Tor project needs volunteers to help Iranian users access the internet
lists.torproject.org
lists.torproject.org
[i am about to try build this on an aws instance, but since i know very little about images i am sure others will be better/quicker than me]
[update: if anyone else is doing this, you are best picking a new base distro that is new enough to contain libevent 2]
it is common - https://cloud.torproject.org/
tor is not mentioned on the aws site - http://aws.amazon.com/search?searchQuery=tor&searchPath=...
there is nothing related in the customer agreement - http://aws.amazon.com/agreement/ (no mention of tor, proxy, etc).
I've set it up in my home server (it's seems really easy, at least according to their instructions), but I only have 512kbps of upload, which will probably limit its usefulness.
for something like this, personally, i am also willing to spend some money [i am still working on aws trying to get an image working - last attempt failed through lack of scsi drivers afaict - will post here if successful].
Note that obfsproxy seems to crash in managed mode, so run it stand-alone. Configure tor as a regular bridge (https://www.torproject.org/docs/bridges.html.en#RunningABrid...), and then start obfsproxy with ./obfsproxy obfs2 --dest=127.0.0.1:9001 server 0.0.0.0:1051.
9001 is the bridge port configured in tor and 1051 is the port which will accepted obfuscated connections. I think that a random port is chosen in managed mode, so you might want to change it.
it contains a basic 64 bit amazon linux image, with the extra code generated according to lgeek below http://news.ycombinator.com/item?id=3579531
to run, deploy the image, connect as ec2-user in the normal way and then:
- modify ~/tor.sh to change the port on which obsproxy listens, if you want
- change the security group to allow ports 9100 and 2189 (or whatever you change 2189 to above) (you may need to restart the instance at this point to apply the security group).
- modify the bandwidth limit in /usr/local/etc/tor/torrc (ie sudo emacs -nw /usr/local/etc/tor/torrc) - currently it's 50 KB/s which i think comes out as around $10-20 a month if it's fully used.
- start with the tor.sh script.
- check tor.log and note your external IP address.
- check external access using something like "telnet xxx.xxx.xxx.xxx 2189" (which generates a screenful of binary on success).
- contact tor-assistants at torproject.org so they can give the bridge location out to someone that needs it.
please post here or email me if there are any issues (a confirmation that you can access the ami would be cool too :o). also, are AWS external IP addresses permanent (if not, may need to use elastic IP + DNS)?
Now, please don't be offended, but this is one of the reasons I prefer instructions or more generally an easy way to replicate a result - which is easier to verify - rather than the built software/AMI/whatever. It's trivial to offer a compromised system and nearly impossible to verify that a system is secure.
On the other hand, tor and obfsproxy work for me using your AMI.
I've never seen an external IP address for an EC2 box change, I don't believe they do. They are typically part of the hostname and it would be strange to have amazon change this at random points in time. Elastic IP is good if you want to change a server a domain points to without having to wait for DNS propagation.
I just confirmed that I can access your AMI in the US East region. Be aware, however, that AMIs are region specific and thus your AMI cannot be found or used in any other region (such as US West).
i will delete the ami described in the post above, please use this one.
this will still have my contact details in the tor config /usr/local/etc/tor/torrc - you should change those too... (not a security issue, but if they email me about your install, there's not much i can do...)
http://www.aljazeera.com/news/middleeast/2012/02/20122116495...
If del.icio.us is able to do it[1], surely Iran must be able to too.
Iran wants to prevent users from getting into the Tor network and going to sites that they do not have control over. Since it is easy for them to block the public routers Tor uses "bridges" which are nodes that will allow people to connect to the entry nodes through them. The lists of these nodes are then treated as semi-secret (in that they try to limit any one person or organization from learning all of them). This is exactly what they are looking for people to make, more bridges, not more exits.
edit: They actually say that Iran does very little active blocking and are just throttling anything that looks like TLS, so the bridge vs. entry node distinction does not really apply in this case, but it is relevant to the attack you are trying to describe.
why don't you, you know, read the link that this thread is about before commenting?
Tor also has a well-established way of fighting blacklists. Normal relays are all listed on a public network, but there is also an opt-in program which exists for Tor relays: a Tor relay can choose to be "hidden" in a certain sense. A "hidden" relay node accepts only entrance connections, and these are advertised more quietly by the Tor Project folks, who don't reveal too many too fast. It is therefore the case that blacklists can be circumvented by asking Tor for a couple of hidden entrance nodes and configuring yourself appropriately.
The goal of obfuscation is to buy a little more time during which people can use encryption again, by making the encryption look like normal traffic. (But I have no further knowledge of the particulars, so take what I have said with a grain of salt.)
High Quality H264 link (720x576): http://mirror.fem-net.de/CCC/28C3/mp4-h264-HQ/28c3-4800-en-h... (found on the YouTube page)
If this is true, and if someone is looking at kiddie porn through your connection, could you get implicated?
> Can EFF promise that I won't get in trouble for running a Tor relay?
> No. All new technologies create legal uncertainties, and Tor is no exception. Presently, no court has ever considered any case involving the Tor technology, and we therefore cannot guarantee that you will never face any legal liability as a result of running a Tor relay. However, EFF believes so strongly that those running Tor relays shouldn't be liable for traffic that passes through the relay that we're running our own middle relay.
The goal might not be censorship, even. Iran's most prominent recent actions have been provocative trade threats and hacking a US drone -- and US Presidential candidates have been discussing the possibility of eventually invading Iran. Iran has plenty of paranoia to spare:
http://www.juancole.com/2011/12/iran-has-us-surrounded-all-r...
I'm guessing that they're dropping connections in part based on that; fear of spies rather than fear of speech. In which case they wouldn't really have any motive for a blockpage, either.
It is clearly population/sentiment control and not 'fear of spies'.
You can download the html source at https://raw.github.com/gist/1805605/f2211718b70f7cb24f3d3213...
('peyvandha' means 'links')
If yes, you could setup a tunnel on port 80 and then run openvpn or tor through it. Technically it works as I've done this for a friend in China (but China wasn't doing DPI on SSL handshaking).
I posted this same question on the earlier Iran shutdown thread but was probably too late to get a response (http://news.ycombinator.com/item?id=3577901).
am i missing something?
Edit: the reason I mentioned socat was because when I used it to help the guy in China, it was because they were apparently filtering openvpn and we found that when it went via socat the connection was much more stable and faster.
Edit 2: if TCP through a UDP socat wouldn't work, how about something totally off the wall like an ipv6 tunnel over ipv4 (using http://en.wikipedia.org/wiki/Teredo_tunneling) and then an ipv4 tunnel within that ipv6 tunnel (through which the tor or openvpn connection would go). Sorry if I'm spouting garbage but it's quite fun thinking about all the random ways one might be able to tunnel one stream of data through another. (although given the Iranians urgent predicament, my mental masturbation is probably best saved for another day...)