- tor-relays - lists.torproject.org

Re: [tor-relays] 0.2.4.17-rc on Pi, a couple weeks on
by Joshua Datko 20 Sep '13

20 Sep '13

Just for comparison sake, I'm running a relay on the BeagleBone Black, running Ubuntu (raring), and Tor 0.2.4.17-rc with the following log entries: Sep 19 16:16:40.000 [notice] Circuit handshake stats since last time: 16771/16781 TAP, 13/13 NTor. Sep 19 17:16:40.000 [notice] Circuit handshake stats since last time: 17229/17240 TAP, 14/14 NTor. Sep 19 18:16:40.000 [notice] Circuit handshake stats since last time: 17371/17385 TAP, 13/13 NTor. Sep 19 19:16:40.000 [notice] Circuit handshake stats since last time: 17084/17099 TAP, 17/17 NTor. Sep 19 20:16:40.000 [notice] Circuit handshake stats since last time: 16694/16702 TAP, 13/13 NTor. Sep 19 21:16:40.000 [notice] Circuit handshake stats since last time: 17380/17382 TAP, 20/20 NTor. Sep 19 21:16:45.000 [notice] Heartbeat: Tor's uptime is 11 days 18:00 hours, with 715 circuits open. I've sent 221.93 GB and received 225.81 GB. Sep 19 21:16:45.000 [notice] Average packaged cell fullness: 87.388% Sep 19 21:16:45.000 [notice] TLS write overhead: 8% I currently have the Fast, Guard, Named, Running, Stable and Valid flags. I initially had a "your computer is too slow" message and then I set MaxAdvertisedBandwidth to 200KB and it's be better since. CPU usage is about 70%. The BBB actually has an AES crypto accelerator, but I don't think it's being used and I'm trying to work through that at the moment. Lastly (an somewhat related), I submitted a workshop proposal to 30C3 called "Using the BeagleBone for Fun and Privacy" to talk about BeagleBone hacking and running Tor. I won't find out if it's accepted until November... Josh

1 0

0.2.4.17-rc on Pi, a couple weeks on
by Gordon Morehouse 20 Sep '13

20 Sep '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hey folks, Here are my reports. First the good news: it's WAY more stable. Then the bad news: it still gets OOM-killed once in a while, possibly preventably. THE GOOD (notes from September 14): Here's my Pi relay since compilation of 0.2.4.17-rc: Sep 14 11:50:59.000 [notice] Circuit handshake stats since last time: 13308/13324 TAP, 22/22 NTor. Sep 14 11:51:51.000 [notice] Heartbeat: Tor's uptime is 7 days 18:00 hours, with 434 circuits open. I've sent 42.85 GB and received 34.05 GB. Sep 14 11:51:51.000 [notice] Average packaged cell fullness: 98.369% Sep 14 11:51:51.000 [notice] TLS write overhead: 9% That low NTor number is depressing. That high TAP number is scary. TAP is the old way and the way the botnet is using. NTor is post-0.2.4.8, I think. The replay has settled into a fairly steady state (after losing its flags except Named) of sending 5-10KB more per sec than it gets. I have a feeling this is literally due to the TAP replies being bigger than the TAP requests. It's handling tens of thousands every 6 hours. Load average is steadyish at 0.7. Unlike its predecessor, though, it's not yet crashed under the new network conditions. ...By last night (18 Sept) it had settled in to no Stable flag, but forwarding an essentially random amount of traffic that looked similar minute-to-minute. Load was between 0.9 and 1.1 with tor, top, and nload being really the only active processes. There is still room for tuning with the Pi given that this load was attained relaying about 2Mbps when I looked. THE BAD: This morning: Sep 18 04:50:59.000 [notice] Circuit handshake stats since last time: 34818/41100 TAP, 50/52 NTor. Sep 18 05:30:43.000 [warn] Your system clock just jumped 101 seconds forward; assuming established circuits no longer work. The system clock thing is a Pi thing. I'm pretty sure I need to get much more aggressive with ntpd. (Pis have no battery backup and tend to have pretty bad clock drift.) But then, 2 minutes later: Sep 18 05:32:20 tulameen kernel: [2188444.188460] Out of memory: Kill process 7544 (tor) score 148 or sacrifice child Sep 18 05:32:20 tulameen kernel: [2188444.188475] Killed process 7544 (tor) total-vm:153352kB, anon-rss:115156kB, file-rss:36712kB Coincidence? Bug? Smells like the latter. Shouldn't Tor be shedding memory if it closes all its circuits, not acquiring more? Best, - -Gordon M. -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJSOa+yAAoJED/jpRoe7/ujs4UH/iXK4+hAAk06nYUptKChGRyx boZxDxpNum4uEzkJNZlUdvUILuVLX2DXytN7kNJUKDYKGzwCwBhhcQ7tOyBFucz+ muVcbwgyjM8zDhMFexWX8wVh7lauJRpjcNxzE+5hVRkzMFrbGy7FLXZbTiNGT5Ez cSfZAziu0Au3OKhxLQMUdYiZtfi/b/ReMIx72Xz4pBX4hPiagORG5NPgKpNzeBij C+khy5up1WuE7qxGX8+zG1T6K0whAW6MFYKdIT63GlwVWzYAP7tZDbbQd3kB46Yd e5I+ySBGL7VnOzH6CQl+2l1enu87JDyZ1Hw6zkZp3GQ6u8ThiHQQvmNQx9N3rxQ= =sx6s -----END PGP SIGNATURE-----

