- tor-relays - lists.torproject.org

two relays serving same hidden service
by cmeclax-sazri 10 Apr '11

10 Apr '11

Suppose I have this setup: Dhole, Dingo, and Fennec are three computers on a LAN. Dhole and Dingo both have external IP addresses and both run Tor relays. Fennec runs a hidden service. Both Dhole and Dingo have the same hidden service address, paxamifrabolerfu.onion, pointing to Fennec's LAN address. Alice tries to connect to paxamifrabolerfu.onion. What happens? cmeclax

3 2

avoiding frequent MyFamily syncing on a dynamic Tor instance group
by tagnaq 07 Apr '11

07 Apr '11

Hi, I don't know if this is already done but it just came into my mind when writing something to sync MyFamily settings throughout multiple nodes: To avoid frequent reloads of many Tor instances, one could pre-emptively create keys (lets say keys for 30 nodes) and build a MyFamily set for it. As you add nodes use this MyFamily set although not all 30 keys are in use yet. This way one would not have to touch running instances when adding new ones. >From a security point of view this is probably quite a bad thing, but does someone already do that?

4 4

Re: [tor-relays] Request for help - Tor legal FAQ
by Marcia Hofmann 07 Apr '11

07 Apr '11

>> To make the FAQ as current and useful as possible, we want to make >> sure that we know about any legal issues that relay operators in the >> United States may have experienced over the past few years. > I understand the focus on USA, but wouldn't this be a good opportunity > to add legal information about other countries as well? It's fantastic idea, and we'd love to be able to do it. Unfortunately, all of our practicing lawyers are licensed in the United States, and we don't have the legal expertise to provide an FAQ like this on a country-by-country basis. :(

3 3

high cpu usage, normal ?
by Gijs Peskens 05 Apr '11

05 Apr '11

I'm running an exit relay configured to give up to 6,4MB/s on an Athlon64 3000+ Freebsd box, and I'm seeing cpu usage between 30-60% is this considered normal ? Any means of getting it down? (except getting a faster cpu or hardware crypto)

3 2

help w/ Debian: Error binding network socket: Address already in use
by Olaf Selke 04 Apr '11

04 Apr '11

Kernel 2.6.32-5-amd64 #1 SMP Sat Oct 30 14:18:21 UTC 2010 x86_64 GNU/Linux Tor v0.2.2.23-alpha (git-b85eb949b528f4d7) Hi folks, on blutmagie exit Tor frequently logs Apr 04 15:27:48.706 [warn] Error binding network socket: Address already in use Apr 04 15:27:48.765 [warn] Error binding network socket: Address already in use Apr 04 15:27:48.775 [warn] Error binding network socket: Address already in use Apr 04 15:27:48.785 [warn] Error binding network socket: Address already in use Apr 04 15:27:48.864 [warn] Error binding network socket: Address already in use Apr 04 15:27:48.900 [warn] Error binding network socket: Address already in use I'm a little bit clueless what's wrong here. I've read http://hea-www.harvard.edu/~fine/Tech/addrinuse.html and found SO_REUSEADDR being used in connection.c. Tor opens about 1k new tcp connections/s and the average number of open tcp sessions is about 70k. anonymizer2:/tmp# netstat -tn | wc -l 70597 Any ideas why Tor can't bind to sockets? regards Olaf

2 2

Request for help - Tor legal FAQ
by Marcia Hofmann 04 Apr '11

04 Apr '11

Hi there, EFF is updating the Legal FAQ for Tor Relay Operators, which we first wrote about six years ago. https://www.torproject.org/eff/tor-legal-faq.html.en To make the FAQ as current and useful as possible, we want to make sure that we know about any legal issues that relay operators in the United States may have experienced over the past few years. To that end, does anyone on this list know about situations where... ...a relay operator has been sued or prosecuted for anything Tor-related? ...the police have seized servers that are running relays? ...someone has tried to use a legal demand (like a subpoena) to figure out who operates a relay? Please email me off-list if you know about an incident like this or anything else you think I should be aware of. Many thanks for your help! -- Marcia Hofmann, Senior Staff Attorney Electronic Frontier Foundation 454 Shotwell Street San Francisco, CA 94110 tel: (415) 436-9333 x. 116 | fax: (415) 436-9993 marcia(a)eff.org | http://www.eff.org

3 2

circuits that fail the exit policy repeatedly
by Scott Bennett 03 Apr '11

03 Apr '11

Upon occasion, I see very long sequences of info-level log messages to the effect that an exit stream has failed the exit policy. Is there any good reason why a relay should not return a DESTROY cell on a circuit whose exit connection attempts have failed the exit policy some threshhold number of times? After all, the exit policy is published information. Anyone making repeated attempts to violate it is either doing so in ignorance of a recent change to the exit policy, perhaps not yet propagated to the client causing the problem, or is doing so as some sort of cracking attempt. It seems to me that killing a circuit in this situation is appropriate to minimize waste of tor network resources. Any thoughts on this? Scott Bennett, Comm. ASMELG, CFIAG ********************************************************************** * Internet: bennett at cs.niu.edu * *--------------------------------------------------------------------* * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * * -- Gov. John Hancock, New York Journal, 28 January 1790 * **********************************************************************

