- tor-relays - lists.torproject.org

Running Tor exit nodes on university networks
by Andreas Kempe 11 Jun '21

11 Jun '21

Hello everyone, I'm a member of Lysator ACS at Linköping university, Sweden. I'm currently investigating the possibility for our computer society to run Tor exit nodes. The IT department has made it clear that they will need some convincing that this is a good idea. One thing that they are wondering is whether there are other universites with experience running Tor nodes. If anyone is currently running Tor nodes on university networks, I'd love to hear about your experiences. A few questions that turned up are listed below. - Have you seen any good or bad press because of the node? - Are you receiving a lot of abuse complaints? - How are you handling abuse complaints? - How are you protecting the rest of your infrastructure from possibly malicious traffic? - Do you have any killer arguments as to why supporting Tor is a good idea that helped sway the people in charge at your university? Thank you in advance for any feedback! Cordially, Andreas Kempe

4 5

G-Core Labs and their humanoid robots
by Tor Relays 11 Jun '21

11 Jun '21

TL;DR: G-Core Labs does not understand their abuse detection software and their support agents are a bunch of humanoid robots. Dear customer, Due to suspicious activity SMTP ports have been blocked. Affected service ID: <id>. Destination port: 25, 465, 587. To unblock contact support. Me: hello, i guess you are referring to a recent spamhaus entry? i do not use ports 25, 465, 587 so it likely is a false positive. I don't need these ports open but i would prefer if you could unlock them in case i would like to use them in the future. otherwise i might wonder why they don't work without remembering that they got blocked on your end. Thanls Support agent 1: Hello, In terms of Acceptable Use Policy (AUP), clause 2(d), we reserve a right to block SMTP ports if your service is not located at our platform. Please, find the list of blockage cases and solutions. 1) Service belongs to third parties. Unfortunately, we have to deny your request of unblocking SMTP ports according to AUP. 2) Service belongs to our platform. Please, specify domain you send emails to. If domain is fine, we'll unblock ports accordingly. 3) You didn't send any emails. Please, check your server to find the reason of spamming. As soon you resolve the issue, we'll unblock ports. However if our automated system identifies spamming on your server again, we'll have to block SMTP ports permanently. We kindly ask you to send a reply in a detailed manner so we could analyze your case accordingly. Me: I will repeat myself: I do not send emails. Please unblock the SMTP ports or specify why you blocked the SMTP ports. Thanks. Support agent 1: Check your network settings, perhaps something could cause it. Tell us what you will found and we will figure it out. Me: I do not have a reason to believe the server got hacked and i do not use the server to send emails so it likely is a false positive. Why were the SMTP ports blocked? Support agent 1: It was blocked because automatic monitoring system find your activity suspicious. Now, trust level of your traffic for IP has been increased however the traffic is still automatically monitored. If the system of automatization identifies your traffic as illegitimate or if we receive an infringement report, we'll have to disable ports once again. Me: Please do not block any ports without my consent when you do not have any logfiles that prove any misbehavior. "Automatic monitoring system find your activity suspicious" does not help in debugging any possible misbehavior coming from my server. Do you have information about where i can read up about the function of your automatic monitoring system to prevent this problem? Support agent 1: We can't share information about algorithm. Four days later, different support agent: Dear customer, Due to suspicious activity SMTP ports have been blocked. Affected service ID: <id>. Destination port: 25, 465, 587. To unblock contact support. Me: hello, can you please give me more details about the suspicious activity? Support agent 1: Hello, In terms of Acceptable Use Policy (AUP), clause 2(d), we reserve a right to block SMTP ports if your service is not located at our platform. Please, find the list of blockage cases and solutions. 1) Service belongs to third parties. Unfortunately, we have to deny your request of unblocking SMTP ports according to AUP. 2) Service belongs to our platform. Please, specify domain you send emails to. If domain is fine, we'll unblock ports accordingly. 3) You didn't send any emails. Please, check your server to find the reason of spamming. As soon you resolve the issue, we'll unblock ports. However if our automated system identifies spamming on your server again, we'll have to block SMTP ports permanently. We kindly ask you to send a reply in a detailed manner so we could analyze your case accordingly. Me: Thanks but i know the AUP. The server does not send any emails and i do not have a reason to believe the server got hacked so please tell me the timestamp and destination of the connection that triggered your automatic monitoring system. Support agent 1: Let us please discuss your issue with our colleagues. We will inform you on this ticket. Support agent 1: Hello! Thank you for waiting! Unfortunately, we have to decline your unblocking request. As we see there is a second block on the same server. We couldn't unblock ports if they were blocked once Me: My question was: What triggered the block? Support agent 1: We couldn't provide you detailed information about SMTP-blocking system, sorry. The block is triggered if your server has suspicious activity on SMTP ports. Me: i understood that. What does "suspicious activity" means? Support agent 1: Let us, please, clarify this information with our engineers Me: Thank you. I hope you understand that it's an unfortunate situation when i do not find any misbehavior on the server but your "automatic monitoring system" accuses me of misbehavior and the answer is "there was suspicious activity". I am awaiting the response. Support agent 1: We have received a reply from your colleagues. Sorry, but we couldn't announce how this technology works. It is confidential information! Me: Can you forward me to someone higher or is there an address where i can complain? Support agent 2: Hello, Let us please discuss this moment with colleagues. Please stay tuned! Support agent 3: Thank you for waiting. Unfortunately, we can't forward somebody higher to you or give you an email additional email address. All communications take place via the support team. If you want to complain, please send us your complaint and we will send it to our colleagues. Me: Hello <name>! Sure, i can summarize it for you: I would like to complain about a malfunction in your "automatic monitoring system". Four days ago i received a ticket that SMTP ports are blocked due to "suspicious activity". I answered the support agent that the server is not used for sending emails and there is no sign of a malfunction on the server so it very likely is a false positive and he unblocked the SMTP ports. Today i received such a ticket again and the server is still not used for sending emails and there still is no sign of malfunction. To help you understand the incident i would need some information from you: - the source/destination IP and port that triggered the automatic monitoring system - an exact timestamp What solution can you offer me? Support agent 3: I'll send your message to our colleagues and let you know about the result. Support agent 3: Unfortunately, we can't provide you with any information that you've been asking for and we have to decline your request for unblocking. Our decision is based on our Master Service Agreement. You can find it here: https://gcorelabs.com/legal/ Me: What is the reason that you can not provide me with the requested information? Support agent 3: We don't provide that kind of information. As we already said it's confidential information. Me: Punishing the user for something, then making the information about the cause of the punishment as confidental for him is interesting. Are you sure that you properly understand the function of your "automatic monitoring service" and what steps will you take to prevent false positive results in the future? Support agent 3: Our engineers are working to improve the technology of SMTP ports blocking, but I'm afraid I can't share with you any additional information about it. I gave up after that. This happens when you use A/I to detect abuse and degrade humans to communicate A/I decisions. A/I will abuse us all.

