Hot answers tagged

13

Install Tor package: # apt-get install -y tor Create different data dirs: # mkdir /usr/local/var/lib/tor{1,2,3} Create as many as you want(have different IP Addresses) different configuration files: For example 3: 1st # cat > /usr/local/etc/torrc1 << EOF SocksPort 9051 Log notice file /usr/local/var/log/tor/notices1.log RunAsDaemon 1 ...


13

The short answer is: Yes. All bandwidth is helpful. The long answer is: Sortof. At first your relay is more or less untrusted. For the first 3 days or so it is in the 'unmeasured' phase (roughly no use). If your relays are going to be up for less than 3 days, they probably don't do much good. On days 3–8 your load slowly ramps up; so it's probably okay to ...


13

Increasing the number of hops in a Tor circuit has various impacts : Performance is decreased since the path is longer and latency is bigger. A bigger path is also less reliable and more failures will occur. The same goes for Throughput of the circuit. Throughput is better when having three hops. Anonymity is not enhanced as a matter of fact. Increasing ...


13

I believe that all of your questions can be answered by explaining the underlying threat when running any relay on the same Tor as a hidden service: Relays publish bandwidth information about their usage and availability to enable the Tor network to efficiently route traffic and provide bandwidth where it is needed. Given that I see bandwidth information ...


13

The easiest way is to emulate the network, such as with ExperimenTor (which uses virtual machines) or Shadow (which uses a discrete event simulator). With Shadow (which I have more experience with), a 20 node network should fit in 4 GB of RAM such as on a Amazon EC2 m1.large server. Another option is Chutney, which is simpler than either ExperimenTor or ...


13

Tor is supposed to work in this way. Former versions of Tor built a complete new circuit every time. However some researcher found out that a so-called service location attack is possible. So the Tor Project changed the design in a way that defends this kind of attack. The defense is that the first relay in a circuit stays the same for some period of time. ...


12

Running a guard node (aka an entry node) is safe for the person running it. The reason there aren't as many of them is because there are certain criteria that must be met before your relay can be used as a guard node: The relay needs to have first appeared longer ago than 12.5% of the relays, or 8 days ago, whichever is shorter. The relay needs to advertise ...


12

So I discovered there are some decent one-liner descriptions written in the dir-spec.txt after all. I propose I yoink these verbatim: "Authority" if the router is a directory authority. "BadExit" if the router is believed to be useless as an exit node (because its ISP censors it, because it is behind a restrictive proxy, or for some similar reason). "...


11

Yes, it is possible (through a source-code change), but it is a bad idea. If an attacker is observing (or controls) the first and last hop of your circuit they will very likely be able to de-anonymize you. Changing to four (or more) hop paths doesn't affect the probability of this occurring but it does slow down your Tor connection and increases the load on ...


11

Tor uses fixed cell sizes. The design document states: Traffic passes along these connections in fixed-size cells. Each cell is 512 bytes, and consists of a header and a payload. Apart from that no further mixing or randomisation is used: No mixing, padding, or traffic shaping (yet): Onion Routing originally called for batching and reordering cells as ...


11

Yes. The Tor program caches its directory information -- and it does it the same way inside TBB as it does in, say, the Tor debian package. You can see the files in Data/Tor/ in your tor-browser directory. These files are documented in the Tor man page, under the "FILES" section towards the end. The most interesting two for Tor 0.2.3.x and 0.2.4.x are: ...


9

It used to be manually assigned by the authority operators, but a couple of years ago I wrote a set of scripts to vote on Named automatically. We have documented their behavior in dir-spec: Newer Naming authorities run a script that registers routers in their mapping files once the routers have been online at least two weeks, no other router has that ...


8

There's no point to running multiple instances on a single machine. In fact, it's dangerous. If you fail to set family properly, and the IP's you've got are on different sub-nets (or the user has their torrc configured to allow multiple nodes on the same sub-net for some reason), it's possible (though not likely) that a user would build a circuit using two ...


8

This has been described in details in the phase three of The lifecycle of a new relay. Your new relay has to be stable (up and running for at least 8 days), and have a minimum bandwidth of 250KB/s to receive a guard flag and become an entry node. Here I quote from Tor spec: A router is a possible 'Guard' if its Weighted Fractional Uptime is at least ...


8

There's a good break-down of most of these at https://github.com/torproject/torspec/blob/master/dir-spec.txt It doesn't cover your full list, but the ones it does cover are very clearly explained: Authority A router is called an ‘Authority’ if the authority generating the network-status document believes it is an authority Exit A router ...


