- tor-relays - lists.torproject.org

Exit policy question
by George Gemelos 05 Jun '11

05 Jun '11

I recently had a dedicated server free up and decided to set it up as a Tor relay. It has 100Mbps unmetered traffic, so I thought it would be a good contribution. Right now I have it set up as a middle node, but I am considering possibly converting it to an exit node. Both my server and I are based in the US. I asked my hosting company about the possibility of running a Tor exit node and they said that they do not have a policy against it, but that if they get a lot of complaints they might set up and ACL on specific ports. So I really would like to reduce the probability of getting any complaints. I have heard about the reduced exit policy. What are people's experience running with that policy? Is there a further reduced set that might be better, in the sense of avoiding complaints, and still remain useful as an exit node? Should I just leave it as a middle node? Thanks in advance for any feedback. Regards, George

13 34

Exit enclaves load time
by Zach Lym 20 May '11

20 May '11

I have been running load time tests for duckduckgo.com and ff.duckduckgo.comthrough the Tor network. duckduckgo.com should be on an enclave node<https://www.dan.me.uk/torcheck?ip=72.94.249.36>, ff.duckduckgo.com should not be. But they appear to be loading at comparable times and LoadUI is showing no difference between the two URLs- even more complex queries such as "what is my IP" Can anyone tell if duckduckgo.com misconfigured? Is it the CDN that DuckDuckGo uses that equalizes the load time? Is the Tor network not utilizing the enclave node as heavily as the documentation makes it sound? Or have the exit proxies really gained that much capacity that they are no longer the bottleneck for such small small requests? -Zach Lym

3 4

Keep your Tor relays updated!
by tagnaq 16 May '11

16 May '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, I encourage everyone running a relay to use an up to date Tor version. (especially directory authority operators - but they should know better anyway) This might be an obvious recommendation but there are a lot outdated relays (~15%). What are currently recommended Tor versions? You can find out by going to: https://metrics.torproject.org/consensus-health.html (go to "Recommended versions") 0.2.3.1 is also fine (atm). If you don't know what version you are using, run: tor --version If you are running an old version for a specific reason I'd like to hear about it (off-list if you wish). make the Tor network safer - update your relays. tagnaq PS: Next week I'll try to contact relay operators still running <0.2.1.29 <0.2.2.21 update if you want to help reduce the effort. -----BEGIN PGP SIGNATURE----- iF4EAREKAAYFAk3NhE0ACgkQyM26BSNOM7Z7qwEAtao1Z2CPl+GV8lhwG18sSA1N pFLqVQ4h/EmbzicMuAMA/1U59gNti+hs8wYUh8THXky+aKb7YIR7D0hokdpNcWBY =YTaA -----END PGP SIGNATURE-----

3 6

Difficulties in running a private Tor network
by joel hobson 16 May '11

16 May '11

Hi all, I hope this is the right place to ask for help with this problem. I'm working as a research assistant at a university for the summer, and my project requires me to set up a private Tor network. I'm attempting to run 3 dirservers on three different linux/unix machines. Most of the time, the dirservers upload their signatures to one another as they're supposed to, but I still have problems after that. I'll usually get messages like "Received http status code 404 ("Not found") from server 'IP:PORT' while fetching "/tor/status-vote/consensus-signatures.z"" (the 404s IP:PORT are always the same) or "[notice] While fetching directory info, no running dirservers known. Will try again later. (purpose 5)". Two of the dirservers give me messages saying "[warn] Configured authority type does not match authority type in DirServer list. Adjusting. (4 v 6)" when I start them up. I have little idea of what any of these errors mean, and no idea of how to fix them. My torrc files are mostly the same for each server, and I've pasted one below. I hope someone here can help me figure this out. Thanks, Joel TestingTorNetwork 1 DirServer dir1 v3ident=2D50FCA97045D078CD22E9092C9CF3E300084B87 orport=5151 x.x.x.x:5150 FD65 3AE1 4133 31A9 20DF 8220 1F6F 8DF7 268F F238 DirServer dir2 v3ident=EAC28AB68522174442AA214DC60C625675B2D1E9 orport=5152 y.y.y.y:5150 95B9 79E9 4A37 161C EFCC EE13 E7C5 D7EA EB76 B695 DirServer dir3 v3ident=24BD756B7660827D0507319A87DD16F31250A29C orport=5153 z.z.z.z:5150 23D5 E382 86E6 1118 48E9 C848 2ECE B702 23EA A0E8 DataDirectory . ORPort 5152 SocksPort 0 Address y.y.y.y DirPort 5150 V3AuthoritativeDirectory 1 AuthoritativeDirectory 1 ContactInfo test(a)test.test ExitPolicy accept *:* AllowSingleHopExits 1 ExcludeSingleHopRelays 0

