Re: [tor-relays] Exit relay is apparently being used to attack other servers

[trillium]

Thanks all for the help. I think I may try to move the exit relay over to 
SolarVPS or another VPS. It’s just a bummer because the relay was advertising 
~6-7MB/s bandwidth and using a fair amount of it before people decided to use 
it for attacks, so I felt like I was contributing to the community.

-trillium
> On Jun 13, 2015, at 8:36 PM, I  wrote:
> 
> Trillium,
> 
> I hope this advances your knowledge.
> A couple of days ago one of my exits was threatened with suspension for being 
> 'blacklisted'.
> The VPS business gave me this (below) and was happy when I blocked the ports.
> It is more limiting of TOR but the exit survived.
> 
> " Listing on the Sectoor TOR DNSBL indicates that this IP address is a tor 
> node or a subnet (/24) containing a tor node. This listing does not indicate 
> that your IP address has been blacklisted by Sectoor, as this list also 
> contains subnets that contain a tor node. The subnet listing is not designed 
> to block connections, but rather for use as a scoring mechanism. Your IP will 
> only be blacklisted if it is the tor node itself and listed by Sectoor 
> Exitnodes.
> 
> Sectoor TOR DNSBL lists every IP address which is known to run a tor server 
> and allow their clients to connect to one of the following ports:
> 
>Port 25
>Port 194
>Port 465
>Port 587
>Port 994
>Port 6657
>Ports 6660-6670
>Port 6697
>Ports 7000-7005
>Port 7070
>Ports 8000-8004
>Port 9000
>Port 9001
>Port 9998
>Port 
> More information about SECTOOR can be found at their website: 
> http://www.sectoor.de/tor.php
> 
> Robert
> 
> 
> ___
> tor-relays mailing list
> tor-relays@lists.torproject.org
> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays



signature.asc
Description: Message signed with OpenPGP using GPGMail
___
tor-relays mailing list
tor-relays@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

[tor-relays] Exit relay is apparently being used to attack other servers

[trillium]

Hello,

I’m running an exit relay (fingerprint: 
5793CB9E1F5BAD3D5DA6C4158E16067D80CD8A2E) on a Linode VPS right now, and so far 
they’ve been really fantastic with dealing with a couple of DMCA notices that 
were sent to them. However, in the last week, I received notice from them that 
my server is attacking multiple sites around the web. Their suggestion was to 
go through my logs and remove the offending user, which is obviously unhelpful 
advice as I don’t keep any logs on my relay’s users.

I’d like to keep running the exit relay, but I’m not really sure how to best go 
about mitigating these sorts of threats and don’t want Linode to shut down the 
entire server.

Any suggestions are very much welcomed.

Thanks,
trillium


signature.asc
Description: Message signed with OpenPGP using GPGMail
___
tor-relays mailing list
tor-relays@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays