Skip to content

Please clarify the expectations for Relay Operators regarding statistical summaries

Follow up of https://forum.torproject.org/t/dont-create-a-publicly-available-webpage-showing-bandwidth-history-or-any-statistics-about-the-machine-e-g-cpu-ram-usage-as-these-can-be-used-in-surprising-ways-to-attack-users/16451

Is there a problem having a http (no SSL/TLS) website with mrtg output like this or does it violate the following expectation?

Don't reveal user or destination IP addresses, or the timing or volume of connections. For instance, don't create a publicly available webpage showing bandwidth history or any statistics about the machine (e.g. CPU/RAM usage) as these can be used in surprising ways to attack users.

Information shown on the website:

Graphs (this one) Daily Graph (5 Minute Average) and additionally for Weekly Graph (30 Minute Average), Monthly Graph (2 Hour Average), Yearly Graph (1 Day Average): image

Additional information on that page:

image

Usually 4-6 relays are installed on a machine and in my opinion (which I'm willing to change) the is no real risk for identifying any user traffic or gathering very sensitive information (uptime for the nodes is also shown on metrics. yes, it's uptime for tor, but also gives insight on system uptime too).

Attack scenario: Someone finds out the URL or snoops unencrypted http-traffic and gets the URL from there.

Benefit for me: Easy to install and to aggregate. Notice of unexpected traffic spikes or decreases visually on a "dashboard" for further examination. Having proper TLS means having no port 443 or additional DNS hassles for getting certificates.

Technical this mrtg config is used:

WriteExpires: Yes
WorkDir: /var/www/html/mrtgfolder
Title[^]: Traffic Analysis for
forks: 2
refresh: 300
interval: 5
runasdaemon: yes
Target[index]: `/usr/bin/mrtg-ip-acct eth1`
XSize[index]: 600
YSize[index]: 300
MaxBytes[index]: 134217728
Title[index]: Traffic : eth1
PageTop[index]: Traffic Analysis for localhost
WithPeak[index]: w
Options[index]: growright 
Edited by atari