4 5

Re: [tor-relays] Network Scan through Tor Exit Node (Port 80)
by Scott Bennett 05 May '11

05 May '11

On Fri, 15 Apr 2011 04:12:53 -0700 Mike Perry <mikeperry(a)fscked.org> wrote: >Thus spake Scott Bennett (bennett(a)cs.niu.edu) > >> On Sat, 02 Apr 2011 Jacob Appelbaum <jacob(a)appelbaum.net> > wrote: >> >> On Thu, 10 Mar 2011 10:27:50 -0800 Chris Palmer <chris(a)eff.org> wrote: >> >>> >> >>> The Observatory work was not done through Tor. >> >>=20 >> >> Good. >> > >> >I think we need a scan of the SSLiverse through Tor. >> >> Use !=3D abuse. >> If I run sendmail with it configured to accept mail from outside, th= >at >> does not mean I agree to receive massmail, malware, or other bad stuff via >> TCP port 25. Because various idiots with access to the Internet insist u= >pon >> attempting to abuse my ability to receive mail does not militate against = >my >> defending my system from such malicious activity in any way I see fit. > >You are right. It does not. You are entitled and in fact expected to >defend your system from scans and abuse. > >Censor yourself, not others. Laying aside for the moment the definitional problem with your demand that I am neither a state nor an employee of one, I think you have gotten me mixed up with someone else. I have never advocated censorship. You perhaps have forgotten the many instances in which I have requested a BadExit flag be assigned to exit nodes that altered the data returned to tor streams from the destinations or that reliably "failed" to connect to certain destinations when other exit nodes did connect to them. I have, OTOH, stated approximately my policy regarding inappropriate attempts to probe or otherwise access my computer. If you see some connection between my denial of access to my ORPort and DirPort to systems I deem to be miscreants based upon their own past behavior and the administration of an exit node, then please enlighten me because my understanding hitherto of the design of tor was to render untraceable any relationship between the two, which would seem to me to require that entry node access restrictions have no relationship to exit restrictions. >=20 >> Further, an activity that can be used by one party to cause terminat= >ion >> of another, innocent party's Internet connection is an intolerable assault >> upon the latter party's paid access to the Internet for all purposes, not >> just to offer additional capacity to the tor network, and upon a private >> agreement between the latter party and his/her ISP. Defense against such >> offenses is completely appropriate and in order. > >It is not an arbitrary party whose Internet connection risks >termination. It is a party that signed up to protect Internet freedom >and resist censorship. People who want to bring censorship to Tor are >not welcome on the network. The reason is simply because censorship >does not work. True enough, though irrelevant to the discussion of entry node access. > >> The activity in question also is not easily distinguishable from that >> of a lot of actual malware that scans for open ports to find a way in. > >This justifies Internet censorship? Or censorship at Tor Exits? It seems that I am not the only one who has misplaced some details here. I cannot remember ever having advocated filtering of exit traffic in any way other than by published exit policy. In fact, I have even once asked for a BadExit flag for a node that returned bad data that it itself may have received from some intermediating proxy on grounds that the data were still not what should have been returned. (That was the time that grarpamp objected on grounds that it might not have been the exit node's fault, even though the data were still bad.) I note here again, non-state entities might filter, but by definition, are not censors because they only exert control over their own property, as opposed to state entities that do violate the property rights of others by forcibly exerting control over the private property of others in order to restrict or adulterate the transmission of information. > >Or are we just trying to ethically define "abuse" and "anything that >looks like malware" is the best we've come up with so far? That's >a pretty poor standard. I define it as TCP SYN or UDP packets sent to ports on my system on which no program is listening, which is the same as saying that they are attempts of unauthorized access. > >> >Google seems to have this data from crawling the web and simply caching >> >it as a matter of crawling everything - they get the data from lots of >> >sources such as other urls, toolbars, etc. Google recently published >> >the Google Certificate Catalog: >> >http://googleonlinesecurity.blogspot.com/2011/04/improving-ssl-certifica= >te-security.html >> > >> >So is Google's method the only ethical way to collect this certificate >> >data? Or is there no method for collecting this data without users >> >manually submitting each certificate they encounter by hand? >> >> AFAIK, Google does not use the tor network for its web (or other) >> crawling activities. For Google's purposes, the tor network would be >> unusably slow. AFAIK, Google does not use any method that uses someone >> else's computer(s) to make its connections to a destination.