- tor-relays - lists.torproject.org

upcoming directory authority changes
by Roger Dingledine 08 Dec '22

08 Dec '22

Hello fellow relay operators, Later today (Tuesday) we plan to do a synchronized shift where we make two configuration changes on the directory authorities. The goal will be to make these changes while maintaining the right threshold of signatures so relays and users still get a safe network status consensus that they trust. For background, Tor uses a threshold consensus design, where as long as a majority of directory authorities are behaving properly, all users get the same accurate view of the Tor network. You can learn more about the design in the bottom half of https://support.torproject.org/about/key-management/. Specifically, we plan to make these changes: (1) Temporarily remove Faravahar from the set of directory authorities, until Sina finds a new good home for it. We weren't all comfortable with its previous hosting location inside Team Cymru's network (see the bottom of https://blog.torproject.org/role-tor-project-board-conflicts-interest/ for more details), so to be extra safe we are making it no longer participate in the consensus process until it is reborn in its future home. You can read more about Sina and why we are excited to keep him involved in the Tor community at https://blog.torproject.org/volunteer-spotlight-sina-rabbani-helps-activist…. (2) Rotate to fresh identity keys for moria1, the directory authority that I run. In early November 2022 there was a remote break-in to the computer running moria1. Based on the evidence and the type of attack, I believe it was a standard automated attack -- that is, I think they weren't targeting the directory authority and also they never realized it *was* a directory authority. But to be extra safe, we decided to rotate to a fresh set of keys. I was also in the middle of a planned move to better hardware, so overall it was good timing for a fresh new start. I should note that for both moria1 and Faravahar, we have no evidence of any misuse of their keys. But more importantly, the threshold consensus design keeps Tor users safe *even if* we are underestimating what happened. Tor users and relays demand a consensus signed by a majority of the directory authorities, and right now that's five out of eight. Tor's security/privacy/anonymity properties remained safe before, during, and after these changes. Some closing thoughts and details: * We actually already removed Faravahar in the Tor git repository and in the Tor release 0.4.7.11 (which came out Nov 10 and has been in Tor Browser since Nov 22), so modern clients and relays are already demanding signatures from five authorities that aren't Faravahar. The change we'll do today is to make the other directory authorities stop incorporating its vote and signature into the consensus. Doing these changes at different times opened the window for surprising but harmless log warnings like https://bugs.torproject.org/tpo/core/tor/40725. We could see similar issues with the new moria1 key, and if so they should go away once there's a new release with the new key and you have upgraded. * In my opinion there is a good argument for every directory authority making fresh keys every few years anyway, especially in a world with sophisticated attackers who might try to obtain keys and not leave any traces. So for example when we bring Faravahar back I think it should be with entirely new keys. * Secure consensus designs have become much better in the past decade, in large part from all the Bitcoin enthusiasm. Our current design was always intended to be a placeholder until we got something better. And our friends in the PETS research community have been exploring edge cases where evil directory authorities can create mischief even when they're slightly less than a full majority. So while we're triaging the usual fires and priorities, we shouldn't forget about improving the directory design. * Directory authority keys already have a notion of an offline long-term identity with shorter-lifetime online keys that expire periodically, with the goal of limiting the future impact of a compromise. But it seems like this role separation never quite matches up well to the security issues that arise in practice, whereas it definitely adds complexity both to the design and to operation. This piece of the design could use some new ideas. * Lastly, the directory authority operator community is a community too, and the security of the Tor network relies on social trust and cooperation between these fine people. We used to have directory authority operator meetups in person at security conferences and at Tor dev meetings, to maintain the social and community connections. Covid put a stop to that along with so many other things, and we should work to bring it back. We could start by encouraging directory authority operators to participate in the monthly virtual relay operator meetups. Thanks for reading all the way to the end / hope this level of detail helps, --Roger

3 3

Re: [tor-relays] Tor DDoS Mitigation iptables scripts update. Version 4.0.1
by Chris 05 Dec '22

