- tor-relays - lists.torproject.org

update obfs4proxy if you run a bridge
by meskio 24 Mar '22

24 Mar '22

Hello, TL;RD: if you are a bridge operator please update obfs4proxy to a version>=0.0.12. There is a new version of obfs4proxy (>=0.0.12) which fixes a security issue[0]. Tor Browser has already updated to the new version, which reduces a bit the security problem, but introduces a partial incompatibility between versions[1]. Because of that updating to the latest version greatly will help bridge users. If you use debian you can find the latest version bullseye-backports[2]. If you use docker there is a new version of the official docker image that you can upgrade to[3]. Thank you for running bridges, let me know if you need any help upgrading it. [0] https://lists.torproject.org/pipermail/anti-censorship-team/2022-January/00… [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/40804 [2] https://packages.debian.org/stable-backports/obfs4proxy [3] https://hub.docker.com/layers/thetorproject/obfs4-bridge/0.11/images/sha256… -- meskio | https://meskio.net/ -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- My contact info: https://meskio.net/crypto.txt -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Nos vamos a Croatan.

4 3

Re: [tor-relays] Bridge lifecycle expectations
by Just a Pleb 24 Mar '22

24 Mar '22

Hi meskio, Thanks for the detailed response. My bridge has been assigned to telegram so that explains why it's not active yet. Watching per country stats makes sense for determining where the bridge has been blocked. Also good to know the bridge state should be fully disposed when recycling rather than preserved for reputational purposes. Follow up question on running bridges and relays. If the consensus is I should pick Relays xor Bridges to run I will but I'm not fully convinced that's the right trade off for capacity -vs- security given "good actors" wouldn't attack the traffic and bad actors wouldn't obey the injunction the only extra security impact I see is limiting damage from "good actor who get compromised" which is *some* obviously... Thanks

1 0

Ports blocked
by tdukes＠palmettoshopper.com 23 Mar '22

23 Mar '22

Looks like my ISP has shut me down. The ports I were using are now blocked. I checked them with an online port checker. I tried.

1 0

Snowflake vs bridge on home connection on a Raspberry Pi 4
by Cristian Consonni 23 Mar '22

23 Mar '22

Hi all, I have a fiber connection at home and I would like to run a bridge or standalone Snowflake proxy on a dedicated Raspberry Pi 4. I have been reading some threads [1][2] from this list about the topic, but it is not completely clear to me what would be the best choice. The requirements [3] for running a bridge are 24/7 connectivity and the ability to expose TCP ports; however, I have read that it is also preferred that you have a static IP to run a bridge (in the page about the recent campaign about bridges, having a static IP was listed as a requirement [4]). In principle my home connection has a dynamic IP, but I have been logging my IP address for the last few days and it seems quite stable (it has not changed for the last 4 days). What's the best choice? Can I run both? Best, Cristian [1]: https://lists.torproject.org/pipermail/tor-relays/2022-February/020298.html [2]: https://lists.torproject.org/pipermail/tor-relays/2022-February/020355.html [3]: https://community.torproject.org/relay/setup/bridge/ [4]: https://blog.torproject.org/run-a-bridge-campaign/

