tor-relays

tor-relays@lists.torproject.org

42 participants
4821 discussions

Re: [tor-relays] Is it safe to run an exit node from a VPS provider?
by Sindhudweep Sarkar 13 Aug '13

13 Aug '13

Apologies if the reply goes to the wrong location in the thread. "... At least with Xen/KVM/VMware you're running on your own virtual disk..." Can't the virtual disk just be mounted by whoever has access? I don't think this is a large barrier to entry for anyone or a script looking for private keys. I could argue that pretty much every mac user has been getting software in the form of disk images, and these possibly non-technical users seem to have no issues.

5 4

Question about TOR bandwidth management
by tor＠t-3.net 13 Aug '13

13 Aug '13

Hello, Is it possible to configure a TOR node to have different bandwidth limits at different times of day and on different days of the week? Thank you.

1 0

Raspberry Pi Relay Node Performance and future Plans on Documentation and more
by Michael Berlin 13 Aug '13

13 Aug '13

Hi Gordon and Matthias, I've split your discussion from the original thread "Running exit-node in Germany" and created a new one. I fully agree with you that the Raspberry Pi is the perfect device to let others run a Tor Relay Node very easily. What follows is a long mail about my experiences and more thoughts about the Pi as relay. On Thu, Aug 1, 2013 at 5:29 PM, Gordon Morehouse <gordon(a)morehouse.me>wrote: > Matthias Redies: > > Ok that is good to know. Right know I will probably run it on 1-1.5 Mbps > > and later on 3-4 Mbps. What is the maximum your raspberry is capable to > > do? Please let me know if you publish your tutorial. > > I had it pushing about 1.5Mbps and crashing only about once a week > before I started having TCP connect floods and had to take it offline > until I could pay attention for a while. I'm still tuning it. It > crashed much, much more often before some basic tuning, though. > I'm running a relay node on a Raspberry Pi at my VDSL home connection for several weeks now (provider "Deutsche Telekom", connection is 50mbps down, 10 up) and I didn't run into such issues so far. There're already several howtos out there which describe how to setup a relay node on the Raspberry Pi. I used this German one as starting point: http://blog.weezerle.de/2013/01/11/raspberry-pi-als-tor-server/ My current configuration has only the following two non-default options: DisableDebuggerAttachment 0 AvoidDiskWrites 1 (Plus, I run it as relay only by disabling the socks proxy with "SocksPort 0".) Here's my node: https://atlas.torproject.org/#details/5AB2F49A1B79148E3A8F52808A00451DA0084… http://globe.rndm.de/#/relay/5AB2F49A1B79148E3A8F52808A00451DA00841B1 As you can see, it forwards on average between 2-4mbps (256-512 kB/sec) and there're peaks as high as 5.5mbps (~700 kB/s). The throughput varies depending on the day of week and time of day and therefore I believe the low average isn't the Raspberry's fault. I guess, if I set a higher advertised value, then I would see a more constant throughput closer to the peak value. Currently, it's set to 10mbps: RelayBandwidthRate 1024 KB RelayBandwidthBurst 1024 KB (Note that the Pi is definitely not able to forward 10mbps of Tor traffic, but it would be great to max it out 24/7.) The logged throughput is also consistent with what I saw with the console traffic monitor "nload" (suggested command line options for nicer units and less refreshes: nload -u K -U G -t 3000). I guess, I saw even higher peaks there. Monitoring everything with "arm" is also nice but far too CPU intensive. More information about my setup: - I have the B revision with 512 MB memory - running stock Raspbian - installed "tor" package 0.2.3.25-1 from the Raspbian repository - CPU is overclocked using "raspi-config" to 950 MHz Before I overclocked the Pi, I saw a similar average throughput. When you search for "rasp" at Tor Atlas or Globe (e.g. http://globe.rndm.de/#/search/query=rasp) , you can see that there're already more than 40 devices running. My node performs quite well compared to others and I would argue that it's in the top 5 among all Raspberry Pi nodes so far. To track down possible CPU problems, we should also compare the openssl benchmark results. The Raspberry Pi wiki has some reference values: http://elinux.org/RPi_Performance#Results_3 I've attached the summary output of "openssl speed" for my overclocked Pi (950 MHz) to this mail. As you can see, the numbers are higher than the reference one (I guess probably due to overclocking and different OpenSSL version). I've also attached the log of notices of the last 4 days (unfortunately no longer logs available). Within four days there was only one "Your computer is too slow to handle this many circuit creation requests!" warning and one "Failed to hand off onionskin.". In general I would say, I haven't seen any serious issues so far. > > And my plan is to publish my results to the entire list, because at $35, > Raspberry Pis can make *great* relays for slower home broadband, but > they need a little tender loving care first. :) > > I totally agree with you. Recently, there has been quite some buzz about the OnionPi howto (http://learn.adafruit.com/onion-pi/overview) but its main goal wasn't providing a long-running relay node. In my opinion, this should get addressed separately and made as simple as possible for novices. My guess is that many people want to contribute bandwidth, but they do not want to deal with Linux specifics (and definitely do not want to get into any trouble with the police). They need a plug-and-forget solution: attach the Pi to the router and leave it running in the closet for months. If it has to be restarted, Tor Weather can send them an email. What do you think about documenting the setup of the relay in the Tor wiki? https://trac.torproject.org/projects/tor/wiki I'm not very familiar with the Tor Project yet, but to me it looks like the wiki will be the best place. Other people can contribute as well and it will be visible enough. It would be good if there's an always up-to-date wiki page which could become the reference for new users. The idea of the Raspberry Pi as relay node could be even further expanded: - Matthias already mentioned that there should be a specific image for it. I agree! - New users would prefer a simple webinterface to configure the relay (basically a Vidalia as webinterface :-) - Such a webinterface should also show statistics e.g., "Your node has forwarded 1 TB in the last 4 weeks." This will show people that their contribution made a difference and it will make them happy and more confident about it. Eventually, they'll convince others to run a relay as well. I won't have the time to realize these ideas, but maybe others want to jump in. Further work and testing could be coordinated on this mailing list? I hope to have something up in a week or two, I need to watch it for a > while and continue to tweak, and maybe develop a solution for the TCP > storms that can bring down a lot of consumer routers, before publishing > for all. > I run a regular Linux PC as router which forwards all the traffic of the Pi. The machine has more than enough CPU power and therefore I haven't seen any issues there. Since the two months that I run the relay node on the Pi, my Linux PC router has frozen twice (which didn't happen before). But I'm not sure that it can be related to the forwarding of the relay node traffic. For a broader adaption it's definitely necessary to look into the behavior of the most popular routers e.g., the ones given out by the major providers. These things could be documented on the Tor Wiki as well. Best regards, Michael

