tor-relays

tor-relays@lists.torproject.org

36 participants
4815 discussions

08 Aug '13

I've been an end user of tor for a few years and finally as of last week purchased a virtualhost to run an exit relay. After a few days running smoothly, I received a forwarded abuse complaint from the hosting company from someone saying their are being DDOS'd by my IP. I'm prepared per the tor website regarding DMCA notifications, but haven't found much on how to deal with this situation. I have: * made it quite obvious that this is an exit node * reverse dns is tor-exit-node.nenticom.net * web server running on 8080/80 with the tor notification page * provide full real name and abuse(a)nenticom.net contact * notified the hosting company * applied the recommended exit policy per the "minimum harassment" post You can see most of this off Atlas (node: nenticom). https://atlas.torproject.org/#details/50D04704A5017C02CC63AFE4A66F05DF79ED8… Can anyone provide a recommendation of how to respond to this notice (provided below)? Given the headers the original complainer filed it looks like someone is running benchmark software over tor. Maybe after explaining that I'm a tor exit node to the provider I can offer to block exiting to the IP block belonging to the original complainer? Notice from Hosting Provider ---------------------------- Please review the following abuse complaint and provide us with a resolution: ****************************** Hello, Over the last three days we have experienced a massive amounts of incoming HTTP connections from an IP address under your control as part of a DDOS attack. Can you please investigate the server/computer associated with this IP address as it is more than likely compromised and is now part of a BotNet. For your reference, all requests to our server from the IP in question are listed in the Apache logs as: "GET / HTTP/1.0" 500 11680 "-" "ApacheBench/2.3" The attackers IP address that appears to belong to you or your network is '192.241.230.170'. Please resolve this as soon as possible. -- Kind regards, Benjamin Hodgetts Dedicated Hosting Server Administrator Namesco Ltd. Phone: +44 (0)1905 342347 Email: bhodgetts(a)names.co.uk DDI: +44 (0)1905 342384 Main Line: +44 (0)1905 342342 / 0845 363 3630 Main Fax: +44 (0)1905 342343 / 0845 363 3631 Support Email: supportmanager(a)names.co.uk Website: http://www.names.co.uk Namesco Limited (Registration No: 3913408) is incorporated in England and Wales with its registered office at Acton House, Perdiswell Park, Worcester, WR3 7GD. Information contained in this e-mail is intended for the use of the addressee only, and is confidential. If you have received this email in error please notify the sender immediately. Any dissemination, distribution, copying or use of this communication without prior permission of the addressee is strictly prohibited. The contents of an attachment to this e-mail may contain software viruses, which could damage your own computer system. While Namesco has taken every reasonable precaution to minimise this risk, we cannot accept liability for any damage, which you sustain as a result of software viruses. You should carry out your own virus checks before opening the attachment. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company. ©2013 Namesco Limited. All rights reserved. ******************************

5 5

Dealing with VPS suspension
by Bernard Tyers - ei8fdb 07 Aug '13

07 Aug '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I've been running an exit node on a VPS hosting for the past few months. I've had no issues until this morning. The VPS has been suspended due to a report of "massive amounts of incoming HTTP connections from an IP address under your control as part of a DDOS attack". Once I contacted the hosting company they were a bit more forthcoming with information. It took me some time explaining Tor, what it is etc...and why I couldn't really tell them where the traffic was coming from. I'm waiting to hear back from them, but I was wondering: is there a "standard"/informational e-mail template that I can use to communicate the important points to a hoster who has pulled an account? I've read some of the posts on how to run an exit node for minimal harrasment (I checked steps 2, 3, 4, 6, 7). It may be just a matter of education (I didn't do step 1). The hoster has no (public) AUP so I can't have been in violation of it. Ultimately it's their decision, but I'd like to think karma might be on my side if I play nice. Thanks, Bernard - -------------------------------------- Bernard / bluboxthief / ei8fdb IO91XM / www.ei8fdb.org -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJSAqZLAAoJENsz1IO7MIrrT/UH/1T6YTnowguuyFaSR743uFDp gtR7/xVEk0KWE3KuiYmhP8KvMyaYJBiIMq8rRboxr7TI0NfZA50shJ12hI1ITZ4X TSMApNU219B8bQNAfR6LH9H/sBqgYkba5ZtEkGt5O0oA43+08RhJL0s5fkHfznPR rQj1PpuHNR1LFOu2G8uJ3ljVXzHfEdAZwPfzol/f4QURj3dE9boinmzmFJOx+z9U Pz7UsAjFZbx4wPinAbUGFSn9As99pWvxYtUvI4It1RdvtfPb/bh46R5RT/s7/zve ayOgv+WvdwUYhxX242odoq+WksQlKm7eXrAtAw1GV7XcK0g1dZAQcixXc1hWbzU= =kpn9 -----END PGP SIGNATURE-----

2 2

Up and running!
by Cassey Jean Claude 07 Aug '13

07 Aug '13

Hi all - I have a semi-idle laptop that I decided to let Tor run on by 10mb down, 1.5mb up connection. Curious what is needed more: Bridge relays or non-exit relays? Not ready to be an exit-relay yet... one step at a time. Cassey