=20 > >What does using the Tor network have to do with the ethics of crawling >the web/Internet? What makes it not OK to crawl the Internet >anonymously, but makes it acceptable to seek that same information so >long as you are not anonymous? Or are we being Kantian here, and >saying that if everyone crawled the Internet, we'd be doomed. So >therefore, only Google can crawl the Internet? That doesn't work >either. The problem, as I hoped I had made clear already, is that it incites damage to the tor network, specifically to both the population of tor exit nodes and their operators' Internet access. Google, AFAIK, does not use tor and therefore does not place tor exit nodes at risk. > >Again, people sign up to be Tor relays to take a stand against >Internet censorship and surveillance. It is thus expected that they >allow all traffic to pass unmolested and unmonitored, or work to >implement a way to do their programmatic ExitPolicy filtering in a way >that does not impede client activity. > >Exits are not so scarce that we need to flex our morals on this point. I am not going to get into a discussion of morals because morals vary from one person to another based upon anything from religion to culture to personal whim. I limit my discussion to points of ethics, which are invariant and can therefore be addressed with consistency. > >> An EFF employee, OTOH, has confessed to doing so on this list. The >> latter, then, is burning CPU time, as well as network connection >> throughput capacity, on not just one system, but on routelen + 1 >> systems for each scanned system times the number of ports scanned on >> that system. > >Nobody confessed to doing anything over Tor. Chris and Jake simply >defended the idea of crawling the net over Tor. At no point did >anybody state that the scan did happen over Tor. In fact, several >people said the opposite. > You are correct in this matter. I misremembered that detail, and I apologize for my misstatement. Nevertheless, Chris, IIRC, did say that he supported such abuse of tor exits, even though he had not (yet) done so himself. >Perhaps if your mail client supported threading this would be more >apparent to you? Actually, it's right there in the very first text you No, it has nothing to do with mail software, as you observe in your next sentence. >quoted, though. So perhaps something else is amiss. Is the pager in >UNIX 'mail' still the original 'more' or something? Or are you still less(1). >using 'ed' to type your mails? :) The problem was (and still is, though less so already) the delay in catching up to current mail due to an immense backlog in my in box. Ever since I unsubscribed from tor-talk several weeks ago, I have slowly been gaining ground on the extent of the running backlog, so the situation can be expected to improve over time. My apologies for my confusion. > >> Another point, though irrelevant due to the ethical considerations >> that we've been discussing so far, is that there is no particular >> reason to use tor rather than some other proxy to look at the >> Internet from different locations. Anonymity is not necessary to >> achieve that end. > >It is very useful to be able to scan the Internet from multiple, >stable vantage points with anonymity. That seems likely true. However, it doesn't justify doing damage to third parties, who have committed no offense other than to offer a service to a community of users who desire to access the Internet anonymously, nor to that community of users by reducing the size of the pools of exit nodes and of any other circuit positions in which those same nodes may serve. > >So long as the resources of any one site are not unreasonably >consumed, and so long as the scanner is not substantially occupying Tor >exit bandwidth, I really don't see what is so ethically complicated >about this.=20 As noted before, the ethical problem is that exit nodes are put at much greater risk of elimination. I realize full well that there are plenty of other tor users who act in similarly damaging ways for actually nefarious ends, but the point remains that the means are wrong, regardless of the ends. > >By occupying this topic with our attention, we are allowing ISPs who >seek to impose restrictions on Tor traffic in one form or another to >have their way and dictate what is acceptable on our network. Such I would be interested to know what evidence you have to support that claim. From what I've seen thus far, ISPs, especially gigantic ones like Comcast, have not the slightest interest in which programs one runs, much less the often esoteric discussions on mailing lists related to those programs. Instead, they care about dividing their services into two classes: one class that is relatively cheap but is definitely *not* a full-service for Internet access and another class that costs at least twice as much and usually provides something approximating full Internet access. In the U.S., the partial service has sometimes been falsely, and therefore illegally, advertised as "full Internet service" or "unlimited Internet access/service". >ISPs do not deserve any Tor-related revenue. Agreed. However, in many locations there is no or greatly restricted competition, often due to governmental intervention, so the individual subscriber's options may be limited to either working with such degenerate corporations or not being connected to the Internet at all. > >It is that simple. We can worry about compromising our principles for >precious few kilobits when all else has failed. > If you are so willing to compromise on principles, then why do you devote your professional life's work to the tor project? Do you secretly aim to undermine the goals of the project in some way? After all, you recently opined that exit nodes with throughput capacities less than 100 kB/s were basically a nuisance and/or not worth bothering with, just caused load distribution problems, and so forth, an opinion discouraging volunteers from running such exits. If that discouragement were to succeed in reducing the size of the exit pool, that would seem to reduce the anonymity of tor users correspondingly, something that would also seem in order for someone trying to sabotage a project for which he worked. I trust that wasn't your real intention, but it surely could have been interpreted that way by someone outside your inner circle. I was astonished when I first read it. Scott Bennett, Comm. ASMELG, CFIAG ********************************************************************** * Internet: bennett at cs.niu.edu * *--------------------------------------------------------------------* * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * * -- Gov. John Hancock, New York Journal, 28 January 1790 * **********************************************************************