4 8

Tor Relay getting "Failed to terminate process with PID" messages
by Michael Gorbach 19 Sep '13

19 Sep '13

Hi, I started up a Tor relay several days ago, and the usage seems to be ramping up nicely. However, I am seeing some unexpected messages like this, in ARM and in the tor log files: 17:21:56 [NOTICE] Failed to terminate process with PID ‘29778' They seem to be showing up, reliably, every 5 minutes or so. Each has a different PID. What’s strange is that these PIDs don’t exist by the time I see the message, i.e. I guess whatever process had that PID is now dead. Anyone know what could be causing this? Should I be concerned, or is this some kind of artifact of my setup or software? The machine is a modern Gentoo linux install running a 3.10 kernel and Tor 0.2.3.25 (running inside VMWare). Thanks in advance for your help. Yours, ~ M.

2 4

Too little traffic on my #2 non-exit relay
by Christian Dietrich 19 Sep '13

19 Sep '13

Hey there, I'm currently running two tor (non-exit) relays on one host machine. "000000000000myTOR1" and "000000000000myTOR2". Now my problem is that tor relay #2 generates almost no traffic. https://atlas.torproject.org/#search/000000000000myTOR Log Relay #1: Circuit handshake stats since last time: 1566234/14743525 TAP, 10428/10433 NTor. Heartbeat: Tor's uptime is 7 days 6:00 hours, with 56008 circuits open. I've sent 2167.46 GB and received 1567.97 GB. Log Relay #2: Circuit handshake stats since last time: 63/63 TAP, 1/1 NTor. Heartbeat: Tor's uptime is 7 days 6:00 hours, with 4 circuits open. I've sent 1.58 GB and received 844.66 MB. Both have the same binary and configuration (except incoming/outgoing IPv4). I've also tried to switch from "fully self compiled debian, with custom kernel, and own tor binary" to "Out of the Box Ubuntu LTS, with torproject tor package" .. without any improvement. Both relays works as expected. OT: for my opinion avg 150 mbit/s (99% done by node #1) is too less for an Ivy-Bridge Based Xeon Quad Core (/w HT) on an unshared gigabit line. Apart from the fact that multithread support is really missing. Can anyone give me a hint, or am i just too stupid? Thanks ;)

4 8

Re: [tor-relays] Reimbursement of Exit Operators
by tor＠t-3.net 18 Sep '13

18 Sep '13

It's a little old. Posted July 24, 2012 We knew a lot less on that date. On Wednesday 18/09/2013 at 3:08 pm, Andrew Lewman wrote: > On Wed, 18 Sep 2013 13:36:39 -0400 > Rick <rerushg(a)gmail.com> wrote: > >> >> Nope, I don't think so. Perhaps it's the timing. In this post-Snowden >> period most everything is a little bit creepy. There's plenty of FUD >> to go around. A position paper from Torproject on this and other >> recent issues would be handy about now. > > Does this qualify as a position paper? > https://blog.torproject.org/blog/turning-funding-more-exit-relays > > -- > Andrew > http://tpo.is/contact > pgp 0x6B4D6475 > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

