- tor-relays - lists.torproject.org

Re: [tor-relays] Relays vulnerable to OpenSSL bug: Please upgrade
by tor＠t-3.net 09 Apr '14

09 Apr '14

On 04/09/2014 04:39 AM, Roger Dingledine wrote:> On Tue, Apr 08, 2014 at 07:31:43PM -0600, Jesse Victors wrote: >> I'd recommend that every relay operator delete their keys as well, > > Not every. Those on OpenSSL 0.9.8, e.g. because they're using Debian > oldstable, were never vulnerable to this bug. I imagine there are some > FreeBSD or the like people out there in a similar boat. And Centos > people, etc. > > --Roger > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > The most up-to-date CentOS was supposedly vulnerable? Same as RedHat. But I don't know how to test for the vulnerability itself so I don't really know. Redhat's emailed warning to update OpenSSL went out yesterday as "Security Advisory - RHSA-2014:0376-1". CentOS' updated OpenSSL was available right away as well, and the CentOS 6.5 boxes pulled it right down in an update. I did have some slightly older CentOS 5 boxes which had a version of SSL that was reportedly not vulnerable. Page heartbleed.com said: How about operating systems? Some operating system distributions that have shipped with potentially vulnerable OpenSSL version: Debian Wheezy (stable), OpenSSL 1.0.1e-2+deb7u4 Ubuntu 12.04.4 LTS, OpenSSL 1.0.1-4ubuntu5.11 CentOS 6.5, OpenSSL 1.0.1e-15 Fedora 18, OpenSSL 1.0.1e-4 OpenBSD 5.3 (OpenSSL 1.0.1c 10 May 2012) and 5.4 (OpenSSL 1.0.1c 10 May 2012) FreeBSD 10.0 - OpenSSL 1.0.1e 11 Feb 2013 NetBSD 5.0.2 (OpenSSL 1.0.1e) OpenSUSE 12.2 (OpenSSL 1.0.1c) Operating system distribution with versions that are not vulnerable: Debian Squeeze (oldstable), OpenSSL 0.9.8o-4squeeze14 SUSE Linux Enterprise Server FreeBSD 8.4 - OpenSSL 0.9.8y 5 Feb 2013 FreeBSD 9.2 - OpenSSL 0.9.8y 5 Feb 2013 FreeBSD Ports - OpenSSL 1.0.1g (At 7 Apr 21:46:40 2014 UTC)

2 1

any action required for AWS cloud relays?
by lee colleton 09 Apr '14

09 Apr '14

I have relay(s) running in AWS. Will they auto-update? Do I need to take any action?

3 3

Clarification regardind business as usual
by Sebastian Urbach 09 Apr '14

09 Apr '14

Hi, I want to clarify my mail from earlier today regarding the recovery of the network / relays. I wrote that i expect business as usual within 2-3 days for the vast majority of the relays. That does not mean that everything is the way it was before. When the content of the /keys directory is gone you have basically a new relay and therefore the process of getting flags starts from scratch. Roger posted an excellent article regarding the life cycle of relays: https://blog.torproject.org/blog/lifecycle-of-a-new-relay -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ---------------------------------------------- Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. ---------------------------------------------- Benjamin Franklin (1706 - 1790), Inventor, journalist, printer, diplomat and statesman

1 0

TTTT
by Sebastian Urbach 09 Apr '14

09 Apr '14

Dear list members, There are also some good News in this in this sad OpenSSL days. The TTTT data collection server is back as well as the Scoreboard. Everybody who has some stored data (or new Volunteers), feel free to remove the parking brakes and start submitting ;-) New Scoreboard URL though: http://hatswitch.ece.illinois.edu/tor-traceroutes/relay_scoreboard.html Project: http://web.engr.illinois.edu/~das17/tor-traceroute_v1.html -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ---------------------------------------------- Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. ---------------------------------------------- Benjamin Franklin (1706 - 1790), Inventor, journalist, printer, diplomat and statesman

1 0

Re: [tor-relays] Heartbleed" Exchange of keys now or later?
by tor＠t-3.net 09 Apr '14

