- tor-relays - lists.torproject.org

Bridges on OpenWrt
by Mitar 29 Mar '11

29 Mar '11

Hi! Is there some package for running Tor bridges on OpenWrt supported devices? But as I understand Tor bridges consumes same amount of CPU power and RAM as Tor itself so they are not really possible for low power devices as WiFi routers where OpenWrt normally runes (with typically around 16 MB RAM and 200 MHz CPU power). But on the other hand, as we have in operation a lot of WiFi routers around the country, many of them having their own public IP from very diverse IP ranges, this would be quite useful for bridges. So my question is if somebody has tried to do something like that? Have some experience with it? And also if maybe bridges support would be possible to extend so that we could make (low overhead) tunnels from this WiFi routers to the central server where there would be running a Tor node connected to the Tor network, having enough CPU power and RAM to run everything. So it would be great if the Tor clients would be able to connect to those VPNed end points, but encryption itself would be done on the server. Mitar

3 5

multiple tor nodes on one router? was first using bridge then become bridge
by Lorenz Kirchner 27 Mar '11

27 Mar '11

Hi everyone, so I received no hint as to how or whether to pursue this thought... i shall find other sources of information I just started reading the manual, would you believe it.. I have a new question now, I currently have set up number of tor relays on my router which are loadbalanced using squid... in the hope to increase throughput and perhaps achieve increased anonymity by sending requests for one site through different tor routes... Is that advisable or even effective? My feeling is that the connection is somewhat more reliable than with just one tor relay.. and following on with this could one of these relays be set up to connect to tor via a bridge and then pass directory info on to the other relays running on the same machine? Kind regards, Loz On Thu, Mar 10, 2011 at 11:16 PM, Lorenz Kirchner <znerol2(a)gmail.com> wrote: > On 3/9/11 11:29 PM, mick wrote: > >> >> This this: >>> https://sites.google.com/a/infosecurity.ch/testst/ >>> >>> It's the google spreadsheet that load the bridge information embedded >>> into a google site. >>> >> I need a google account for that. What if I don't want one? >> >> So, any new ideas anybody? I still feel it would be best if 1. there was > a special function within tor to change from using a bridge to becoming a > bridge whithin the censored network, and 2. spreading this bridge-status > info locally... perhaps like dht in torrent.. only revealing a small > selection of available bridges nearby.. i obviously only have a very dim > idea of what i'm talking about.. sorry about that > > anyways, if these two problems could be addressed tor could be a biggie > with a lot of people here.. ;) -- think: cheap openwrt low maintenance > appliance.. > > Loz >

2 2

what updates do I need to install?
by Kathryn Cramer 25 Mar '11

25 Mar '11

I gather from Jacob's Twitter feed that I should download and install the new Tor Browser Bundle because of security updates. Will this affect the relay I am running? Do I also need to update Vidalia? Kathryn

2 1

IRQ affinity
by Mitar 24 Mar '11

24 Mar '11

Hi! I do not know if you have solved this but reading here: http://www.alexonlinux.com/smp-affinity-and-proper-interrupt-handling-in-li… It is written that: "So if on your system CPU0 handles all interrupts by default, this probably means that APIC configured ambiguously." So maybe it is nothing wrong with e1000e drivers/cards but with APIC configuration? Mitar

1 1

frequency of checking an IP change
by tagnaq 23 Mar '11

23 Mar '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, I'm wondering how often Tor tries to detect an IP change of itself and if a relay operator can modify that frequency? Observing the detection point in time and the actual IP change I guess it takes several minutes: - From the logfile: 00:33:30 Tor: Our IP Address has changed from ... to ... The new IP address was actually assigned several minutes before: 00:27:53 (check occurs every 10seconds) It would be valueable to modify the frequency because the relay in question gets a new IP address every few hours (<10h). Looking at the man page I couldn't find anything regarding that frequency. kind regards, tagnaq -----BEGIN PGP SIGNATURE----- iF4EAREKAAYFAk2J3ZIACgkQyM26BSNOM7b4NwD/QmH0RWDsp0muCy0PFtkE0Gw4 TDNZx4eDYcOLKfvRX5UA/1PdG8w7DYtfvktWGkzBj82d6/gFo68oVJ+QAM8yqvWU =wnE6 -----END PGP SIGNATURE-----

1 0

abuse reports from shadowserver.org
by Alexander Bernauer 21 Mar '11

21 Mar '11

Hi everybody, my ISP keeps on receiving abuse reports from shadowserver.org. They claim that an IRC bot operates from the IP that belongs to my tor exit. The strange thing is that my exit policy only allows web and mail ports. Furthermore, the IPs of the shadowserver honeypots have a ptr entry for *.sinkhole.shadowserver.org. So, I could block their servers either by means of the exit policy or with iptables. Which one would you prefer? I additionally wanted to ask here if there is any experience with shadowserver in this regard? Explaining the issue to my ISP failed. They keep on getting nervous. Talking to shadowserver also failed, because subscription to their public mailing list is moderated and my direct mails have been ignored for several months now. Any advice? regards Alex

6 6

weighting algorithm
by Olaf Selke 16 Mar '11

16 Mar '11

Hi, between Saturday evening and Tuesday afternoon (UTC+1) my relay's bandwidth dropped to about 2/3 of its normal value. Did some changes in directory's weighting algorithm occur during this time period? regards Olaf

