ofA bWPehBV8+V8E//4G/XLsePCciBN0071ylg+YoGcxDpM97WHvmQKbi5VU3KfQJFTB AFaQ+7ib1BNhe7KEC7V0Iha6Yu/BTNhDRA/0i1C3pad32HQsfGvep261yq+KBjc= =Wemh -----END PGP SIGNATURE-----

3 3

the obfsproxy bundle, and decrease in number of users to my bridges
by Viking God 27 Mar '14

27 Mar '14

A repost, as I didn't get any answers when I posted in another thread: Where can I download an obfsproxy bridge bundle nowadays? It seams to have disappeared. I use both win and linux(but not debian/ubuntu). I have found dual information pages about setting up obfsproxy+tor in Debian/Ubuntu Here: https://www.torproject.org/projects/obfsproxy-instructions.html.en And here: https://www.torproject.org/projects/obfsproxy-debian-instructions.html.en Why dual instructions for Debian/Ubuntu? But no instructions for other OS:es, and no direct download links with compiled packages/programs here: https://www.torproject.org/dist/ How do you suppose that people will be able to help setting up obfsproxy bridges, when there isn't any way to get instructions or packages/programs? Previously I ran an obfsproxy bridge and saw the amount of traffic get lower and lower, at the end it was only about 2-10 MB of traffic per week and with very few users. Some weeks I go no users so I stopped wasting my electricity and stopped running the obfs-bridge. But now I would like to try again after a couple of months pause. I'm interested to see if the Internet-blocking in Turkey might have caused some more traffic. I also used to run a normal bridge up until a couple of weeks ago but saw the traffic get as low as around 50MB per week, while normally I used to get around 1-2GB per week so I shut it down too. I asked myself: "What's the point of wasting energy and at the same time making it easier to hack into my network, when I'm not even helping the world?". So I shut it down too. Perhaps some changes in the tor network after the release of Tor 0.2.4 has reduced the number of bridge and obfsproxy users globally? Due to the constant flow of bugs in the different tor-related software and bundles, my first guess is that the problem is with changes in Tor plus related software. A look at the bug tracker makes me wonder if there are more things in the Tor related software that do work or don't work??? But perhaps more bridges are blocked nowadays by the filters that various countries apply to the Internet? Or perhaps less countries block their Internet users so less people need to use bridges? Or perhaps a lot of new bridge operators have arisen, making every bridge receive less traffic? My ISP isn't known for blocking anything and I've never heard of any government blocking of Tor in the EU, so the problem is probably not with my ISP nor the EU. I have always been running the latest stable release of the bundles, so It doesn't have anything to do with old versions. So my questions: Where can I find a obfsproxy bridge bundle for rpm-linux and for windows? Is there any good explanation to why the traffic to my normal bridge and my obfsproxy bridge got lower and lower after the release of tor 0.2.4 as stable?

2 1

Tor-Plugin for munin
by Martin Weinelt 27 Mar '14

27 Mar '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Everybody likes graphs, right? I tried some of the available munin plugins, but none of those were really working anymore. So I sat down and began writing my own, using stem, which is really awesome. These are really early stages, but it already supports autoconf determination and suggestions. If you want to take a look, it is hosted on github[1]. At the moment it supports a connection graph, getting its data from orconn-status. More graphs are possible, but not yet implemented. Ideas are welcome. Regards, Martin Weinelt [1] https://github.com/mweinelt/munin-tor -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJTMhmTAAoJEL1KoFKPY/F+Hs0H/2X3RwoyIMJrAximYeqMTDbN 5w5nOwi+iv0Klr2Pe4bkSIR+OHoTp7lUHFlEGHk7WC/Z6LE0luCHEmQbRS0S9a6o e0gcTczRFfxW/BNLUMeiD0SbKLromdDBJtGFM94Eqr9da/CpiicLG4sBkOwO0k8p 2NF8cBSrwqpLlg+FdA+wIomFUAl4Ph/qKRNN6NALeQqxkLFI1vQxmJarC+y9bV6Q z+g8ccn5jqhaJm4rX0j9/MzSspwtf5yQ+2pD6+QCroXynbMq5AQjU3BTb9VCk9jW eofy3LlP0LnVw9nFBKpGWWNFyYfG/cptrORLwMBfuaHqscYrbAAdcwlu0D4nxwc= =H5tI -----END PGP SIGNATURE-----

2 2

log: Error binding network socket to 203.217.31.172: Cannot assign requested address
by Zenaan Harkness 27 Mar '14

