update obfs4proxy if you run a bridge
Hello, TL;RD: if you are a bridge operator please update obfs4proxy to a version>=0.0.12. There is a new version of obfs4proxy (>=0.0.12) which fixes a security issue[0]. Tor Browser has already updated to the new version, which reduces a bit the security problem, but introduces a partial incompatibility between versions[1]. Because of that updating to the latest version greatly will help bridge users. If you use debian you can find the latest version bullseye-backports[2]. If you use docker there is a new version of the official docker image that you can upgrade to[3]. Thank you for running bridges, let me know if you need any help upgrading it. [0] https://lists.torproject.org/pipermail/anti-censorship-team/2022-January/000... [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/40804 [2] https://packages.debian.org/stable-backports/obfs4proxy [3] https://hub.docker.com/layers/thetorproject/obfs4-bridge/0.11/images/sha256-... -- meskio | https://meskio.net/ -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- My contact info: https://meskio.net/crypto.txt -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Nos vamos a Croatan.
On 21 Mar 2022, 17:46 +0000, meskio <meskio@torproject.org>, wrote:
Hello,
TL;RD: if you are a bridge operator please update obfs4proxy to a version>=0.0.12. Thanks, done.
Worth noting I had to adjust (on Debian) /etc/apparmor.d/abstractions/tor to contain: /sys/kernel/mm/transparent_hugepage/hpage_pmd_size r, To prevent the error: apparmor="DENIED" operation="open" profile="system_tor" name="/sys/kernel/mm/transparent_hugepage/hpage_pmd_size per [1]. And be sure to setcap the obfs4proxy binary again if running on a port<1024, as well as restart Tor after updating. Cheers. [1]: https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1839505....
On 3/21/22 18:45, meskio wrote:
Thank you for running bridges, let me know if you need any help upgrading it.
I'm not really familar with Debian and do wonder, what line I have to add to /etc/apt/apt.conf.d/50unattended-upgrades to get that automatically installed ? Maybe I need to add the repo too ? Currently it looks like: ~# cat /etc/apt/apt.conf.d/50unattended-upgrades Unattended-Upgrade::Origins-Pattern { "origin=Debian,codename=${distro_codename},label=Debian"; "origin=Debian,codename=${distro_codename},label=Debian-Security"; "origin=Debian,codename=${distro_codename}-security,label=Debian-Security"; "origin=TorProject"; }; Unattended-Upgrade::Package-Blacklist { }; Unattended-Upgrade::Automatic-Reboot "true"; -- Toralf
On Wednesday, March 23, 2022 6:08:10 PM CET Toralf Förster wrote:
On 3/21/22 18:45, meskio wrote:
Thank you for running bridges, let me know if you need any help upgrading it.
I'm not really familar with Debian and do wonder, what line I have to add to /etc/apt/apt.conf.d/50unattended-upgrades to get that automatically installed ? Maybe I need to add the repo too ?
Yes, first edit '/etc/apt/sources.list': # bullseye-backports, previously on backports.debian.org deb http://deb.debian.org/debian/ bullseye-backports main #deb-src http://deb.debian.org/debian/ bullseye-backports main Then install: apt update apt install -t bullseye-backports obfs4proxy https://backports.debian.org/Instructions/ You should always install individual packages from the backports archive. Don't use apt-pinning for the whole backport archive in '/etc/apt/preferences'. -- ╰_╯ Ciao Marco! Debian GNU/Linux It's free software and it gives you freedom!
participants (4)
-
lists＠for-privacy.net -
meskio -
Spydar007 -
Toralf Förster