Yay, family key's are live: Implemented-In: Tor 0.4.9.1-alpha, Arti 1.4.1 https://gitlab.torproject.org/tpo/core/torspec/-/blob/main/proposals/321-hap... https://community.torproject.org/relay/setup/post-install/family-ids/ Copy the MyFamilyKey.secret_family_key file into the KeyDir of _every_ _one_ of your relay. Oooh, damn it. No ansible. Happy copy pasting happy-families ;-) -- ╰_╯ Ciao Marco! Debian GNU/Linux It's free software and it gives you freedom!
I really hope I don't have to copy paste it all given the amount of relays that I am currently running. Hopefully, nusenu will update the ansible repo to support it. On Sat, Mar 22, 2025, at 2:55 PM, boldsuck via tor-relays wrote:
Yay, family key's are live: Implemented-In: Tor 0.4.9.1-alpha, Arti 1.4.1 https://gitlab.torproject.org/tpo/core/torspec/-/blob/main/proposals/321-hap...
https://community.torproject.org/relay/setup/post-install/family-ids/ Copy the MyFamilyKey.secret_family_key file into the KeyDir of _every_ _one_ of your relay.
Oooh, damn it. No ansible. Happy copy pasting happy-families ;-)
-- ╰_╯ Ciao Marco!
Debian GNU/Linux
It's free software and it gives you freedom! _______________________________________________ tor-relays mailing list -- tor-relays@lists.torproject.org To unsubscribe send an email to tor-relays-leave@lists.torproject.org
*Attachments:* • signature.asc
On Sunday, 23 March 2025 00:05 John Crow wrote:
I really hope I don't have to copy paste it all given the amount of relays that I am currently running. Hopefully, nusenu will update the ansible repo to support it.
:-) Nusenu has not only implemented this in his ansible-relayor, but has also given hints during development: https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/857#note_3164207
On Sat, Mar 22, 2025, at 2:55 PM, boldsuck via tor-relays wrote:
Yay, family key's are live: Implemented-In: Tor 0.4.9.1-alpha, Arti 1.4.1 https://gitlab.torproject.org/tpo/core/torspec/-/blob/main/proposals/321-h appy-families.md
https://community.torproject.org/relay/setup/post-install/family-ids/ Copy the MyFamilyKey.secret_family_key file into the KeyDir of _every_ _one_ of your relay.
Oooh, damn it. No ansible. Happy copy pasting happy-families ;-)
-- ╰_╯ Ciao Marco! Debian GNU/Linux It's free software and it gives you freedom!
On Sat, Mar 22, 2025, at 2:55 PM, boldsuck via tor-relays wrote:
Yay, family key's are live: Implemented-In: Tor 0.4.9.1-alpha
Note that the version number given there is wrong. tor 0.4.9.1-alpha does not include support for the new happy families feature. 0.4.9.2-alpha will probably be the first tor release with happy families support. This has been corrected on this page: https://community.torproject.org/relay/setup/post-install/family-ids/ but has not found its way to the proposal page yet. Thanks to early adopters like toralf bugs in happy families are being reported and fixed.
I really hope I don't have to copy paste it all given the amount of relays that I am currently running. Hopefully, nusenu will update the ansible repo to support it.
:-) Nusenu has not only implemented this in his ansible-relayor, but has also given hints during development: https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/857#note_3164207
The current implementation in tor does not support setting the path to the family key file. Which is a bit cumbersome for large operators because they need to copy the file for every tor instance (keys folder) instead of a single time for each server and a single torrc config line. This is less problematic for ansible-relayor than for operators doing it manually because we can automate that task in realyor, but the runtime will certainly increase significantly for large operators if we need to copy that file for every tor instance including setting permissions and so on. I hope a torrc option for specifying the path to the key file is added before the first tor release with happy families is published to mitigate this overhead. Here is the related gitlab issue for it: https://gitlab.torproject.org/tpo/core/tor/-/issues/41033 After this has been clarified/implemented (or rejected) an ansible-relayor release with happy families support will be implemented. OrNetStats will also get Happy Families support but this depends on onionoo's support for Happy Families: https://gitlab.torproject.org/tpo/network-health/metrics/onionoo/-/issues/40... I found it surprising to learn from the proposal that the old MyFamily design makes up over 80% of microdescriptors size so this change has significant potential to decrease the bandwidth used for answering directory requests https://metrics.torproject.org/dirbytes.html but since both Family designs will co-exist for some time for backward compatibility reasons it will take some time before operators can remove there old MyFamily lines from their torrc config files. kind regards, nusenu -- https://nusenu.github.io
On Sunday, 23 March 2025 10:37 nusenu via tor-relays wrote:
On Sat, Mar 22, 2025, at 2:55 PM, boldsuck via tor-relays wrote:
Yay, family key's are live: Implemented-In: Tor 0.4.9.1-alpha
Note that the version number given there is wrong. tor 0.4.9.1-alpha does not include support for the new happy families feature.
