1

According to Tor's official website (https://www.torproject.org/docs/tor-doc-relay.html.en), to be a relay I only have to modify the 'torrc' file and add the following information:

 ORPort 443     Exitpolicy reject *: *     Nickname ididntedittheconfig     ContactInfo human @ ...

Okay. First question: But can I configure the "ORPort" field with any other port? Port 443 is used for default HTTPS communications; So Second question: does that mean that a person who is browsing by Tor on an HTTP web page (port 80 or 8080) will not be able to navigate through my relay?

Third question: Adding these parameters to the 'torrc' file, will I be an intermediate node only? Because I suppose to be an exit node the Exitpolicy field has to be configured with ports too, right? Example: ExitPolicy accept: *: 80, accept *: 110 Or has this changed?

Fourth question: This question is extremely curious. In an old example of the 'torrc' file (https://svn.torproject.org/svn/tor/tags/tor-0_0_9_5/src/config/torrc.sample.in) this was said:

################ This section is just for servers ##################### NOTE: If you enable these, you should consider mailing your identity. key fingerprint to the tor-ops, so we can add you to the list of servers that clients will trust. See the README for details.

In the example of the current 'torrc' file (https://gitweb.torproject.org/tor.git/tree/src/config/torrc.sample.in) this no longer appears. Why?

Also, in the Tor FAQ (https://www.torproject.org/docs/faq.html.en) there is a question that is NOT ACCESSIBLE. Specifically this question: "So I can just set a nickname and ORPort and join the network?"

However, on a non-torproject web page (https://archive.li/K3iJY#selection-1815.0-1815.203) this question still appears. And the answer is:

"Yes. But by default users will only use you for the middle hop of their circuits. To become more useful to the network, please send mail to the ops with your key fingerprint and contact information".

So, the question: To be an exit node, is it necessary to send an email to The Tor Project? I'm very confused...

Fifth question: I have read that once the file 'torrc' has been modified, the directory authorities must vote and approve the node. Is this still so? And in that case, who votes that a node is valid or not? A human administrator? Automatic software?

Next topic: I have read that to be an entry guard, I have to meet some requirements. Well, here are two questions:

1. Does the first node (or entry guard) to the Tor network know the IP of the Tor client? 2. I have read that to be an entry guard node it is necessary to have a good bandwidth and be a stable node. Who decides that I am prepared to be an input node? A human administrator, or software?

That's all by now. Thank you Tor Stacks volunteers. I'm learning a lot with you.

(Please forget my English; English is not my mother tongue).

4

But can I configure the "ORPort" field with any other port?

Yes. This is arbitrary, 443 can be useful for some users behind weak censorship or firewalls but ultimately the choice of port is entirely at the relay operators discretion.

does that mean that a person who is browsing by Tor on an HTTP web page (port 80 or 8080) will not be able to navigate through my relay?

No, the ORPort is only used by: Clients using you as an entry point and other relays. It has no impact on how Tor users could use you to route their traffic.

Adding these parameters to the 'torrc' file, will I be an intermediate node only?

Not only an itermediate node. If your policy specifies ExitPolicy reject *:* you will not be an exit. You may however be other nodes in the network, for example a guard, directory, introduction point or rendezvous point. Your suitability to fill these positions is decided by the client and the directory authorities.

In the example of the current 'torrc' file this no longer appears. Why?

That code an example configuration file are over a decade old. Tor has seen significant improvement since them.

there is a question that is NOT ACCESSIBLE.

Yup, that looks like a bug on the website. Content renamed, changed or removed but with the old link to it still intact. I've created a ticket for this, #21519.

To be an exit node, is it necessary to send an email to The Tor Project?

No. If you want to avoid confusion then don't read information that's over a decade old, read the current information.

who votes that a node is valid or not?

The directory authorities are directory servers, each votes and they together create a consensus. The votes are based on various aspects of your relays configuration and it's capacity. More details on this are available in dir-spec.txt, along with some of the changes made and the rationale for those changes. The consensus is distributed to all Tor clients, a break down of votes made and votes on what are also available at the consensus-health website.

