1. Hakikisha bandari ya rilei yanaweza kufikiwa

Ikiwa unatumia ngome, fungua shimo kwenye ngome yako ili miunganisho inayoingia iweze kufikia milango utakayotumia kwa rilei yako (ORPort).

Pia, hakikisha unaruhusu miunganisho yote inayotoka pia, ili rilei yako uweze kufikia rilei zingine za Tor, wateja na unakoenda.

Unaweza kupata nambari mahususi ya bandari ya ORPort TCP katika Ukurasa wa Mipangilio (katika sehemu mahususi za Mfumo wa Uendeshaji).

2. Thibitisha kuwa rilei yako inafanya kazi

Ikiwa faili yako ya kumbukumbu (syslog) ina ingizo ifuatayo baada ya kuanza daemon yako ya rilei inapaswa kuwa juu na kufanya kazi kama inavyotarajiwa:

Self-testing indicates your ORPort is reachable from the outside. Excellent.
Publishing server descriptor.

Takriban saa 3 baada ya kuanzisha rilei yako, inapaswa kuonekana kwenye Utafutaji Rilei kwenye tovuti ya Metrics.... Unaweza kutafuta rilei yako kwa kutumia jina la utani au anwani ya Itifaki ya mtandao.

3. Soma kuhusu mzunguko wa maisha wa rilei ya Tor

Inachukua muda kwa trafiki ya rilei kuongezeka, hii ni kweli hasa kwa rilei za ulinzi lakini kwa kiwango kidogo pia kwa rilei za kutoka. Ili kuelewa mchakato huu, soma kuhusu mzunguko wa maisha wa rilei mpya.

4. Usimamizi wa usanidi

If you plan to run more than a single relay, or you want to run a high capacity relay (multiple Tor instances per server) or want to use strong security features like Offline Master Keys without performing additional steps manually, you may want to use configuration management for better maintainability.

Kuna suluhisho nyingi za usimamizi wa usanidi kwa mifumo ya uendeshaji inayotegemea Unix (Ansible, Puppet, Salt, ...).

Jukumu lifuatalo la Ansible linastahili kutekeleza limeundwa mahususi kwa waendeshaji rilei ya Tor na kutumia mifumo mingi ya uendeshaji: Ansible Relayor.

5. Muhimu: ikiwa unaweza kuendesha zaidi ya mfano mmoja wa Tor

To avoid putting Tor clients at risk, when operating multiple relays you must set a proper FamilyID value and have a valid ContactInfo in your torrc configuration. The FamilyID setting is simply telling Tor clients what Tor relays are controlled by a single entity/operator/organization, so they are not used in multiple positions in a single circuit.

Instead of setting up FamilyID manually, for big operators we recommend to automate it setting via a configuration management solution. Manually managing FamilyID for big relay groups is error-prone and can put Tor clients at risk. Please note that MyFamily, the previous family configuration method, has been removed.

6. Add firewall rules to protect against DDoS attacks

Configuring your firewall to stop too many concurrent connections has been shown to significantly help deal with DDoS attacks against relays.

Consider implementing one of the following mechanisms:

Note: These are community provided resources. You should check them carefully before applying them to your system. Additionally, be aware that these rules have been shown to work for particular attacks that have happened in the past. Attacks are constantly evolving and will often need new rules, so please stay connected to update these as necessary, either by subscribing to the relevant project or by subscribing to the tor-relays mailing list.

7. Optional: Limiting bandwidth usage (and traffic)

Tor will not limit its bandwidth usage by default, but supports multiple ways to restrict the used bandwidth and the amount of traffic. Hii inaweza kukusaidia ikiwa unataka kuhakikisha kuwa rilei yako ya Tor haizidi kiwango fulani cha kipimo data au jumla ya trafiki kwa siku/wiki/mwezi. Chaguzi zifuatazo za usanidi wa torrc zinaweza kutumika kuzuia kipimo data na trafiki:

  • AccountingMax
  • AccountingRule
  • AccountingStart
  • BandwidthRate
  • BandwidthBurst
  • RelayBandwidthRate

Kuwa na rilei ya haraka kwa muda fulani wa mwezi kunapendekezwa kuliko rilei polepole kwa mwezi mzima.

Pia tazama ingizo la kipimo data katika Maswali Yanayoulizwa Mara kwa Mara.

8. Check IPv6 availability

We encourage everyone to enable IPv6 on their relays. This is especially valuable on exit and guard relays. Note that Tor requires IPv4 connectivity, you can not run a Tor relay on IPv6-only.

Before relying on IPv6, it's recommended to do some basic IPv6 connectivity tests. Mstari wa amri ufuatao utaweka anwani za IPv6 za mamlaka ya saraka ya Tor kutoka kwa seva yako:

ping6 -c2 2a02:16a8:662:2203::1 && ping6 -c2 2620:13:4000:6000::1000:118 && ping6 -c2 2001:67c:289c::9 && ping6 -c2 2001:678:558:1000::244 && ping6 -c2 2001:638:a000:4140::ffff:189 && echo OK.

At the end of the output you should see "OK." If that is not the case, do not enable IPv6 in your torrc configuration file before IPv6 is indeed working. Ikiwa utawezesha IPv6 bila muunganisho wa IPv6 unaofanya kazi, rilei yako yote itasalia bila kutumika, bila kujali kama IPv4 inafanya kazi.

If IPv6 works, your relay is likely already reachable via IPv6. Since Tor 0.4.5, IPv6 address discovery is enabled by default. An ORPort line without an explicit address binds to both IPv4 and IPv6 (0.0.0.0:9001 and [::]:9001), and Tor attempts to auto-discover your IPv6 address the same way it discovers your IPv4. If it can't find a working IPv6 address, it simply publishes IPv4 only.