0.4.9.2-alpha will probably be the first tor release with happy families support. This has been corrected on this page: https://community.torproject.org/relay/setup/post-install/family-ids/ but has not found its way to the proposal page yet.
OK, thanks. With tor-nightly-main-* currently: 0.4.9.1-alpha-dev I was able to create the family key and id.
Thanks to early adopters like toralf bugs in happy families are being reported and fixed.
I really hope I don't have to copy paste it all given the amount of relays that I am currently running. Hopefully, nusenu will update the ansible repo to support it.
:-)
Nusenu has not only implemented this in his ansible-relayor, but has also given hints during development: https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/857#note_31642 07 The current implementation in tor does not support setting the path to the family key file. Which is a bit cumbersome for large operators because they need to copy the file for every tor instance (keys folder) instead of a single time for each server and a single torrc config line. This is less problematic for ansible-relayor than for operators doing it manually because we can automate that task in realyor, but the runtime will certainly increase significantly for large operators if we need to copy that file for every tor instance including setting permissions and so on.
I hope a torrc option for specifying the path to the key file is added before the first tor release with happy families is published to mitigate this overhead.
Yes, I was also looking for the option to specify the path. Now it doesn't matter, for me. I copied the key in every tor instance and changed permissions. torrc config is only one file per server. I just have to comment out 'FamilyId' line with upcoming stable 0.4.9.n BTW: I hope 0.4.9 finally includes 'ReevaluateExitPolicy' and 'DoSStreamCreation*' for exits, in addition to the family keys. 'ReevaluateExitPolicy' on restart breaks tens or hundreds of thousands of existing connections, and healthy relays lose the HsDir flag. DoS and DDoS consume power and bandwidth. 'ReevaluateExitPolicy' on reload can, AFAIK, also help the relays before exits in the circuit.
Here is the related gitlab issue for it: https://gitlab.torproject.org/tpo/core/tor/-/issues/41033
After this has been clarified/implemented (or rejected) an ansible-relayor release with happy families support will be implemented.
OrNetStats will also get Happy Families support but this depends on onionoo's support for Happy Families: https://gitlab.torproject.org/tpo/network-health/metrics/onionoo/-/issues/4 0051
I found it surprising to learn from the proposal that the old MyFamily design makes up over 80% of microdescriptors size so this change has significant potential to decrease the bandwidth used for answering directory requests https://metrics.torproject.org/dirbytes.html but since both Family designs will co-exist for some time for backward compatibility reasons it will take some time before operators can remove there old MyFamily lines from their torrc config files.
kind regards, nusenu
-- ╰_╯ Ciao Marco! Debian GNU/Linux It's free software and it gives you freedom!
On 3/22/25 10:55 PM, boldsuck via tor-relays wrote:
Copy the MyFamilyKey.secret_family_key file into the KeyDir of _every_ _one_ of your relay.
FWIW: Twe identifier "MyFamilyKey" is free of choice. But once it is choosen it must not be ommitted from the filename b/c it is part of the key. -- Toralf
On Sun, Mar 23, 2025 at 6:11 AM Toralf Förster via tor-relays <tor-relays@lists.torproject.org> wrote:
On 3/22/25 10:55 PM, boldsuck via tor-relays wrote:
Copy the MyFamilyKey.secret_family_key file into the KeyDir of _every_ _one_ of your relay.
FWIW:
Twe identifier "MyFamilyKey" is free of choice. But once it is choosen it must not be ommitted from the filename b/c it is part of the key.
FWIW, any filename should be okay, so long as it ends with ".secret_family_key". But "secret_family_key" on its own is not okay: the period is required.
On Sunday, 23 March 2025 17:18 Nick Mathewson via tor-relays wrote:
On Sun, Mar 23, 2025 at 6:11 AM Toralf Förster via tor-relays
FWIW:
Twe identifier "MyFamilyKey" is free of choice. But once it is choosen it must not be ommitted from the filename b/c it is part of the key.
FWIW, any filename should be okay, so long as it ends with ".secret_family_key". But "secret_family_key" on its own is not okay: the period is required.
Uuh, thanks. Then everything's fine. I created the key with: tor --quiet --keygen-family ForPrivacyNET and then copied 'ForPrivacyNET.secret_family_key' into tor's KeyDir The most annoying thing for me¹ was changing the rights ;-) chown _tor-00:_tor-00 /var/lib/tor-instances/00/keys/ForPrivacyNET.secret_family_key ... chown _tor-$$:_tor-$$ /var/lib/tor-instances/$$/keys/ForPrivacyNET.secret_family_key ¹because I'm brain-dead and don't use ansible. -- ╰_╯ Ciao Marco! Debian GNU/Linux It's free software and it gives you freedom!
participants (6)
-
boldsuck -
John Crow -
lists＠for-privacy.net
-
Nick Mathewson -
nusenu -
Toralf Förster