09 Apr '14

After updating the OpenSSL, I chopped our relay's keys at noon EST yesterday. The traffic has indeed collapsed since then. Old configuration was averaging around 55Mb/s per my Cacti. A URL here: https://atlas.torproject.org/#details/566B0F92197A9D855846E68D2AEEF8266B147… This morning my Cacti graphs say it is still sitting at near nothing, like 1.5Mb. "arm" says between 500-600Kb/s. The new URL is here and at least at this time, you can really see the dropoff in the 3-day graph. https://atlas.torproject.org/#details/30C19B81981F450C402306E2E7CFB6C3F79CB… I wonder how long it will take our relays to recover? I wonder if it is a good idea, or technically feasible, to do a one time kick-over of something in the Tor network so that the system sees what the relay flags etc. should be on these emergency-redefined relays. Certainly if everyone updated at once and the traffic died like this everywhere, Tor would be pretty messed.

3 2

Heartbleed: Exchange of keys now or later?
by Paul Görgen 09 Apr '14

09 Apr '14

Hi all, the discussion during the last days was inconclusive to me: Should everyone who was using a vulnerable openssl exchange their keys right now/right after the update, or should we wait for some random amount of time as to not lose all the guard relays at the same time? My guard relay went up in traffic by 50-100% since monday and I guess that is a sign that already now there is a lack of guard relays. Also I am not sure about the risks, given that probably the number of middle and exit nodes with safe keys is rising. ~Paul

1 0

Re: [tor-relays] Relays vulnerable to OpenSSL bug: Please upgrade
by Jesse Victors 09 Apr '14

09 Apr '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 I've updated OpenSSL, deleted the keys on my exit per the recommendations, and restarted the whole box. I got a new fingerprint. I'll watch to see how long the flags take to come back, but I predict it will be like a new relay. I wonder how this changes the flow rates across the Tor network. Perhaps adversary-controlled exits may not be upgraded so that they can keep their percentage advantages and take advantage of the disruption. In due time things will come back to normal. I'd recommend that every relay operator delete their keys as well, just to be safe. Pure speculation on my part here, but a well-resourced adversary might have seized the moment and done some attacking, or perhaps they knew about it beforehand. This is a major vulnerability. Admins are revoking SSL certificates, and that's for web servers. The blog post is very helpful for outlining how this exploit affects us, but let's assume the worst here. While we're updating, how about we all make sure we are running the 0.2.4 series of Tor, preferably 0.2.4.21. Switch to the Tor Project's repositories if you haven't already. Good luck guys. Jesse V. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQF8BAEBCgBmBQJTRKL/XxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQxMjgyMjhENjEyODQ1OTU1NzBCMjgwRkFB RDk3MzY0RkMyMEJFQzgwAAoJEK2XNk/CC+yAsk4H/RezKq0rEPbdbk9HG3Wjz0rE wUWBfGh3J4oultac256USLXHBHdyWnp8sT73ZhHm9H9i+ja/OjGpEwvXFIzIW09j cLMSZTf3AwTIeA8PO3S3qZsuNUwMC6kz5XhyFeRbuaBjD93Dr29Q4/zehGtPU02j 4CEqFqegjxXWL6WoKt2JyhOaV2meEz5d2GN/F6oguzk3orwX8FWc5jOewvNcRknv stFaz17JBrzqHUQY1NDx29Dw81dO5H4+sTzM+DRvTSSLKx8R1Zbw5ApevNkoWTFg ldhv/v/pHR1UnB9gsQ+r61BK3OQIWzAaVXgeZh3PDtkfX7yg1LnrdNZ2+NhUi6w= =eBTS -----END PGP SIGNATURE-----

2 1

Re: [tor-relays] Metrics for assessing EFF's Tor relay challenge?
by Karsten Loesing 09 Apr '14

