Re: [tor-relays] Relay configuration issue "Could not bind to 0.0.0.0:443: Permission denied"

2016-01-22 Thread Roger Dingledine
On Mon, Jan 18, 2016 at 01:26:05AM +0100, AJ NOURI wrote: > *sudo service tor reload* > > * Reloading tor daemon configuration... [fail] > > > Jan 08 12:31:58.000 [notice] Received reload signal (hup). Reloading > > config and resetting internal state. > > Jan 08 12:31:58.000

Re: [tor-relays] Running a relay, only, in win7

2016-01-19 Thread Roger Dingledine
On Tue, Jan 19, 2016 at 02:43:15PM +, je suis wrote: > Even if I say I need to use win7 these days that doesn't mean I'm looking > for an easy way to do it; as many steps as there are required, that's how > many I'll take, but I'd rather be tor alone that runs, not a whole army. Is > it

Re: [tor-relays] uptime "algorithm"

2015-12-14 Thread Roger Dingledine
On Mon, Dec 14, 2015 at 08:14:12PM +0100, Logforme wrote: > Can't see why, for example the Debian /etc/init.d/tor script, couldn't > send tor a flag telling it that this is a restart, causing tor to > save/restore its uptime information. Yes, this would be possible. > Circuits auto-reconnect if

Re: [tor-relays] Faravahar messing with my IP address

2015-11-09 Thread Roger Dingledine
On Mon, Nov 09, 2015 at 08:04:55PM +1100, Tim Wilson-Brown - teor wrote: > Subsequent queries get the same IP address for several tens of seconds > afterwards. Woah. Are we setting the Expires: http header in our Tor answer based on how long we think the *payload* will remain valid, and the

Re: [tor-relays] 130 "11BX1371" relays joined on 2015-10-30

2015-11-02 Thread Roger Dingledine
On Sun, Nov 01, 2015 at 05:41:44PM +, n...@cock.li wrote: > Tom van der Woerdt: > > Should they actually be blocked though? > > > > I mean, it's a lot of relays, but they're also contributing actual exit > > bandwidth and it's not like they're spread over hundreds of /16s. > > I was just

Re: [tor-relays] HoneyPot?

2015-10-29 Thread Roger Dingledine
On Thu, Oct 29, 2015 at 05:25:31PM -0600, Mirimir wrote: > On 10/29/2015 05:20 PM, Green Dream wrote: > > Unfortunately that line > > of the exit policy isn't displayed on Atlas. You can see the full policy on > > Globe: > > > >

Re: [tor-relays] Bots, love 'em or hate 'em?

2015-09-08 Thread Roger Dingledine
On Mon, Sep 07, 2015 at 10:30:38AM -0400, starlight.201...@binnacle.cx wrote: > This is curious: Appears a large number of Tor > client-bots have set > > UseEntryGuards 0 > > From current relays that have never had the guard flag: > > extra-info moep

Re: [tor-relays] Does Setting Up a Bridge Relay Disable the Browser?

2015-09-07 Thread Roger Dingledine
On Mon, Sep 07, 2015 at 12:11:28AM -0600, Kenneth Freeman wrote: > This may be a naïve question, but I've fired up my 64-bit Debian box now > that the nights are cool, and editing the torrc to establish a bridge > relay borks the browser. I provide anonymity much more than I use it > myself, but

Re: [tor-relays] Bots, love 'em or hate 'em?

2015-09-07 Thread Roger Dingledine
On Wed, Aug 19, 2015 at 11:11:59AM -0400, starlight.201...@binnacle.cx wrote: > So I'm left thinking that 95% or more of the > bandwidth consumption and client count is from > crusty old botnet bots running ancient versions > of the Tor daemon. Client count (for non guards), yes I think that's a

Re: [tor-relays] No guard flag?

2015-08-18 Thread Roger Dingledine
On Tue, Aug 18, 2015 at 07:43:15AM -0400, 12xBTM wrote: Advertised/Measured bandwidth is too low. This is true. Only the top XX% (I think 10-20%, I don't remember off-hand) of nodes (by bandwidth) are eligible to become guard nodes. At the moment, that works out that your node needs to have

Re: [tor-relays] do not run Tor client and OR relay together!

2015-08-16 Thread Roger Dingledine
On Sun, Aug 16, 2015 at 05:14:42PM -0400, starlight.201...@binnacle.cx wrote: Unfortunately the log-to-file feature does not include fractional seconds, but it's glaring even with whole-second resolution. Haven't looked at the rest of this thread, but: LogTimeGranularity 1 --Roger

Re: [tor-relays] Multicore, bandwidth, relays, capacity, location

2015-08-13 Thread Roger Dingledine
On Thu, Aug 13, 2015 at 03:03:10AM -0400, grarpamp wrote: [Yes I broke the thread because no subject and gmail are even lamer than I]. (Please don't cross-post across lists. I've followed up on tor-talk, and I encourage those here to do that too:

Re: [tor-relays] clarification on what Utah State University exit relays store (360 gigs of log files)

2015-08-13 Thread Roger Dingledine
On Thu, Aug 13, 2015 at 07:39:45PM -0700, Mike Perry wrote: Otherwise, from these defaults, it sounds like Tor's one hour timeout on client TLS connections seems reasonable, and perhaps not worth raising, since even if we were using padding and keep-alives, the flow data would still record a

Re: [tor-relays] Guard flag flapping

2015-08-09 Thread Roger Dingledine
On Sun, Aug 09, 2015 at 12:52:21PM -0700, Green Dream wrote: Some of the speeds are a bit slow, but nothing low enough to explain the extremely low measured bandwidth these relays are getting. Note that the bandwidth weights in the consensus are unitless: they are simply weights, and they

Re: [tor-relays] Failure from drain-fd

2015-08-06 Thread Roger Dingledine
On Thu, Aug 06, 2015 at 05:13:45PM -0700, Brian Walker wrote: Anybody know what this means? My logs are littered with it. Tor v2.6.9 with Libevent 2.0.21-stable, OpenSSL 1.0.1o and Zlib 1.2.8 on Windows Server 2012 R2. Aug 06 13:26:35.000 [warn] Failure from drain_fd [3892 similar

Re: [tor-relays] longclaw BWauth is back, not measuring 2000 relays, what's with that?

2015-08-06 Thread Roger Dingledine
On Thu, Aug 06, 2015 at 10:53:04AM -0400, starlight.201...@binnacle.cx wrote: longclaw 4691 Measured values in w lines maatuska 6815 Measured values in w lines gabelmoo 6347 Measured values in w lines moria16715 Measured values in w lines longclaw moved from the old

Re: [tor-relays] BWauth no-consensus state in effect

2015-08-04 Thread Roger Dingledine
On Thu, Jul 30, 2015 at 08:53:33PM +0200, nusenu wrote: Has this fallback happened before (=some experience on the potential impact available) or is this outage happening for the first time since the bwauths are in place? Indeed, it happened a few times back in 2010-2011 when we were first

Re: [tor-relays] pinning relay keys to IPs (or not)

2015-07-27 Thread Roger Dingledine
On Sun, Jul 26, 2015 at 04:48:37PM +, Yawning Angel wrote: If the relay's IP is constantly changing significantly faster than the Guard rotation interval (needs more numbers here), I'm not sure if they make great Guards, but this is an arma/asn type question since they think more about

Re: [tor-relays] [warn] Content-Length is less than zero; it looks like someone is trying to crash us

2015-07-23 Thread Roger Dingledine
On Thu, Jul 23, 2015 at 09:38:02AM -0400, Steve Snyder wrote: Yes, I got the same thing recently. A burst of 56 of these log entries over a 3-minute period on July 21st. Seen with v0.2.6.10. Somebody shaking doorknobs. If your DirPorts are on port 80, it might even just be a random bad

Re: [tor-relays] Fwd: Tor family graphs

2015-07-22 Thread Roger Dingledine
On Wed, Jul 22, 2015 at 09:31:58PM +0800, Virgil Griffith wrote: I present three graphs of all Tor relays (nodes) with at least one family connection (edge). Thanks Virgil! I think the clear first conclusion here is that our current method, writing symmetric fingerprints into torrcs, is not

Re: [tor-relays] circuit_unlink_all_from_channel

2015-06-26 Thread Roger Dingledine
On Fri, Jun 26, 2015 at 07:17:45PM +0200, Logforme wrote: FYI I run the relay 855BC2DABE24C861CD887DB9B2E950424B49FC34. Today I found a message in the log file I have not seen before: Jun 26 18:05:20.000 [warn] circuit_unlink_all_from_channel(): Bug: Circuit on detached list which I had no

Re: [tor-relays] OpenBSD: tor rc script: don't kill unrelated tor instances (patch)

2015-06-23 Thread Roger Dingledine
On Tue, Jun 23, 2015 at 01:09:07PM +0200, Fabian Keil wrote: In the ElectroBSD version of the port I recently went with the mentioned specify all log files in the torrc strategy ... You might also enjoy the --defaults-torrc option, which you can use for giving Tor new defaults while still

Re: [tor-relays] Help with my first relay.

2015-06-07 Thread Roger Dingledine
On Sun, Jun 07, 2015 at 06:42:29PM +0200, janarkop...@riseup.net wrote: Hi, i want to check if the relay has a good configuration. Also i have another question, why the speed of the relay is so slow, i have a VPS with a connection of 100mb/s, the relay is new. This is torrc: ORPort

Re: [tor-relays] tor network loses ~50 relays/day due to bw auth problem

2015-06-02 Thread Roger Dingledine
On Mon, Jun 01, 2015 at 11:02:53AM -0500, Tom Ritter wrote: Hrm. So this gets into the inner workings of the bwauth system which is... complicated.[0] Honestly, I'm not actually sure how the individual data from the different bwauths is combined into a single value for the consensus. The

Re: [tor-relays] tor network loses ~50 relays/day due to bw auth problem

2015-05-25 Thread Roger Dingledine
On Wed, May 20, 2015 at 04:13:57PM -0500, Tom Ritter wrote: Right now Tor has two new BWAuths spinning up, one of which will hopefully be included in the vote this week or weekend. And, it looks like Tom's bwauth data is now being used by maatuska. So I expect this will be good news for many,

Re: [tor-relays] BWauth kookiness

2015-05-20 Thread Roger Dingledine
On Wed, May 20, 2015 at 06:16:36PM -0400, starlight.201...@binnacle.cx wrote: but in the last few days the BWAuths' opinion went from bw1-w Bandwidth=7382 Measured=7100 *bw2-w Bandwidth=7382 Measured=9330 bw3-w Bandwidth=7382 Measured=13700 GuardFraction=69 bw4-w Bandwidth=7382

Re: [tor-relays] tor network loses ~50 relays/day due to bw auth problem

2015-05-19 Thread Roger Dingledine
On Tue, May 19, 2015 at 08:47:56PM +, nusenu wrote: sounds alarming if people operating tor's key infrastructure do not care (or have not enough time to care) Well, we are working on a variety of approaches now for fixing it. Some in the short term (get more bwauths, fix bugs), some in the

Re: [tor-relays] amount of unmeasured relays continuously rising since 2 weeks

2015-05-18 Thread Roger Dingledine
On Mon, May 18, 2015 at 09:02:27PM +, nusenu wrote: now even DocTor starts to complain https://lists.torproject.org/pipermail/tor-consensus-health/2015-May/005772.html Yep. moria1's bwauth seems to be working fine, so I'm the only one paying attention to the thread here, and also the only

Re: [tor-relays] amount of unmeasured relays continuously rising since 2 weeks

2015-05-18 Thread Roger Dingledine
On Tue, May 19, 2015 at 12:27:12AM +0300, s7r wrote: Hi nusenu, Again thanks for keeping an eye on things. At least partially, the balance of measured/unmeasured should be fixed in the new few days. To relay operators, in the mean time, please bare for few more days and sorry for the

Re: [tor-relays] amount of unmeasured relays continuously rising since 2 weeks

2015-05-14 Thread Roger Dingledine
On Thu, May 14, 2015 at 08:01:19PM +, nusenu wrote: Dear Tor BW Authories, we'd like to bring the following issue to your attention. Since the last two weeks the amount of unmeasured relays is steadily rising [1]. Hello nusenu, Thanks for the kick. For other statistics, each hour I

Re: [tor-relays] T-shirts and Confirming Relay Control

2015-05-03 Thread Roger Dingledine
Matt: Thanks for leading us forward on the tshirt topic! I still, alas, have a pile of tshirt requests from Jan-Mar that I should collate and forward to you. On Sun, May 03, 2015 at 10:26:52AM -0800, I wrote: Isn't the value of the t-shirt disproportionate to the trouble you're going to to give

Re: [tor-relays] help interpreting fault setting up exit

2015-04-11 Thread Roger Dingledine
On Sat, Apr 11, 2015 at 05:11:41PM -0800, I wrote: -bash: sudo: command not found Looks like you might want to apt-get install sudo. That said, if you're running the command as root already, you can just omit the 'sudo' word. Once you have done the apt-get sudo, do a 'man sudo' and you can

Re: [tor-relays] MY IP adress on blacklist and then in exit relay policy

2015-03-30 Thread Roger Dingledine
On Mon, Mar 30, 2015 at 12:23:21PM -0400, Zack Weinberg wrote: The only way your exit node's own IP address could be in the exit policy is if someone put it there. Maybe you did that and you don't remember doing it? If you didn't do it, then you might indeed have had your node broken into,

Re: [tor-relays] Undiagnosable Crashes in Relays

2015-03-25 Thread Roger Dingledine
On Wed, Mar 25, 2015 at 08:26:20AM +, skyhighatrist wrote: I have no idea why they all fell over, the last thing in the logs was the usual current status output with some traffic measuring, seemingly immediately afterwards, the process killed itself for no reason. You might also enjoy

Re: [tor-relays] Many inbound and outbound connections but no circuits

2015-03-11 Thread Roger Dingledine
On Wed, Mar 04, 2015 at 04:30:58PM +0100, mattia wrote: Hello, I've been running a relay for some weeks. It has now earned the stable flag. Despite this I always have more than 500 inbound and outbound connections but no circuits at all. Is this normal? It depends what you're using to learn

Re: [tor-relays] 0.2.5.10 / 0.2.6.x and ticket 9682

2015-03-07 Thread Roger Dingledine
On Sat, Mar 07, 2015 at 12:53:39PM +0100, Sebastian Urbach wrote: Hard to tell pretty much says it all :-( Not much of a change. Now the multithread feature becomes the last hope :-) Thanks gor your reply, domehow i expected it zo be more of a boost after reading Nick's text:

Re: [tor-relays] new ansible-tor features: automatic instance configuration + automatic MyFamily generation (PATCH)

2015-02-17 Thread Roger Dingledine
On Tue, Feb 17, 2015 at 11:00:02PM +0100, Moritz Bartl wrote: We still lack the gamification Relay Challenge website that Virgil was talking about. It would just sum up all relays of a family, and then it really does not matter any more. If anybody (ok, it has to be the right people, not quite

Re: [tor-relays] Very Safe Exit Policy

2015-02-17 Thread Roger Dingledine
On Tue, Feb 17, 2015 at 11:02:45AM -0500, Chris Patti wrote: I tried running an exit for a bit and it lasted a few weeks before some brainless wonder hijacked someone's Gmail with my exit, so I had to pull it down and go relay only. Even worse (or maybe better), this sort of thing happens when

Re: [tor-relays] Is Bridges supposed to get a gurard flag?.

