tor-relays September 2019

tor-relays@lists.torproject.org

38 participants
26 discussions

Sudden bridge activity from Russia and Iran, strange?
by nottryingtobelame＠protonmail.com 18 Sep '19

18 Sep '19

Hello, my new bridge sat for a few weeks with 0 clients. I understand it takes time to begin seeing clients, but all of a sudden within the span of one 6-hour heartbeat period, I picked up 346 clients. Since then, it has been 20-50 every 6 hours. But when I pull the bridge-stats file, it shows 104 from Iran, and 64 from Russia. These two are the overwhelming majority of my clients; all the other countries each have 8. Is this normal, or suspicious?

2 1

SSH scanning on TOR Exit - Nerfing Rules
by AMuse 16 Sep '19

16 Sep '19

Hi all! I'm curious what y'all think of this situation. I have SSH open as an exit port on a TOR exit that my friends and I are maintaining - and of course it's the #1 offender by far in automated abuse notifications we get from our ISP, from peoples' fail2ban servers sending abuse emails. This all seems like a huge waste of time, but that's a separate issue. I'm wondering if nerfing outbound SSH to rate limit will be effective at getting the SSH scanning bots to stop using my exit in their circuit, while leaving SSH open for actual humans who need to SSH while using TOR. I've implemented, as a test, rate limiting outbound on the SSH port. What do you think the impact of this will be? No impact? Losing exit status because connections on SSH die? Something else entirely? Here's the pf rules in question: pass in on $ext_if proto {tcp udp} from any to any port 9000:9150 keep state pass in on $ext_if proto tcp from any to any port 22 keep state pass in on $ext_if proto tcp from any to any port 80 keep state pass out on $ext_if from any to any keep state pass out on $ext_if proto tcp from any to any port 22 keep state (max-src-conn 25, max-src-conn-rate 1/5 )

3 2

Re: [tor-relays] Short Research Survey
by entensaison＠use.startmail.com 13 Sep '19

13 Sep '19

Hi! Most online surveys ask the participants to confirm that their replies can be used after the last question of the survey. I would recommend you to do that, too. Sometimes people give random answers because they are curious about the survey's questions. ;-) > Dear Tor relay operators, > > We are a team of researchers at MIT, and we would like to ask Tor relay > operators to participate in a short and anonymous survey (no personal > information or IP address collected). This study is focused on the > importance of providing anonymity by volunteers in various contexts, > and will take no more than 5-10 minutes to finish. > > You can learn more and take the survey at this link: https://mit.co1.qualtrics.com/jfe/form/SV_6W3YXSCnqMVGPs1 > > Your input is very valuable to our study, and we look forward to your > feedback. > > Please feel free to email us at anon-research(a)mit.edu if you have any > questions. > > (Our survey platform unfortunately uses JavaScript. We apologize for > being unable to switch it off. We would be grateful for your > participation if you are comfortable taking the survey.)

1 0

Running on a Raspberry Pi
by William Denton 13 Sep '19

13 Sep '19

I'm reconfiguring things and decided to move a relay from an old laptop to a Raspberry Pi. I tried it on a Pi Zero W, which is very cheap but also pretty slow, and it just didn't work. Now I'm trying it on a Pi Four (which has four CPUs and two gigs of RAM) and so far it's working, though it's not moving as much traffic as on the laptop. There I was doing about 25 gigs a day, and so far now I'm doing about four or five with the same configuration. Anyone else running a relay on a Pi? It's cheap and pretty easy to set up, even if it turns out not to be an enormous contribution to the network. Bill -- William Denton :: Toronto, Canada --- Listening to Art: https://listeningtoart.org/ https://www.miskatonic.org/ --- GHG.EARTH: http://ghg.earth/ Caveat lector. --- STAPLR: http://staplr.org/

5 5

Re: [tor-relays] Running on a Raspberry Pi
by nottryingtobelame＠protonmail.com 13 Sep '19

13 Sep '19

If you're having any heat issues with the Pi 4, may I suggest the aluminum heatsink case from flirc.tv? It took my average temps down about 10°C. Beautiful case, great price for what it does. -------- Original Message -------- On Sep 13, 2019, 8:00 AM, wrote: > Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > > Today's Topics: > > 1. Re: Running on a Raspberry Pi (William Denton) > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 12 Sep 2019 19:50:22 -0400 (EDT) > From: William Denton <wtd(a)pobox.com> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Running on a Raspberry Pi > Message-ID: <alpine.DEB.2.02.1909121945030.14928(a)shell.miskatonic.org> > Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII > > On 10 September 2019, ronqtorrelays(a)risley.net wrote: > >> From what I have read about the Pi 4, heat is a big issue. If you're not doing >> something to cool it, your CPU speed is likely being throttled due to >> overheating. > > I'm not doing any cooling except for not having it in case. I'm in Canada, and > with winter coming I can leave it hanging inside a window, and that'll cool it > down some. > > The speed on the relay has picked up to about a quarter of what it was (so about > six gigs a day), and I'll wait and see if it continues to increase, and then > maybe fiddle with the config. > > So, if a Pi is cheap to buy and easy to use and maintain, I'm happy to use it > for a relay, even if it's not a major contributor to the network. > > Bill > -- > William Denton :: Toronto, Canada --- Listening to Art: https://listeningtoart.org/ > https://www.miskatonic.org/ --- GHG.EARTH: http://ghg.earth/ > Caveat lector. --- STAPLR: http://staplr.org/ > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > ------------------------------ > > End of tor-relays Digest, Vol 104, Issue 15 > *******************************************

