This is a Tor Exit Router

From 71f040014d900d636eeeda62c4bb7ea8ea84e309 Mon Sep 17 00:00:00 2001 From: drebs Date: Wed, 11 Jan 2012 01:33:12 -0200 Subject: many small fixes --- files/tor-exit-notice.html | 144 +++++++++++++++++++++++++++++++++++++++++++++ manifests/daemon.pp | 66 +++++++++++---------- templates/torrc.relay.erb | 2 +- 3 files changed, 181 insertions(+), 31 deletions(-) create mode 100644 files/tor-exit-notice.html diff --git a/files/tor-exit-notice.html b/files/tor-exit-notice.html new file mode 100644 index 0000000..de3be17 --- /dev/null +++ b/files/tor-exit-notice.html @@ -0,0 +1,144 @@ + + + + + +This is a Tor Exit Router + + + + + + +

This is a +Tor Exit Router

+ +

+Most likely you are accessing this website because you had some issue with +the traffic coming from this IP. This router is part of the Tor Anonymity Network, which is +dedicated to providing +privacy to people who need it most: average computer users. This +router IP should be generating no other traffic, unless it has been +compromised.

+ + + + +

+ + +

+ +

+Tor sees use by many +important segments of the population, including whistle blowers, +journalists, Chinese dissidents skirting the Great Firewall and oppressive +censorship, abuse victims, stalker targets, the US military, and law +enforcement, just to name a few. While Tor is not designed for malicious +computer users, it is true that they can use the network for malicious ends. +In reality however, the actual amount of abuse is quite low. This +is largely because criminals and hackers have significantly better access to +privacy and anonymity than do the regular users whom they prey upon. Criminals +can and do build, +sell, and trade far larger and more +powerful networks than Tor on a daily basis. Thus, in the mind of this +operator, the social need for easily accessible censorship-resistant private, +anonymous communication trumps the risk of unskilled bad actors, who are +almost always more easily uncovered by traditional police work than by +extensive monitoring and surveillance anyway.

+ +

+In terms of applicable law, the best way to understand Tor is to consider it a +network of routers operating as common carriers, much like the Internet +backbone. However, unlike the Internet backbone routers, Tor routers +explicitly do not contain identifiable routing information about the source of +a packet, and no single Tor node can determine both the origin and destination +of a given transmission.

+ +

+As such, there is little the operator of this router can do to help you track +the connection further. This router maintains no logs of any of the Tor +traffic, so there is little that can be done to trace either legitimate or +illegitimate traffic (or to filter one from the other). Attempts to +seize this router will accomplish nothing.

+ + + +

+Furthermore, this machine also serves as a carrier of email, which means that +its contents are further protected under the ECPA. 18 +USC 2707 explicitly allows for civil remedies ($1000/account +plus legal fees) +in the event of a seizure executed without good faith or probable cause (it +should be clear at this point that traffic with an originating IP address of +FIXME_DNS_NAME should not constitute probable cause to seize the +machine). Similar considerations exist for 1st amendment content on this +machine.

+ + + +

+If you are a representative of a company who feels that this router is being +used to violate the DMCA, please be aware that this machine does not host or +contain any illegal content. Also be aware that network infrastructure +maintainers are not liable for the type of content that passes over their +equipment, in accordance with DMCA +"safe harbor" provisions. In other words, you will have just as much luck +sending a takedown notice to the Internet backbone providers. Please consult +EFF's prepared +response for more information on this matter.

+ +

For more information, please consult the following documentation:

+ +

+That being said, if you still have a complaint about the router, you may +email the maintainer. If +complaints are related to a particular service that is being abused, I will +consider removing that service from my exit policy, which would prevent my +router from allowing that traffic to exit through it. I can only do this on an +IP+destination port basis, however. Common P2P ports are +already blocked.

+ +

+You also have the option of blocking this IP address and others on +the Tor network if you so desire. The Tor project provides a web service +to fetch a list of all IP addresses of Tor exit nodes that allow exiting to a +specified IP:port combination, and an official DNSRBL is also available to +determine if a given IP address is actually a Tor exit server. Please +be considerate +when using these options. It would be unfortunate to deny all Tor users access +to your site indefinitely simply because of a few bad apples.