09 Apr '14

Christian, Lukas, everyone, I learned today that we should have something working in a week or two. That's why I started hacking on this today and produced some code: https://github.com/kloesing/challenger Here are a few things I could use help with: - Anybody want to help turning this script into a web app, possibly using Flask? See the first next step in README.md. - Lukas, you announced OnionPy on tor-dev@ the other day. Want to look into the "Add local cache for ..." bullet points under "Next steps"? Is this something OnionPy could support? Want to write the glue code? - Christian, want to help write the graphing code that visualizes the `combined-*.json` files produced by that tool? The README.md suggests a few possible graphs. Thanks in advance! You're all helping grow the Tor network! Also replying to Christian's mail inline. On 28/03/14 09:07, Christian wrote: > On 27.03.2014 16:25, Karsten Loesing wrote: >> On 27/03/14 11:57, Roger Dingledine wrote: >>> Hi Christian, other tor relay fans, >>> >>> I'm looking for some volunteers, hopefully including Christian, to work >>> on metrics and visualization of impact from new relays. >>> >>> We're working with EFF to do another "Tor relay challenge" [*], to both >>> help raise awareness of the value of Tor, and encourage many people to >>> run relays -- probably non-exit relays for the most part, since that's >>> the easiest for normal volunteers to step up and do. >>> >>> You can read about the first round from several years ago here: >>> https://www.eff.org/torchallenge >>> >>> To make it succeed, the challenge for us here is to figure out what to >>> measure to track progress, and then measure it and graph it for everybody. >>> >>> I'm figuring that like last time, EFF will collect a list of fingerprints >>> of relays that signed up "because of the challenge". >>> >>> One of the main pushes we're aiming for this year is longevity: it's >>> easy to sign up a relay for two weeks and then stop. We want to emphasize >>> consistency and encourage having the relays up for many months. > > Do you want the challenge application to simply provide some graphs or > give some sort of interactive dashboard (clientside JavaScript)? You asked Roger, and I'm not Roger, but I'd say let's start with some graphs. We can always make it more interactive later. Though I doubt it will be necessary. >> Before going through your list of things we'd want to track below, let's >> first talk about our options to turn a list of fingerprints into fancy >> graphs: >> >> 1. Write a new metrics-web module and put graphs on the metrics >> website. This means parsing relay descriptors and storing certain >> per-relay statistics for all relays. That gives us maximum flexibility >> in the kinds of statistics, but is also most expensive in terms of >> developer hours. I don't want to do this. >> >> 2. Extend Globe to show details pages for multiple relays. This >> requires us to move to the server-based Globe-node, because the poor >> browser shouldn't download graph data for all relays, but the server >> should return a single graph for all relays. It's also unclear if the >> new graphs will be of general interest for Globe users, and if the rest >> of the Globe details will be confusing to people interested in the relay >> challenge. Probably not a great idea, but I'm not sure. >> > > I agree that Globe isn't the best place to display the challenge graphs. > Currently the only focus for Globe is to provide data for single relays > and bridges. > Imo it would be better if the challenge participants list adds links to > atlas, blutmagie and globe. Agreed! >> 3. Extend Onionoo to return aggregate graph data for a given set of >> fingerprints. Seems useful. But has the big disadvantage that Onionoo >> would suddenly have to create responses dynamically. I'm worried about >> creating a new performance bottleneck there, and this is certainly not >> possible with poor overloaded yatei. >> >> 4. Write a new little tool that fetches Onionoo documents once (or >> twice) per day for all relays participating in the relay challenge and >> that produces graph data. That new tool could probably re-use some >> Compass code for the backend and some Globe code for the frontend. >> Graphs could be integrated directly into EFF's website. This is >> currently my favorite approach. >> > > I like this idea. Glad to hear! I slightly moved away from the "fetches once or twice per day" idea to a more elaborate approach. But the general idea is still the same. >> Note for 2--4: Onionoo currently only gives out data for relays that >> have been running in the past 7 days. I'd have to extend it to give out >> all data for a list of fingerprints, regardless of when relays were >> running the last time. That's 2--3 days of coding and testing for me. >> It's also potentially creating a bottleneck, so we should first have a >> replacement for yatei. >> >>> So what are the things we'd want to track? >>> >>> - Number of relays signed up that are Running, over time. >> >> We can do something here with Onionoo's new uptime documents. >> >>> - Total bandwidth history of these running relays, over time. >> >> We can sum up data from bandwidth documents for this. >> >>> - Maybe a graph showing the total number of bytes ever contributed >>> by these relays? That would impress people perhaps. >> >> Sure, same data as above. >> >>> - Total consensus weight of these running relays, over time. >> >> We only have total consensus weight *fraction*, but yes. >> >>> - Something emphasizing duration -- e.g. the total consensus weight of >>> the subset of the relays that have been in the consensus for 90% of >>> the past month, 2 months, 6 months, etc. Are there better ideas here >>> I hope? We'll want to be cognizant that if we're in the first week >>> of the challenge, the 2 month graph will be empty and thus look sad. >> >> Not sure what the 90% part is for, but yes, graphs with total consensus >> weight fraction are doable. >> >> Regarding the sad-looking 2 month graph, we can easily define the data >> when the challenge starts and not show graphs until they make sense. >> Note that the current intervals for most data are 1 week, 1 month, 3 >> months, 1 year, and 5 years. >> >>> - Something comparing the above numbers to the total numbers. Given how >>> huge some of the relays are lately, it would be easily to visualize >>> the new contribution as a tiny irrelevant fraction, which could be >>> disheartening to new relay operators even if their relays will actually >>> become a big deal with some patience. What are some strategies for >>> making this work right? E.g. a layer graph showing y layered on top of >>> x where y is the new contribution, rather than a percentage-of-total >>> graph that shows approximately 0%. >> >> Absolute contributions to consensus weight are not available, just >> relative fractions. >> >>> We could also imagine more niche categories. For example, if we're hoping >>> to get people to sign up relays at universities, we could imagine that >>> the folks running the challenge give us a list of fingerprints of relays >>> that self-identify as being at universities, and then we do up the same >>> set of graphs with that subset of relays. >> >> Sure, that's doable. >> >>> So, Christian, others, how much of this is possible as-is or with some >>> limited tweaking, with Globe and related scripts? >>> is most of it. :) I also cc Karsten because a lot of this overlaps with >>> the metrics scripts, but I am expecting Karsten to push back against >>> the idea of integrating these measurements more with the metrics project. >> >> Right, adding this to the metrics website is not a good idea, because >> then we'd have to parse raw relay descriptors. >> >> Somebody else to include here is Sreenatha who has done a pretty good >> job processing Onionoo data for the t-shirt yes/no ticket #9889. >> >>> Any other ideas for what to measure to help people know whether their >>> contribution is being worthwhile? >> >> Not yet, but new ideas may arise when we start working on the code. >> >>> [*] Please don't take this mail as any official announcement, or timeline, >>> or any of that. At this point we need to collect people to help make >>> this happen, not collect news stories. >> >> What's the timeline for this? This requires some non-trivial coding >> time, and I'm not sure how to prioritize this over existing things on my >> todo list. >> >> All the best, >> Karsten (Found nothing else to comment on.) Thanks! All the best, Karsten

