Greetings,
A year ago we asked you to run obfuscated bridges to help people in Iran [0]. Many people answered our call and we ended up having a big pool of obfuscated bridges to give to our users.
Unfortunately, today, most of those bridges are down, and fresh ones are needed more than ever, since obfuscated bridges are the only way for people to access Tor in some areas of the world (like China, Iran and Syria).
On the bright side, Tor's anti-censorship infrastructure has improved, and now you don't have to send the bridge addresses to us; if you run an obfuscated bridge with Tor 0.2.4.x, Tor will send its own address to BridgeDB [1] like normal bridges do.
Also, obfsproxy was rewritten in Python and it now supports a new pluggable transport called 'obfs3' which works even in China [2]. We have dropped support for the C-version of Obfsproxy, and the new Pluggable Transport Bundles contain the Python version [3]. Finally, future pluggable transports will be developed for the Python version.
Looking into BridgeDB, we have 200 obfs2 bridges, but only 40 obfs3 bridges: this means that we need more people running the new Python obfsproxy! Upgrading obfsproxy should be easy now, since we prepared new instructions and Debian/Ubuntu packages. If you run Debian or Ubuntu check out these instructiosn: https://www.torproject.org/projects/obfsproxy-debian-instructions.html.en otherwise use these: https://www.torproject.org/projects/obfsproxy-instructions.html.en (and make sure your pip is upgraded so that it uses HTTPS [4])
Furthermore, Tor's support assistants need some _unpublished_ bridges to give to censored users who ask for help via email. To configure an unpublished bridge you add "PublishServerDescriptor 0" to its torrc. After you do so, fire up Tor, and check its logs to find the ports that 'obfs2' and 'obfs3' are using. Send your IP and ports to tor-assistants@torproject.org.
Finally, if in the future we need you to do something extra (for example to upgrade obfsproxy to support a new pluggable transport) we will send another mail to tor-relays.
Thanks for the help!
[0]: https://lists.torproject.org/pipermail/tor-talk/2012-February/023070.html [1]: https://bridges.torproject.org [2]: In China obfs2 is blocked using active probes: https://trac.torproject.org/projects/tor/ticket/8591 [3]: https://blog.torproject.org/blog/new-name-obfsproxy-tor-browser-bundles [4]: https://groups.google.com/forum/#!msg/python-virtualenv/foXxh-NpdGg/uT0NPc9m...
I would love to help. My questions, does it make any sense to run a bridge from a residential internet that changes its IP 2-3 times a day? My server is running constantly, however my provider "likes" disconnects and as a result my IP changes.
Greetings,
A year ago we asked you to run obfuscated bridges to help people in Iran [0]. Many people answered our call and we ended up having a big pool of obfuscated bridges to give to our users.
Unfortunately, today, most of those bridges are down, and fresh ones are needed more than ever, since obfuscated bridges are the only way for people to access Tor in some areas of the world (like China, Iran and Syria).
On the bright side, Tor's anti-censorship infrastructure has improved, and now you don't have to send the bridge addresses to us; if you run an obfuscated bridge with Tor 0.2.4.x, Tor will send its own address to BridgeDB [1] like normal bridges do.
Also, obfsproxy was rewritten in Python and it now supports a new pluggable transport called 'obfs3' which works even in China [2]. We have dropped support for the C-version of Obfsproxy, and the new Pluggable Transport Bundles contain the Python version [3]. Finally, future pluggable transports will be developed for the Python version.
Looking into BridgeDB, we have 200 obfs2 bridges, but only 40 obfs3 bridges: this means that we need more people running the new Python obfsproxy! Upgrading obfsproxy should be easy now, since we prepared new instructions and Debian/Ubuntu packages. If you run Debian or Ubuntu check out these instructiosn: https://www.torproject.org/projects/obfsproxy-debian-instructions.html.en otherwise use these: https://www.torproject.org/projects/obfsproxy-instructions.html.en (and make sure your pip is upgraded so that it uses HTTPS [4])
Furthermore, Tor's support assistants need some _unpublished_ bridges to give to censored users who ask for help via email. To configure an unpublished bridge you add "PublishServerDescriptor 0" to its torrc. After you do so, fire up Tor, and check its logs to find the ports that 'obfs2' and 'obfs3' are using. Send your IP and ports to tor-assistants@torproject.org.
