Thanks Roger for your helpful explanations, as always.

I still have exit flags. The total traffic through through my exits does not see change whatever I do to port 80, with some 3,000 exits. Vnstat makes it 17 T a month on my main server. I am puzzled that amount of activity, with limited port 80, is not generating anything on the abuse front with so many ports open,...touching wood firmly now. Delighted, and of course I do feel guilty that I do not have port 80 (or 22 for that matter) wide open for Tor community, but don't have the balls for it, and I am not hiding behind a limited company.

Gerry Bulger

-----Original Message----- From: tor-relays tor-relays-bounces@lists.torproject.org On Behalf Of Roger Dingledine Sent: 18 December 2018 00:47 To: tor-relays@lists.torproject.org Subject: Re: [tor-relays] Extreme Exit Policy

On Mon, Dec 17, 2018 at 11:40:05PM +0000, gerard@bulger.co.uk wrote:

I always blocked the obvious abuse ports, but for reasons I do not know, blocking port 80 except to a few subnets, abolished complaints about my exits. I widened the number of subnets and complaints started again, so put restrictions back.

443 wide open, along with very wide range of ports and most high numbers. I am puzzled that port 80 attracts the abuse complaints. Is it because the port 80 traffic is more easily read by agencies sniffing for bad things and copyright infringements?

One plausible explanation would be that when you blocked too much of port 80, you lost the Exit flag, which caused most clients to not consider you as suitable for use in the third hop of their circuit. https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt#n2564

That is, by closing down your exit policy so much, you signaled to clients that they shouldn't try using you as their exit, so most of them didn't.

(You might still see a few exit requests anyway, since clients with a stream request for port 443 would still consider you a legit option if they don't have an available circuit. But when they're making preemptive circuits, they would skip over you because you don't seem like the sort of relay that's likely to be able to satisfy whatever their future requests will be.)

--Roger

_______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

On Mon, Dec 17, 2018 at 11:51:29PM -0700, Mirimir wrote:

Given that I SSH via Tor a lot, that would suck for me. If too many exits didn't allow port 22, anyway. As it is, it's not uncommon for SSH logins via Tor to die. Presumably after some network hiccup.

And sure, I could setup .onion SSH for everything, and that'd arguably be more secure. But sometimes I'm just too lazy for that.

Now that I'm thinking of it, though, I wonder whether I ought to change SSH to port 443. That'd give me a larger exit population, which would be good. But for anyone watching, my SSH sessions would be more unusual.

What would be the likely net impact of using port 443 for SSH?

Another more surprising impact for you is that your ssh connections would, counterintuitively, die more often.

That's because Tor has a LongLivedPorts option, where streams for those destination ports use circuits with all Stable-flagged relays, and 22 is in the list but 443 is not:

LongLivedPorts PORTS A list of ports for services that tend to have long-running connections (e.g. chat and interactive shells). Circuits for streams that use these ports will contain only high-uptime nodes, to reduce the chance that a node will go down before the stream is finished. Note that the list is also honored for circuits (both client and service side) involving hidden services whose virtual port is in this list. (Default: 21, 22, 706, 1863, 5050, 5190, 5222, 5223, 6523, 6667, 6697, 8300)

--Roger

...

Another more surprising impact for you is that your ssh connections would, counterintuitively, die more often.

That's because Tor has a LongLivedPorts option, where streams for those destination ports use circuits with all Stable-flagged relays, and 22 is in the list but 443 is not:

   LongLivedPorts PORTS
       A list of ports for services that tend to have long-running
       connections (e.g. chat and interactive shells). Circuits for
       streams that use these ports will contain only high-uptime

nodes, to reduce the chance that a node will go down before the stream is finished. Note that the list is also honored for circuits (both client and service side) involving hidden services whose virtual port is in this list. (Default: 21, 22, 706, 1863, 5050, 5190, 5222, 5223, 6523, 6667, 6697, 8300)

And re .onion services, it's interesting that OnionCat port 8060 isn't on the list.

Nice. Considering all that is, and can be, stuffed over OnionCat, including the above, 8060 could probably be added to the list. Similar could perhaps be said for any tunneling protocols... OpenVPN, etc.

On Dec 17, 2018, at 22:51, Mirimir mirimir@riseup.net wrote:

And sure, I could setup .onion SSH for everything, and that'd arguably be more secure. But sometimes I'm just too lazy for that.

I'm pretty frickin' lazy, but I do this with all my servers. Here's the recipe for Linux/Debian provisioning:

-*"*-.,,.-*"*-.,,.-*"*-.,,.-*"*-.,,.-*"*-.,,.-*"*-.,,.-*"*-

# cat >>/etc/apt/sources.list

deb https://deb.torproject.org/torproject.org stretch main deb-src https://deb.torproject.org/torproject.org stretch main # apt install gnupg2 dirmngr

# gpg2 --recv A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89

I've had gpg2 fail, in which case this should work: # gpg --keyserver hkp://pool.sks-keyservers.net --recv A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89

# gpg2 --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add -

# apt update

# apt install tor deb.torproject.org-keyring

edit /etc/tor/torrc, the "hidden services" section, to add: HiddenServiceDir /var/lib/tor/control/ HiddenServicePort 22 127.0.0.1:22 # service tor restart

# cat /var/lib/tor/control/hostname

Record the onion address for posterity

-*"*-.,,.-*"*-.,,.-*"*-.,,.-*"*-.,,.-*"*-.,,.-*"*-.,,.-*"*-

The SSH sessions to the .onion address seem pretty darned solid.

--Ron

On Wed, Dec 19, 2018 at 07:17:49AM +0100, dns1983@riseup.net wrote:

Hi,

excuse my bad english.

I would run an exit relay on a virtual server. For now i run just a non exit relay on my own mini server. I don't like too much do not have full control on the server, but, for me, it is the only way to run an exit relay.

How I know which service can get me a pubblic ip address on which I can put my email address on report abuse section, so I can directly receive abuse warning without passing throw my server provider?

Could you suggests me some providers that possiby offer unlimited monthly data too?

Regards Gigi

This message is more appropriate as a new post. Thanks!