- tor-relays - lists.torproject.org

Info from my ISP about investigation of tor exits
by Olaf Grimm 03 Jan '21

03 Jan '21

Here is the original of mail (in copy) from my provider Mail copy: "Hello, Unfortunately your traffic type is full of unwanted events not compatible with our company ethic. Since the first date of activity we've received many abuse reports regarding bruteforce, layer7 attacks, hacking and many others. Currently there is a police investigation regarding one of the 2 servers related to hacking activity against an european country security. The access and content is in interpol custody and we have a restriction on reactivation. Kind regards, George Oprea 24/7 Technical Support Zetservers.com /Romania" --> My answer: Thank you for your information. Good luck. I change my other servers to less trouble. (Change Exits to Relay) Olaf

4 3

Should I worry about sudden swings in connection numbers to my relay?
by torix＠protonmail.com 03 Jan '21

03 Jan '21

Dear List, One of my exits, which has been up for 6 months now with an average of 2000 to 4000 connections, since yesterday has been jumping up to 10,000, 8,000, then back to 3500 or so. My history is a simple test file of date and connection numbers taken every 5 minutes: Sun Jan 3 07:20:00 MSK 2021 3233 Sun Jan 3 07:25:00 MSK 2021 3342 Sun Jan 3 07:30:00 MSK 2021 9679 Sun Jan 3 07:35:00 MSK 2021 3455 Sun Jan 3 07:40:00 MSK 2021 6800 Sun Jan 3 07:45:00 MSK 2021 3402 Sun Jan 3 07:50:00 MSK 2021 3346 Sun Jan 3 07:55:00 MSK 2021 3355 Sun Jan 3 08:00:00 MSK 2021 3358 Sun Jan 3 08:05:00 MSK 2021 10067 Sun Jan 3 08:10:00 MSK 2021 3343 ----------------- TIA, --Torix Sent with [ProtonMail](https://protonmail.com) Secure Email.

1 0

Info from my ISP about investigation of tor exits - Update
by Olaf Grimm 03 Jan '21

03 Jan '21

Exit-IPs: Please block these Exits /Relays 89.34.27.149, active 89.34.27.43 , "supended" in panel, but active. Warning! 89.34.27.48, active 89.34.27.49, active (89.34.27.59 since some days terminated) (89.34.27.37 since some week terminated)

2 1

event.reasons for ORStatus.CLOSED
by Toralf Förster 01 Jan '21

01 Jan '21

I wrote a small Pythons script [1] to catch the event.reasons for ORStatus.CLOSED. The output is something like this: orstatus.py --ctrlport 9051 DONE FAF3236D37B0B18D8438C46317940F642E296924 IOERROR 917A0A924DA50B46CD740924AB42B237A831E182 DONE DCEA2A6D8034E164A4FFDD8AFF997E2F6FB2ECF8 50.7.179.202 443 v4 0.4.4.5 IOERROR CDE4149F0DC65A7BE1AE440340BE1C7A18135E29 192.250.236.130 80 v4 0.4.4.6 DONE 24E2F139121D4394C54B5BCC368B3B411857C413 204.13.164.118 443 v4 0.4.4.6 DONE 24E2F139121D4394C54B5BCC368B3B411857C413 204.13.164.118 443 v4 0.4.4.6 IOERROR 8A51DC1ACBBC411E3B4D124F44A98F5ADC6A8984 IOERROR 57C799B990D61FB49E22E792670F5B28FE2E7FEA A stat over a day or so showed that the majority of systems have 0-10 IOERRORS whereas there're few dozen systems failing all the time and having 100x more IOERRORS in the same time frame. I do wonder however whether such a statistics is capable to give a senseful answer if a relay itself behaves well or not? [1] https://github.com/toralf/torutils/blob/master/orstatus.py -- Toralf

1 0

attacks from problematic tor exit relays
by BRBfGWMz 31 Dec '20

31 Dec '20

I am trying to guess what kind of target attacks are possible through problematic relays. Suppose the network relay is controlled by the enemy. How do they determine the original IP address of the outbound traffic? Correlation attacks are possible, but they seem very difficult and probably require a lot of resources. Also, changing the route stops this. If I assume that they determine what traffic flow is mine, and that I always use the same route, what attacks are possible? Are there any good posts or videos? \-- Sent using MsgSafe.io's Free Plan Private, encrypted, online communication For everyone. https://www.msgsafe.io