2015-02-10 Thread Roger Dingledine
Thanks for running a bridge! (But, please don't cross-post onto multiple Tor lists. Or for a different perspective, the tor-dev list is for developing Tor, not for reaching Tor's developers. :) On Tue, Feb 10, 2015 at 09:03:10AM +, Sasikantha babu wrote: Hello All,    I've been running a

Re: [tor-relays] Minimizing service interruption when reloading torrc?

2015-02-08 Thread Roger Dingledine
On Mon, Feb 09, 2015 at 04:29:01AM +0100, Sebastian Urbach wrote: I'd like to reload torrc; I think I can do this by either restarting tor or by sending a SIGHUP to the tor process, but I'm not sure how much of a service interruption each of these approaches will cause. What's the best way

Re: [tor-relays] Relay is down

2014-12-31 Thread Roger Dingledine
On Wed, Dec 31, 2014 at 01:44:59PM -0500, Giovanny Andres Gongora Granada wrote: Well my relay continues being down. Will my relay up someday again? I think, doesn't have sense to have relay on my server configured if it will not be available because was blacklisted for some reason that I don't

Re: [tor-relays] Out of memory message

2014-12-09 Thread Roger Dingledine
On Sun, Dec 07, 2014 at 01:43:46PM +0100, Logforme wrote: To me it looks like an attacker that ramped up over a 6 hour period and then stopped building new circuits. Since the tor process still uses all available memory (more than 24 hours later) I guess the attacker still holds some circuits

Re: [tor-relays] Guard flag and some irregularities

2014-12-06 Thread Roger Dingledine
On Sat, Dec 06, 2014 at 03:40:41PM -0500, Rafael Rodriguez wrote: https://atlas.thecthulhu.com/#details/48ADFCC561402D7EBB1CDE233F206B01D8FA0765 1- Is it ok for the Guard flag to come and go so often? Yes, it can oscillate for some relays, if some directory authorities think the relay

Re: [tor-relays] Windows Tor Server Guide

2014-11-05 Thread Roger Dingledine
On Tue, Nov 04, 2014 at 05:25:28PM -0500, Nick Mathewson wrote: I'd suggest that you start by posting your process to this mailing list, so that other folks can add improvements for it. (Though I hope that expert packages in some form will return soon.) The expert packages have indeed

Re: [tor-relays] upgrade tor bridge raspberry-pi

2014-10-30 Thread Roger Dingledine
On Thu, Oct 30, 2014 at 08:30:31PM +, jchase wrote: On hearing the news that tor 0.2.5.10 was available, I upgraded my raspberry-pi tor (obfuscated bridge) to 0.2.4.something. The upgrade restarted the tor daemon automatically. I would have rather done it myself using a restart. When I

Re: [tor-relays] My VPS relay has just been hacked

2014-10-25 Thread Roger Dingledine
On Sat, Oct 25, 2014 at 03:36:05PM +0100, Nick Sheppard wrote: This is typical of what I found. 1root 20 0 10604 832 700 S ... 0:00.10 init 2root 20 0 000 S ... 0:00.00 kthreadd/3277 3root 20 0 000 S ... 0:00.00 khelper/3277 1370 root 20 0 36976 660

Re: [tor-relays] Tor 0.2.5.10 is released!

2014-10-25 Thread Roger Dingledine
On Sun, Oct 26, 2014 at 12:49:10AM +0200, g...@kset.org wrote: I first updated from 0.2.4.24 to 0.2.5.9rc and then to 0.2.5.10 as the packages hit the repositories. In both cases my notice log is now showing 0 NTor handshakes: Tor 0.2.5.9-rc (git-067214faa586161d) opening new log file.

Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection

2014-10-19 Thread Roger Dingledine
On Sun, Oct 19, 2014 at 01:24:31PM +0200, Kees Goossens wrote: However, the only thing I do with my VPS is run tor. I don???t run a web site, and don???t have apache or whatever installed. I didn???t investigate much further, but my hypothesis is that when publishing the tor-exit notice on

Re: [tor-relays] Obfuscated bridges and tor-arm

2014-10-16 Thread Roger Dingledine
On Thu, Oct 16, 2014 at 01:12:44PM +0200, justaguy wrote: Does the tor-arm tool display the used BW of the obfuscated bridge or only the normal non obfuscated bridge? It should display the used bandwidth of the Tor program, which includes all the various ways that people can talk to it. That

Re: [tor-relays] Anonbox Project

2014-10-16 Thread Roger Dingledine
On Thu, Oct 16, 2014 at 11:56:57AM -0700, Mike Perry wrote: As a result of their claims not matching up to reality, I've been debating writing a blog post warning about the various issues with Anonabox I think a blog post teaching people about the issues is a fine plan. I was thinking

Re: [tor-relays] GoodBadISPs revamp?