5 6

Exit
by Walenty Czerwinski 11 Jun '21

11 Jun '21

Is there a chance to get problems with law enforcement in Poland because of operating exit relays? I heard in some countries law enforcement arrested relay operators thinking they committed a crime with a server where relays are hosted.

2 1

IPv6 not showing up on tor exit node
by pimpnet 10 Jun '21

10 Jun '21

I run a tor exit node and have properly configured IPv6 but sometimes it does not appear on the tor relay list. This is fixed when I reboot the tor service but what could be the reason?

1 0

More Tor measurements next week [opt out]
by Zachary Newman 07 Jun '21

07 Jun '21

tl;dr: Low-load measurements coming; no action needed unless you would like to opt out. Hi all, Next week (week of 2021-05-31), we will be starting a wide-scale measurement of the latencies between relays on the Tor network for a research project; these measurements will last an estimated 1-2 months. We have the permission of the Tor Research Safety Board and this information will ultimately be used to improve the network. Further, the load at any one time on the Tor network from these measurements will be limited and negligible (approximately the same load as the start-up tests of a few new Tor clients). We are coordinating with the currently-running speed test[1], and will start our measurements after the conclusion of this speed test. If you operate a relay and would like to opt out of these measurements, please send us an email (shortor(a)csail.mit.edu) including the fingerprint of your relay(s). We will stop sending you traffic and, if the test has begun, delete past measurements involving your relay(s). Status updates will be posted publicly[2], and we will bump this thread before we start and if anything important changes. Please contact shortor(a)csail.mit.edu with any questions. Regards, Zack Newman (on behalf of the ShorTor team) [1] https://lists.torproject.org/pipermail/tor-relays/2021-May/019649.html [2] https://people.csail.mit.edu/zjn/tor.txt

