tor-relays

tor-relays@lists.torproject.org

42 participants
4821 discussions

Re: [tor-relays] exit and skype
by Jan Hendrik den Besten 05 Nov '13

05 Nov '13

> On Tue, Nov 5, 2013 at 2:54 PM, Lars Nood?n <lars.nooden(a)gmail.com> wrote: > > > On 11/05/2013 09:00 PM, Jan Hendrik den Besten wrote: > > > Boy, now I am in trouble... > > > > > > I run an exit node from my home address for a few weeks now, but my gf > > > starts complaining she cannot use Skype anymore to chat with her mum. > > > > > > I understand Microsoft blocks all tor exits from accessing Skype. Is > > there > > > anything I can do except converting the exit into a relay? > > > > You could try Jitsi or Blink. They're not the same as Skype but they > > are freer and the sound is better. > > > > /Lars Thanks for the suggestions. I would need something cross-platform (Linux, Windows, ipad). I'll try Jitsi.

1 0

Re: [tor-relays] Amazon abuse report
by tor＠tafb.xxx 04 Nov '13

04 Nov '13

I'm new to running a relay. There are lots of exit policies when I look at my atlas details: https://atlas.torproject.org/#details/DDB401F4CA108C6F6AF4E0DCE2DFC3407F577… Is this a pretty good exit policy list to prevent harassment from my ISP? Thanks! -Jamie M. > Putting the extensive exit restriction policy in the responses to take-down demands seems like a good idea. > > Robert

7 11

max TCP interruption before Tor circuit teardown?
by Gordon Morehouse 03 Nov '13

03 Nov '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello, I'm working on building support scaffolding[1] for Tor on Raspberry Pi and other small ARM single-board computers (SBCs). With the slower computers, sometimes too many attempts to connect to the ORPort (I am almost positive as part of TAP circuit building, but not *really* sure) can eventually cause Tor to consume more physmem than available and cause the oom-killer to kill Tor. Also, depending on the crappiness of the user's router, it's effectively a SYN flood, and can crash or impair consumer routers. My solution, so far, is to define (through trial and error on a per-machine basis, since [1] is only officially supporting 3 SBCs right now) limits on how many SYNs may be sent to the ORPort and the DirPort per second. This is done with iptables. I experimented, tuned the parameters and watched traffic for weeks and came up with a pretty good set of limits for a 950MHz Raspberry Pi: 4 SYNs/sec burst 10. (For those about to say the Pi is thus too slow to be used as a relay, it's quite capable of relaying *at least* 2.5Mbps, but *not* when it's getting SYN flooded.) So, sometimes hosts exceed this limit. Once the limit is exceeded, my current strategy is to use iptables REJECT to send an ICMP Service Unavailable (or whatever it's called, sorry no coffee yet) back to the hosts that triggered the filter. This is on a per-SYN basis. After watching the data, I noticed that some hosts just try to connect once or twice, or try to connect (during overload conditions) at reasonable intervals of tens of seconds to a few minutes. Other hosts will quadruple-tap the ORPort with SYNs, four in a row, and otherwise be much more aggressive with sending SYNs. I'm currently testing fail2ban[2] as a way to ban aggressive peers by changing that iptables REJECT to a DROP for a short period, in order to accomplish two things: 1. Encourage them to knock off their bad behavior (i.e., go away for a little while). 2. Free up CPU time, RAM and bandwidth because we don't have to construct and send ICMP packets to banned peers. Currently, if a peer violates the 4/sec burst 10 SYN limit more than 5 times in 60 seconds, that peer will be banned for 90 seconds. I'm trying to trim this down to the minimum that will protect the relay, and 90 seconds is a guess given some of my fears, read on... During an overload condition, my primary priority is to protect the relay, but of course I wish to do so with as little disruption to the Tor network as possible. So, here is a potential problem with my approach that I can think of, which could degrade service (mildly, for a few end users) on the Tor network. First, during a SYN flood type overload, some peers which have *existing* circuits built through the relay and are sending SYNs as normal traffic, will stochastically get "caught" in the filter and banned for a short time. If these hosts already have circuits open through the relay which is overloaded, I would prefer to preserve those circuits rather than break them. My defensive strategy versus overload here is to throttle new circuit creation requests, *not* to break existing circuits. So here's the $64,000 question: If a tor relay has a circuit built through a peer, and the peer starts dropping 100% of packets, how long will it take before the relay with the circuit "gives up" on the circuit and tears it down? I want to set my temp ban time *below* this timeout. Thus, unlucky peers that were caught in the filter and have circuits already built through the relay they will experience a brief performance degradation, but they won't lose their active circuits through the overloaded relay, and in the meantime hopefully the overload condition is becoming resolved. Is there such a timeout? There must be. Can someone tell me what it is? Or, is there a better way to protect low-resource machines (slow CPU, 512MB RAM) against the SYN flood "circuit creation storm" conditions which occasionally arise on the Tor network? Again, I must reiterate, machines with specs like these can be very good relays for home broadband users. The true goal of my project[1] is to build a set of software which enables a "plug and forget" relay for home broadband users that costs well under $100. [1] https://github.com/gordon-morehouse/cipollini [2] http://www.fail2ban.org/wiki/index.php/Main_Page Best, - -Gordon M. -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJSZAfXAAoJED/jpRoe7/ujGQ4H/jUUjdufoWw1qthjsqdf4ICO ejJXBuZ60O8TpuiT07EtZq9tSDsb5hLqjJMORNJWPJe3ffD7/BHv/6St0y0fkjFh svEFBwVMmkNfaDd65z2JaFBRnSQTsgtiOeOnQFQt1evWQMeVmFsvoMvVIbqGSkf6 NipJnfFeoAtt/6cCMl7+yIxmGGb1Udl0ZEmlVacIYtFr8MjgIo59vT94k7SuzV1N 4Na9PNeQ9WIBlZf9vyesHgnuzJA8hEkFyoP5Fc3bPT/e3WYdAIifswE6rhZVT+AQ 9rHRvBUVoYpMNyy0fqMY34rLYegelIYstsy26dmW+robJKDxGVC3zBeGbOtcEOE= =mSYu -----END PGP SIGNATURE-----