2 1

Newbie needs help
by tdukes＠palmettoshopper.com 23 Mar '22

23 Mar '22

Hi, Thanks for adding me to the list. I setup a Tor Relay in Docker using this image: https://hub.docker.com/r/doudou34/tor-server Its running, so how can I test it? When I try to access it using port 9001, I'm unable to connect. I have opened the port on my firewall to the public. Haven't done it on my router yet but I have Portainer running in Docker and have no problem accessing it. Not a lot of instructions that I can find. I can post the torrc file but it's the same as the one on the docker page. ### /etc/torrc ### # see /etc/torrc/torrc.default and https://www.torproject.org/docs/tor-manual.html.en # Server's public IP Address (usually automatic) #Address 10.10.10.10 # Port to advertise for incoming Tor connections. # common ports are 9001, 443 ORPort 9001 # Mirror directory information for others (optional) # common ports are 9030, 80 #DirPort 9030 # Run as a relay only (not as an exit node) ExitPolicy reject *:* # no exits allowed # Set limits #RelayBandwidthRate 1024 KB # Throttle traffic to #RelayBandwidthBurst 2048 KB # But allow bursts up to #MaxMemInQueues 512 MB # Limit Memory usage to # Run Tor as obfuscated bridge #ServerTransportPlugin obfs3 exec /usr/bin/obfsproxy managed #ServerTransportListenAddr obfs3 0.0.0.0:54444 #BridgeRelay 1 # Run Tor only as a server (no local applications) SocksPort 0 # Run Tor as a regular user (do not change this) User debian-tor DataDirectory /var/lib/tor # If no Nickname or ContactInfo is set, docker-entrypoint will use # the environment variables to add Nickname/ContactInfo here #Nickname Tor4 # only use letters and numbers #ContactInfo email(a)example.org I've only been using docker for a few days, so maybe its an issue there. TIA

4 4

Bridge on two port
by binarynoise 22 Mar '22

22 Mar '22

Hello everyone, I currently run a bridge on port 8080. As I don't have a webserver running, I thought I'd also publish that bridge on port 443. For relays there is that "ORPort 443 NoListen"-Option. What is the equivalent for ServerTransportListenAddr? Is ServerTransportListenAddr obfs4 0.0.0.0:443 NoListen the right way? Is this possible at all? Does make running a bridge on two ports make sense at all? Greetings binarynoise

1 0

Tor 0.3.5.x is unsupported, please upgrade
by Georg Koppen 21 Mar '22

21 Mar '22

Hello! It's time again to get relays upgraded running an EOL Tor series (0.3.5.x). We'll start reaching out to operators with valid contact information this week and plan to start reject relays which are still on 0.3.5.x about 4 weeks from now on at the begin of March. You can follow along that process in our bug tracker[1] if you want. For the general processes around dealing with EOL relays in the Tor network see my mail from last October[2]. Feedback and improvements are welcome, as always. Georg [1] https://gitlab.torproject.org/tpo/network-health/team/-/issues/171 [2] https://lists.torproject.org/pipermail/tor-relays/2021-October/019862.html

1 1

Connection burst
by Felix 21 Mar '22

21 Mar '22

Hi everybody Just to let you know. Yesterday between 21:26 and 21:31 utc the relay 03C3069E814E296EB18776EB61B1ECB754ED89FE (Tor 0.4.7.4-alpha, LibreSSL 3.4.2) received a connection burst of 2k+ source addresses out of 174 /8 ip4 nets (1-223/8). They were kicked off by the packetfilter because the max conn per ip rate was above my applied max threshold. The notice level DoS mitigation entry remained untouched while sitting behind the pf. Beautiful! -- Cheers Felix

2 1

Which is the most useful: relay or bridge
by Thoughts 20 Mar '22

20 Mar '22

Currently running both a guard relay and a bridge, one each on two different systems, but both behind the same firewall and static IP. Curious if this is a good idea, or if one or the other is of much greater value. Seeing about 2200 inbound, 2800 outbound connections on my relay per nyx, with an observed speed of 5 MB/s (only a few days into the guard ramp-up phase) Seeing about 20 connected clients on the bridge, which is advertising 2.2 MiB/s per the metrics page. R/W rates around around 150k per that same page, about 1/4th of the average on the guard relay. Thoughts?

4 4

What is the current method of submitting Tor-friendly ISPs for consideration?
by Isaac Grover, Aileron I.T. 18 Mar '22

18 Mar '22

Good afternoon from Wisconsin, Following up on a previous post to this list, I started contacting AS administrators in bulk and currently have five ISPs in unique ASs who state they can accommodate Tor exit nodes. The GoodBadISPs page on TP.o doesn't have a submission form or contact email address where I can submit the relevant info. Should I post them here or is there a better/preferred method? Thank you in advance, Isaac Grover

2 1