8

Maybe think of it as a defense in depth idea. If you only have two hops, and your adversary owns or watched your exit node, they immediately know which other node to compromise to get you. That single node is a particularly high-value target since you'll be using your guard node for a while, so maybe it's worth investing some resources to be able to watch ...


8

The blog post »The lifecycle of a new relay« is helpful for your question: A new relay, assuming it is reliable and has plenty of bandwidth, goes through four phases: the unmeasured phase (days 0-3) where it gets roughly no use, the remote-measurement phase (days 3-8) where load starts to increase, the ramp-up guard phase (days 8-68) where load ...


8

The circuit: [ Tor user <-> Guard node <-> Middle node <-> Exit node <-> Server ] Sending data to server: The Tor client always encrypt the data for the exit node And then encrypts it again (another layer) for the middle node And then again (yet another layer) for the guard node This way one layer need to be peeled of at each hop in the ...


7

The Tor community maintains a list of ISPs that have worked for others in the past along with some comments of people's experiencs working with each service. That list is here: https://trac.torproject.org/projects/tor/wiki/doc/GoodBadISPs The Bitcoin wiki maintains a list of VPS providers that accept payment in Bticoin. This does not mean that they are ...


7

In addition to Sam Whited's answer, short-term bridges are mostly useless. They'd be better off as normal relays. Bridges are generally handed out by the Tor Project on a small scale. So the address may not be given out to someone in need for quite a while. Especially as they try to ration new bridges so that they go unblocked for as long as possible. Of ...


7

You can use ExoneraTor, a tool by Tor Project designed for that work. Of course you should also contact a lawyer with some affinity on Internet laws so as to handle better your case. If you're located in USA you could contact EFF, a non-profit which actively and legally supports digital rights. If you're in Europe, people of Torservers could give you some ...


7

Just install Tor on the new server and then copy over your torrc file and the files from the Tor data directory on the old server: https://www.torproject.org/docs/faq.html.en#UpgradeOrMove The data directory is in different locations depending on your OS. On Linux it's located at: /var/lib/tor. You can skip the "cached-" files, copying them can cause some ...


7

As of today, the highest performing Tor node is pushing about 30 MB/s so if you are looking for tips, I'd suggest trying to match what the fastest Tor nodes are doing. Firstly, choose a good platform. Linux works well, as does FreeBSD. Avoid Windows; while it is possible to get good performance out of Windows it requires a very different programming style ...


7

From the Tor directory specification (emphasis added): Named – Directory authority administrators may decide to support name binding. If they do, then they must maintain a file of nickname-to-identity-key mappings, and try to keep this file consistent with other directory authorities. If they don't, they act as clients, and report ...


7

The main problem seems the port you are using. According to your command you're using port 9150 which is used by Tor Browser Bundle. If the bundle is closed, this port is not open. In the default configuration Tor uses port 9050 as SocksPort: curl --socks5-hostname 127.0.0.1:9050 https://www.torproject.org/ or curl -x socks5h://127.0.0.1:9050/ https://...


7

I would think a bridge could be considered a private relay. You can even setup the bridge so it is not broadcast to the bridge authority. In that setup you would be the only person able to give out access to the bridge, so if you wanted you could keep it private to just yourself. General info on bridges: https://www.torproject.org/docs/bridges.html.en ...


6

Email information is publicly available so you'd better use a special email address for your relay. Either set up a fresh one (optionally via Tor) or check if your email provider gives the opportunity to set up email aliases. This way you can handle better spam bots. Email contact is useful in case someone wants to reach you and in general is the kindest ...


6

No, it won't hurt your anonymity and there are no other implications (unless you're severely bandwidth or CPU constrained). Obviously running a relay requires a bit more bandwidth and Tor can be a bit of a CPU hog but any semi-modern processor should be able to handle the extra load fine. I should note that running a public relay does let people know that ...


6

Did you open the DirPort on your relay? That would make your relay a directory mirror which answers directory requests of clients. A directory request is typically quite small ("please give me the current consensus"), but the response can be quite big ("here is the list of the 4400 currently running relays"). That would explain the difference between sent ...


6

You can look up your own relay on Atlas and check your Exit Policy and flags. And yes, rejecting everything, like you do, makes you a non-exit.


Only top voted, non community-wiki answers of a minimum length are eligible