Finally, if in the future we need you to do something extra (for example to upgrade obfsproxy to support a new pluggable transport) we will send another mail to tor-relays.
Thanks for the help!
[2]: In China obfs2 is blocked using active probes: https://trac.torproject.org/projects/tor/ticket/8591 [3]: https://blog.torproject.org/blog/new-name-obfsproxy-tor-browser-bundles [4]: https://groups.google.com/forum/#!msg/python-virtualenv/foXxh-NpdGg/uT0NPc9m... _______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
On Tuesday, April 16, 2013 12:52pm, "George Kadianakis" desnacked@riseup.net said: [snip]
Looking into BridgeDB, we have 200 obfs2 bridges, but only 40 obfs3 bridges: this means that we need more people running the new Python obfsproxy! Upgrading obfsproxy should be easy now, since we prepared new instructions and Debian/Ubuntu packages.
[snip]
Users running RHEL/CentOS need not apply.
obfs2 wouldn't build on RHEL5/CentOS5 due to the minimum autoconf version required to build it. Fair enough, the 5.x series is pretty old in terms of package versions installed.
obfs3 won't build/run on RHEL6/CentOS6 due to the Python 2.7.x (plus many, many subpackages) requirement. Replacing the installed Python v2.6.x will break your system. Installing to an alternate location (download, ./configure, make altinstall) and editing /usr/bin/obfsproxy isn't enough as the subpackages are all still installed beneath /usr/lib/python2.6/.
Oh, and the "pip" referred to in the build instructions (https://www.torproject.org/projects/obfsproxy-instructions.html.en) is named "pip-python" in CentOS6.
Steve Snyder:
obfs3 won't build/run on RHEL6/CentOS6 due to the Python 2.7.x (plus many, many subpackages) requirement.
That's a pity: obfsproxy can actually run with Python 2.6 as I've happily discovered when doing packages for Debian Squeeze.
I hope George will be able to lower the requierements in the next release.
Quoth Steve Snyder swsnyder@snydernet.net, on 2013-04-16 15:53:14 -0400:
obfs3 won't build/run on RHEL6/CentOS6 due to the Python 2.7.x (plus many, many subpackages) requirement. Replacing the installed Python v2.6.x will break your system. Installing to an alternate location (download, ./configure, make altinstall) and editing /usr/bin/obfsproxy isn't enough as the subpackages are all still installed beneath /usr/lib/python2.6/.
Indeed.
I tend to run my server-y machines on CentOS 6 at the moment, and I was going to try to spin up an obfs3 proxy on one of them, but the Python 2.7 dependency steamrolls that plan. Curiously, if it needed Python 3, I would be more amenable to it, both since the major version change means upstreams are likely to make sure parallel installation works, and because I'm interested in increased Python 3 adoption anyway.
I am not really inclined to do any of:
- try to have both a distribution and an out-of-distribution Python 2 installed in parallel;
- bypass declared installation requirements, use 2.6.6, and blindly hope that it won't result in some awful subtle bug;
- allocate additional money and tracking resources to fooling around with Amazon (eating my free usage quota and then likely causing me to drop the bridge after a year anyway, which is exactly what you _didn't_ want) when I have perfectly good spare computing power already;
- try to figure out how to retrieve the "Tor Cloud" image and/or convert it into something I can use outside of Amazon's service.
I also ran into the following:
- I'd like to examine the obfsproxy source code out of curiosity to see how it's likely to interact with my other network services. The only thing that looks like a source link on [1] points me to installation instructions of the form "now, here's how to vomit all the files somewhere on your system using pip, which you already have because you're about to install it on this very machine, right?". Where's the beef^Wtarball? Hell if I know without spending a lot of energy on it.
[1] https://www.torproject.org//projects/obfsproxy.html.en
- What's the way to make this play nicely if all the "common" encrypted-connection ports (particularly 443/tcp) are already bound to their "usual" services on this IP address? Does that exist? What requirements are there for what the service "looks like" to the outside for the obfs3 usage to actually be effective? I can't easily tell.
For me, this is "oh, well", but if you want more deployed obfuscated bridges, there might be other people running into the same things.