Reimbursement of Exit Operators
by Moritz Bartl 18 Sep '13

18 Sep '13

Hi, tl;dr: We want to start reimbursing exit operators end of this month. Partner orgs, please sign the contract! Everyone else, consider becoming a partner. --- In July last year, Roger announced that BBG was interested in funding fast exits. [1] The initial discussion on the mailing list continued into August. If you're interested, you should consult the archive for the various points raised. Since then, we've been discussing that topic on and off. It matched with my plans to turn torservers.net into a platform for many organizations, instead of just one single entity that runs too many exit relays, so I agreed to take the lead. I posted a status report of some sort on this list in April this year. [2] The Wau Holland Foundation agreed to be one of the organizations willing to handle the money and pass it on to other entities, be it single operators or organizations. Both Torproject and Wau Holland Foundation checked with their lawyers to see if this turns into a problem about liability, and it looks like it does not. We're open for more organizations to join in to manage the reimbursement process, but this is what we've got for now. In parallel, we've seen a growing number of organizations that were created to turn donations into exit bandwidth. [3] Two issues with reimbursements, that were also mentioned in Roger's initial posting, are that (1) you don't want to drive away all the volunteers, and (2) you don't want to become dependent on (a single or a handful of) sponsors. These are difficult issues, and I want to strongly encourage everyone to keep contributing to the network. We really need you, and we need more of you! The second issue, dependence on funders, is on the one hand a harder one, but on the other hand (in my opinion) a less relevant one. If structures die and nodes have to be shut down because a funder backs off, so be it. We hopefully don't change the picture too much in comparison to the "unfunded times of today". The reimbursement process does not guarantee a money stream, and the amounts are set on a month-to-month basis, to encourage recipients to plan only short-term, and only make contracts based on the money they have, disregarding what they may or may not receive in the future. The current "bucket" is the one-time BBG money, and it currently does not look like they will restock it. It might sound scary, but to satisfy the tax authorities (and to show that it is a [hopefully] fair and transparent process), the Wau Holland Foundation needs to have partners sign a contract. The contract does not limit the partners abilities or restrict what they do, it only defines the reimbursement process. The way we want to start doing it now is not set in stone, and hopefully now that we finally start handing out money it will encourage further discussion around it. We want to refine the process over time, but it looks like we just have to try with what we have now and learn from our mistakes. Please don't be too hard with your criticism or you will emotionally hurt me. I'm all ears. :-) We want to reimburse based on the throughput per exit relay and organization. To strengthen network diversity, we came up with the plan to also factor in the location of the relays. There is a maximum amount any entity can receive so we hopefully don't grow big monsters. The contract [4] specifies that there is a monthly amount, currently set to $3500, split amongst all recipients (whom I started calling "torservers partners"). The recipient share is calculated from the throughput per relay * country factor, and the maximum amount per month per partner is 500 Euro. The Wau Holland Foundation can currently only reimburse via wire transfer. The country factors can change over time, and are currently derived from the total exit probability of that country. We can and should refine this. Changes of these factors do not require new contracts. Note that since the total amount of $3500 will be handed out every month, as long as we have less than 6 entities signing the contract, each entity will receive their maximum share of 500 Euro. I don't really like the idea of a fixed monthly total handed out like that, but that's what the lawyers and tax authorities signed off for Wau Holland Foundation. It seems to be costly to re-evaluate such contracts, so this is what we will stick to for now via WHF. Technically, the monthly shares and the country factors are calculated using a tool written by Lunar^^ (big thanks!). [5] You can find an example report at [6] (not the correct numbers, but you'll get the idea). This monthly report will be sent to all partners, and once they signed the contract they will simply get their monthly share. As stated at the top, we want to start reimbursing this month. Please let me know if you have any questions. We have a mailing list that is public and read-only where we send important announcements, and require every participant to be on and actually read. We have another mailing list that is also read-only for the public, but people of the participating organizations can post and discuss everything around Torservers.net and reimbursements. [7] The process to become a "partner" for now requires that I "know you". So, if you're interested in becoming a partner, start social interaction with me. I see that as a bad bottleneck, and I hope we can somehow get rid of it in the future. I generally prefer "organizations" over single persons, because (1) in most countries it seems to be really inexpensive and easy to set up organizations and (2) the process of setting up such entities includes that you gather enough people around you, so chances are you will continue even if one of you drops out. If you want to discuss, I prefer the tor-relays mailing list and our IRC channel, #torservers on irc.oftc.net. I also explicitly want to invite every partner to join that channel. --Moritz [1] https://lists.torproject.org/pipermail/tor-relays/2012-July/001433.html [2] https://lists.torproject.org/pipermail/tor-relays/2013-April/001996.html [3] http://www.torservers.net/partners.html [4] [fill out + send back via pgp-encrypted and signed mail to me] plain: https://www.torservers.net/misc/2013-07-19_TorExit_en.txt fancy: https://www.torservers.net/misc/2013-07-19_TorExit_en.ott german: https://www.torservers.net/misc/2013-07-19_TorExit_de.ott [5] git clone https://people.torproject.org/~lunar/exit-funding.git [6] https://www.torservers.net/misc/reimburse-output-2013-07.txt (set encoding to Unicode) [7] https://lists.torproject.org/pipermail/tor-relays/2013-May/002138.html

