Slicehost: Setting up a Tor relay on Fedora to help keep Iran connected #IranElection

As many of you know, most of the information from within Iran is coming from on-the-ground new-media and social networking sites such as Twitter, YouTube, and Facebook. This is happening despite crackdowns on communications networks by the Iranian government. The way this information is able to escape the firewalls of Iran is via proxies which relay and “hide” the destination of the communications so that it becomes difficult to block. This allows those on the ground in Iran to communicate with the world instantly and effectively, without fear of government crackdown. But it is a constant arms race. As soon as a relay becomes known by the Iranian government it gets shut down. The only way to keep the lines of communication open are to strengthen the distributed Tor network by adding more relays and bridges, making it more difficult for the Iranian government to block them all.

There have already been great write-ups on how you can contribute to the distributed proxy network Tor:
http://anonygreen.wordpress.com/2009/06/18/how-to-setup-a-tor-relay-or-tor-bridge/
http://smokingfish.blogspot.com/2009/06/brief-introduction-to-tor-and-why-its.html

Please read over those documents for an overview. I wanted to provide detailed instructions on how to get a Tor network set up quickly, easily, and cheaply for those of you who would like to contribute. You can provide invaluable assistance to the people of Iran for as little as 15 minutes of your time and $20/month.

First off, this document assumes you have some system administration knowledge with Linux (Fedora) and are comfortable installing and configuring packages from the command line. If that’s you, you can have a Tor relay up and running in about 15 minutes.

Key:
Shell commands are in purple
Config file settings are in blue

  1. Register at Slicehost

    Slicehost is a VPS provider that allows you to quickly build/deploy webservers very cheaply. Sign up here and purchase the cheapest $20 slice to get started. Pick Fedora 10 as your Linux Distribution. Do not pick Fedora 11, as it is incompatible with the current version of Tor. Once you are registered, Slicehost will email you your IP and root password. It can take a few minutes to build your new slice, so be patient.

  2. Slice Security

    Log in to your new slice. Please note that this document covers the bare minimum of commands to get Tor up and running. You should follow due diligence when it comes to securing your new slice, something which is outside the scope of this document. Common practice security configurations are recommended. Security is your own responsibility, and I will not be held liable for any security issues with your slice. There are a few bare-minimum security things you should do to your slice:

    Change the root password:
        passwd root

    Create your own account & set password:
        adduser yourusername
        passwd yourusername

    Disable root login to ssh
        vim /etc/ssh/sshd_config
        Change to this: PermitRootLogin no
        service sshd restart

    These steps are the BARE MINIMUM you should do to secure your slice.

  3. Update Your System

    yum -y update

  4. Install Prerequisites

    yum install wget vim-enhanced gcc make libevent libevent-devel openssl openssl-devel zlib zlib-devel rpm-build

  5. Download Tor & Signature


    wget https://www.torproject.org/dist/rpm/tor-0.2.1.16.rc-tor.0.fc10.src.rpm
    wget https://www.torproject.org/dist/rpm/tor-0.2.1.16.rc-tor.0.fc10.src.rpm.asc

  6. Verify Packages

    Follow directions at http://www.torproject.org/verifying-signatures.html.en to verify that you have an authentic RPM and not a fake.

  7. Build & Install Tor


    rpmbuild --rebuild tor-0.2.1.16.rc-tor.0.fc10.src.rpm
    rpm -i rpmbuild/RPMS/x86_64/tor-0.2.1.16.rc-tor.0.fc10.x86_64.rpm

  8. Configure Tor

    vim /etc/tor/torrc

    Change the following settings, substituting your own values for Nickname and Address:

    DataDirectory /var/lib/tor
    ORPort 9001
    DirPort 9030
    Nickname YOUR_NICKNAME
    Address YOUR.IP.ADDRESS.XX

    Save & Exit

  9. Set Bandwidth Limits for Tor

    These settings are largely dependent on which slice you have purchased. The ones you see below are for a 20GB slice, and they allow 2GB of transfer per day, so you should be well within the 20GB slice limit of 100GB/month. If you have purchased a larger slice, these settings can be increased accordingly. Be careful here, incorrect settings can push you over your monthly bandwidth limit very quickly! I did over 12GB of transfer in a little over 8 hours before limiting bandwidth with these settings.

    vim /etc/tor/torrc

    RelayBandwidthRate 64 KBytes
    RelayBandwidthBurst 128 KBytes
    AccountingStart day 12:00
    AccountingMax 2 GB

    Save & Exit. The AccountingStart and AccountingMax settings will limit 2GB max transfer per day, resetting at 12:00 every day. The RelayBandwidthRate and RelayBandwidthBurst settings throttle the bandwidth so that you don’t reach AccountingMax after only a few hours. Normally AccountingStart and AccountingMax would be enough to stay within your bandwidth limits, but I want my relay to be available all day rather than reaching AccountingMax and shutting down after a few hours.