Does the first node...know the IP of the Tor client?

Yes, by virtue of internetworking it must otherwise the client would have no means to connect to the guard and the guard no means to send the responses back to the client.

Who decides that I am prepared to be an input node?

Software, the directory authorities, by virtue of a human decision on suitable parameters. They are defined in the aforementioned dir-spec.txt.

  • 1/3 Thank you very much as always! However, a doubt: In the past a relay had to provide an e-mail. Okay. And was not this method safer? I explain: It is currently possible for the NSA to prepare many Tor nodes (in the end, nodes are voluntary, and this has advantages and disadvantages). – NewUser Feb 21 '17 at 10:49
  • 2/3 Imagine then that the NSA launches several nodes to the Tor network. These nodes have a high bandwidth (the NSA has much more budget and capacity than any user). Stable and bandwidth nodes are "privileged" by directory authorities. – NewUser Feb 21 '17 at 10:50
  • 3/3 Then, it is more possible to reward nodes of the NSA (in this example) than other nodes. However, if it were necessary to provide an email to The Tor Project to be a node, perhaps everything would be safer, right? – NewUser Feb 21 '17 at 10:50
  • @NewUser The NSA does not need to run nodes, they can already watch and intercept all traffic – user139336 Feb 21 '17 at 13:39
  • 1/2 I asked a question related to what you say. I know the NSA has the means to monitor submarine cables; In the end I came to the conclusion that although they can monitor the cables, actually if the user use Tor and the HTTPS protocol he/she is more or less safe. – NewUser Feb 21 '17 at 17:13
0

OK, so let's do it step-by-step!

But can I configure the "ORPort" field with any other port? Port 443 is used for default HTTPS communications;

Yes, you can choose whatever you wish from a free port list. But keep in mind if you will be launching Tor from unprivileged user from the very beginning, then you need to use port number greater than 1024(or 2048 on some OSes), also called as an unprivileged ports. But you better use 443. Why? Because if people are behind the too-strict firewalls, also called as "facist firewalls" in Tor docs, they do allow only a strict amount of ports on remote side to be accessed. If you will run a bridge, for example obfs3 or 4 - use it for bridge incoming port, otherwise use it as an ORPort, you will maximize your relay usability by improving it's "reachability" for other people.

So Second question: does that mean that a person who is browsing by Tor on an HTTP web page (port 80 or 8080) will not be able to navigate through my relay?

No, the ports for Tor itself are influentive only on the connectivity to the Tor network itself. Once "you're inn" - your requests are tunneled through Tor network by using Tor protocol and because of that fact it's completely unrelated. Your requests are packed into the crypto-onions that contain not just the request data but also a "destination address", i.e. host+port or hostname+port in case of hidden onion service.

Third question: Adding these parameters to the 'torrc' file, will I be an intermediate node only? Because I suppose to be an exit node the Exitpolicy field has to be configured with ports too, right? Example: ExitPolicy accept: *: 80, accept *: 110 Or has this changed?

Yes and no =) Tor nodes are basically all the same, the p2p nodes to be more specific. So unless you have specified ClientOnly 1 in your config - you're a full p2p node, a "middle node". They do have roles, that can also be referred as Flags, and roles are assigned differently. Some of them - like "Exit" and "V2dir" - are assigned only if configured by the user in the config of this very specific node. Others like Guard, Stable, HSDir, Fast - are assigned by network consensus. I do recommend you to add DirPort 80 to enable directory("V2Dir") functionality - it won't overload you at all and won't make traffic grow any sensible high, but it will make your node serve a signed cache copies of "Tor directories" that are responsible for network consensus. It will help a lot to all the nodes in your vicinity and in global scale. Some roles are disabling others, for example an "Exit" won't be used as a "Guard". If you're about to be an exit node - you need to explicitly enable via ExitPolicy accept xxx and ExitPolicy accept6 xxx for IPv4 and IPv6 respecitvely. And here is the trick: *:<port> means Any destination address to port. Don't try to be a censorship supporter and put there anything except an asterisk in host part. It's impossible, for example, to "reject all requests to Google to 443 port* - addresses are changing and you will overload your relay with rubbish. At the end always make a reject *:* and reject6 *:*(if you have IPv6).