2014-10-12 Thread Roger Dingledine
On Mon, Oct 13, 2014 at 02:09:50AM +0100, Thomas White wrote: Anyone with access to create a new page on the list and we can add subsections to a new page containing the dated responses from each company on their policy towards Tor hosting. On 13/10/2014 01:56, subk...@riseup.net wrote:

[tor-relays] Help collect hidden service usage stats?

2014-09-24 Thread Roger Dingledine
Hi folks, If you are comfortable compiling Tor from git, and you want to help investigate what fraction of Tor network load comes from hidden service use, I have a shiny new git branch called hs-stats that will collect per-thirty-minute statistics about number of circuits and number of cells your

Re: [tor-relays] Correctly setting up arm

2014-09-22 Thread Roger Dingledine
On Mon, Sep 22, 2014 at 09:34:40PM +0100, Chris Whittleston wrote: Previously, I've run arm using 'sudo -u debian-tor arm'. As was mentioned here previously, this is not how you should run it - in fact there is a bit of documentation to suggest how it should be done. Yep. See

Re: [tor-relays] fingerprint info propogation

2014-09-06 Thread Roger Dingledine
On Sun, Sep 07, 2014 at 01:00:38AM +, ja...@icetor.is wrote: Sorry if asked before, made a stupid oversight restarting one of my exits yesterday, had duplicated the fingerprint file from another node. Changed the file to the correct nickname today (I know nicknames are depreciated now) and

Re: [tor-relays] Time information

2014-09-04 Thread Roger Dingledine
On Tue, Sep 02, 2014 at 07:19:02PM +, Marcin Gondek wrote: Sep 02 21:11:52.000 [info] channel_tls_process_netinfo_cell(): Received NETINFO cell with skewed time from server at x.x.x.x:449. It seems that our clock is ahead by 1 hours, 19 minutes, or that theirs is behind. Tor requires

Re: [tor-relays] Authdir is rejecting routers in this range

2014-08-29 Thread Roger Dingledine
On Fri, Aug 29, 2014 at 09:51:33PM +, Davíð Steinn Geirsson wrote: I rented a dedicated server to run a tor relay (100Mbit/s) to contribute to the network. On this machine, tor gives messages like these on startup: http status 400 (Authdir is rejecting routers in this range.) response

Re: [tor-relays] managing bandwidth quotum

2014-08-26 Thread Roger Dingledine
On Tue, Aug 26, 2014 at 06:43:04PM +0200, Kees Goossens wrote: A question on how to manage a bandwidth quotum of my internet provider. I run a non-exit relay on a hosted server with 1000 GB bandwidth per month. In essence, should I A- only set the AccountingMax, and let the relay figure out

Re: [tor-relays] Directory Server and bandwidth accounting

2014-06-28 Thread Roger Dingledine
On Sat, Jun 28, 2014 at 09:51:08AM -0700, Kali Tor wrote: So, no way to offer DS while setting AccountingMax? Correct. At least in the scenario in this thread, not advertising the dirport is a good choice by Tor, since it saves all your bandwidth for 'real' Tor traffic. The key thing to

[tor-relays] Best way for normal OS X users to run a relay?

2014-06-04 Thread Roger Dingledine
What is the best way to run a relay on OS X currently? Now that the Vidalia bundles are deprecated and hard to find, I believe we have no packages or bundles for OS X other than TBB 3.x? So either install from source, write your own init script, hope you know what ulimit -n is, good luck with

Re: [tor-relays] hardening a tor relay

2014-05-26 Thread Roger Dingledine
On Fri, May 23, 2014 at 06:30:08PM -0400, Roger Dingledine wrote: Relays need to allow connections to all outgoing ports. If you do lines like the above, your Tor relay will be unable to reach other Tor relays that chose port 80 or port 110 for their ORPort or their DirPort. (People choose

Re: [tor-relays] Confirm IPv6 Setup as Exit Node

2014-05-24 Thread Roger Dingledine
On Thu, May 22, 2014 at 10:01:19AM -0700, Adam Brenner wrote: For IPv4 I am running a Reduced Exit Policy[1]. Those entries are in my torrc file, however, Atlas is showing none of those policies[2]! Really? https://atlas.torproject.org/#details/6269EC22B7970ACDE4AF09F6ADE67CEB0C7F7964 looks

Re: [tor-relays] Confirm IPv6 Setup as Exit Node

2014-05-24 Thread Roger Dingledine
On Thu, May 22, 2014 at 01:17:17PM +0600, Roman Mamedov wrote: On Wed, 21 May 2014 22:51:49 -0700 Adam Brenner a...@aeb.io wrote: I have setup a Tor exit node and IPv4 appears to work (will get a real test in the next 48 hours). I would like to confirm my IPv6 setup as I have found the