4 12

No disk space for new files created by Tor
by TonyXue 12 Aug '13

12 Aug '13

Dear All, Today when I was checking my Tor notice log file as usual, I noticed that they've included the following warnings: Aug 11 06:23:15.000 [warn] Unable to store router descriptorAug 11 06:23:15.000 [warn] Error writing to "/var/lib/tor/cached-descriptors.new": No space left on device It seems that I've run out of space. But my VPS comes with 35GB disk space and it shouldn't be used up so fast. So how to deal with it?If I do run out of space,any advice for deleting the old files of Tor? Are there any files created by Tor are not useful anymore and can be deleted? Cheers,Tony

5 9

Recommendation on exit node in DE/NL
by Kali Tor 09 Aug '13

09 Aug '13

Hi all, Is there any recommendation for running Tor _exit_ node in NL/DE? The list at https://trac.torproject.org/projects/tor/wiki/doc/GoodBadISPs see,s pretty old and outdated and contradictory at places. Thanks Kali

2 1

"NumCPUs 2" or 2 copies of Tor?
by Steve Snyder 08 Aug '13

08 Aug '13

Given plenty of RAM, a muti-core CPU and a single IP address, which is more efficient: a single instance of Tor configured with "NumCPUs 2" or 2 instances of Tor configured with "NumCPUs 1" and different port numbers? Thanks.

5 5

Tor Exit Node - DDOS
by Kris 08 Aug '13

08 Aug '13

I've been an end user of tor for a few years and finally as of last week purchased a virtualhost to run an exit relay. After a few days running smoothly, I received a forwarded abuse complaint from the hosting company from someone saying their are being DDOS'd by my IP. I'm prepared per the tor website regarding DMCA notifications, but haven't found much on how to deal with this situation. I have: * made it quite obvious that this is an exit node * reverse dns is tor-exit-node.nenticom.net * web server running on 8080/80 with the tor notification page * provide full real name and abuse(a)nenticom.net contact * notified the hosting company * applied the recommended exit policy per the "minimum harassment" post You can see most of this off Atlas (node: nenticom). https://atlas.torproject.org/#details/50D04704A5017C02CC63AFE4A66F05DF79ED8… Can anyone provide a recommendation of how to respond to this notice (provided below)? Given the headers the original complainer filed it looks like someone is running benchmark software over tor. Maybe after explaining that I'm a tor exit node to the provider I can offer to block exiting to the IP block belonging to the original complainer? Notice from Hosting Provider ---------------------------- Please review the following abuse complaint and provide us with a resolution: ****************************** Hello, Over the last three days we have experienced a massive amounts of incoming HTTP connections from an IP address under your control as part of a DDOS attack. Can you please investigate the server/computer associated with this IP address as it is more than likely compromised and is now part of a BotNet. For your reference, all requests to our server from the IP in question are listed in the Apache logs as: "GET / HTTP/1.0" 500 11680 "-" "ApacheBench/2.3" The attackers IP address that appears to belong to you or your network is '192.241.230.170'. Please resolve this as soon as possible. -- Kind regards, Benjamin Hodgetts Dedicated Hosting Server Administrator Namesco Ltd. Phone: +44 (0)1905 342347 Email: bhodgetts(a)names.co.uk DDI: +44 (0)1905 342384 Main Line: +44 (0)1905 342342 / 0845 363 3630 Main Fax: +44 (0)1905 342343 / 0845 363 3631 Support Email: supportmanager(a)names.co.uk Website: http://www.names.co.uk Namesco Limited (Registration No: 3913408) is incorporated in England and Wales with its registered office at Acton House, Perdiswell Park, Worcester, WR3 7GD. Information contained in this e-mail is intended for the use of the addressee only, and is confidential. If you have received this email in error please notify the sender immediately. Any dissemination, distribution, copying or use of this communication without prior permission of the addressee is strictly prohibited. The contents of an attachment to this e-mail may contain software viruses, which could damage your own computer system. While Namesco has taken every reasonable precaution to minimise this risk, we cannot accept liability for any damage, which you sustain as a result of software viruses. You should carry out your own virus checks before opening the attachment. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company. ©2013 Namesco Limited. All rights reserved. ******************************