1 0

Relay behind firewall
by tagnaq 28 Apr '11

28 Apr '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, is there a way to properly configure a relay (ORPort reachable) that has full internet access beside outgoing destination port 80 that will properly work? Problems: publishing descriptor to authorities that use that port, clients are not aware of this restriction of a relay and will try to build circuits where $nextrelay uses ORPort 80 -> circuit will fail (currently 28 relays use ORPort 80) I guess one should simply not bother trying to run a relay in such a scenario. Is my assumption correct? thanks, tagnaq ps: FascistFirewall is for clients only -----BEGIN PGP SIGNATURE----- iF4EAREKAAYFAk25Zg4ACgkQyM26BSNOM7YjMQEAlldmzhXeGbaar0tT0Qvyh3b+ b4cOSdVU3+x1iBPujqcA/0UiLBmGloriq5DJNOqXWQdO9dKIjOxW2zdewiTyNRm/ =sxNK -----END PGP SIGNATURE-----

2 1

DMCA notices in Canada?
by anarcat 26 Apr '11

26 Apr '11

Hi, Have any other tor operator *in Canada* been targeted with DMCA takedown notices? We have received a bunch from our upstream provider and so far have refused legal responsability because (a) we're not in the US and (b) there's nothing to takedown, we're just a transit provider... But now our upstream is threatening us to completely disconnect us if we do not take action within 30 days. We're running a full exit node, so it's likely getting used by people for bittorrent downloads... Ideas? Suggestions? Legal support? United organised legal front? A. -- Imagination is more important than knowledge - Albert Einstein

2 3

Persistent XSS vulnerability in TorStatus
by tagnaq 23 Apr '11

23 Apr '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 "TorStatus is a website display used to summarize metrics about the Tor Network. It's a precursor to http://metrics.torproject.org. The code repository is at https://svn.torproject.org/svn/torstatus/. Example running sites are http://torstatus.blutmagie.de/ [...]" Note: TorStatus is not a Tor Project product and is not maintained. Vulnerability - ------------- DisplayRouterRow() in index.php prints the contact information string from a server descriptor - defined via 'ContactInfo' in torrc by a node operator - into the HTML page without proper output encoding. This leads to a persistent cross-site scripting vulnerability where every Tor node operator can insert HTML/JavaScript on all vulnerable TorStatus mirrors. The contact information column is only included in the HTML page if the end-user (browsing a TorStatus mirror) adds the contact column via "Advanced Display Options" (column_set.php), the contact column is not included by default. An attacker might set the displayed columns for a victim via CSRF. A simple search in the server descriptors of the last two months did not reveal an obvious exploitation in that time period. The simple search used is not suitable to give a clear answer. [grep -hir ^contact * |egrep -i '(script|src)'] Affected Versions - ----------------- 4.0 3.6.1 3.6 3.5 3.4.2 3.4.1 and probably others Solution - -------- The attached patch was committed to the svn (revision r24666). https://svn.torproject.org/svn/torstatus/ Thanks to Robert, Andrew, Olaf, Damian and Sebastian. -----BEGIN PGP SIGNATURE----- iF4EAREKAAYFAk2zBb4ACgkQyM26BSNOM7YE8gD9HzwAZ1rfUDM+GLxjFfo0o1R7 A5l2MPddbmPlr+d23oYA/1m8VI3bbG9RXvao453j2Yyqix/iJ01rJbLP63PtWShw =Ay2T -----END PGP SIGNATURE-----