Re: [tor-relays] hardening a tor relay

2014-05-23 Thread Roger Dingledine
On Fri, May 23, 2014 at 06:16:56PM -0300, Noilson Caio wrote: Block all output like http and smtp in my netfilter (Gnu Linux); -A OUTPUT -p tcp -m tcp --dport 80 -j DROP -A OUTPUT -p tcp -m tcp --dport 110 -j DROP etc .. Relays need to allow connections to all outgoing ports. If you do

Re: [tor-relays] relay not receiving very much traffic

2014-05-18 Thread Roger Dingledine
On Sun, May 18, 2014 at 08:51:57PM +0200, Tim Semeijn wrote: It looks like your node is running as guard. This usually drops your traffic for a while before it builds up again. Tim is referring to the phenomenon described here: https://blog.torproject.org/blog/lifecycle-of-a-new-relay And

Re: [tor-relays] Relay down, rejected, help

2014-04-21 Thread Roger Dingledine
On Sat, Apr 19, 2014 at 02:15:52PM -0800, I wrote: Wow, I always thought that *was* the safe way to run arm. I wonder where we both got the advice to do it the dangerous way. from ARM [ARM_NOTICE] Arm is currently running with root permissions. This is not a good idea, and will

Re: [tor-relays] Announcing the removal of Tor v0.2.2.x relays

2014-04-21 Thread Roger Dingledine
On Mon, Apr 21, 2014 at 01:36:53PM +, Nusenu wrote: Question arisen from looking at the relays by version graph: If you look at that graph you see that on 2014-04-08 the number of relays (in the consensus) running 0.2.2.x were about zero, and now (2014-04-21) we are back at about 170

Re: [tor-relays] Relay down, rejected, help

2014-04-19 Thread Roger Dingledine
On Sat, Apr 19, 2014 at 09:19:26AM -0700, kbesig wrote: Install of tor-arm went well enough, no error msg's. ~$ sudo -u debian-tor arm You're using arm dangerously. See item #14 on https://www.torproject.org/docs/tor-relay-debian for the safer way to run arm with your Debian / Ubuntu relay.

Re: [tor-relays] Recommended reject lines for relays affected by Heartbleed

2014-04-17 Thread Roger Dingledine
On Thu, Apr 17, 2014 at 12:17:02AM -0400, Roger Dingledine wrote: Thanks Andrea. 374 of the 380 lines from Sina's file overlap with yours. I've moved moria1 to reject the union of the two lists. Four other directory authority operators have also blacklisted these keys, and they've now been

Re: [tor-relays] Recommended reject lines for relays affected by Heartbleed

2014-04-16 Thread Roger Dingledine
On Wed, Apr 16, 2014 at 08:03:51PM -0700, Andrea Shepard wrote: http://charon.persephoneslair.org/~andrea/private/hb-fingerprints-20140417002500.txt The SHA-256 hash of that file, for the sake of stating it under a PGP signature, is:

[tor-relays] Rejecting 380 vulnerable guard/exit keys

2014-04-15 Thread Roger Dingledine
Hi folks, I'm attaching the list of relay identity fingerprints that I'm rejecting on moria1 as of yesterday. I got the list from Sina's scanner: https://encrypted.redteam.net/bleeding_edges/ I thought for a while about taking away their Valid flag rather than rejecting them outright, but this

Re: [tor-relays] NSA knew about Heartbleed

2014-04-12 Thread Roger Dingledine
On Sat, Apr 12, 2014 at 08:45:23PM +, Delton Barnes wrote: Two sources familiar with matter could merely be two computer security experts who have an unsubstantiated opinion that the NSA was exploiting this beforehand. We have no idea how credible these sources are. I agree. I'm assuming

Re: [tor-relays] tor relay recommended upgrade procedure?

2014-03-29 Thread Roger Dingledine
On Sun, Mar 30, 2014 at 11:21:02AM +1100, Zenaan Harkness wrote: The Debian install script evidently gives tor 30 seconds to disconnect, since it did stop tor after 30 seconds. This is actually Tor's behavior. From the man page: ShutdownWaitLength NUM When we get a SIGINT

Re: [tor-relays] Avoiding sinkholes

2014-03-28 Thread Roger Dingledine
On Fri, Mar 28, 2014 at 08:36:06AM +0300, r...@goodvikings.com wrote: It's on that list since at some point a botnet talking through tor to its CC server used my exit node to do so Actually, it could easily have been a computer security researcher who used Tor to access that address, not

[tor-relays] Metrics for assessing EFF's Tor relay challenge?

2014-03-27 Thread Roger Dingledine
Hi Christian, other tor relay fans, I'm looking for some volunteers, hopefully including Christian, to work on metrics and visualization of impact from new relays. We're working with EFF to do another Tor relay challenge [*], to both help raise awareness of the value of Tor, and encourage many

Re: [tor-relays] Relay configuration for FreedomBox

2014-03-23 Thread Roger Dingledine
On Sat, Mar 22, 2014 at 01:03:43PM -0700, Lance Hathaway wrote: On the plus side, obfs3 is still pretty strong, and it's one of the common pluggable transports right now. Scramblesuit is not live in the official bundles yet (AFAIK), but it just released and has some pretty robust-looking

Re: [tor-relays] Exiting only port 8333

2014-03-23 Thread Roger Dingledine
On Mon, Mar 17, 2014 at 09:39:05PM +0100, Mike Hearn wrote: I would like to be an exit for port 8333 only. I have configured my relay to do this, but I am not being listed with the relay flag and do not see any traffic exiting my node (at least not using arm). I saw an FAQ that says this is

Re: [tor-relays] Why would consensus weight would be declining like this?