+ + + diff --git a/manifests/daemon.pp b/manifests/daemon.pp index 80da4c7..ad84589 100644 --- a/manifests/daemon.pp +++ b/manifests/daemon.pp @@ -50,7 +50,7 @@ class tor::daemon inherits tor { } # tor configuration file - concatenated_file { '${config_file}': + concatenated_file { "${config_file}": dir => $spool_dir, header => "${spool_dir}/00.header" mode => 0600, @@ -59,10 +59,10 @@ class tor::daemon inherits tor { } # config file headers - file { '${spool_dir}/00.header': + file { "${spool_dir}/00.header": content => template('tor/header.erb'), - require => File['${spool_dir}'], - notify => Exec['concat_${config_file}'], + require => File["${spool_dir}"], + notify => Exec["concat_${config_file}"], ensure => present, owner => 'debian-tor', group => 'debian-tor', mode => 0755, } @@ -70,10 +70,10 @@ class tor::daemon inherits tor { # global configurations define tor::global_opts( $log_rules = [ 'notice file /var/log/tor/notices.log' ], $ensure = present ) { - file { '${spool_dir}/01.global': + file { "${spool_dir}/01.global": content => template('tor/global.erb'), - require => File['${spool_dir}'], - notify => Exec['concat_${config_file}'], + require => File["${spool_dir}"], + notify => Exec["concat_${config_file}"], ensure => $ensure, owner => 'debian-tor', group => 'debian-tor', mode => 0755, } @@ -83,10 +83,10 @@ class tor::daemon inherits tor { define tor::socks( $socks_port = 0, $socks_listen_addresses = [], $socks_policies = [] ) { - file { '${spool_dir}/02.socks': + file { "${spool_dir}/02.socks": content => template('tor/socks.erb'), - require => File['${spool_dir}'], - notify => Exec['concat_${config_file}'], + require => File["${spool_dir}"], + notify => Exec["concat_${config_file}"], ensure => $ensure, owner => 'debian-tor', group => 'debian-tor', mode => 0755, } @@ -95,21 +95,21 @@ class tor::daemon inherits tor { # relay definition define tor::relay( $port = 0, $listen_addresses = [], - $nickname = '', - $address = $hostname, $relay_bandwidth_rate = 0, # KB/s, 0 for no limit. - $relay_bandwidth_burst = 0, # KB/s, 0 for no limit. - $accounting_max = 0, # GB, 0 for no limit. + $relay_bandwidth_burst = 0, # KB/s, 0 for no limit. + $accounting_max = 0, # GB, 0 for no limit. $accounting_start = [], $contact_info = '', - $my_family = '', + $my_family = '', # TODO: autofill with other relays $bridge_reay = 0, $ensure = present ) { + $nickname = $name + $address = $hostname - file { '${spool_dir}/03.relay': + file { "${spool_dir}/03.relay": content => template('tor/relay.erb'), - require => File['${spool_dir}'], - notify => Exec['concat_${config_file}'], + require => File["${spool_dir}"], + notify => Exec["concat_${config_file}"], ensure => $ensure, owner => 'debian-tor', group => 'debian-tor', mode => 0755, } @@ -119,10 +119,10 @@ class tor::daemon inherits tor { define tor::control( $port = 0, $hashed_control_password = '', $ensure = present ) { - file { '${spool_dir}/04.control': + file { "${spool_dir}/04.control": content => template('tor/control.erb'), - require => File['${spool_dir}'], - notify => Exec['concat_${config_file}'], + require => File["${spool_dir}"], + notify => Exec["concat_${config_file}"], ensure => $ensure, owner => 'debian-tor', group => 'debian-tor', mode => 0755, } @@ -131,10 +131,10 @@ class tor::daemon inherits tor { # hidden services definition define tor::hidden_service( $ports = [], $ensure = present ) { - file { '${spool_dir}/05.hidden_service.${name}': + file { "${spool_dir}/05.hidden_service.${name}": content => template('tor/hidden_service.erb'), - require => File['${spool_dir}'], - notify => Exec['concat_${config_file}'], + require => File["${spool_dir}"], + notify => Exec["concat_${config_file}"], ensure => $ensure, owner => 'debian-tor', group => 'debian-tor', mode => 0755, } @@ -145,10 +145,16 @@ class tor::daemon inherits tor { $listen_addresses = [], $port_front_page = '', $ensure = present ) { - file { '${spool_dir}/06.directory': + file { "${spool_dir}/06.directory": content => template('tor/directory.erb'), - require => File['${spool_dir}'], - notify => Exec['concat_${config_file}'], + require => [ File["${spool_dir}"], File['/etc/tor/tor-exit-notice.html'] ], + notify => Exec["concat_${config_file}"], + ensure => $ensure, + owner => 'debian-tor', group => 'debian-tor', mode => 0755, + } + file { '/etc/tor/tor-exit-notice.html': + source => "puppet://$server/modules/tor/tor-exit-notice", + require => File['/etc/tor'], ensure => $ensure, owner => 'debian-tor', group => 'debian-tor', mode => 0755, } @@ -158,10 +164,10 @@ class tor::daemon inherits tor { define tor::exit_policy( $accept = [], $reject = [], $ensure = present ) { - file { '${spool_dir}/07.exit_policy.${name}': + file { "${spool_dir}/07.exit_policy.${name}": content => template('tor/exit_policy.erb'), - require => File['${spool_dir}'], - notify => Exec['concat_${config_file}'], + require => File["${spool_dir}"], + notify => Exec["concat_${config_file}"], ensure => $ensure, owner => 'debian-tor', group => 'debian-tor', mode => 0755, } diff --git a/templates/torrc.relay.erb b/templates/torrc.relay.erb index d9f06ae..95496d6 100644 --- a/templates/torrc.relay.erb +++ b/templates/torrc.relay.erb @@ -19,7 +19,7 @@ RelayBandwidthBurst <%= relay_bandwidth_burst %> KB <%- end -%> <%- if accounting_max != '0' then -%> AccountingMax <%= accounting_max %> GB -<%- for accounting in accounting_start -%> +<%- if accounting_start then -%> AccountingStart <%= accounting_start %> <%- end -%> <%- end -%> -- cgit v1.2.3