1 0

Re: [tor-relays] Network Scan through Tor Exit Node (Port 80)
by Scott Bennett 03 Apr '11

03 Apr '11

On Thu, 10 Mar 2011 10:27:50 -0800 Chris Palmer <chris(a)eff.org> wrote: >On 03/10/2011 09:10 AM, mick wrote: > >> Using Tor to scan the internet is a good way to see how the internet >> looks from different perspectives at once, which can be quite valuable." >> >> Which says to me that you are using Tor to do this research. > >No, it says to you that using Tor to scan the internet is a good way to >see how the internet looks from different perspectives at once, which >can be quite valuable. > >> So which is it? > >The Observatory work was not done through Tor. Good. > >However, using Tor to scan the internet is a good way to see how the >internet looks from different perspectives at once, which can be quite >valuable, so I vociferously defend the idea of doing so. > Ah. "The ends justify the means." How enlightened. :-( Scott Bennett, Comm. ASMELG, CFIAG ********************************************************************** * Internet: bennett at cs.niu.edu * *--------------------------------------------------------------------* * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * * -- Gov. John Hancock, New York Journal, 28 January 1790 * **********************************************************************

2 1

Tor not releasing port on shutdown?
by Geoff Down 02 Apr '11

02 Apr '11

Hi, the most recent times I have tried to restart Tor after a 'killall -INT' I have been presented with the following error: "[warn] Could not bind to 0.0.0.0:9001: Address already in use. Is Tor already running?" I'm not sure if this has started since I changed version, I'm on Tor 0.2.2.22-alpha (git-e5e38e55b33b2cc0) OSX 10.3.9 . Anyone else see this? How do I release that port? Command 'lsof -i' returns no results, so I don't see Tor is really using it still - no sign of Tor in command 'ps -aux' output. Update: after running those commands, Tor was able to start. Why the delay? Is this normal? TIA GD -- http://www.fastmail.fm - The professional email service

5 5

Re: [tor-relays] Network Scan through Tor Exit Node (Port 80)
by Scott Bennett 30 Mar '11

30 Mar '11

On Wed, 9 Mar 2011 19:18:34 -0500 cmeclax-sazri <cmeclax-sazri(a)ixazon.dynip.com> wrote: >On Wednesday 09 March 2011 17:20:17 Chris Palmer wrote: >> On 03/09/2011 01:48 PM, Arjan wrote: >> >> We are saying hello on port 443, and then saying goodbye. Once. Using >> >> normal TCP and TLS handshaking, no tricks. For the good of the internet. >> > >> > That would be enough to get me in trouble with my ISP for performing >> > portscans (if I were running an exit node). >> >> And how would you, or anyone else, differentiate that from normal web >> browsing? > >If a lot of those connection attempts are going to IP addresses with no host >present, or hosts not running a webserver, it looks like portscanning. If >almost all of the connection attempts are to webservers that have port 443 >open, it looks like normal https web browsing. Are you kidding? Closing a connection upon receipt of the ACK response to the SYN you sent looks like normal HTTPS web browsing? On what planet? Normal web browsing, whether HTTP or HTTPS, involves data transmission occurring in both directions between receipt of that ACK and the closing of the connection by the web browser. Closing the connection upon receipt of the ACK response to the SYN without any intervening data transmission is, OTOH, a characteristic behavior of port scanners. So you had it backwards. Here's a tidbit for you to consider. pf offers an option on filtering rules for inbound SSL connections called "synproxy", which relieves server software of the effort of dealing with bogus connection attempts by handling the SSL exchanges itself before passing the connection on to the server. It also means that a connection from something that doesn't know how to perform the SSL handshaking will sit until the timeout occurs, so the attacker is stuck with an outstanding connection tying up resources until that happens. That delay of a couple of minutes can be a long and wasteful nuisance to an attacker. OTOH, a legitimate application, e.g., a tor client or relay trying to connect to the ORPort of another relay, completes the handshake and begins communicating with its peer with no delay, and the software accepting the connection only deals with the legitimate connections. It works just great! :-) I highly recommend it to anyone running a tor relay on a system that supports pf. > >I have only one external address and only a few ports forwarded, so I can't >detect portscans. I have noticed that an attempt to guess passwords on SSH is >often, but not always, preceded by a connect and disconnect from the same IP >address, which is probably part of a portscan. I don't block addresses that >scan ports, but I do block addresses that try to guess passwords (not on the >Tor box, just on the other one). The block expires in a day. > To each his/her own. Legitimate port scanning operations are typically run by system/network administrators against the machines on their *own networks*. I treat any others as attackers or at least attacker-wannabes, and I keep track of such miscreants indefinitely against the possibility that I might someday provide services other than tor relaying. The miscreants will have no access to such services on general principles and will only have access to the tor node if and when they are currently running a public (i.e., not a bridge) tor node on the system with the IP address from which their tor attempts to connect to mine. Scott Bennett, Comm. ASMELG, CFIAG ********************************************************************** * Internet: bennett at cs.niu.edu * *--------------------------------------------------------------------* * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * * -- Gov. John Hancock, New York Journal, 28 January 1790 * **********************************************************************

4 4