2 1

Relay operators meetup @ rC3
by Stefan Leibfarth 31 Dec '20

31 Dec '20

Hello Tor friends and relay operators, I haven't heard of a relay operators meetup at the ongoing rC3. Are there any plans? If not, who of you is interested? It would be my pleasure arrange a session. Please get back to me. Cheers Leibi

7 8

Re: [tor-relays] Relay operators meetup @ rC3: today 22:00 UTC+1
by BRBfGWMz 30 Dec '20

30 Dec '20

Do you guys meet via video? Is there a calendar? On Tue, Dec 29, 2020 at 01:39 PM, kantorkel <kantorkel(a)hamburg.freifunk.net> wrote: > To avoid confusion: We will meet today at 21:00 UTC, that is 22:00 CET > > https://www.starts-at.com/event/2603308559 > > > > On 12/29/20 12:30 PM, kantorkel wrote: > > Hi all, > > > the meetup will take place today, 2020-12-29, at 10pm UTC+1. > > > In rC3 world, we will meet in the bottom right corner of the Jena > hackerspace "Krautspace" > (https://rc3.world/rc3/room/5edc1329-f55c-46e1-a739-b0d642c2c80f/) Please > use https://jitsi.rc3.world/torrelayops-724b5 to join from the outside > world. > > > Thanks to qbi for organizing the room. > > > Best > > kantorkel > > > On 12/27/20 10:54 PM, Stefan Leibfarth wrote: > >> Hello Tor friends and relay operators, > >> > >> I haven't heard of a relay operators meetup at the ongoing rC3. > >> Are there any plans? > >> If not, who of you is interested? > >> > >> It would be my pleasure arrange a session. > >> Please get back to me. > >> > >> Cheers > >> Leibi > >> > >> _______________________________________________ > >> tor-relays mailing list > >> tor-relays(a)lists.torproject.org > >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > >> > > _______________________________________________ > > tor-relays mailing list > > tor-relays(a)lists.torproject.org > > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > \-- Sent using MsgSafe.io's Free Plan Private, encrypted, online communication For everyone. https://www.msgsafe.io

1 0

M1 anyone?
by niftybunny 29 Dec '20

29 Dec '20

With one of my servers down and giving me brain cancer … anyone tried to run relays on the new M1 chip? Is it even officially supported right now? Anyone any idea how much it could push? cheers, nifty

2 1

SSH
by Андрей Гвоздев 29 Dec '20

29 Dec '20

Hello I'm running a TOR relay, every time I SSH to my server I see a message that there were thousands of failed login attempts Do you see this message too?

10 12

Bridge acting strange
by enrollado 29 Dec '20

29 Dec '20

I have noticed some bizarre behavior on one of my relays. I logged into the server hosting particlefive (bridge) on November 15 and noticed that the tor process had crashed (not a clean exit). I had accounting set up, so it had hibernated from 11/07 00:00 UTC to 11/07 00:44 UTC. After that, it appeared to be running normally, but it crashed sometime after 11/07 06:25 UTC. I don't have crash dumps enabled, so I don't have any information on the crash. I restarted it and it appeared to have been working normally. I checked on it again on the 16th and all was well. On December 2nd, it suddenly stopped receiving client connections. According to the metrics page, it hasn't passed any traffic since then, though the logs show 20 - 60 GB per heartbeat interval. The log rotation has gone strange as well. As of today: notices.log - 12/29 06:25 to 12/29 12:20 notices.log.1 - 12/28 06:25 to 12/29 06:20 notices.log.2 - 11/06 06:25 to 11/07 06:25 notices.log.3 - 12/26 06:25 to 12/27 06:25 notices.log.4 - 12/25 06:25 to 12/26 06:25 notices.log.5 - 12/23 06:25 to 12/24 06:25 So, the log from the day before the crash is still hanging around with no unusual activity shown, and I'm missing the log file for 12/24. At this point, it seems to be running normally, but it is not receiving any new connections. Yesterday, I changed the configuration from accounting to bandwidth limiting, so notices.log.1 has the hup I sent to reload the configuration. However, notices.log.3 also shows a hup signal at 06:25 UTC that I did not send. I should probably report this on the tor-dev list, but moderation on that list appears to be pretty slow, and this list is more active. I was wondering if anyone else has seen this kind of odd activity on a bridge before. My paranoia alarm is in yellow status, so I'm about to dump this relay, get a new IP, and start over. Any advice is appreciated. No me preguntas nada, no te digo una mentira. Enrollado Sent with ProtonMail Secure Email.

1 0