2014-03-23 Thread Roger Dingledine
On Tue, Mar 18, 2014 at 05:02:07PM -0400, Tora Tora Tora wrote: Declining dramatically https://atlas.torproject.org/#details/90743CFA1B93295B9334CC0C625D22990AABA25F vs https://atlas.torproject.org/#details/CC2F7C6ED12B67CB3882B98213E02DEF2CB82293 that is holding steady A fine

Re: [tor-relays] Tor relay setup

2014-03-23 Thread Roger Dingledine
On Sat, Mar 15, 2014 at 08:46:44PM +, eugene zhukovsky wrote: I am trying to setup Tor relaying, but it doesn't work so far. Windows 8, private vpn. I opened ports 80,443,9001 and 9030 (both TCP and UDP) on my Comcast router to be forwarded to the box I'm trying to configure. I added

Re: [tor-relays] new fingerprint after update

2014-03-22 Thread Roger Dingledine
On Sat, Mar 22, 2014 at 03:26:07PM +0100, Oliver Schönefeld wrote: i updated from Tor 0.2.3.25 (relay 266C0CADC79F802C554019887324A57332A1DA70) to Tor 0.2.4.21 yesterday and the relay fingerprint changed to 07E333A3B979C27739096C5B2EE10D7C8E3D8FFD.

Re: [tor-relays] Best price/efficiency ratio

2014-03-22 Thread Roger Dingledine
On Sat, Mar 22, 2014 at 10:33:01PM +0100, Rick Ross wrote: Question how long you'll stay in the Top 50. Maybe you are lucky but probably the ISP will end your contract for abusing fair use policies/TOS. Best case they'll throttle you down. Let us know in 30 days :) Or maybe more than 30 days

Re: [tor-relays] External connections to port 9050

2014-02-28 Thread Roger Dingledine
On Fri, Feb 28, 2014 at 09:22:10AM -0600, Greg W wrote: Roger, You've confirmed my thoughts. I suspected that some people were bulk scanning relays/exits looking for open proxies too which is why I was curious if any other operators were seeing this. Thus far today I've got 175,000

Re: [tor-relays] External connections to port 9050

2014-02-27 Thread Roger Dingledine
On Thu, Feb 27, 2014 at 11:39:55PM +0100, Jeroen Massar wrote: On 2014-02-27 23:12, Greg W wrote: I turned on some logging on my firewall today to help troubleshoot and issue and noticed a load of connections from external addresses to port 9050 on my exit node. I don't think that should be

Re: [tor-relays] (no subject)

2014-02-24 Thread Roger Dingledine
On Tue, Feb 25, 2014 at 10:15:11AM +1100, Zenaan Harkness wrote: I'm on Debian and did a service tor reload (not restart) and tor crashed! I didn't realise immediately, took may be a minute to realise and restart. Anyway apologies to any connections that were going through this relay.

Re: [tor-relays] Considering setting up an exit, need advice

2014-01-31 Thread Roger Dingledine
On Fri, Jan 31, 2014 at 01:22:47AM -0700, Jesse Victors wrote: Thanks again guys for the help. usuexit is now online, and should be functioning properly, but there seem to be a few mystifying issues: 1) TorStatus marks it as hibernating which it clearly isn't; it's online and accepting

Re: [tor-relays] 0.2.4.20 logging duplicate messages

2014-01-28 Thread Roger Dingledine
On Tue, Jan 28, 2014 at 03:10:57AM -0600, Scott Bennett wrote: Along with my recent OS upgrade I have also updated my tor relay from 0.2.4.3-alpha to 0.2.4.20. The latter version write two identical copies of every message to the log file. I have only one uncommented Log line in my

Re: [tor-relays] which browser for BSD systems?

2014-01-28 Thread Roger Dingledine
On Tue, Jan 28, 2014 at 06:34:49AM -0600, Scott Bennett wrote: Assuming that the tor browser is still a fork off of firefox from a few years ago, then I'd still like to build it using local tuning. firefox is such a CPU hog that I'd really like to get the most out of compiler

Re: [tor-relays] bandwidth authority algorithm is cracked

2014-01-22 Thread Roger Dingledine
On Wed, Jan 22, 2014 at 02:33:21PM -0500, Roger Dingledine wrote: The consensus weight is computed using a) the relay's self-advertised bandwidth in its descriptor: https://gitweb.torproject.org/torspec.git/blob/HEAD:/dir-spec.txt#l389 b) the ratios of bandwidth weights for various types

Re: [tor-relays] bandwidth authority algorithm is cracked

2014-01-22 Thread Roger Dingledine
On Wed, Jan 22, 2014 at 01:02:29PM -0500, starlight.201...@binnacle.cx wrote: Also keep in mind that what the bandwidth authorities actually measure is not total capacity but spare stream capacity (by downloading large files through at least 5 different two hop circuits times for each relay).