---> Drake Wilson
Drake Wilson:
- bypass declared installation requirements, use 2.6.6, and blindly hope that it won't result in some awful subtle bug;
obfsproxy works on Debian Squeeze which bears 2.6.6. I had to patch the test suites but that was all: http://anonscm.debian.org/gitweb/?p=collab-maint/pyptlib.git;a=blob;f=debian/patches/0001-Monkey-patch-unittest.TestCase-to-add-missing-assert.patch;h=ebba348;hb=refs/heads/tpo-squeeze-backport http://anonscm.debian.org/gitweb/?p=collab-maint/obfsproxy.git;a=blob;f=debian/patches/0001-Monkey-patch-twisted.trial.unittest.TestCase-to-add-.patch;h=c7b78eda;hb=refs/heads/tpo-squeeze-backport
- I'd like to examine the obfsproxy source code out of curiosity to see how it's likely to interact with my other network services.
https://gitweb.torproject.org/pluggable-transports/obfsproxy.git or `git clone https://git.torproject.org/pluggable-transports/obfsproxy.git%60 or https://pypi.python.org/pypi/obfsproxy (tarball and gpg sig)
Hope that helps,
On Fri, 19 Apr 2013 13:50:48 +0000, Lunar wrote:
Drake Wilson:
- bypass declared installation requirements, use 2.6.6, and blindly hope that it won't result in some awful subtle bug;
obfsproxy works on Debian Squeeze which bears 2.6.6. I had to patch the
Mind to provide any more details? The 'pip install obfsproxy' runs into all sorts of errors (first missing C compiler, then missing Python.h) on my fresh debian box.
Andreas
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 19.04.2013 19:48, Andreas Krey wrote:
On Fri, 19 Apr 2013 13:50:48 +0000, Lunar wrote:
Drake Wilson:
- bypass declared installation requirements, use 2.6.6, and
blindly hope that it won't result in some awful subtle bug;
obfsproxy works on Debian Squeeze which bears 2.6.6. I had to patch the
Mind to provide any more details? The 'pip install obfsproxy' runs into all sorts of errors (first missing C compiler, then missing Python.h) on my fresh debian box.
Andreas
A missing Python.h is probably contained in your python2.6-dev package. The rest could probably be debugged if you provided a log.
Martin Weinelt
On Fri, 19 Apr 2013 19:49:12 +0000, Martin Weinelt wrote: ...
A missing Python.h is probably contained in your python2.6-dev package.
Ah, thanks. Now caching 'Python.h => python-dev' relation.
So, one more obfs3 bridge (apparently, no client at hand yet) up.
Andreas
On Fri, 19 Apr 2013 20:07:43 +0000, Andreas Krey wrote: ...
So, one more obfs3 bridge (apparently, no client at hand yet) up.
And a long download later I learned that the obfsproxy bundle doesn't work on this old XP (just the obfsproxy plugin, actually, the browser itself does). :-( So, no function test, except for the regular bridge.
Andreas
On 19.04.2013 20:59, Andreas Krey wrote:
And a long download later I learned that the obfsproxy bundle doesn't work on this old XP (just the obfsproxy plugin, actually, the browser itself does).
Oh? How come? Can you please file a ticket about it and provide details?
On Sun, 21 Apr 2013 10:23:06 +0000, Moritz Bartl wrote:
On 19.04.2013 20:59, Andreas Krey wrote:
And a long download later I learned that the obfsproxy bundle doesn't work on this old XP (just the obfsproxy plugin, actually, the browser itself does).
Oh? How come? Can you please file a ticket about it and provide details?
The log says (literally):
Apr 21 11:44:35.318 [Warning] Failed to create child process flashproxy-client: Diese Anwendung konnte nicht gestartet werden, weil die Anwenungskonfiguration nicht korrekt ist. Zur Problembehebung sollten Sie die Anwendung neu installieren. Apr 21 11:44:35.318 [Warning] Managed proxy at 'flashproxy-client' failed at launch. Apr 21 11:44:35.318 [Warning] Failed to create child process pyobfsproxy: Diese Anwendung konnte nicht gestartet werden, weil die Anwenungskonfiguration nicht korrekt ist. Zur Problembehebung sollten Sie die Anwendung neu installieren. Apr 21 11:44:35.318 [Warning] Managed proxy at 'pyobfsproxy' failed at launch.