6 6

Traffic shaping on exit nodes (appeasing automated network monitoring systems)
by Philip Paeps 17 Sep '13

17 Sep '13

I had a less-than-amusing conversation with my ISP this week about how my Tor exit node was performing "network scans". As far as I can tell, their definition of "network scan" comprises anything from "knocking on the same port on every machine in a /8" to "creating lots of legitimate connections to the same port in a /8". Obviously, their network monitoring system is too trigger-happy, but there is nothing I can do about that. Do other relay operators have traffic-shaping solutions that make legitimate (and not-so-legitimate) Tor traffic look less like network abuse? I've reconfigured my exit to be a non-exit for the time being. I'm more than happy to be an exit (and field genuine abuse complaints), but I'd prefer not to trigger automated network abuse monitoring systems (too often). Any tips? My node is running FreeBSD with ipfw and dummynet, if someone happens to have ready to copy/paste settings. ;-) Philip -- Philip Paeps Senior Reality Engineer Ministry of Information

1 0

Creating circuits to myself?
by Niles Rogoff 16 Sep '13

16 Sep '13

I was using arm when I noticed this line: 173.79.154.243 --> 173.79.154.243 (us) Purpose: Ags=is_internal,need_capacity, Circuit ID: 5 4.0m (CIRCUIT) That's my IP, and it showed the exit node as the same as my node. There are currently three circuits both originating *and* exiting at my node. I am using Tor 0.2.3.25 (recommended) on Windows 7. My fingerprint is 1E598CDB9BBC751D753146D880B326952886D73B

2 2

tor bridge
by 封添 15 Sep '13

15 Sep '13

i'm tian.please give me list of tor bridge .

2 1

Appropriate bandwidth limits for my home relay
by Nick 15 Sep '13

15 Sep '13

Hi all, After running my relay for a bit on my home connection I found that Tor would happily consume all the bandwidth available, which (coupled with the number of connections overwhelming my home router, I suspect) caused my internet connection to be unusable for other things. So I set the RelayBandwidthRate and RelayBandwidthBurst values to 20 KBytes, as 20KBytes/s is a reasonable amount of bandwidth I can spare (total upload bandwidth on the connection is around 50KBytes/s). However now atlas.torproject.org shows an average of only around 0.5 - 1.5 Kbytes/s usage, and says the advertised bandwidth is 10 Kbytes/s. Should I increase the RelayBandwidthRate value to more than I can comfortably provide, on the basis that it isn't likely to all be used? Or should I just relax and let the network use my relay as little as it likes? Sometime quite soon my home internet connection will get much faster; I'm aware the relay is of questionable value at present bandwidth levels, but they should increase in not too long. Thanks, Nick

2 2