5 17

URGENT: active OpenSSL "Heartbleed" attack on Tor Nodes
by starlight.2014q2＠binnacle.cx 08 Apr '14

08 Apr '14

Have been running Tor relay with AddressSanitizer and it crashed this morning. I thought it was related to the system being close to running out of free memory until I read about the new OpenSSL vulnerability. Anyone running a Tor relay with OpenSSL 1.0.1 should update the library or rebuild against an older version immediately!!!!

2 1

Tor download signatures
by Tora Tora Tora 05 Apr '14

05 Apr '14

OK, perhaps I have missed "the how" and "which" somewhere, but which signature am I supposed to verify the new Tor 0.2.5.3 tarball against? I tried the ones mentioned on Tor signing page and none seem to stick. A typical message is: # gpg --verify tor-0.2.5.3-alpha.tar.gz{.asc,} gpg: Signature made Sun 23 Mar 2014 02:40:49 AM UTC using RSA key ID 8D29319A gpg: Good signature from "Nick Mathewson <nickm(a)alum.mit.edu>" gpg: aka "Nick Mathewson <nickm(a)wangafu.net>" gpg: aka "Nick Mathewson <nickm(a)freehaven.net>" gpg: aka "[jpeg image of size 3369]" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: B35B F85B F194 89D0 4E28 C33C 2119 4EBB 1657 33EA Subkey fingerprint: EF00 F369 1387 FCC5 8CD6 8E13 9103 97D8 8D29 319A

3 2