Tor Relay Web Ports
Hi, I'm running a non-exit relay for quite some time now and I would like to open ports 53, 80, 443 (web ports) to be more useful. How do you handle fraudulent complaints? What is the best approach to this situation? Thank you for your help. Sent with ProtonMail Secure Email.
Are you running that from home? Then don't. Are you running it from a datecenter? Ask the ISP if they allow Tor Exits. Then we will see! On 20/05/2020 09:24, mnlph74 wrote:
Hi, I'm running a non-exit relay for quite some time now and I would like to open ports 53, 80, 443 (web ports) to be more useful. How do you handle fraudulent complaints? What is the best approach to this situation? Thank you for your help.
Sent with ProtonMail <https://protonmail.com> Secure Email.
_______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
Port 53 over TCP (DNS) seems useless, it won't be used at all or only very rarely - your exit already resolves domain names for your clients, this is why it's recommended to have a local recursive resolver installed instead of passing on DNS requests to remote services such as Google or Cloudflare DNS, due to the possibility of correlation and anonymity compromising attacks: https://medium.com/@nusenu/who-controls-tors-dns-traffic-a74a7632e8ca https://medium.com/@nusenu/what-fraction-of-tors-dns-traffic-goes-to-google-... If you open up 80 and 443, expect to receive a lot of abuse mails related to brute-forcing or exploit attempts, and having to deal with the occasional douche-bag downloading child porn from a clear-net hoster and confused law enforcement agencies. If that doesn't bother you or your hoster (in the case of OVH, it will, I can guarantee you that), then go ahead. OVH is a bad provider though, over-congested network due to all the seed boxes, bad peering, many Tor nodes already hosted there, etc. All that means please don't host another node there, instead go for a small provider, ideally also in a country which does not host a lot of Tor nodes already, see if they host only a handful of Tor nodes, ideally colocate, get your own IP range and ask them to modify the abuse address for the range to an address you control. After that is all done, you can safely ignore most abuse reports unless they actually have a case against you, which, in most countries is not possible due to network providers being protected from liability by the law. Hope this helps. 2020-05-20 7:24 GMT, mnlph74 <mnlph74@protonmail.com>:
Hi, I'm running a non-exit relay for quite some time now and I would like to open ports 53, 80, 443 (web ports) to be more useful. How do you handle fraudulent complaints? What is the best approach to this situation? Thank you for your help.
Sent with ProtonMail Secure Email.
P.S: If you were not asking about relays on OVH, my bad - had their company name stuck in my head due to your previous posts to the mailing list. 2020-05-20 21:07 GMT, William Kane <ttallink@googlemail.com>:
Port 53 over TCP (DNS) seems useless, it won't be used at all or only very rarely - your exit already resolves domain names for your clients, this is why it's recommended to have a local recursive resolver installed instead of passing on DNS requests to remote services such as Google or Cloudflare DNS, due to the possibility of correlation and anonymity compromising attacks:
https://medium.com/@nusenu/who-controls-tors-dns-traffic-a74a7632e8ca https://medium.com/@nusenu/what-fraction-of-tors-dns-traffic-goes-to-google-...
If you open up 80 and 443, expect to receive a lot of abuse mails related to brute-forcing or exploit attempts, and having to deal with the occasional douche-bag downloading child porn from a clear-net hoster and confused law enforcement agencies.
If that doesn't bother you or your hoster (in the case of OVH, it will, I can guarantee you that), then go ahead.
OVH is a bad provider though, over-congested network due to all the seed boxes, bad peering, many Tor nodes already hosted there, etc.
All that means please don't host another node there, instead go for a small provider, ideally also in a country which does not host a lot of Tor nodes already, see if they host only a handful of Tor nodes, ideally colocate, get your own IP range and ask them to modify the abuse address for the range to an address you control.
After that is all done, you can safely ignore most abuse reports unless they actually have a case against you, which, in most countries is not possible due to network providers being protected from liability by the law.