1 0

ORPort
by Anonforpeace 12 Sep '19

12 Sep '19

Hello: Hope someone can help me. I'm trying to configure a bridge and I've followed all the instructions and I've chosen several ports and none of them are reachable. I've used the test site that Tor lists on its site. "Your server has not managed to confirm that your its ORPort is reachable." Each port I list on the test site says unreachable. What am I missing? The instructions are pretty straightforward. Thanks

4 6

Short Research Survey
by Anon-research 12 Sep '19

12 Sep '19

Dear Tor relay operators, We are a team of researchers at MIT, and we would like to ask Tor relay operators to participate in a short and anonymous survey (no personal information or IP address collected). This study is focused on the importance of providing anonymity by volunteers in various contexts, and will take no more than 5-10 minutes to finish. You can learn more and take the survey at this link: https://mit.co1.qualtrics.com/jfe/form/SV_6W3YXSCnqMVGPs1 Your input is very valuable to our study, and we look forward to your feedback. Please feel free to email us at anon-research(a)mit.edu if you have any questions. (Our survey platform unfortunately uses JavaScript. We apologize for being unable to switch it off. We would be grateful for your participation if you are comfortable taking the survey.)

3 2

Re: [tor-relays] Running on a Raspberry Pi
by nottryingtobelame＠protonmail.com 10 Sep '19

10 Sep '19

My primary relay runs on a Pi 3B. 903CA67D0DEB74CFBB01432840A26CB8C6C18FDF. According to the logs, it's sending and receiving a total of about 130 GB per day. A Pi 4 should definitely be able to handle it. Pi Zeroes had a conflict with the name of the CPU architecture and so Tor apparently never worked quite right on them. I'm not an expert, but my guess is that the relay just had to reset its advertised bandwidth and has to build back up again. Hope this helps.

1 0

FW: Lots of spam on new tor exit node.
by email-group＠tor.bband.net 10 Sep '19

10 Sep '19

I have recently setup a new tor exit node but since about an hour of setting it up it has been almost maxed out with spam. https://metrics.torproject.org/rs.html#details/4AFECB973C2268D5074D8DEDAF0BD B604C89ED50 How can I combat it? I turned the node off for about an hour from about 6.30am GMT but the user reconnected. From the looks of it they are connecting through the tor network. DNS logs are looking like it is targeting illicit Russian drug forums almost all with .biz domains.

3 3

What could cause a huge clock skew (9 days) across Tor restarts - anyone else experienced something like this?
by s7r 07 Sep '19

07 Sep '19

Hello, I'd like to hear if anyone else experienced this and has an idea of what the cause might be. I did not oped a ticket about this yet because I am not sure there is a problem in Tor, and it eventually healed by itself. The relay was running just fine. Server had an accurate time before upgrade and time service ntp was running. I only did an upgrade to Tor from the latest nightly build and of course it does a service stop -> upgrade -> service start. After Debian finished installing the new Tor, I did as usual: check the log file to see that all is OK and circuits were built and descriptors published, etc. I saw this: The log before restart was reporting: Sep 06 21:03:16.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. Sep 06 21:03:17.000 [notice] Delaying directory fetches: We are hibernating or shutting down. Sep 06 21:03:46.000 [notice] Clean shutdown finished. Exiting. [skipped boring part intentionally] Aug 28 07:40:07.000 [warn] Our clock is 9 days, 11 hours, 20 minutes behind the time published in the consensus network status document (2019-09-06 23:00:00 UTC). Tor needs an accurate clock to work correctly. Please check your time and date settings! Aug 28 07:40:07.000 [warn] Received ns flavor consensus with skewed time (CONSENSUS): It seems that our clock is behind by 9 days, 11 hours, 20 minutes, or that theirs is ahead. Tor requires an accurate clock to work: please check your time, timezone, and date settings. Aug 28 07:40:07.000 [warn] Problem bootstrapping. Stuck at 0% (starting): Starting. (Clock skew -818406 in ns flavor consensus from CONSENSUS; CLOCK_SKEW; count 2; recommendation warn; host ? at ?) Aug 28 07:40:08.000 [warn] Our clock is 9 days, 12 hours, 20 minutes behind the time published in the consensus network status document (2019-09-07 00:00:00 UTC). Tor needs an accurate clock to work correctly. Please check your time and date settings! Aug 28 07:40:08.000 [warn] Received microdesc flavor consensus with skewed time (CONSENSUS): It seems that our clock is behind by 9 days, 12 hours, 20 minutes, or that theirs is ahead. Tor requires an accurate clock to work: please check your time, timezone, and date settings. Aug 28 07:40:08.000 [warn] Problem bootstrapping. Stuck at 0% (starting): Starting. (Clock skew -822006 in microdesc flavor consensus from CONSENSUS; CLOCK_SKEW; count 3; recommendation warn; host ? at ?) and then Sep 06 21:04:50.000 [notice] Starting with guard context "default" ...proceed to normal start and everything as usual from now... So, Tor had the time Sep 06 21:03:46.000 before restart. After restart, it thought it had Aug 28 07:40:07.000 and then Aug 28 07:40:08.000 and then it healed and reported Sep 06 21:04:50.000. This is kind of odd. What could be the reason for this? The server is just a Debian machine that runs Tor and nothing else. Thanks!

3 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-relays September 2019