You can confirm which addresses Tor bound to and discovered by checking your notice log (look for the Opened OR listener lines and the reachability-check results).

If you prefer to specify your IPv6 address explicitly - recommended if auto-discovery picks the wrong address - add a second ORPort line:

ORPort [IPv6-address]:9001

Note: Unlike an auto-discovered address (which Tor silently drops if unreachable), an explicitly configured IPv6 ORPort that fails its reachability check will stop your relay from publishing its descriptor at all, so only configure an address you know works. You have to explicitly specify your IPv6 address in square brackets.

Eneo la laini hiyo katika faili ya usanidi haijalishi. Unaweza kuiongeza karibu na laini za kwanza ya ORPort kwenye faili yako ya torrc.

Ikiwa unayo anwani ya IPv6 ya kimataifa unapaswa kuipata katika matokeo ya amri ifuatayo:

ip -6 addr | grep global | sed 's/inet6//;s#/.*##'

To turn IPv6 off entirely and disable auto-discovery, set AddressDisableIPv6 1 in your torrc.

Ikiwa wewe ni rilei ya kutoka yenye muunganisho wa IPv6, mwambie tor daemon yako ikuruhusu kutoka kupitia IPv6 ili wateja waweze kufikia maeneo ya IPv6:

IPv6Exit 1

9. Maintaining a relay

Hifadhi Nakala za Vifunguo vya Utambulisho wa Tor

Baada ya usakinishaji wako wa awali na kuanzishwa kwa tor daemon ni wazo nzuri kufanya nakala rudufu ya funguo za kitambulisho cha muda mrefu ya rilei yako. Zinapatikana katika folda ndogo ya "funguo" ya Saraka yako ya Data (tengeneza tu nakala ya folda nzima na uihifadhi mahali salama). Kwa kuwa rilei zina wakati wa kuongeza njia inaeleweka kucheleza ufunguo wa kitambulisho ili kuweza kurejesha sifa ya rilei yako baada ya hitilafu ya diski - vinginevyo itabidi upitie awamu ya kupanda tena. Fanya hivi ikiwa tu una mahali salama sana pa funguo zako kana kwamba zimeibiwa, funguo hizi zinaweza kuruhusu kinadharia trafiki fiche au uigaji.

Maeneo chaguomsingi ya folda ya funguo:

  • Debian/Ubuntu: /var/lib/tor/keys
  • FreeBSD: /var/db/tor/keys
  • OpenBSD: /var/tor/keys
  • Fedora: /var/lib/tor/keys

Jiandikishe kwa orodha ya barua pepe

This is a very low traffic mailing list and you will get information about new stable tor releases and important security update information: tor-announce.

Kuweka arifa za kukatika

Once you have set up your relay, it will likely run without much work from your side. If something goes wrong, it is good to get notified automatically. We recommend using Tor Weather, a notification service developed by the Tor Project. It helps relay operators get notified when their relays or bridges are offline, as well as for other incidents.

Another option is to use one of the free services that allow you to check your relay's ORPorts for reachability and send you an email should they become unreachable. UptimeRobot ni mojawapo ya huduma hizi zinazokuruhusu kufuatilia wasikilizaji wa TCP kwenye bandari zisizo za kawaida. Hii hukagua tu kwa msikilizaji lakini haiongei itifaki ya Tor.

Njia nzuri ya kufuatilia rilei kwa hali yake ya afya ni kuangalia grafu zake za kipimo data.

Ufuatiliaji wa afya wa mfumo

Ili kuhakikisha rilei yako ina afya na haijazidiwa ni jambo la busara kuwa na ufuatiliaji wa kimsingi wa mfumo ili kuweka macho kwenye vipimo vifuatavyo:

  • Kipimo data
  • Viunganisho vya TCP vilivyoanzishwa
  • Kumbukumbu
  • Badili
  • CPU

Kuna zana nyingi za ufatiliaji wa aina hii ya data, munin ni mojawapo ya hizi na ni rahisi kusandi.

Kumbuka: Usifanye grafu zako za kibinafsi za ufuatiliaji wa data kuwa za umma kwani hii inaweza kuwasaidia washambuliaji kwa kuondoa utambulisho wa watumiaji wa Tor.

Mashauri fulani yanayofaa:

  • If you want to publish traffic statistics, you should aggregate your relays' traffic over at least a day or use bigger aggregation windows for bandwidth if feasable and combine graphs/statistics for multiple relays where possible.
  • Kuripoti rilei binafsi ni mbaya zaidi kuliko kuripoti jumla ya vikundi vya rilei. Katika siku zijazo,tor itajumlisha kwa usalama takwimu za kipimo data, kwa hivyo ripoti yoyote ya kipimo data cha rilei itakuwa salama kidogo kuliko takwimu za tor.
  • Vipindi vidogo ni vibaya zaidi.
  • Nambari ni mbaya zaidi kuliko grafu.
  • Data ya wakati halisi ni mbaya zaidi kuliko data ya kihistoria.
  • Data katika makundi (toleo la IP, ndani/nje, n.k.) ni mbaya zaidi kuliko data jumla.

Zana

Sehemu hii inaorodhesha zana chache ambazo unaweza kupata zinafaa kama mwendeshaji wa rilei ya Tor.

  • Nyx: ni zana ya Mradi wa Tor (hapo awali ilikuwa mkono) ambayo hukuruhusu kuona data halisi ya rilei yako.

  • vnstat: vnstat ni zana ya mstari wa amri ambayo inaonyesha kiasi cha data kinachopitia muunganisho wako wa mtandao. Unaweza pia kuitumia kutengeneza picha za PNG zinazoonyesha grafu za trafiki. hati ya vnstat na toleo la onyesho.

Learn how to configure your relays' FamilyID