1 1

New Test for Measuring the Accuracy of Tor Relays' Advertised Bandwidths
by Georg Koppen 07 Jun '21

07 Jun '21

Hello everyone! Some of you might remember the speed test Rob had been running during August 2019 to investigate the accuracy of the advertised bandwidth a relay is reporting in its server descriptor.[1] Back then this involved, for each relay, downloading several large data streams for a period of about 20 seconds to get a better estimation of the relay's true capacity (See: [1] and follow-up emails for the exact details of the experiment). We plan to do this speed test again in about 1 week and relay operators can opt-out of it (again) if they want to. We still believe that the overhead of this speed test is in line with regular usage, but if anyone doesn't want to participate that's fine. Let us know if so (by replying to this thread or off-list, if preferred) and we remove your relay(s) from the list to scan. Thanks, Georg [1] https://lists.torproject.org/pipermail/tor-relays/2019-July/017535.htmlff.

4 5

current HSDir flag requirements
by Scott Bennett 03 Jun '21

03 Jun '21

What are all the current requirements for a relay to get a HSDir flag? 96 (97?) hours of uptime and what else? Can someone tell me what my relay, MYCROFTsOtherChild, is missing for a HSDir flag? Thanks in advance for any relevant information. Scott Bennett, Comm. ASMELG, CFIAG ********************************************************************** * Internet: bennett at sdf.org *xor* bennett at freeshell.org * *--------------------------------------------------------------------* * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * * -- Gov. John Hancock, New York Journal, 28 January 1790 * **********************************************************************

4 9

Block certain .onion websites
by Tor Operator 29 May '21

29 May '21

Hello, exit node operator here. I share the values of the TOR foundation, that’s why I’m operating an exit node but I can’t unsee all the bad it is used for. I know it would sound like censorship but wouldn’t it be possible for an exit relay to block certain (mainly cp) .onion websites so that they cannot be visited from certain exit nodes? Thanks in advance

3 2

ssh request from Virgin Media (Liberty Global)
by Cristiano Kubiaki Gomes 27 May '21

27 May '21

I have a Relay and a Bridge up and running with ssh password disabled, ssh port changed and fail2ban installed. With that I noticed that one particular IP was trying to ssh my both machines and that IP belongs to Liberty Global, an Anglo-Dutch-American telecommunication company which is owner of the Virgin Media, UPS and Vodafone. I was wondering, why is this company trying to ssh my Tor machines? Has anyone else noticed this? I am afraid to share the company IP here because they could be here on this list and they could use one IP to target on specific subject and if I disclose that IP they could find me out 😂 It’s just a FYI. Stay safe. -- Cristiano Kubiaki Telegram <https://telegram.me/cris_kubiaki> | LinkedIn <https://www.linkedin.com/in/cristianokubiaki/> | Twitter <https://twitter.com/criskubiaki> ITIL - MCP - MCDST - MCTS - DCSE

4 3

Wrote a small "script" for automatic family synchronisation
by charles＠torrelays.ru 25 May '21

25 May '21

Hey y'all. I made a small script to automate the Family setup of relays and wanted to get your opinion on it. step 1) create a file called sync_Fam.sh in the /home/ directory. (or wherever you feel like creating it) the file should contain this: sed -i '/MyFamily/d' /etc/tor/torrc cat "FamilyList.txt" >> /etc/tor/torrc What this will do is remove the line with "MyFamily" in the torrc file, and add the contents of a file called "FamilyList.txt" to the torrc file. FamilyList.txt will, ofcourse, contain the line MyFamily $fingerprint1, $fingerprint2, $fingerprint 3,.... step 2) create a webserver where you display the list of fingerprints to add I used nginx for this, use whatever you feel like using. as long as it works :p step 3) search for the location of the .pid file of tor. if you want to use a custom location you can do it by adding the line "PidFile {locationofwhereyouwanttoplaceit}" i decided to also place it in the home directory. step 4) add a crontab (you can use crontab -e) 45 * * * * cd /home/ && wget -N http://{IPofTheWebServer}/FamilyList.txt 46 * * * * cd /home/ && ./sync_Fam.sh 47 * * * * kill -HUP $(cat /home/tor.pid) what this will do, is download the FamilyList.txt file from the webserver, run sync_Fam.sh, and reload tor. (-HUP sends a reload signal) so.. what do y'all think of it? is it a good script?

1 0