Hope this helps.
2020-05-20 7:24 GMT, mnlph74 <mnlph74@protonmail.com>:
Hi, I'm running a non-exit relay for quite some time now and I would like to open ports 53, 80, 443 (web ports) to be more useful. How do you handle fraudulent complaints? What is the best approach to this situation? Thank you for your help.
Sent with ProtonMail Secure Email.
Thanks for the links and reply, I appreciate it, that answers my question on web ports. How about Bitcoin ports 8333 to help other BTC nodes sync? Is this port also risky to open? Thanks again... Sent with ProtonMail Secure Email. ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Thursday, May 21, 2020 5:21 AM, William Kane <ttallink@googlemail.com> wrote:
P.S: If you were not asking about relays on OVH, my bad - had their company name stuck in my head due to your previous posts to the mailing list.
2020-05-20 21:07 GMT, William Kane ttallink@googlemail.com:
Port 53 over TCP (DNS) seems useless, it won't be used at all or only very rarely - your exit already resolves domain names for your clients, this is why it's recommended to have a local recursive resolver installed instead of passing on DNS requests to remote services such as Google or Cloudflare DNS, due to the possibility of correlation and anonymity compromising attacks: https://medium.com/@nusenu/who-controls-tors-dns-traffic-a74a7632e8ca https://medium.com/@nusenu/what-fraction-of-tors-dns-traffic-goes-to-google-... If you open up 80 and 443, expect to receive a lot of abuse mails related to brute-forcing or exploit attempts, and having to deal with the occasional douche-bag downloading child porn from a clear-net hoster and confused law enforcement agencies. If that doesn't bother you or your hoster (in the case of OVH, it will, I can guarantee you that), then go ahead. OVH is a bad provider though, over-congested network due to all the seed boxes, bad peering, many Tor nodes already hosted there, etc. All that means please don't host another node there, instead go for a small provider, ideally also in a country which does not host a lot of Tor nodes already, see if they host only a handful of Tor nodes, ideally colocate, get your own IP range and ask them to modify the abuse address for the range to an address you control. After that is all done, you can safely ignore most abuse reports unless they actually have a case against you, which, in most countries is not possible due to network providers being protected from liability by the law. Hope this helps. 2020-05-20 7:24 GMT, mnlph74 mnlph74@protonmail.com:
Hi, I'm running a non-exit relay for quite some time now and I would like to open ports 53, 80, 443 (web ports) to be more useful. How do you handle fraudulent complaints? What is the best approach to this situation? Thank you for your help. Sent with ProtonMail Secure Email.
tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
On 20/05/2020 23:07, William Kane wrote:
After that is all done, you can safely ignore most abuse reports unless they actually have a case against you, which, in most countries is not possible due to network providers being protected from liability by the law. But everyone should be aware that that might not stop the law enforcement from raiding your home. Or even worse: https://www.heise.de/newsticker/meldung/Oesterreich-Tor-Serverbetreiber-wege... (Sorry, German)
And, keep in mind, in countries without a "Beweismittelverwertungsverbot" (like Austria and I think Germany also) it doesn't matter if the search was illegal - they can still use everything they found against you. Don't get me wrong, it's great you want to run an exit and I also did so in the past, but be careful. Sebastian
They can raid my home(s), it won't make it any less legal to operate an exit node, for it's traffic I am still not responsible. I've had run-ins with the law regarding exit nodes in the past, and all the cases against me got dropped due to not being liable for the traffic I have not initiated. Any good lawyer will know this. I also recommend the EFF pages on the topic. 2020-05-21 21:49 GMT, Sebastian Elisa Pfeifer <newsletter@unicorncloud.org>:
On 20/05/2020 23:07, William Kane wrote:
After that is all done, you can safely ignore most abuse reports unless they actually have a case against you, which, in most countries is not possible due to network providers being protected from liability by the law. But everyone should be aware that that might not stop the law enforcement from raiding your home. Or even worse: https://www.heise.de/newsticker/meldung/Oesterreich-Tor-Serverbetreiber-wege... (Sorry, German)
And, keep in mind, in countries without a "Beweismittelverwertungsverbot" (like Austria and I think Germany also) it doesn't matter if the search was illegal - they can still use everything they found against you.