5 5

Dealing with VPS suspension
by Bernard Tyers - ei8fdb 07 Aug '13

07 Aug '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I've been running an exit node on a VPS hosting for the past few months. I've had no issues until this morning. The VPS has been suspended due to a report of "massive amounts of incoming HTTP connections from an IP address under your control as part of a DDOS attack". Once I contacted the hosting company they were a bit more forthcoming with information. It took me some time explaining Tor, what it is etc...and why I couldn't really tell them where the traffic was coming from. I'm waiting to hear back from them, but I was wondering: is there a "standard"/informational e-mail template that I can use to communicate the important points to a hoster who has pulled an account? I've read some of the posts on how to run an exit node for minimal harrasment (I checked steps 2, 3, 4, 6, 7). It may be just a matter of education (I didn't do step 1). The hoster has no (public) AUP so I can't have been in violation of it. Ultimately it's their decision, but I'd like to think karma might be on my side if I play nice. Thanks, Bernard - -------------------------------------- Bernard / bluboxthief / ei8fdb IO91XM / www.ei8fdb.org -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJSAqZLAAoJENsz1IO7MIrrT/UH/1T6YTnowguuyFaSR743uFDp gtR7/xVEk0KWE3KuiYmhP8KvMyaYJBiIMq8rRboxr7TI0NfZA50shJ12hI1ITZ4X TSMApNU219B8bQNAfR6LH9H/sBqgYkba5ZtEkGt5O0oA43+08RhJL0s5fkHfznPR rQj1PpuHNR1LFOu2G8uJ3ljVXzHfEdAZwPfzol/f4QURj3dE9boinmzmFJOx+z9U Pz7UsAjFZbx4wPinAbUGFSn9As99pWvxYtUvI4It1RdvtfPb/bh46R5RT/s7/zve ayOgv+WvdwUYhxX242odoq+WksQlKm7eXrAtAw1GV7XcK0g1dZAQcixXc1hWbzU= =kpn9 -----END PGP SIGNATURE-----

2 2

Up and running!
by Cassey Jean Claude 07 Aug '13

07 Aug '13

Hi all - I have a semi-idle laptop that I decided to let Tor run on by 10mb down, 1.5mb up connection. Curious what is needed more: Bridge relays or non-exit relays? Not ready to be an exit-relay yet... one step at a time. Cassey

2 2

Re: [tor-relays] VPS Hardware Specification & Advice
by Tor Pids 06 Aug '13

06 Aug '13

Hi, i just saw this post on the web archive and felt I can contribute something here so I finally registered. Maybe this reply will not be correctly recognized to the thread, sorry. The VPS specs you posted should be more than enough - but the price is too expensive! I currently run about 20 Tor relays on cheap VPS all around the world: http://globe.rndm.de/#/search/query=torpids Basically I just care for the bandwidth/included traffic when choosing a VPS. 256MB RAM is enough, disk space doesn't matter at all. Tor doesn't scale that well with CPU cores so 1 core is ok. For only 1 or 2 of my VPS the CPU is the bottleneck (at about 20-30MBit/s), but most are fast enough. Most cheap VPS are based on the OpenVZ virtualization which limits you to their old kernel and sometimes they limit the number of tcp connections (see "cat /proc/user_beancounters"). KVM or Xen virtualisation is better because you have more control on the VM. Most VPS providers add up the incoming and outgoing bandwidth, meaning that you might be able to just send about 500GB with your 1TB plan. For example with a VPS from www.jiffybox.de for 15€ per month it is possible to push more than 1TB PER DAY(!) (and not per month as with the 18€ plan you mentioned). OVH just released a server for £2,99 per month with unlimited 100MBit/s as well: https://www.ovh.co.uk/dedicated_servers/kimsufi.xml Other typical offers are like 10TB for 10$ or 20MBit/s unlimited for 3€. Good places to find cheap VPS deals: http://www.lowendbox.com/ and http://lowendtalk.com/categories/offers http://www.wjunction.com/46-vps http://www.webhostingtalk.com/forumdisplay.php?f=104 Best, Torpids

3 3

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-relays