5 29

Re: [tor-relays] dynamically adjusting bandwidth
by starlight.2013q4＠binnacle.cx 03 Nov '13

03 Nov '13

>The question is, should I put in an adjustment for >'MaxAdvertisedBandwidth' during the backup window >or make any other change to advise remote relays to >de-prioritize the node for the duration? Another unanswered question now understood: As a consequence of a simple parameter tweak, Vidalia buggily zapped (for the second time) the relay configuration and turned off relaying. Quickly restored 'torrc' and restarted the relay, but noticed that the getinfo dir/server/authority observed bandwidth value (third of three) was zapped to a low value for about an hour. This had the effect of causing four out of nine authorities to remove the Guard flag and almost resulted in a consensus "not Guard" state. So the answer here is definitely DO NOT lower 'MaxAdvertisedBandwidth' during intervals when 'RelayBandwidthRate' is reduced for events like offsite backups. Doing so will probably cause the Guard flag to be removed when it is present. The only possible exception would be if one has insane amounts of bandwidth and the lowered value is still quite high. Seems unlikely that 'MaxAdvertisedBandwidth' has any immediate effect on the selection algorithm is only averaged into consensus bandwidth gradually, so probably it's best to not make temporary reductions.

2 1

connecting to obfsproxy bridge from OSX10.9 and TorBrowser-Pluggable-Transports-2.4.17-beta-2-pt3-osx-i386
by Paul Garrett Hugel 03 Nov '13

03 Nov '13

Please steer me to the correct list if off topic here Remote machine is Ubuntu obfsproxy bridge on amazon ec2 using ARM My local machine running 10.9 Mavericks with TorBrowser-Pluggable-Transports-2.4.17-beta-2-pt3-osx-i386 I read the trouble ticket #10030 https://trac.torproject.org/projects/tor/ticket/10030 changed the torrc file entries as indicated below ClientTransportPlugin flashproxy exec ./flashproxy-client --register :0 :9000 ClientTransportPlugin obfs2,obfs3 exec ./obfsproxy.bin managed Still cannot get the Browser to use the proxy Nov 01 22:55:58.740 [Warning] Could not launch managed proxy executable at './flashproxy-client' ('No such file or directory’). Nov 01 22:55:58.764 [Warning] Could not launch managed proxy executable at './obfsproxy.bin' ('No such file or directory’). Ok If I want to get serious and access my Ubuntu obfsproxy bridge on amazon ec2 what Tor components on local machine do I use and configuration Tor builds the circuits but browser can’t connect to proxy so Its non-functional for web browsing Thank you D922 B7B1 3A4D 9BF9 0927 DCA1 7A14 4B7D A3F4 8305