05 Dec '22

Hi Andres, Not at all. That's how I'm running my own relays. Just run the **combined.sh** on each individual VM and you'll be fine. As for the ORPort, yes, I agree. There are ways to read the torrc file and set the ORPort automatically. I will incorporate that into the scripts in future versions. My original intention was to put something simple together with minimum complexity that anyone with little or no expertise can understand and modify if necessary without breaking the code. I've also set up a [Discussion Board](https://github.com/Enkidu-6/tor-ddos/discussions) for the repository on github in case you have any questions, suggestions or simply need further help. On 12/1/2022 11:57 AM, Anders Trier Olesen wrote: > Hi Chris > > We run all the 12 dotsrc relays on a single host with many IP > addresses. Would we need to change anything? > > Btw, you can make the scripts find the all the OR ports by running > something like ‘ss -pl | grep tor’. > > - Anders > > tor. 1. dec. 2022 kl. 09.02 skrev Chris <tor(a)wcbsecurity.com > <mailto:tor@wcbsecurity.com>>: > > Background: > > A set of bash scripts used to apply iptables rules to fight the > current > DDoS attacks. They require no dependencies to install except > iptable/nftables which all Linux flavors already have and require no > particular expertise. The issue was discussed here: > > [issue > 40093](https://gitlab.torproject.org/tpo/community/support/-/issues/40093) > > Change log: > > Some modifications due to a change in the nature of the attacks. > > - Re ordered rules for more efficiency and reducing the load > - Removed the hashlimit rule as it puts more load on the system > with not > much overall benefit as the attackers have adapted to it and it > reduces > the size of the block list. > - Reduce the number of allowed concurrent connections to 2 if > you're not > a relay. > - Use of remove.sh cron script at regular intervals (optional) > will give > relays a chance to create up to 4 connections if they need to. > ******- Created a new cron file **refresh-authorities.sh** to refresh > your allow-list with the most up to date IP addresses for the > authorities and snowflake. Should be run daily. > - Removed an unnecessary line in the update files. > - Modified Readme.MD file to reflect new changes. > > The new modifications have been tested for two weeks now and the > systems > are running smoothly with no ill effect. > > You can read more and download here: > > [Enkidu-6 tor-ddos on Github](https://github.com/Enkidu-6/tor-ddos) > > To avoid occasional NTor drops a minimum NumCPUs 16 in torrc is > recommended. > > P.S. > The NumCPUs option is unfortunately poorly documented. It really has > nothing to do with the number of CPUs you have. It's about the > number of > worker threads Tor will create to deal with decryption of > onionskins. So > you can have two CPUs and still set NumCPUs to 16. > > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > <mailto:tor-relays@lists.torproject.org> > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >

2 2

Another attempt against Tor DDoS
by Frank Steinborn 04 Dec '22

04 Dec '22

Hi, I want to show you my anti DDoS solution for my relays (aswell ;-). It works without ipset, but with a mix of the recent and hashlimit iptables modules. What is does: * If one IP address tries to make 7 SYN connection attempts per second, they are locked out for 300 seconds. If they try another connection in that timeframe, the timer is reset and they are locked out for another 300 seconds. * Threre are no more SYNs allowed if 4 connections are already in use to the ORPort. It works *very* well for me. Other solutons are far more aggressive but I feel my solution works perfectly against the attacks, even if they are not that aggresive. On top of that, I feel its more easy to implement into ones existing firewall solution. You can find the repo here: https://github.com/steinex/tor-ddos Feel free to give it a shot and feedback would be much appreciated! Greetings, steinex

1 0

relayor v22.0.0-rc is released
by nusenu 03 Dec '22

03 Dec '22

Hi, relayor v22.0.0-rc is released. relayor is an ansible role that helps you with running tor relays with minimal effort (automate everything). https://github.com/nusenu/ansible-relayor#main-benefits-for-a-tor-relay-ope… Changes since relayor v21.2.0-rc: * MetricsPort support improvements: * generate nginx reverse server config for remote prometheus scraping on the relay (we do not install nginx) * generate htpasswd file for HTTP basic auth of MetricsPort on the relay * debian/ubuntu: support new alpha repos (branch name is no longer included in the repo name). * FreeBSD 12.3 is supported kind regards, nusenu -- https://nusenu.github.io

2 4

Difficulties testing my bridge
by binarynoise 02 Dec '22

02 Dec '22

Hello everyone, I run a bridge and as I was doing maintenance on my server, I wanted to check whether my bridge works and whether the bandwidth is really as low as advertised in the relay search (it's not, maybe because no-one uses it, as it's on reserved distribution). So I started my tor-browser, opened htop locally and on the server and started browsing. Everything went smoothly, but something was odd: I did not see any traffic on my server (that idles most of the time, so I should see my bridges traffic). Checked connection-info: no bridge there. Went to settings, checked the bridge settings: yes, I had entered by bridge-line. Odd. Continued to the tor logs: oh, bridge-line didn't parse. Interesting. (I put in the server's identity key ed25519 fingerprint instead of the not-ed25519 one and put my bridges name somewhere there too). Ok, but why doesn't it tell me? Why is there no big "Couldn't connect to your configured bridges"- warning after hitting the connect-to-tor-button? Anyway, does some tool exist, where you enter your bridge's information or run it on the server, that tells you if the recommended versions of tor + dependencies are installed and actually used? That would make the task of keeping the bridge healthy easier. Greetings binarynoise