Fourth question: This question is extremely curious. In an old example of the 'torrc' file (https://svn.torproject.org/svn/tor/tags/tor-0_0_9_5/src/config/torrc.sample.in) this was said:

########## This section is just for servers ##################### NOTE: If you enable these, you should consider mailing your identity. key fingerprint to the tor-ops, so we can add you to the list of servers that clients will trust. See the README for details.

In the example of the current 'torrc' file (https://gitweb.torproject.org/tor.git/tree/src/config/torrc.sample.in) this no longer appears. Why?

At the earlier days Tor - as all the software - was debugged, and this was needed to keep in touch with the people who were running some kind of functionality that was debugged and/or developed that particular moment. This is OK, for any software, not just Tor. Nowdays it's done and working properly so there's no need in it. That's why all the stuff about it was removed - it's obsolete. You don't need to email anyone and/or announce your contacts.

Fifth question: I have read that once the file 'torrc' has been modified, the directory authorities must vote and approve the node. Is this still so? And in that case, who votes that a node is valid or not? A human administrator? Automatic software?

Yes, network consensus and directories are making automatic voting possible, and that's how it should be. No human factor involved: it's the most mailfunctioning part in most of IT systems, the human factor...

  1. Does the first node (or entry guard) to the Tor network know the IP of the Tor client?

Yes it does, but it does not know what are you doing in/via Tor network. There's no risk, and in some "last resort" cases you can disable using entry guards by adding UseEntryGuards 0 in your config. But this is last resort ONLY method, you should not use it in normal case. To make it clear I'll describe such a last-resort case: you are behind a firewall that somehow syndicates the guard list and blocks access to these addresses on by-ip basis. So if you have "seeded" your instance of Tor in working connection and disabling the guards - you have a chance that the node will be used which is not blocked. Because the total node address pool is a quite a big to be blocked in a whole, and it's changing frequently - a "jailbreak" scenario here is the really last resort you have. In other cases do not disable it.

  1. I have read that to be an entry guard node it is necessary to have a good bandwidth and be a stable node. Who decides that I am prepared to be an input node? A human administrator, or software?

Actually - as my experience shows - you need a stable bandwidth and long-term-online node. 1Mibps is more than enough to become a guard and I think lesser speeds are too. But it must be stable. That makes a great sense: a guard's primary task is to be a gatekeeper, so it should be reachable, online when it's needed and it's connection should actually allow it to fullfill it's task(to let people in).

  • "So unless you have specified ClientOnly 1 in your config - you're a full p2p node, a "middle node"" Wrong. – cacahuatl Feb 22 '17 at 0:34
  • "If you're about to be an exit node - you need to explicitly enable" Wrong. – cacahuatl Feb 22 '17 at 0:35
  • "you can disable using entry guards by adding UseEntryGuards 0 in your config" Users should never do this, I've explained this to you before. This is never a good idea. A bridge is always a better choice. Stop telling people to do this, it is never the right choice. never. – cacahuatl Feb 22 '17 at 0:37
  • @canonizingironize read the warning near the subject. And yes - we do have different opinions on this matter. So stop yelling your "no/never" stuff every time. Would you be so kind to be more constructive? – Alexey Vesnin Feb 22 '17 at 13:21
  • Thank you very much. You said "Some roles are disabling others, for example an "Exit" won't be used as a "Guard" ". Does it mean that an exit node cannot act as an entry Guard at the same time? I ask this because from atlas.torproject.com I have seen some relays have "Exit flag" and "Guard flag" (like this relay: atlas.torproject.org/#details/…) So I do not know if a relay can be an entry guard and an exit relay. – NewUser Feb 22 '17 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.