3 2

Re: [tor-relays] significance of different bandwidth values
by starlight.2013q4＠binnacle.cx 01 Nov '13

01 Nov '13

At 16:19 10/15/2013 -0400, starlight(a)binnacle.cx wrote: >Question: > >What the difference between the bandwidth >value given by > getinfo ns/name/xxxxx > >>> w Bandwidth=297 >and > getinfo dir/server/authority > >>> bandwidth 300000 375000 335872 Since no one answered the question and I now have an idea about it, I'll attempt an answer for future web-searchers. . . getinfo ns/name/<node-name> This appears to be a consensus bandwidth calculation generated by five of the nine Tor authority nodes. These nodes run a special relay control client that accumulates and analyzes bandwidth reporting by other Tor nodes via "signal" updates from a daemon control channel. Think they are called 'bwauth's. The value can swing wildly, but appears that the pattern is sinusoidal with an average close to the true bandwidth available from a relay. After a few days the swings in the value seem to dampen somewhat. This "consensus bandwidth" value appears to be what is used by the client nodes' relay path selection algorithm. getinfo dir/server/authority This appears to the observed bandwidth calculation derived from local node statistics. Is much more stable and accurate, but is "informational" and is not used in the path selection algorithms.

1 0

Cisco ASA
by starlight.2013q4＠binnacle.cx 31 Oct '13

31 Oct '13

For anyone running a Cisco ASA between their 'tor' relay and the Internet, some potentially useful info: The default ASA connection timeout is short and often results in 'telnet' sessions through VPN tunnels getting whacked. So one might add timeout conn 48:00:00 to a config to mitigate that issue. However a busy 'tor' relay instance will rapidly accumulate large numbers of dead connection table entries due to loss of FIN packets from flaky corners of Internet. I'm not 100% sure about this, but it seems these dead connection table entries can impair the formation of new connections, not to mention the obvious potential for excessive memory consumption on the ASA. The solution is: access-list tor-class extended permit tcp any host X.X.X.X access-list tor-class extended permit tcp host X.X.X.X any where X.X.X.X is the 'inside' server running 'tor' class-map tor match access-list tor-class policy-map outside class tor set connection timeout idle 0:06:00 As 'tor' sockets have a default KeepalivePeriod 300 any connection with an idle time of more than five minutes is a dead duck and can safely be removed. Checked this out carefully. The comment above was inspired by a seeming performance boost and increase in connections observed after the change was made, not by direct traffic analysis. Could be coincidental. The way to verify it's working is with the show conn addr X.X.X.X long command, which includes the idle timeout associated with each connection. If one has other services running on the same box as 'tor', it might be necessary to adjust the 'access-list' to take them into account.

1 0

Re: [tor-relays] Advice on dealing with ISP's response toDMCAtakedownnotice.
by tor＠t-3.net 30 Oct '13

30 Oct '13

Yeah. Not saying I see a good way to do it. Not really asking for it. Whiny, IDS-noticed, almost nuisance-type complaints are the only ones we've gotten. The complaints aren't even describing successful intrusions. Sucks if these whinebucket type of complaints are making it harder in real world terms for people to host exit nodes. On Wednesday 30/10/2013 at 8:56 am, Linus Nordberg wrote: > Hi, > > Sounds like you risk ending up with a censorship tool controlled by > those who control the list of attack signatures. > > I'd prefer if we educate service providers about this dangerous place > called the internet with the goal of making them turn down the volume > on > their sirens a notch. > > > tor(a)t-3.net wrote > Wed, 30 Oct 2013 07:56:28 -0400: > > | What he said. > | > | No DMCA so far but, one thing I keep getting is complaints about > "SQL > | injection attacks". Apparently snort or other IDS picks this stuff > up > | and emails the abuse box. Some but not all of the complaints are > | automated. > | > | It would be nice if something could detect these attack signatures > on > | the internet-bound packets from our exit node and drop them. With > | trends as they are, we'd see zero abuse complaints, if there were a > | good way to do that. > | > | > | > | > | On Wednesday 30/10/2013 at 6:41 am, Moritz Bartl wrote: > | > On 25.10.2013 19:13, krishna e bera wrote: > | >> > | >>> > | >>> ExitPolicy accept *:1723 # PPTP > | >> How are you getting PPTP to work over Tor? The ISP-supplied > modems > | >> i've > | >> seen won't pass IP protocol 47 (GRE) packets without putting the > | >> target > | >> machine in a DMZ. > | > > | > > https://trac.torproject.org/projects/tor/wiki/doc/ReducedExitPolicy> > contains it. > | > > | > It's more of a "catch all" exit policy, but gets rid of most DMCA > | > complaints. > | > _______________________________________________ > | > tor-relays mailing list > | > tor-relays(a)lists.torproject.org > | > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > | > | _______________________________________________ > | tor-relays mailing list > | tor-relays(a)lists.torproject.org > | https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

Re: [tor-relays] Advice on dealing with ISP's response to DMCAtakedownnotice.
by tor＠t-3.net 30 Oct '13

30 Oct '13

What he said. No DMCA so far but, one thing I keep getting is complaints about "SQL injection attacks". Apparently snort or other IDS picks this stuff up and emails the abuse box. Some but not all of the complaints are automated. It would be nice if something could detect these attack signatures on the internet-bound packets from our exit node and drop them. With trends as they are, we'd see zero abuse complaints, if there were a good way to do that. On Wednesday 30/10/2013 at 6:41 am, Moritz Bartl wrote: > On 25.10.2013 19:13, krishna e bera wrote: >> >>> >>> ExitPolicy accept *:1723 # PPTP >> How are you getting PPTP to work over Tor? The ISP-supplied modems >> i've >> seen won't pass IP protocol 47 (GRE) packets without putting the >> target >> machine in a DMZ. > > https://trac.torproject.org/projects/tor/wiki/doc/ReducedExitPolicy > contains it. > > It's more of a "catch all" exit policy, but gets rid of most DMCA > complaints. > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

2 1

Re: [tor-relays] Advice on dealing with ISP's response to DMCA takedownnotice.
by tor＠t-3.net 30 Oct '13

30 Oct '13

Reply to the email, say that you found a misconfiguration in your Tor daemon which could have accounted for this problem and you've repaired it, and hopefully this problem is resolved for the future. Put the below as your exit policy in torrc, and I'd stop/start the service to be sure it grabbed it. Using the below exit policy, we've had our exit node running for a couple months or so doing pretty good bandwidth, and not had a single warez-related complaint. Seen some complaints about SQL injection attacks but perhaps those will annoy your ISP less. ExitPolicy accept *:20-23 # FTP, SSH, telnet ExitPolicy accept *:43 # WHOIS ExitPolicy accept *:53 # DNS ExitPolicy accept *:79-81 # finger, HTTP ExitPolicy accept *:88 # kerberos ExitPolicy accept *:110 # POP3 ExitPolicy accept *:143 # IMAP ExitPolicy accept *:194 # IRC ExitPolicy accept *:220 # IMAP3 ExitPolicy accept *:389 # LDAP ExitPolicy accept *:443 # HTTPS ExitPolicy accept *:464 # kpasswd ExitPolicy accept *:531 # IRC/AIM ExitPolicy accept *:543-544 # Kerberos ExitPolicy accept *:554 # RTSP ExitPolicy accept *:563 # NNTP over SSL ExitPolicy accept *:636 # LDAP over SSL ExitPolicy accept *:706 # SILC ExitPolicy accept *:749 # kerberos ExitPolicy accept *:873 # rsync ExitPolicy accept *:902-904 # VMware ExitPolicy accept *:981 # Remote HTTPS management for firewall ExitPolicy accept *:989-995 # FTP over SSL, Netnews etc ExitPolicy accept *:1194 # OpenVPN ExitPolicy accept *:1220 # QT Server Admin ExitPolicy accept *:1293 # PKT-KRB-IPSec ExitPolicy accept *:1500 # VLSI License Manager ExitPolicy accept *:1533 # Sametime ExitPolicy accept *:1677 # GroupWise ExitPolicy accept *:1723 # PPTP ExitPolicy accept *:1755 # RTSP ExitPolicy accept *:1863 # MSNP ExitPolicy accept *:2082 # Infowave Mobility Server ExitPolicy accept *:2083 # Secure Radius Service (radsec) ExitPolicy accept *:2086-2087 # GNUnet, ELI ExitPolicy accept *:2095-2096 # NBX ExitPolicy accept *:2102-2104 # Zephyr ExitPolicy accept *:3128 # SQUID ExitPolicy accept *:3389 # MS WBT ExitPolicy accept *:3690 # SVN ExitPolicy accept *:4321 # RWHOIS ExitPolicy accept *:4643 # Virtuozzo ExitPolicy accept *:5050 # MMCC ExitPolicy accept *:5190 # ICQ ExitPolicy accept *:5222-5223 # XMPP, XMPP over SSL ExitPolicy accept *:5228 # Android Market ExitPolicy accept *:5900 # VNC ExitPolicy accept *:6660-6669 # IRC ExitPolicy accept *:6679 # IRC SSL ExitPolicy accept *:6697 # IRC SSL ExitPolicy accept *:8000 # iRDMI ExitPolicy accept *:8008 # HTTP alternate ExitPolicy accept *:8074 # Gadu-Gadu ExitPolicy accept *:8080 # HTTP Proxies ExitPolicy accept *:8087-8088 # Simplify Media SPP Protocol, Radan HTTP ExitPolicy accept *:8332-8333 # BitCoin ExitPolicy accept *:8443 # PCsync HTTPS ExitPolicy accept *:8888 # HTTP Proxies, NewsEDGE ExitPolicy accept *:9418 # git ExitPolicy accept *:9999 # distinct ExitPolicy accept *:10000 # Network Data Management Protocol ExitPolicy accept *:11371 # OpenPGP hkp (http keyserver protocol) ExitPolicy accept *:12350 # Skype ExitPolicy accept *:19294 # Google Voice TCP ExitPolicy accept *:19638 # Ensim control panel ExitPolicy accept *:23456 # Skype ExitPolicy accept *:33033 # Skype ExitPolicy reject *:* On Thursday 24/10/2013 at 9:11 pm, Christopher Jones wrote: > > I’ve been running an exit relay for about 3 days and, sure enough, > some BitTorrent bugger caused sh3lls.net to send me a DMCA nastygram: > >> >> We have got the following complain, please remove all illegal torrents >> immediately from your server: >> >> Evidentiary Information >> Title: Suits (TV) >> Infringement Source: BitTorrent >> Initial Infringement Timestamp: 17 Oct 2013 22:06:17 GMT Recent >> Infringement Timestamp: 17 Oct 2013 22:06:17 GMT Infringing Filename: >> Suits Season 3 Episode 6 (The Other Time) (HDTV x264)-ASAP (1GBps >> SeedBox).mp4 URL if applicable: >> Infringing File size: 364405400 >> Infringers IP Address: 64.32.14.34 >> Bay ID: 7fbb4256bfca558d5a809b9f6536b5fd5e4e782d|364405400 >> Port ID: 33788 > > I followed through with the templates provided by the Tor Project as a > response to the DMCA takedown notification. A day later, the ISP sent > me this: > >> >> Dear Christopher >> Whether you run Tor or not, we even told you in past, it's your >> responsibility to stop all abuse >> If Tor is causing it, stop the program Tor on your server, if we get >> another complain we will have to suspend/terminate your services >> >> tor always always gets lots and lots of abuse and complains >> >> Update us within 24 hours >> >> Thanks > > I was never provided with the full text of the original DMCA > complaint, so I was unable to respond. Furthermore, I was never > “even told…in the past” that I had to stop all abuse caused by > Tor. Tor is not singled out in the ToS or AUP. And I was certainly > never told anything in the past about abuse and Tor specifically. As I > said, first warning. Then there’s the “tor always always gets lots > and lots of abuse and complains [sic]”. Which is kind of bizarre, > because their position on tor seems a bit cagey. Does the claim about > lots of abuse mean they won’t allow exit nodes? Or is that just a > “hint” that I’d be better off not trying to run it? > > And this is an ISP I picked from the good list. > > Suggestions are welcome. I’m running with the default exit node > policy, which should block most of the abuse-laden ports. > BitTorrent’s a little harder to deal with. I’ve no qualms working > with the ISP to mitigate their concerns, but I’m not sensing their > returning the same spirit of cooperation. > > .cpj_______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >

3 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-relays