Don't get me wrong, it's great you want to run an exit and I also did so in the past, but be careful.
Sebastian _______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
You know that, I know that, the police probably also knows that. And I never said it was not legal. But also, it could be that that won't help you and you still get convicted like the guy from Graz in the link.. Sebastian On 22/05/2020 23:28, William Kane wrote:
They can raid my home(s), it won't make it any less legal to operate an exit node, for it's traffic I am still not responsible.
I've had run-ins with the law regarding exit nodes in the past, and all the cases against me got dropped due to not being liable for the traffic I have not initiated. Any good lawyer will know this.
I also recommend the EFF pages on the topic.
2020-05-21 21:49 GMT, Sebastian Elisa Pfeifer <newsletter@unicorncloud.org>:
On 20/05/2020 23:07, William Kane wrote:
After that is all done, you can safely ignore most abuse reports unless they actually have a case against you, which, in most countries is not possible due to network providers being protected from liability by the law. But everyone should be aware that that might not stop the law enforcement from raiding your home. Or even worse: https://www.heise.de/newsticker/meldung/Oesterreich-Tor-Serverbetreiber-wege... (Sorry, German)
And, keep in mind, in countries without a "Beweismittelverwertungsverbot" (like Austria and I think Germany also) it doesn't matter if the search was illegal - they can still use everything they found against you.
Don't get me wrong, it's great you want to run an exit and I also did so in the past, but be careful.
Sebastian _______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
_______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
German laws are different from Austrian laws. I quickly skimmed the German article and the defendant had made less-than-optimal statements in court, like "I don't care if my nodes are being used to distribute child-pornography." and "I actually recommend the Tor Network in chats for hosting of child pornography". No wonder he got sentenced, he also _did not_ have a lawyer. If you are not a, sorry for the foul language but it's true, dumb-ass like him, and have a competent lawyer familiar with the Tor network and the laws protecting network operators, your chances of being sentenced are slim to none, depending on the country you operate your relays in, and your personal jurisdiction. 2020-05-23 17:15 GMT, Sebastian Elisa Pfeifer <newsletter@unicorncloud.org>:
You know that, I know that, the police probably also knows that. And I never said it was not legal.
But also, it could be that that won't help you and you still get convicted like the guy from Graz in the link..
Sebastian
On 22/05/2020 23:28, William Kane wrote:
They can raid my home(s), it won't make it any less legal to operate an exit node, for it's traffic I am still not responsible.
I've had run-ins with the law regarding exit nodes in the past, and all the cases against me got dropped due to not being liable for the traffic I have not initiated. Any good lawyer will know this.
I also recommend the EFF pages on the topic.
2020-05-21 21:49 GMT, Sebastian Elisa Pfeifer <newsletter@unicorncloud.org>:
On 20/05/2020 23:07, William Kane wrote:
After that is all done, you can safely ignore most abuse reports unless they actually have a case against you, which, in most countries is not possible due to network providers being protected from liability by the law. But everyone should be aware that that might not stop the law enforcement from raiding your home. Or even worse: https://www.heise.de/newsticker/meldung/Oesterreich-Tor-Serverbetreiber-wege... (Sorry, German)
And, keep in mind, in countries without a "Beweismittelverwertungsverbot" (like Austria and I think Germany also) it doesn't matter if the search was illegal - they can still use everything they found against you.
Don't get me wrong, it's great you want to run an exit and I also did so in the past, but be careful.
Sebastian _______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
_______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
_______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
participants (3)
-
mnlph74 -
Sebastian Elisa Pfeifer -
William Kane