Depends.exe says it's a missing msvcr90.dll. Which is interesting as there is a copy in the portable firefox, so the bundle doesn't expect it to be present in the system. Also says 'Error: The Side-by-Side configuration information for "c:\dokumente und einstellungen\ak\eigene dateien\tor browser\app\PYOBFSPROXY.EXE" contains errors. '
When I copy the msvcr90.dll into the directory containing the pyobfsproxy the missing dill is fixed, but depend.exe still complains about the borken side-by-side configuration, and it still doesn't come up.
Packing for windows is hard. :-( I will file a bug if you don't deem this to be a problem with XP being to ancient (service pack-wise).
Andreas
PS: The typo in the german error message ('Anwenungskonfiguration') is real.
Andreas Krey:
On Fri, 19 Apr 2013 13:50:48 +0000, Lunar wrote:
Drake Wilson:
- bypass declared installation requirements, use 2.6.6, and blindly hope that it won't result in some awful subtle bug;
obfsproxy works on Debian Squeeze which bears 2.6.6. I had to patch the
Mind to provide any more details? The 'pip install obfsproxy' runs into all sorts of errors (first missing C compiler, then missing Python.h) on my fresh debian box.
If you are on Squeeze, just use the packages available on deb.torproject.org instead of `pip`.
The source is also on deb.torproject.org or available through Git: http://anonscm.debian.org/gitweb/?p=collab-maint/obfsproxy.git;a=tree;h=refs/heads/tpo-squeeze-backport;hb=tpo-squeeze-backport
On Tue, 16 Apr 2013 19:52:19 +0300 George Kadianakis desnacked@riseup.net wrote:
Also, obfsproxy was rewritten in Python and it now supports a new pluggable transport called 'obfs3' which works even in China [2]. We have dropped support for the C-version of Obfsproxy, and the new Pluggable Transport Bundles contain the Python version [3]. Finally, future pluggable transports will be developed for the Python version.
I wish this sort of functionality was integrated directly into tor.
I am not up for installing and configuring an extra piece of Python software on my bridges, and it doesn't help that it isn't even present in Debian (only version 0.1.4 is there, which I guess is not obfs "3" that you now promote).
On 16.04.2013 22:27, Roman Mamedov wrote:
Also, obfsproxy was rewritten in Python and it now supports a new pluggable transport called 'obfs3' which works even in China [2].
I wish this sort of functionality was integrated directly into tor. I am not up for installing and configuring an extra piece of Python software on my bridges, and it doesn't help that it isn't even present in Debian (only version 0.1.4 is there, which I guess is not obfs "3" that you now promote).
If you have deb.torproject.org as apt repository source, which is also the recommended way to get and keep Tor up to date, you can simply apt-get it.
Don't confuse the version number of Obfsproxy with supported transport protocols. Obfsproxy is a software that currently supports the "obfs2" and "obfs3" protocols, and is at version 0.2.1-2. It is likely that in the future support for more protocols will be added.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 16.04.2013 22:37, Moritz Bartl wrote:
On 16.04.2013 22:27, Roman Mamedov wrote:
Also, obfsproxy was rewritten in Python and it now supports a new pluggable transport called 'obfs3' which works even in China [2].
I wish this sort of functionality was integrated directly into tor. I am not up for installing and configuring an extra piece of Python software on my bridges, and it doesn't help that it isn't even present in Debian (only version 0.1.4 is there, which I guess is not obfs "3" that you now promote).
If you have deb.torproject.org as apt repository source, which is also the recommended way to get and keep Tor up to date, you can simply apt-get it.
Don't confuse the version number of Obfsproxy with supported transport protocols. Obfsproxy is a software that currently supports the "obfs2" and "obfs3" protocols, and is at version 0.2.1-2. It is likely that in the future support for more protocols will be added.
Does it make sense to launch an Obfsproxy on a IP already running a relay node? If yes, can I run it in the same tor session? What options do I need to activate?