  10. Configure Your Firewall

    iptables-save > /etc/sysconfig/iptables.default
    iptables-save > /etc/sysconfig/iptables.test
    vim /etc/sysconfig/iptables.test

    Insert the following settings:

    # tor ORPort & DirPort
    -A INPUT -p tcp –dport 9001 -j ACCEPT
    -A INPUT -p tcp –dport 9030 -j ACCEPT


    # tor Allow all outbound traffic
    -A OUTPUT -j ACCEPT

    Save & Exit.

    iptables-restore < /etc/sysconfig/iptables.test iptables -L     (verify the rules are correct)
    iptables-save > /etc/sysconfig/iptables

  11. Increase the number of open file descriptors

    vim /etc/security/limits.conf

    Add this line:

    _tor hard nofile 32768

    Save & Exit

  12. Start up the Tor Service

    service tor start

    13. If everything starts correctly, you should see output like this:
    Starting tor: Jun 21 15:44:04.219 [notice] Tor v0.2.1.15-rc. This is experimental software. Do not rely on it for strong anonymity. (Running on Linux x86_64)
    Jun 21 15:44:04.219 [notice] Your ContactInfo config option is not set. Please consider setting it, so we can contact you if your server is misconfigured or something else goes wrong.
    Jun 21 15:44:04.223 [notice] Initialized libevent version 1.4.5-stable using method epoll. Good.
    Jun 21 15:44:04.223 [notice] Opening OR listener on 0.0.0.0:9001
    Jun 21 15:44:04.223 [notice] Opening Directory listener on 0.0.0.0:9030
    Jun 21 15:44:04.223 [notice] Opening Socks listener on 127.0.0.1:9050
    /usr/bin/torctl start: tor started [ OK ]

    Also, you should view the tor.log and verify that you see the following (after 20-minutes):

    cat /var/log/tor/tor.log

    Jun 21 15:44:13.835 [notice] Tor has successfully opened a circuit. Looks like client functionality is working.
    Jun 21 15:44:13.835 [notice] Bootstrapped 100%: Done.
    Jun 21 15:44:13.835 [notice] Now checking whether ORPort XXX.XXX.XXX.XXX:9001 and DirPort XXX.XXX.XXX.XXX:9030 are reachable.. (this may take up to 20 minutes -- look for log messages indicating success)
    Jun 21 15:44:18.492 [notice] Self-testing indicates your DirPort is reachable from the outside. Excellent.
    Jun 21 15:44:18.492 [notice] Not advertising DirPort (Reason: AccountingMax enabled)
    Jun 21 15:44:26.804 [notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor.
    Jun 21 15:44:43.813 [notice] Performing bandwidth self-test.. done.

    If you see some errors or it doesn’t start correctly, post in the comments and I’ll see if I can help you out. Here are some references to help you get it going:
    http://www.torproject.org/docs/tor-doc-unix.html.en#installing
    http://www.torproject.org/docs/tor-doc-relay.html.en

That’s it! You now have a fully functioning Tor Relay and are helping the Iranian people get news and information out to the rest of the world. The cool thing about Slicehost is that you can easily upgrade your Slice with the click of a button to allow more bandwidth, RAM, and other resources. They also have a Clone option so that once you have your initial Tor slice running, you can clone it multiple times so that you can have multiple Tor servers at a time.

More good reads on Tor and its effect in Iran:
http://blog.torproject.org/blog/measuring-tor-and-iran
http://p10.hostingprod.com/@spyblog.org.uk/blog/2009/06/tor-relays-and-exit-nodes-for-iran-and-for-the-rest-of-us.html

Update 1 – Preventing Abuse by BitTorrent Users

A couple of days after setting up my Tor slice, I received a Digital Millennium Copyright Act (“DMCA”) notice that my relay was hosting copyrighted material and that I would be required to remove it or face having my Slice shut down. Turns out that there are people out there using BitTorrent over the Tor network to transfer copyrighted material. Philosophical debates about BitTorrent and copyright law aside, the whole reason why I am running Tor is to help those in Iran stay connected — not to assist in the distribution of copyrighted material. So, after a few minutes of research, I found out we can prevent Tor being used by BitTorrent by adjusting your ExitPolicy:

vim /etc/tor/torrc

Add the following:
ExitPolicy reject *:1214
ExitPolicy reject *:4661-4666
ExitPolicy reject *:6346-6429
ExitPolicy reject *:6881-6999

Save & Exit
Restart Tor: service tor restart

You should also probably follow the advice at http://blog.torproject.org/blog/tips-running-exit-node-minimal-harassment

References:
http://www.torproject.org/faq.html.en#ExitPolicies – Exit Policies in Tor
https://www.torproject.org/eff/tor-dmca-response.html – DCMA Response Template
http://www.orient-lodge.com/node/3622?dsq=11687593 – A Slicehost user who also received a DCMA notice
http://www.chrisbrunner.com/?p=119 – Why You Shouldn’t Run BitTorrent Over Tor

Update 2 – Slicehost Responds

After making the adjustments above, I notified Slicehost of my changes and they have responded:
Thank you for your response. We will go ahead and consider this matter resolved. Thank you for your attention to this matter.
Gotta give them credit for understanding that we’re trying to help people in Iran — not to pirate movies. Thanks Slicehost!