1 0

Re: [tor-relays] high cpu usage, normal ?
by Scott Bennett 20 Apr '11

20 Apr '11

On Tue, 5 Apr 2011 14:56:42 +0200 Gijs Peskens <gpeskens85(a)gmail.com> wrote: >I'm running an exit relay configured to give up to 6,4MB/s on an Athlon64 >3000+ Freebsd box, and I'm seeing cpu usage between 30-60% is this >considered normal ? Any means of getting it down? (except getting a faster For such a high-throughput node on such an old CPU, yes, that is not only normal, but actually quite low CPU usage. >cpu or hardware crypto) I don't remember whether the 3000+ is a K10-type CPU or later. If it is, then make sure you have superpages support enabled in your kernel at boot time. If the 3000+ is pre-K10, then enabling superpages support is as likely to hurt performance as it is to help it, which basically would leave you the option of trying it both ways to see which worked better for you. On a K10 or later style of CPU, running a high-throughput node with superpages enabled should shave 10% to 30% from whatever tor's current usage. IOW, if you're seeing 30% - 60% now, then what you see with superpages enabled would probably fall into the 21% - 54% range. The problem with AMD's pre-K10 CPUs is that the size of the TLB shrinks when 4 MB pages are used, so that instead of having 64 entries for text pages and 64 entries for data/stack pages, there are only two (maybe just one--I don't recall for sure) entries for each. Because tor is a much larger process than would fit into one 4 MB page of each kind, using the 4 MB page size instead of the 4 KB page size is very likely to drastically increase the frequency of full address translations, rather than reducing it as on later CPUs in which the TLB retains the capacity for both page sizes. To enable the use of superpages, your system must be at 7.2-RELEASE or later of FreeBSD. Just add the following to /boot/loader.conf, and then reboot. # enable superpages (4 MB) for large processes vm.pmap.pg_ps_enabled=1 Scott Bennett, Comm. ASMELG, CFIAG ********************************************************************** * Internet: bennett at cs.niu.edu * *--------------------------------------------------------------------* * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * * -- Gov. John Hancock, New York Journal, 28 January 1790 * **********************************************************************

1 0

Tor and Viruses
by Porcelain Mouse 17 Apr '11

17 Apr '11

Greetings All, I've been running an exit for about 5 months, but had to stop due to virus abuses. In the last two weeks, my ISP has partially blocked my Internet access twice due to suspected virus infections. I'll spare you the long story, but I was able to get a copy of their "evidence" and I'm fairly certain it was connections made through my Tor relay. 1) How common is it that Tor is abused by viruses? What is the trend? 2) Is this just standard virus-kit material, these days? I guess I was a little surprised. Obviously, this is a great idea for hiding the infection site, so I'm sure it's being done. But still, I've been fighting viruses for quite a while and I don't think I've read a single virus description that mentioned Tor. I'm sure it's happening, but I've never heard a single statistic about it, so I thought I would ask. Also, this type of abuse is *not* mentioned on the Tor wiki's Abuse FAQ under "What should I expect if I run an exit relay?" I read that section carefully and was prepared for most of the things mentioned. Again, I'm not completely shocked. I'm just saying it didn't seem likely, according to the FAQ. It would be nice to know how likely is this kind of abuse, and what is the trend. (And, maybe someone can add the results to the FAQ when we have an answer.) Thanks, PMouse

7 7