- tor-relays - lists.torproject.org

Tor and firewall output rules
by Anton Korec 28 Jun '12

28 Jun '12

Hi, I'm new to this list, so I apologise when my problem has been solved already. I'm runing new tor router as a non-exit relay, with ORPort 443 and DirPort 80. Server is running on Debian stable and tor version is 0.2.2.35. Tor is running under debian-tor user. I have restrictive iptables firewall rules (in both directions, INPUT and OUTPUT). I do not like fw rules of type "all outgoing is allowed". So I set fw up as found somewhere on torproject.org wiki, with "-m owner --uid-owner debian-tor": IPTABLES -P INPUT DROP IPTABLES -P OUTPUT DROP IPTABLES -P FORWARD DROP ... ... IPTABLES -A INPUT -i eth0 -p tcp -s 0.0.0.0/0 --sport 1024: -d ${MYIP} --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT IPTABLES -A OUTPUT -o eth0 -p tcp -s ${MYIP} -d 0.0.0.0/0 -m state --state NEW,ESTABLISHED -m owner --uid-owner debian-tor -j ACCEPT In such configuration fw has been dropping large numbers of packets with uid 0 and packets with no uid set. And it seems that there was almost no tor traffic on relay. So I changed OUTPUT rule to: IPTABLES -A OUTPUT -o eth0 -p tcp -s ${MYIP} -d 0.0.0.0/0 -m state --state NEW,ESTABLISHED -j ACCEPT and everything worked fine. I tried to use 0.2.2.37, 0.2.3.17-beta precompiled deb packages, tried to compile from source downloaded from torproject.org, but packet dropping was the same on every version of tor. Last thing I did, was update fw rules to: IPTABLES -A INPUT -i eth0 -p tcp -s 0.0.0.0/0 --sport 1024: -d ${MYIP} --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT IPTABLES -A OUTPUT -o eth0 -p tcp -s ${MYIP} -d 0.0.0.0/0 -m state --state NEW,ESTABLISHED -m owner --uid-owner debian-tor -j ACCEPT IPTABLES -A OUTPUT -o eth0 -p tcp -s ${MYIP} -d 0.0.0.0/0 -m state --state NEW,ESTABLISHED -j ACCEPT to count packets traversing each OUTPUT rule (with and without uid to "debian- tor" set). 22% of all packets (it is 11% of bytes of that traffic) sent by tor relay was uid not set to "debian-tor". Why is tor sending packets with uid not set to "debian-tor"? Regards Tony

1 0

Failed to parse/validate config: failed to bind one of the listener ports
by Christian 26 Jun '12

26 Jun '12

Hi dear fellows, I'm sorry to use again this way of addressing my problem as in Vol 17, Issue 5. It will be the last time. Promise. I can't find any solution on the web. When starting tor, it always reads "Failed to parse/validate config: failed to bind one of the listener ports". Furthermore, there are only empty logfiles, independent of the configuration of the logs option "notice". Has anyone else this kind of problem? This is my ORPort section: ORPort 443 NoListen ORPort 0.0.0.0:9090 NoAdvertise I even can't make a control port accessible for e.g. arm running on the same machine, although I didn't use it before. Client functionality is not working either. No connections through tor. Tor is configured as a bridge, my OS is Ubuntu lucid 10.04 and Tor's version is 2.3.17-beta-1~lucid+1. It just worked until the upgrade to the new version through torproject's repository. I really do have forwarded external port 443 to port 9090 on my machine. It nearly has me left in broken state dying. I checked for new requests concerning apparmor allowance, but there were only the ability to chown and access to /sys/devices/system/cpu/ which I granted both. I'm not so really competent with computers and therefore grateful for any help. Strange. No error logs, no function, no topic on the web.. Kind regards, christian

3 3

Traffic stats without vidalia
by Name Withheld 19 Jun '12

19 Jun '12

I've done some searching, but I can't seem to find any references to how I check the traffic stats (current b/w use, total MB passed, etc) for my node when running on a linux (CentOS 6) platform. I've built a new vps with a huge pipe that's command-line-only to maximize performance, but I'm noticing that I can't tell if it's working well without being able to view basic statistical info within that CLI environment. Does anyone know the solution to this? Thank you very much.