27 Mar '14

>From here: Mar 27 16:50:35.000 [warn] Error binding network socket to 203.217.31.172: Cannot assign requested address to here: Mar 27 23:56:46.000 [warn] Error binding network socket to 203.217.31.172: Cannot assign requested address I got 828 of those messages. Why no socket number, or more information in the logs to debug this? Although it only happened in that time frame above - not happening any more. TIA Zenaan

1 0

Tor relay setup
by eugene zhukovsky 26 Mar '14

26 Mar '14

Hi, I am trying to setup Tor relaying, but it doesn't work so far. Windows 8, private vpn. I opened ports 80,443,9001 and 9030 (both TCP and UDP) on my Comcast router to be forwarded to the box I'm trying to configure. I added inbound and outbound rules in the firewall setup for ports 80,443,9001 and 9030 (both TCP and UDP) but I'm still getting Mar 15 15:30:58.654 [Warning] Your server (62.210.167.197:443) has not managed to confirm that its ORPort is reachable. Please check your firewalls, ports, address, /etc/hosts file, etc. Mar 15 15:30:58.658 [Warning] Your server (62.210.167.197:9030) has not managed to confirm that its DirPort is reachable. Please check your firewalls, ports, address, /etc/hosts file, etc. Please advise, ----------- Best wishes, Gene

5 8

ORPort is unavailable after a couple of minutes of successful self-testing
by Tachkov Sergey 25 Mar '14

25 Mar '14

Hello, We have previously set up and adjusted a non-exit node with the following key parameters: ORPort 443 NoListen ORPort 127.0.0.1:4443 NoAdvertise After upgrading tor up to the latest version (0.2.4.21) we started receiving in log the following: Mar 23 11:53:06.000 [notice] Now checking whether ORPort 1.2.3.4:443 and DirPort 1.2.3.4:9030 are reachable... (this may take up to 20 minutes -- look for log messages indicating success) Mar 23 11:53:07.000 [notice] Self-testing indicates your DirPort is reachable from the outside. Excellent. Mar 23 12:13:06.000 [warn] Your server (1.2.3.4:443) has not managed to confirm that its ORPort is reachable. Please check your firewalls, ports, address, /etc/hosts file, etc. Mar 23 12:33:06.000 [warn] Your server (1.2.3.4:443) has not managed to confirm that its ORPort is reachable. Please check your firewalls, ports, address, /etc/hosts file, etc. Firewall and the application which redirects traffic to the 4443 port haven't changed. What may be the cause of that?

2 2

Tor Relay Performance
by Sebastian Urbach 25 Mar '14

25 Mar '14

Hi, Everytime i speak with colleagues i wonder that the most performance related options for TOR relays are unknown. I just started to write down what i know and i would be happy if someone else could benefit from that. http://key-server.org -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ---------------------------------------------- Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. ---------------------------------------------- Benjamin Franklin (1706 - 1790), Inventor, journalist, printer, diplomat and statesman