2 2

Re: [tor-relays] VPS Hardware Specification & Advice
by Tor Pids 06 Aug '13

06 Aug '13

Hi, i just saw this post on the web archive and felt I can contribute something here so I finally registered. Maybe this reply will not be correctly recognized to the thread, sorry. The VPS specs you posted should be more than enough - but the price is too expensive! I currently run about 20 Tor relays on cheap VPS all around the world: http://globe.rndm.de/#/search/query=torpids Basically I just care for the bandwidth/included traffic when choosing a VPS. 256MB RAM is enough, disk space doesn't matter at all. Tor doesn't scale that well with CPU cores so 1 core is ok. For only 1 or 2 of my VPS the CPU is the bottleneck (at about 20-30MBit/s), but most are fast enough. Most cheap VPS are based on the OpenVZ virtualization which limits you to their old kernel and sometimes they limit the number of tcp connections (see "cat /proc/user_beancounters"). KVM or Xen virtualisation is better because you have more control on the VM. Most VPS providers add up the incoming and outgoing bandwidth, meaning that you might be able to just send about 500GB with your 1TB plan. For example with a VPS from www.jiffybox.de for 15€ per month it is possible to push more than 1TB PER DAY(!) (and not per month as with the 18€ plan you mentioned). OVH just released a server for £2,99 per month with unlimited 100MBit/s as well: https://www.ovh.co.uk/dedicated_servers/kimsufi.xml Other typical offers are like 10TB for 10$ or 20MBit/s unlimited for 3€. Good places to find cheap VPS deals: http://www.lowendbox.com/ and http://lowendtalk.com/categories/offers http://www.wjunction.com/46-vps http://www.webhostingtalk.com/forumdisplay.php?f=104 Best, Torpids

3 3

VPS Hardware Specification & Advice
by torrelay＠mail.md 06 Aug '13

06 Aug '13

Greetings! My ISP British Telecom is rate limiting my Internet connection despite a big splashy advertising campaign earlier this year in which it claimed that it would no longer rate limit during so-called 'peak hours' or cap the bandwidth consumption when it reaches a ceiling that they decide is 'too much'. I've tried various bandwidth rates that are a sensible percentage of the total available bandwidth but anything above a very small amount (50-80KB/s) is being rate limited even though the total amount of bandwidth available is approximately 30.00 Mbps downstream & 6.12 Mbps upstream. Now even 50-80 KB/s is rate limited. Well, it's the school holidays started recently here & BT have just brought out a new streaming sports service which coincides with my bandwidth being rate becoming limited from about 2 weeks ago. I was able to run a consistently faster tor relay on British Telecom 7 years ago than I can today & I don't want to speak with a telephone operative in India who follows a script & will test my connection. I just take my business somewhere else -- rant finished! Consequently I've sourced a company, located in a Scandinavian country, offering a VPS with 1TB of data consumption per month for approximately 18 Euros (more than half the price of my shitty, crippled British Telecom Internet connection) so I'll try this. The cost of running the VPS is based on the hardware specification which brings me to my question. I plan to utilise the full 1TB of data each month & I'd like some idea if the specification (below) is sufficient for an entry/middleman tor relay using 1000GB bandwidth per month. The hardware specification I've chosen is: CPU Cores: 1 - exact details of CPU are not specified on the company's website, problem? RAM Memory: 1024 MiB Traffic: 1000GB Drive: 50GB Price: 18 Euros I'm completely new to VPS & am sure this will be a learning curve but no matter I will try to see if I can make it work even if performance of VPS might not be perfect. If anyone has written a guide to hosting a tor relay on a VPS, I'd welcome any links to further information or any other useful advice based on experience of others. Best regards, Edvard.

1 0

VPS
by Tom McLoughlin 04 Aug '13

04 Aug '13

I'm looking for a VPS to run a tor exit node on, any ideas? Regards, Tom McLoughlin

5 6

Running an obfuscated bridge at home still safe?
by z0rc 03 Aug '13

03 Aug '13

Hi, I've been running an obfuscated bridge on a Raspberry Pi at home (in Switzerland) for a week now. Until recently, I thought running a bridge at home was no problem at all. But yesterday Paul Staroch reported in [1] that he got notice from the German police (BKA) concerning his non-exit relay. So I'm a bit scared now. Is it still believed to be safe to run a non-exit relay or bridge at home? Or is this just one single incident? Any other experiences on this? Cheers, z0rc [1] https://lists.torproject.org/pipermail/tor-relays/2013-August/002365.html

1 0

Attacker IP database
by Bryan Carey 03 Aug '13

03 Aug '13

Is there any kind of compiled list of IPs that relay operators can refer to that are known bad IPs (sources of brute force SSH attempts, etc.)? Is there a reason to NOT block (drop) traffic from these IPs? Here are some that I have seen recently trying to brute force common user accounts and root password attempts: 198.50.197.98 220.161.148.178 223.4.217.47 199.187.125.250 175.99.95.252 62.64.83.38 125.209.110.234 37.235.53.172 Also, in general what are some good security practices to keep in mind while running a Tor relay? Thanks, Bryan

8 10

Relay or Obfuscated Bridge?
by Richard Budd 02 Aug '13

02 Aug '13

I have several Tor relays running on VPS providers around the world (the 7 bucks a month kind). Most have around 5 to 6 meg a second bandwidth available. Would it be more useful for the Tor system to change a few of them over to obfuscated bridges?

1 0

Tor bridge on Amazon not doing much
by Shawn A. Miller 02 Aug '13

02 Aug '13

I've been running a Tor bridge on the Amazon EC2 cloud computing platform (per instructions at https://cloud.torproject.org/) since July 27, and while the bridge is up and running according to the logs, there doesn't seem to be much traffic running through it, i.e., latest logs indicate Tor uptime is 2 days 12 hours with 2 circuits open; 6.6 MB sent and 45.75 MB received. Have I somehow managed to misconfigure the bridge or is this normal? Best, Shawn

6 7

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-relays