3 3

Problems with nameservers and permissions
by George 18 Jun '12

18 Jun '12

I've just started running a relay on Linux with Tor starting automatically, however arm reported that "all nameservers have failed" and, unsure what to do, I stopped Tor to go look up the problem. Then when I tried to start it in Terminal again I'm greeted with this: Jun 18 11:53:15.000 [warn] Couldn't open "/home/george/.tor/lock" for locking: Permission denied Jun 18 11:53:15.000 [err] set_options(): Bug: Acting on config options left us in a broken state. Dying. I've tried changing the permissions of the directory and the lock file but it still says permission denied. What should I do? I'm running Tor 0.2.3.17-beta-1 on Ubuntu 12.04. Thank you for any help, George

1 0

Failed to bind one of the listener ports / V. 2.3.17
by Christian 18 Jun '12

18 Jun '12

Hi all, since the last update from the repositories took place where I replaced the torrc file by the new version, I get the error message indicating no binding to the listener ports. I use Ubuntu lucid and Tor 2.3.17-beta-1~lucid+1 as a bridge. My ORPort section reads as follows: ORPort 443 NoListen ORPort 0.0.0.0:9090 NoAdvertise Am I missing something? I have forwarded external port 443 to port 9090 on my machine on my router. The setup consists of only one machine and the router. It worked well until this afternoon. ;-) I read about a copy and paste issue in config.c on the web, but it had been marked solved in February and doesn't seem to be for non-compilers like me. I really appreciate your kind help and thank you in advance. Greetings, christian

1 0

Tor Network Map advertising available B/W way too low
by Name Withheld 14 Jun '12

14 Jun '12

Hello, I just set up an exit node (PrivacyFoundation on the list), and while I've got 5mbps up, it only advertises as 80-90kb b/w available. That's not at all accurate, and I think it's meaning the connection is ending up way underutilized, since I'm not seeing much traffic on the b/w graph. How do I change the advertised b/w? Thanks!

2 1

running first Relay, low budget VPS on a Gigabit line
by tim 12 Jun '12

12 Jun '12

Hi, I have installed my first Tor-Relay on a low priced test VPS (1 BTC/m) hosted in NL some days ago. Today iftop shows the VPS puts 35 MByte/s in both directions through the line. *Phew* The hosting plan includes 50GB per month so I'm a bit over the fair use. What would you do? Let it run? throttle down? do no harm? Other than expected I only got a short mail with ssh login from them. The answer to my question if customers get some kind of admin-panel was: no, this would be higher security risk. contact us we do it in 2 hours. Any suggestions how to measure the traffic would be appreciated, must be roughly 12 TB the last 2 days. -- http://www.fastmail.fm - Accessible with your email software or over the web

4 4

ARM 1.4.5 has a very high cpu consumption
by tor-admin 10 Jun '12

10 Jun '12

Hi, today I updated arm from 1.4.4.1 to 1.4.5. After this update I noticed that the arm display is very unresponsive. The arm cpu jumps ever couple of seconds up to 90-100 %. If this happens arm does not update its display. This can be observed on all pages. I monitor two high capacity nodes with each about around 10K concurrent connections. With 1.4.4.1 the arm cpu was normally below 5 %. The tor server runs debian squeeze with python 2.6.6. Is this a known issue? Any options other that downgrading back to 1.4.4.1? Regards, Klaus

2 2

rpm init script not setting ulimit properly
by Aaron Hopkins 06 Jun '12

06 Jun '12

I noticed my exit node (tordienet) hovering around 1024 connections open, and checked /proc/<pid>/limits (available on newer kernels) and noticed that the filedescriptor ulimit was at the default 1024, which is likely not a great plan. I'm using the stock /etc/init.d/tor startup script that came in the tor-0.2.3.12.alpha-tor.0.rh5_7 RPM offered by the YUM repo http://deb.torproject.org/torproject.org/rpm/centos5-experimental. It attempts to set ulimit, but at least at startup on my Centos 5.8 openvz container, there's a soft limit set at 1024 filedescriptors, which requires the -S flag to ulimit to override. I changed line 87 of /etc/init.d/tor to: if ulimit -SHn "$MAX_FILEDESCRIPTORS" ; then And /proc/<pid>/limits shows tor running with the appropriate limits now. Unfortunately, this is likely to get reverted with the next package update. Is anyone else using the stock RPMs seeing the same behavior? -- Aaron

1 0

case law on for exit nodes
by Rejo Zenger 28 May '12

28 May '12

Hi, Who knows about cases where the owner of Tor exit node was prosecuted or taken to court for information that was up- or downloaded using his/her Tor node? Basically, I'm looking for case law on running Tor exit-nodes. I am especially interested in case law from countries in Europe, but other examples are most welcome as well. If there is an interesting set of verdicts, I'll compile a summary and I'll share it with this list. Thanks for your help! -- Rejo Zenger . <rejo(a)zenger.nl> . 0x21DBEFD4 . <https://rejo.zenger.nl> GPG encrypted e-mail preferred . +31.6.39642738 . @rejozenger

13 25