5 4

Port 8118 Traffic?
by Dennis Crawford 25 Mar '14

25 Mar '14

Hello - I just recently installed a Tor Relay and now I'm seeing a TON of port 8118 denied requests in my log. Mar 21 17:24:51 kendra kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=c8:0a:a9:9e:2f:02:00:90:1a:a2:a0:7e:08:00 SRC=162.211.126.188 DST=72.90.68.179 LEN=48 TOS=0x00 PREC=0x00 TTL=122 ID=16300 DF PROTO=TCP SPT=4853 DPT=8118 WINDOW=65535 RES=0x00 SYN URGP=0 Mar 21 17:24:53 kendra kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=c8:0a:a9:9e:2f:02:00:90:1a:a2:a0:7e:08:00 SRC=162.211.126.227 DST=72.90.68.179 LEN=48 TOS=0x00 PREC=0x00 TTL=122 ID=19011 DF PROTO=TCP SPT=1146 DPT=8118 WINDOW=65535 RES=0x00 SYN URGP=0 Mar 21 17:24:55 kendra kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=c8:0a:a9:9e:2f:02:00:90:1a:a2:a0:7e:08:00 SRC=162.211.126.173 DST=72.90.68.179 LEN=48 TOS=0x00 PREC=0x00 TTL=122 ID=28405 DF PROTO=TCP SPT=3137 DPT=8118 WINDOW=65535 RES=0x00 SYN URGP=0 Mar 21 17:24:57 kendra kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=c8:0a:a9:9e:2f:02:00:90:1a:a2:a0:7e:08:00 SRC=216.245.222.105 DST=72.90.68.179 LEN=52 TOS=0x00 PREC=0x00 TTL=56 ID=24995 DF PROTO=TCP SPT=2998 DPT=8118 WINDOW=65535 RES=0x00 SYN URGP=0 Mar 21 17:24:59 kendra kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=c8:0a:a9:9e:2f:02:00:90:1a:a2:a0:7e:08:00 SRC=162.211.126.180 DST=72.90.68.179 LEN=48 TOS=0x00 PREC=0x00 TTL=122 ID=21683 DF PROTO=TCP SPT=3372 DPT=8118 WINDOW=65535 RES=0x00 SYN URGP=0 Mar 21 17:25:01 kendra kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=c8:0a:a9:9e:2f:02:00:90:1a:a2:a0:7e:08:00 SRC=173.234.116.173 DST=72.90.68.179 LEN=48 TOS=0x00 PREC=0x00 TTL=247 ID=9188 PROTO=TCP SPT=1976 DPT=8118 WINDOW=65535 RES=0x00 SYN URGP=0 I'm not configured at 8118. My config: SocksPort 72.90.68.179:9050 # Bind to this adddress:port too. SocksPolicy accept 72.90.68.176/29 ControlPort 9051 ORPort 9001 DirPort 9030 # what port to advertise for directory connections On my firewall, I'm allowing: TCP_IN: 9030,9001,9050,9051 and TCP_OUT: 9030,9001,9050,9051 Am I doing something wrong? Why am I getting all this 8118 traffic? Any help would be greatly appreciated. Dennis

3 2

Raspberry Pi binary .debs - 0.2.4.21
by Gordon Morehouse 24 Mar '14

24 Mar '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello all, I've finally released[1] signed binary .debs for Tor 0.2.4.21 for Raspberry Pi. All the usual "random dude's binaries" apply, but at least these are signed with my PGP key and distributed with hashes. They're really for temporary Pi testing or convenience, be paranoid and build from source following the procedure alluded to in the project README. Check the Cipollini Project README[2] for more information about the (very nascent) project. Best, - -Gordon M. 1. https://github.com/gordon-morehouse/cipollini/tree/master/raspbian_packages… 2. https://github.com/gordon-morehouse/cipollini -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJTLg/MAAoJED/jpRoe7/ujO+8H/3c3RJzsYEtWq8/BJcwnW0nP awxBU3Lb0iAt9JNOw7zcdtA6WdC6eIHgKYZ0nH7Vwc4+bHn/RGyvLrD4n11pgB2I eKz2ikQXSWb5jqNQD7sCwQeh5drLxH0VMedOtirpMlqyUteKJOMQfbxmDRA5MBtN KXSSsbKxatnnVA/3/9GFO8oLDEfA0IXp5/RN4bjXDqzW9jHJfC7LVRxq8LK3RRif MYTuzNV3e8CQ9+q5fyqgCBPLA7OBIhH+wVKOVwU/RLlyQTRUqtV9b9Fe7CXXj5eZ YgUgZeNVQZ3gBtSuWWuVHGPu+ZKskSvVKu8Gcj71XCnu6LfI+3DyRWmhCXRU5i4= =yTek -----END PGP SIGNATURE-----

4 7

New obfsproxy release: obfsproxy-0.2.7 [bridge operators: please upgrade!]
by George Kadianakis 24 Mar '14

24 Mar '14

Hello, a few days after the release of obfsproxy-0.2.6, we spotted a bug where scramblesuit would basically reject clients if they try to connect a second time after a short amount of time has passed [0]. This is a serious correctness bug and bridge operators are advised to upgrade to obfsproxy-0.2.7 as soon as possible (we want to start suggesting scramblesuit to users and we need to make sure that most bridges have already upgraded by then). You can use git master or pip to upgrade to 0.2.7. We have also notified the obfsproxy Debian maintainers and we should soon have obfsproxy-0.2.7 packages ready (we will send an email to this list when they are ready). Furthermore, obfsproxy-0.2.7 clients now support SOCKS5 (thanks Yawning!) and the changes also include a few performance enhancements for obfs3 and scramblesuit. Please upgrade your bridges. Thanks! PS: We will do yet another obfsproxy release soon-ish (probably in the next 2 weeks) which will include some more scramblesuit improvements and other miscellaneous code changes. Again, we will inform you by sending an email to this list. [0]: https://trac.torproject.org/projects/tor/ticket/11100

8 9