DDoS attacks on circuits

[warn] MaxCircuitDirtiness option is too short; raising to 10 seconds. [warn] CircuitStreamTimeout option is too short; raising to 10 seconds.

The logs you posted show you are essentially unintentionally DDOSing yourself by over tuning your torrc. Your "massive" attack is being worsened by two specific settings.

By forcing circuits to rotate every 10 seconds, you are forcing your CPU to perform constant, expensive cryptographic handshakes. Under an attack, Tor needs to focus on handling incoming cells, however your config is forcing it to constantly tear down and rebuild paths. Vanguard offers solid anonymity, but it can severely impact availability during a DoS attack, as it limits your options for routing. When your aggressive timeouts terminate a circuit, Vanguard restricts the "safe" nodes available for creating a new one. If those limited nodes are overloaded, your service remains offline.

Remove MaxCircuitDirtiness and CircuitStreamTimeout. Let Tor use its default window. Enable POW by adding HiddenServicePoWDefensesEnabled 1. Set HiddenServiceDoSNumIntroductionPoints 12 (or up to 20). This spreads the attack across more nodes so one choke point doesn't take you down. PHP/Nginx rate limits won't help here because the attack is hitting the Tor protocol layer, not the web layer.

Endgame may be of some help to you, but if you're having trouble installing and setting it up, I'm not convinced you should be operating any kind of hidden service.

Tor 0.4.9.6 (git-894a92ac2279747e) running on Windows 8 [or later]

I would highly recommended that you operate your server(s) on Debian or an alternative Linux distribution. Windows is fundamentally contrary to operational security and quite laughable.

Yes Ive been experiencing the same type of attack on my market /d/Omega

I do have Endgame in place but the current setup isn’t strong enough to fully withstand the attack due to a low circuit kill rate.

To improve things Ive added more Nginx rate limiting along with cookie-based blocking.

I’m also working on sharing sessions across all fronts. Right now Endgame only blocks cookies locally and kills circuits per front. This means if you’re running something like 20 frontends behind GoBalance an attacker can reuse the same cookie up to 20 times once per frontend before it gets fully blocked, which is obviously a problem.

What I’m implementing now is a shared session system so that once a cookie is blocked on one frontend, it’s automatically blocked across all fronts.

That said, I’d still recommend installing Endgame it does help mitigate a good portion of these attacks.

Thank you,

Q

I understand, thank you very much for your reply. I hope I can fix it; the site has been struggling since the 2nd and it just won't get off the ground.

Look at the OP’s logs again. If you're encountering the same "attack" as OP, you have no business running a market.

3000 is kind of cheap. Do you run tests on Windows? Good job, installing Windows 98 should help.

XP is better, I've been told. I'm using Windows right now, but I use Linux for my website

if it's anything illegal maybe you should fully migrate to linux because windows telemetry is danger

Thank you very much for your reply. I use Linux; it was only for testing because Linux also crashes it.

Hey!! Thanks for your reply!

majority of are here are on Linux too bud