Update 3 – Upgraded to 0.2.1.16 & Config Adjustments

I received some configuration recommendations from Andrew Lewman of The Tor Project, and have updated the steps above accordingly.

|         

Politics is Hockey

Hockey = Politics So it’s been about 5 days since McCain’s announcement of Sarah Palin as his VP candidate, and the majority of pundits, bloggers, and even myself still aren’t quite sure what to think about it. This could be due to the fact that she is holed up in a bunker avoiding answering questions about her positions and beliefs, but that’s OK, there is plenty of red meat to drive speculation.

As a junkie of both politics and hockey, I couldn’t have been happier coming across this post at the wonderful Five Thirty Eight blog that really ties everything together about the current state of the election by using a brilliant hockey analogy:

In the hockey analogy, Palin wouldn’t get within a thousand miles of an NHL All-Star Game because she’s not a scoring talent. She’s a role player, an emotion-rouser. Emotion messes with the chalkboard-drawn game plan and thus achieves a specific strategic objective. She can make game-changing agitation plays that rouse her home team and provoke the other side into counterattacks that – 100% of the time – end up punishing the team who hits back. Democrats would be smart to understand her as such, and I see a lot of reaction that doesn’t seem to grasp what Palin is doing and the value she’s providing. I see a lot of Democrats taking a lot of bait.

So what mold of hockey agitator does she fit into? Is she Esa Tikkanen, the Oiler’s agitator who trash-talked in three languages and opened up the ice for Gretzky and Kurri to dominate the opponent? Or is she Sean Avery, the annoying, victim-card playing, whiny little bitch who does nothing but piss off the opponent and bring glee to the home team? Will she drop the gloves and back up her trash talk with her fists, or will she simply wave her stick in the goalie’s face in a annoying fit of desperation? (Remember, though, that the Rangers scored after Avery got on Brodeur’s nerves – mission accomplished). Will the fracas stay between the enforcers, or will we see a bench clearing brawl? Only time will tell, but so far she’s acting like a Sean Avery — starting some shit, then turtling and hiding behind her teammates when it comes time to pay the piper.

What role does McCain play in this analogy? 538 says:

In the end a great hockey agitator who rouses both sides emotionally (and successfully gets the other team to lose focus) still needs the home team scoring talent to come through. Successful agitator Kris Draper of the Detroit Red Wings had the clutch Steve Yzerman for a lot of years. That worked. Detroit won Cups. They had parades.

So is McCain the Yzerman to Palin’s Draper? I doubt it. To me, McCain seems like the past-his-prime 45-year-old veteran hanging on to his legacy while attempting one last time to raise the Cup before retiring. Think Chris Chelios without the Cups. Or maybe he is Ray Bourque, traded to the other team in order to give him a chance at the Cup before retirement. I only hope that the Bourque analogy doesn’t play out,

There is plenty more political hockey goodness in the post at 538.com, so make sure to read it if you are a fan of either hockey, politics, or both.

Or maybe this is just an excuse for me to post some YouTube hockey videos. 🙂

|     

Immigration & The Bible – Leviticus comes back to haunt Conservatives

These days, religion and politics seem to be one in the same. The line has been blurred so much that I sure as hell don’t see a line any more. Most issues are constantly debated in terms of the Bible, whether its abortion (“life is sacred and granted by God”) or even the war in Iraq (“end of days” anyone?). As evangelicals have hijacked the GOP, they’ve installed a religious litmus test for candidacy: only the most pious may win. And the Democrats? Don’t vote for them, they’re a bunch of godless, druggie, homosexual, Mexican lovers. The GOP evangelicals often quote Bible passages to argue their points, the most obvious which is their stance on homosexuality. “Leviticus! Leviticus!” is the only evidence they use to argue that homosexuality is sin. Well, if we’re working under the assumption that the Bible is the law of the land, what about the part regarding immigrants, another hot-ticket wedge issue pimped by the GOP? Let us consult our trusty virtual Bible to find out…

Leviticus 19.33-34: When an alien resides with you in your land, you shall not oppress the alien. The alien who resides with you shall be to you as the citizen among you; you shall love the alien as yourself, for you were aliens in the land of Egypt: I am the Lord your God.

Or, the modern translation:

Leviticus 19.33-34: When the Mexicans are living in the USA, treat them with respect. Treat them as if they are an US citizen. You used to be an illegal alien too, you know. I’m the man!

Seems pretty obvious to me. If evangelicals followed the Bible as well as they claim, they’d be all about amnesty and helping out immigrants. Instead, we see the opposite: xenophobia, hatred, and racism. And yet the pundits still wonder why the GOP is bankrupt in more ways than one.

|