5 6

Re: [tor-relays] Network Scan through Tor Exit Node (Port 80)
by Scott Bennett 10 Mar '11

10 Mar '11

On Sat, 26 Feb 2011 12:13:53 -0800 Chris Palmer <chris(a)eff.org> wrote: >On Feb 26, 2011, at 9:53 AM, mick wrote: > >> No reputable security researcher would a) scan a network without that >> network owner's explicit permission, nor b) use tor for that scan. > >Lots of reputable security researchers who scan the entire internet without getting permission. You can't get permission from every operator in the world, but you still need to do good and interesting research. Examples of reputable researchers who have scanned the whole internet include Dan Bernstein, Dan Kaminsky, and EFF. (At least I think we're reputable. :) ) I don't know for sure, but I can't imagine Arbor, CAIDA, and Renesys can do their jobs without scanning the internet. Well, as I've just finished describing in another topic here, I treat scanning of my system as attempted security breaches. Such scans will not elicit any apparent response from my system, except that the scanner's IP address will shortly be added to my "block" file, which will deny all future access to my tor node's ORPort and DirPort. > >Using Tor to scan the internet is a good way to see how the internet looks from different perspectives at once, which can be quite valuable. > I disagree and, as noted above, treat that as a cracking attempt. tor nodes that you abuse in such fashion will continue to function by the means described below, provided they are listed in the current consensus document. My current procedures are described in the next two paragraphs. However, your implication quoted above that EFF has/does/will abuse tor exits in this manner suggests I may have to modify my treatment of tor exits from which your scans emerge, given the increased likelihood that the offenses did not originate from the exit node's system and that the exit node was instead a victim as well. Nevertheless, your scans will not get responses from my system, except for connection attempts to the ORPort or the DirPort. First, I have set the sysctl variable called net.inet.tcp.blackhole to 2, which causes the kernel to drop all incoming packets addressed to closed ports. The IP addresses of tor nodes, including exit nodes, listed in the cached-consensus file on my system are placed into a "pass" file every 30 minutes, which temporarily exempts them from being checked against the "block" file. It is temporary in that the exemption lasts for 30 minutes only, although it will be exempted for another 30 minutes whenever the address exists in the cached-consensus file at the time the "pass" file is rebuilt. Anyone who may be concerned that their IP address or address range might be listed in my "block" file is welcome to write to me to inquire about it. If it is, then I will offer to remove the block on an indefinitely probationary basis. However, if I encounter the same IP address in my pf log again, then I will block the address permanently. Frankly, I think it's appalling that a previous sponsor organization for the tor project should turn on the tor network in the fashion you've confessed here that it has. I'm tempted to dig out all of the EFF IP address ranges and block them permanently, just as a matter of principle, although it would obviously have little real effect upon your organization. No wonder so many of us have run afoul of our ISPs when trying to run exit nodes when even EFF is trying to spoil the tor network for us. Who needs enemies with "friends" like EFF? Scott Bennett, Comm. ASMELG, CFIAG ********************************************************************** * Internet: bennett at cs.niu.edu * *--------------------------------------------------------------------* * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * * -- Gov. John Hancock, New York Journal, 28 January 1790 * **********************************************************************

12 27

first using bridge then become bridge
by Lorenz Kirchner 10 Mar '11

10 Mar '11

Hi everybody, i'm in china and when i start tor nodes (on a linux server) i often have to first start up the node using bridges, after i ran tor for a while i can restart the node as a bridge-no-exit-relay-entry-node, or whatever, and it will (through its cached data, I guess) be able to connect to the tor network.. and, importantly, help other nodes to connect to the tor network. It would be great if the node's mode could automatically change, when I start the tor node it will try to be a bridge relay according to my torrc, if it can not establish a connection it will first use a bridge and when it has enough data (non blocked entry nodes) will return to becoming a relay. Does this make sense? btw i think bridges.torproject.org is blocked in china (perhaps not surprisingly). And also, on linux servers, couldn't the tor node get the bridges via email by itself, that would be fantastic! each tor node could have its own gmail account, but i guess it would probably somehow be a problem for anonymity..? take care :)

4 11

tor not working
by prafull moulekhi 09 Mar '11

09 Mar '11

hi I m having problem in running tor since last 1 week. I am getting the following log. Mar 08 14:17:17.950 [Notice] Initialized libevent version 1.4.14-stable using method win32. Good. Mar 08 14:17:17.950 [Notice] Opening Socks listener on 127.0.0.1:9050 Mar 08 14:17:17.950 [Notice] Opening Control listener on 127.0.0.1:9051 Mar 08 14:17:17.950 [Notice] Parsing GEOIP file. Mar 08 14:17:22.831 [Notice] No current certificate known for authority moria1; launching request. Mar 08 14:17:22.831 [Notice] No current certificate known for authority tor26; launching request. Mar 08 14:17:22.831 [Notice] No current certificate known for authority dizum; launching request. Mar 08 14:17:22.831 [Notice] No current certificate known for authority ides; launching request. Mar 08 14:17:22.831 [Notice] No current certificate known for authority gabelmoo; launching request. Mar 08 14:17:22.832 [Notice] No current certificate known for authority dannenberg; launching request. Mar 08 14:17:22.832 [Notice] No current certificate known for authority urras; launching request.

1 0