Re: [tor-relays] DoS attack on Tor exit relay

Subject: Re: [tor-relays] DoS attack on Tor exit relay

From: David Poulsen <atuaruk@xxxxxxxxxxxxxx>

Date: Wed, 31 Jul 2019 19:30:21 +0000

Delivery-date: Wed, 31 Jul 2019 19:47:38 -0400

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=protonmail.com; s=default; t=1564601425; bh=3+M8baP1lBRNhTBIQo3kcjP7AjNfrQq5vz8Yz1FpLww=; h=Date:To:From:Reply-To:Subject:In-Reply-To:References:Feedback-ID: From; b=MvxPOY5oi0VHPPtCpfPXsYnH7SCcpSHxAvtiqRFjk9Ir5ijHtAYDe+sYAtvRvWVVc 3uim/RD14QY4cLmQiPuka1gFKJhXOOnZ9DPhJnnjMT42wC0onWl43jkuSszgwl6gL4 iWbBrUwhcj0Sw2J2Tv90i6fFPWDwtYDGSCsMP0r0=

Feedback-id: gmw5r1FkdynJ_87JQzm46Ygoj3kbUQNdtRv3V7IubO67AtR7LhljmPuY6r1OLJLB-ZL7F0bmGc96r8pqahzQDQ==:Ext:ProtonMail

In-reply-to: <3b45bceb-0db8-515f-0806-148155ac54af@cni.net>

List-archive: <http://lists.torproject.org/pipermail/tor-relays/>

List-help: <mailto:tor-relays-request@lists.torproject.org?subject=help>

List-id: "support and questions about running Tor relays \(exit, non-exit, bridge\)" <tor-relays.lists.torproject.org>

List-post: <mailto:tor-relays@lists.torproject.org>

List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=subscribe>

List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=unsubscribe>

References: <UCE2yOt3j5aVTKaJNFoM9zhqsvt93YoNeLjkIikW0wbIss4q3eZeMxooQ-GurcRxzXBfd9__N7zkVabJolStsSMtsJTGYhndBppvd-SmDog=@protonmail.com> <34D35ED9-6575-4252-B978-D5B17C62B86B@linux-hus.dk> <3b45bceb-0db8-515f-0806-148155ac54af@cni.net>

Reply-to: tor-relays@xxxxxxxxxxxxxxxxxxxx

Sender: "tor-relays" <tor-relays-bounces@xxxxxxxxxxxxxxxxxxxx>

Yes, I have fail2ban installed but the attack is focused on my ORPort 9001. Similarly, I have an external firewall but it permits 9001 port passage.

Thanks for the thoughts, though, --potlatch

On 7/31/2019 2:40 AM, TorGate wrote:

You can install failtoban, have you a extern firewall ?

Am 31.07.2019 um 05:14 schrieb potlatch <potlatch@xxxxxxxxxxxxxx>:

Hello Tor users,

Help me with a problem please. I have a small exit/backup & directory VPS in Finland [1]. This last week the server (and Tor) have been overwhelmed with non-Tor IP addresses. This may be a small version of a DoS attack. I took the server down for a few days but when I restarted it the attack was there before Tor users. Eventually, the load caused kernal crash.

I noticed this last week, that my Consensus Weight had dropped from 5500 to 68.

Does anyone have an efficient way to defeat this ongoing attack?

--potlatch

[1] 9B31F1F1C1554F9FFB3455911F82E818EF7C7883 TorExitFinland

Sent with ProtonMail Secure Email.

_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

--
1. When a distinguished but elderly scientist states that something is possible, he is almost certainly right. When he states that something is impossible, he is very probably wrong. 2. The only way of discovering the limits of the possible is to venture a little way past them into the impossible. 3. Any sufficiently advanced technology is indistinguishable from magic. - Arthur C. Clarke

_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

References:
- [tor-relays] DoS attack on Tor exit relay
  - From: potlatch
- Re: [tor-relays] DoS attack on Tor exit relay
  - From: TorGate
- Re: [tor-relays] DoS attack on Tor exit relay
  - From: Larry Brandt

Prev by Author: Re: [tor-relays] Question about Bridges Bandwidth Authority
Next by Author: Re: [tor-relays] Unutilized bandwidth
Previous by thread: Re: [tor-relays] DoS attack on Tor exit relay
Index(es):
- Author
- Thread