I added the SoftwareTransportPlugins to my configuration and upon rehashing it showed it listened to two more ports: 22:43:39 [NOTICE] Registered server transport 'obfs2' at '0.0.0.0:47533' 22:43:39 [NOTICE] Registered server transport 'obfs3' at '0.0.0.0:42580'
I however did not yet add "BridgeRelay 1" because I don't know how that affects relay functionality.
Where do I go from here?
Martin Weinelt
On 16.04.2013 22:49, Martin Weinelt wrote:
Does it make sense to launch an Obfsproxy on a IP already running a relay node?
That is a fine question. Some countries currently seem to block relays by IP:Port combination, so the rest of the ports could be still reachable. In theory, it should work to be a relay and run obfsproxy on top of it, but i am not sure it works in practice.
I added the SoftwareTransportPlugins to my configuration and upon rehashing it showed it listened to two more ports: 22:43:39 [NOTICE] Registered server transport 'obfs2' at '0.0.0.0:47533' 22:43:39 [NOTICE] Registered server transport 'obfs3' at '0.0.0.0:42580'
I however did not yet add "BridgeRelay 1" because I don't know how that affects relay functionality.
Where do I go from here?
Make sure the two ports are reachable from the outside. I don't know if Tor publishes these ports to BridgeDB (the place where censored users will learn about bridges) without being a bridge relay, and you cannot enable "BridgeRelay 1" because one Tor process can either be a relay or a bridge.
If you want to make sure it works, you have to spin up and manage a second Tor process.
On Tue, Apr 16, 2013 at 4:52 PM, George Kadianakis desnacked@riseup.net wrote:
Looking into BridgeDB, we have 200 obfs2 bridges, but only 40 obfs3 bridges: this means that we need more people running the new Python obfsproxy! Upgrading obfsproxy should be easy now, since we prepared new instructions and Debian/Ubuntu packages. If you run Debian or Ubuntu check out these instructiosn: https://www.torproject.org/projects/obfsproxy-debian-instructions.html.en otherwise use these: https://www.torproject.org/projects/obfsproxy-instructions.html.en (and make sure your pip is upgraded so that it uses HTTPS [4])
The easiest way to run an obfs3 bridge is to spin up an Amazon EC2 instance from https://cloud.torproject.org/. The instance will automatically be a normal bridge, an obfs2 bridge, and an obfs3 bridge. The bridge will announce itself to the bridge database, so you don't have to email us with the IP and port. The best part is that it will cost you less than $30 per month!
On Tue, 16 Apr 2013 23:41:34 +0000 "Runa A. Sandvik" runa.sandvik@gmail.com wrote:
The best part is that it will cost you less than $30 per month!
Is that really supposed to be the "best" part?
$5-$7 today gets you a VPS with 1-2TB of bandwidth per month, http://www.lowendbox.com/
$17 gets you a Core Duo dedicated server with two HDDs and 5 TB of bandwidth, http://www.kimsufi.com/fr/bons_plans/index.xml
And $26 gets you a Dual Xeon dedicated server with 10 TB of bandwidth. http://www.webhostingtalk.com/showthread.php?t=1248180
So no, $30/mo for just one bridge (as I read the website, with only 40 GB of bandwidth???) is not the most efficient use of your funds.
George Kadianakis desnacked@riseup.net writes:
Looking into BridgeDB, we have 200 obfs2 bridges, but only 40 obfs3 bridges: this means that we need more people running the new Python obfsproxy! Upgrading obfsproxy should be easy now, since we prepared new instructions and Debian/Ubuntu packages. If you run Debian or Ubuntu check out these instructiosn: https://www.torproject.org/projects/obfsproxy-debian-instructions.html.en otherwise use these: https://www.torproject.org/projects/obfsproxy-instructions.html.en (and make sure your pip is upgraded so that it uses HTTPS [4])
I read about this on Arstechnica and wanted to help out. I think I got a bridge running. But how do I check? The logs just say:
Apr 19 19:03:26.000 [notice] Registered server transport 'obfs3' at '0.0.0.0:xxxx0' Apr 19 19:03:26.000 [notice] Registered server transport 'obfs2' at '0.0.0.0:xxxx' Apr 19 19:03:27.000 [notice] Guessed our IP address as xxxx (source: 93.114.43.156). Apr 19 19:03:27.000 [notice] Tor has successfully opened a circuit. Looks like client functionality is working. Apr 19 19:03:27.000 [notice] Bootstrapped 100%: Done. Apr 19 19:03:27.000 [notice] Now checking whether ORPort xxxx:443 is reachable... (this may take up to 20 minutes -- look for log messages indicating success) Apr 19 19:06:30.000 [notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor. Apr 19 19:11:35.000 [notice] Performing bandwidth self-test...done.
...no self-test for obfs?
Best,
-Nikolaus
Hi,
Am 16.04.2013 um 18:52 schrieb George Kadianakis:
Ubuntu check out these instructiosn: https://www.torproject.org/projects/obfsproxy-debian-instructions.html.en
I am trying to install obfsproxy on Ubuntu lucid. Sadly, using these apt lines
deb http://deb.torproject.org/torproject.org lucid main deb http://deb.torproject.org/torproject.org experimental-lucid main
seems not to be enough:
$ apt-cache search obfsproxy
finds nothing. Any ideas?
Lutz
On Sun, 21 Apr 2013 14:46:28 +0200 Lutz Horn lutz.horn@posteo.de wrote:
Hi,
Am 16.04.2013 um 18:52 schrieb George Kadianakis:
Ubuntu check out these instructiosn: https://www.torproject.org/projects/obfsproxy-debian-instructions.html.en
I am trying to install obfsproxy on Ubuntu lucid. Sadly, using these apt lines
deb http://deb.torproject.org/torproject.org lucid main deb http://deb.torproject.org/torproject.org experimental-lucid main
seems not to be enough:
$ apt-cache search obfsproxy
finds nothing. Any ideas?
Did you do "apt-get update" before trying 'search'?
Hi,
Am 21.04.2013 um 14:54 schrieb Roman Mamedov:
Did you do "apt-get update" before trying 'search'?
This is what I do:
$ sudo grep tor /etc/apt/sources.list deb http://deb.torproject.org/torproject.org lucid main deb http://deb.torproject.org/torproject.org experimental-lucid main $ sudo apt-get update … Hit http://deb.torproject.org lucid Release.gpg Hit http://deb.torproject.org experimental-lucid Release.gpg Hit http://deb.torproject.org lucid Release Hit http://deb.torproject.org experimental-lucid Release Ign http://deb.torproject.org lucid/main Packages Ign http://deb.torproject.org experimental-lucid/main Packages Ign http://deb.torproject.org lucid/main Packages Ign http://deb.torproject.org experimental-lucid/main Packages Hit http://deb.torproject.org lucid/main Packages Hit http://deb.torproject.org experimental-lucid/main Packages Reading package lists... Done $ apt-cache search obfsproxy $
No obfsprox :(
Lutz
Lutz Horn:
Am 16.04.2013 um 18:52 schrieb George Kadianakis:
Ubuntu check out these instructiosn: https://www.torproject.org/projects/obfsproxy-debian-instructions.html.en
I am trying to install obfsproxy on Ubuntu lucid. Sadly, using these apt lines
deb http://deb.torproject.org/torproject.org lucid main deb http://deb.torproject.org/torproject.org experimental-lucid main
seems not to be enough:
$ apt-cache search obfsproxy
finds nothing. Any ideas?
Ubuntu Lucid can't be supported through Debian packages. See https://trac.torproject.org/projects/tor/ticket/8714 for details.
Lunar <lunar@...> writes:
Ubuntu Lucid can't be supported through Debian packages. See https://trac.torproject.org/projects/tor/ticket/8714 for details.
Ticket 8714 has been updated with directions for lucid users.
Please which linux is long term tor supported? Thank You
On Tue, Apr 30, 2013 at 10:31 AM, Jack Zielke torrelay@linuxcoffee.comwrote:
Lunar <lunar@...> writes:
Ubuntu Lucid can't be supported through Debian packages. See https://trac.torproject.org/projects/tor/ticket/8714 for details.
Ticket 8714 has been updated with directions for lucid users.
tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
B L:
which linux is long term tor supported?
Several members of the Tor project are also Debian developers. Debian Wheezy has been released last week-end and should be supported for the next 2-3 years.
I hope that answers your question.
tor-relays@lists.torproject.org