3 4

Tor DDoS Mitigation iptables scripts update. Version 4.0.1
by Chris 30 Nov '22

30 Nov '22

Background: A set of bash scripts used to apply iptables rules to fight the current DDoS attacks. They require no dependencies to install except iptable/nftables which all Linux flavors already have and require no particular expertise. The issue was discussed here: [issue 40093](https://gitlab.torproject.org/tpo/community/support/-/issues/40093) Change log: Some modifications due to a change in the nature of the attacks. - Re ordered rules for more efficiency and reducing the load - Removed the hashlimit rule as it puts more load on the system with not much overall benefit as the attackers have adapted to it and it reduces the size of the block list. - Reduce the number of allowed concurrent connections to 2 if you're not a relay. - Use of remove.sh cron script at regular intervals (optional) will give relays a chance to create up to 4 connections if they need to. ******- Created a new cron file **refresh-authorities.sh** to refresh your allow-list with the most up to date IP addresses for the authorities and snowflake. Should be run daily. - Removed an unnecessary line in the update files. - Modified Readme.MD file to reflect new changes. The new modifications have been tested for two weeks now and the systems are running smoothly with no ill effect. You can read more and download here: [Enkidu-6 tor-ddos on Github](https://github.com/Enkidu-6/tor-ddos) To avoid occasional NTor drops a minimum NumCPUs 16 in torrc is recommended. P.S. The NumCPUs option is unfortunately poorly documented. It really has nothing to do with the number of CPUs you have. It's about the number of worker threads Tor will create to deal with decryption of onionskins. So you can have two CPUs and still set NumCPUs to 16.

1 0

Considering running a relay on AWS Free tier
by Keifer Bly 29 Nov '22

29 Nov '22

Hi, So I don't know if I will do it, but I am considering setting up a tor middle relay on AWS free tier. I have been asking their support tem regarding how much traffic one can push and remain free tier, their response was: If your microservice application is using an RDS or Amazon DynamoDB Accelerator (DAX) database, the Lambda-to-database traffic will be free if it’s in the same region, including if VPC peering is used. Traffic to databases in a different region will incur a regional transfer fee of $0.09 per GB for both the Lambda and database egress traffic. Ingress traffic is free for both.\" I am wondering does anyone else run tor middle relays on AWS free tier, and what is the best torrc configuration to use for keeping the inbound and outbound traffic in free tier in case I do go fourth with this? Thanks. --Keifer

2 1

Next Tor relay operator - November 19th at 19.00 UTC
by gus 23 Nov '22

23 Nov '22

Dear relay operators, The next Tor relay operator meetup will happen on Saturday, November 19th at 19.00 UTC. ## Where BigBlueButton: https://tor.meet.coop/gus-og0-x74-dzn ## Agenda (WIP) - Announcements - State of DoS attack - Q&A - Next Tor Relay Operator Meetup Meeting pad: - https://pad.riseup.net/p/tor-relay-op-meetup-n19-keep - http://kfahv6wfkbezjyg4r6mlhpmieydbebr5vkok5r34ya464gqz6c44bnyd.onion/p/tor… Everyone is free to bring up additional questions or topics at the meeting itself. ## Registration No need for a registration or anything else, just use the room-link above. We will open the room 10 minutes before so you can test your mic setup. Please share with your friends, social media and other mailing lists! cheers, Gus -- The Tor Project Community Team Lead

1 1

Re: [tor-relays] preventing DDoS is more than just network filtering
by Toralf Förster 15 Nov '22

15 Nov '22

On 11/8/22 10:57, Chris wrote: > The main reason is that a simple SYN flood can quickly fill up your > conntrack table and then legitimate packets are quietly dropped and you > won't see any problems thinking everything is perfect with your server > unless you dig into your system logs. Hhm, my system log doesn't show any problems, maybe due to (or regardless of?): CONFIG_SYN_COOKIES=y ? Nevertheless, I updated the Readme to explain my point of view [1] [2]. [1] https://github.com/toralf/torutils#block-ddos-traffic [2] https://github.com/toralf/torutils#rule-set -- Toralf

3 3

Tor Relay on Gandi.net
by protectmyonion 14 Nov '22

14 Nov '22

mailto:tor-relays@lists.torproject.org I was wondering if anyone had experience running a Tor relay on Gandi. According to [good-bad-isps](https://community.torproject.org/relay/community-resources/g…, Gandi supports all relays. However, I contacted support asking them their policy on Tor and if their policy was the same for all Tor relays. Their response was basically 'You can install any software you want, but its use is subject to French law and our terms of service. If a complaint is received, the Abuse department will take appropriate action and notify you.'. This was pretty vague and kind of seemed like they didn't know what Tor was. I responded and tried to explain what Tor was using most of what was in the Common Boilerplate template. I explained that there were things that I could do to reduce potential abuse, like limiting the exit policy, but that there was always still potential for abuse. The next response came from the Abuse department and basically said 'Any illegal activity on your IP will result in your server being shutdown.'. Based on this, it seems like Gandi is not a good ISP for Tor exits, but likely fine for all other relays. What's a little confusing is that according to Tor metrics, Gandi currently has Tor exits. It is only 2, but nevertheless, they exist. [France](https://metrics.torproject.org/rs.html#search/as:AS203476) location has 2 exits, but [Luxembourg](https://metrics.torproject.org/rs.html#search/as:AS29169) has none. I'm not sure if [good-bad-isps](https://community.torproject.org/relay/community-resources/g… should be updated, given there's conflicting information, but I figured I'd ask if anyone had personal experience with Gandi. Thanks.

3 2