Re: [tor-relays] bandwith unit

2013-12-17 Thread Roger Dingledine
On Tue, Dec 17, 2013 at 02:10:21PM +0100, Kiss Gabor (Bitman) wrote: Another possiblity: Advertised Bandwith in Globe shows not the limit but my actual traffic. That is incidentally 1/8 of the maximum. :-) I think that's it. See also

Re: [tor-relays] Relay / Bridge

2013-12-08 Thread Roger Dingledine
On Sun, Dec 01, 2013 at 10:32:09PM +0100, Sebastian Urbach wrote: Your system is now lsted: ec2bridgerocks001 https://atlas.torproject.org/#details/50855F45464DBE84E917B0ED74E2144E785BA024 It appears that you're running a *relay* on EC2? With a nickname implying that you think it's a

Re: [tor-relays] Relay - Conflicting data (Atlas != log)

2013-12-02 Thread Roger Dingledine
On Tue, Dec 03, 2013 at 11:08:48AM +1100, Mark Jamsek wrote: Dec 02 15:49:34.000 [notice] Now checking whether ORPort 110.146.133.98:9001 and DirPort 110.146.133.98:9030 are reachable... (this may take up to 20 minutes -- [snip] Apart from the DNS hijacking entry(?), Tor is apparently up and

Re: [tor-relays] Proper bandwidth units [was: Exit nodes on Gandi]

2013-11-17 Thread Roger Dingledine
On Mon, Nov 18, 2013 at 12:14:15AM -0500, grarpamp wrote: People, can we please mind using the proper units. I know Tor doesn't make it easy because Tor itself incorrectly uses Bytes. But Tor is a network application, and real network apps are measured in 'bits per second' I understand your

Re: [tor-relays] hourly logging new?

2013-11-10 Thread Roger Dingledine
On Sun, Nov 10, 2013 at 09:58:20PM -0500, gq wrote: On the Message Log console I was seeing hourly entries for TAP and nTor connections. Yep. After over a week, I was getting very low traffic, so rolled back to the stable version vidalia-relay-bundle-0.2.3.25-0.2.21-2.exe to compare, trying

Re: [tor-relays] Amazon abuse report

2013-10-31 Thread Roger Dingledine
On Thu, Oct 31, 2013 at 06:12:47PM -0700, Andy Isaacson wrote: That's correct, it takes a deliberate action on the part of the administrator to become a relay; and another deliberate action to become an exit relay. Actually, that second part isn't true. Once you decide to become a relay, the

Re: [tor-relays] max TCP interruption before Tor circuit teardown?

2013-10-27 Thread Roger Dingledine
On Sun, Oct 20, 2013 at 09:42:01AM -0700, Gordon Morehouse wrote: With the slower computers, sometimes too many attempts to connect to the ORPort (I am almost positive as part of TAP circuit building, but not *really* sure) can eventually cause Tor to consume more physmem than available and

Re: [tor-relays] Thanks for the advice on handling DMCA complaints.

2013-10-25 Thread Roger Dingledine
On Fri, Oct 25, 2013 at 11:03:27AM -0400, Christopher Jones wrote: I just wanted to thank the list members for giving me some great advice on working with my ISP to deal with the DMCA nastygrams. I restricted my exit policy to allow most legitimate TCP services and block the rest, which should

Re: [tor-relays] Advice on dealing with ISP's response to DMCA takedown notice.

2013-10-24 Thread Roger Dingledine
On Thu, Oct 24, 2013 at 09:10:15PM -0400, Christopher Jones wrote: Suggestions are welcome. I?m running with the default exit node policy, which should block most of the abuse-laden ports. BitTorrent?s a little harder to deal with. I?ve no qualms working with the ISP to mitigate their concerns,

Re: [tor-relays] My Relay speed has dropped nearly to zero - Why?

2013-10-22 Thread Roger Dingledine
On Sun, Oct 20, 2013 at 11:08:52AM -0700, Moritz Bartl wrote: The current routing algorithm is not utilizing low-bandwidth relays as well as it should. This is a known problem but difficult to solve. If you can provide below 10 Mbit/s, it might be better for now to go with a bridge instead

Re: [tor-relays] Botnet issues and upgrading to 0.2.4.x

2013-10-14 Thread Roger Dingledine
On Mon, Oct 14, 2013 at 08:26:52PM +0100, Chris Whittleston wrote: So I just started running a non-exit relay on a Raspberry Pi, and have hit a problem where it seems huge numbers of circuits are being created which overwhelms the system and can cause tor to crash. I read here (

Re: [tor-relays] Botnet issues and upgrading to 0.2.4.x

2013-10-14 Thread Roger Dingledine
On Mon, Oct 14, 2013 at 08:36:58PM +0100, Chris Whittleston wrote: Aha - makes sense, I'll just build it myself. Thanks for the quick response. So - the new handshake in 0.2.4.x doesn't help with the ongoing issues? On that page I linked it was suggested it might... It does help! It helps

<    1   2   3   4   5   >