SOTS #29: Ethereum Staking node network security

Transcript

hey superfiz here december 13th 2020. this is maybe my fifth time doing this which is the most times i've ever attempted a recording and still tried it the last time i felt like i got it right and my phone crashed i'm still recording from my phone i'd sort of like to buy a fancy camera like jeremiah has but um i'm still working my way through this before i start my state of the state i want to do a quick confession uh it was probably the confession that i made in videos two and three i'm on five now um i enjoy stating the steak but it does give me some kind of what i would call performance

anxiety or performance pressure pressure to keep doing better every day and that pressure is is just ending up in me feeling anxious when i create them and i need to allow myself to relax and grow into this over time so you know i've started editing i've been working a little bit i know it's not great on my setting and i want to get better but i sort of have to confess to you my friends that i have to give myself a break and make sure it stays fun because if it stays fun if it's not fun then i'll quit and i don't want that to happen

so i just have to get that out there i'm not gonna edit or cut today's video um we'll be lucky if i even publish this we'll see this really is literally the fifth take because one of the videos i was just like just like whiny and whatever anyway just bear with me i'm learning i want to get better i just need to relax and have fun doing this and i think that when i do that the quality will come in time i would rather do this for 10 years and slowly get better than do it for two months and fizzle out and burn out anyway today i

want to talk about uh best practices for network security with a staking node and so uh i've actually done this a couple times now i'm probably getting good at it security with a staking node begins when you generate your seed phrase and the best practice for generating your seed phrase is to kind of do that in what we call an offline computer so maybe you're using an ubuntu live cd or a tail cd and you can youtube for how to do that and you just create a temporary live environment and then you'll copy the deposit script over and from there you'll create your mnemonic

it's really important that if you can you practice that you keep your mnemonic offline and secure as much as you can and i know that for different people it's there are different levels of security i'm willing to confess that i created my deposit.sh my mnemonic on an online computer and i don't fault myself for that but if you're doing best practice you're going to create it in an offline it's okay if it takes you a few days to figure that out you don't have to rush into it and so once you have your 24 word seed phrase you're looking at two real risks with that the first risk is that an attacker will get your seed phrase and use it against

maybe that means they will create validators and have you slashed or they'll wait until transactions are enabled and steal your funds so you'll need to make sure your seed phrase is kept secure the second risk which i think is actually a greater risk is that you'll lose your seed phrase completely you keep it you'll keep it so secure that somehow you've lost it and you can't find it your funds are gone at that point so it's really important that you back up your seed phrase in a way that you can find it if you need it there's another factor to that i've thought of several ways to say this but let me put it simply if you die your family needs to be able to recover that seed phrase so please make a plan if you die that your family has that seed phrase

and that they know who to contact in in that event um and honestly if that's me that's fine have them say hey there's this dude on the internet called superfist he will hook you up i'll take care of your family if something happens i'm i'm not opposed to that at all but really if you're planning ahead you should create or find a friend who can do that with you i'm gonna do a quick plug for collaboration groups um if you i'm gonna put a link below for our collaboration groups and that is where we'll pair you up with four other people who are kind of doing staking also maybe they're learning the same things you are and with that collaboration group you can build a long-term relationship with other people

interested in staking and one of those people might be the right person to be your seed recovery person if you pass away it's really serious so as much as we don't like planning for death i hope you'll plan for that so that is seed phrase security i'm going to move on past that and now talk about your your installation security and i'm only going to talk about linux because to me it doesn't make a lot of sense to run a validator on an operating system other than linux if you want to do that that's great i'm not going to fault you but linux seems to be the correct tool for the job for me and that's what i'm going to talk about now with linux there are about four concerns or four security

opportunities that i want to bring up for you the first thing you should not run unnecessary programs on your staking machine i would strongly discourage you from making your staking machine your daily driver now that's a best practice and i talk about best practice a lot you have to do what works for you if it's your only computer then by all means do what you're gonna do and don't worry about it if it's a choice you're making it's okay we all make less than best practice choices it's fine but to the extent that you can don't run other comp other software on your validator than the things you have to run to be a

staker and the reason i say that is running other programs first requires them to update and second it introduces vulnerabilities so let's say that you like to play silly games on your browser and one of those downloads of trojan has a key logger that's going to pick up the information from your validator and so really you would want to avoid that if at all possible i'm going to tell you a little hint though since you never put your seed phrase on the internet a key logger will never be able to get it and especially your seed phrase no matter where it is should never be on your validator once you get that seed phrase it needs

to be offline written down on paper or hammered in steel or something to keep it secure you should never keep your seed phrase online especially on your validating so that's rule number one don't run unnecessary programs the second rule is port security and let's see what i wrote here malicious actors can try to connect open ports on your machine sure so in a normal home network there are there's a firewall on your router so you have like this wireless router it's a netgear nighthawk and whatever so that device has a built-in firewall and then you have

your computer which will also have a firewall so what you need to do is go to your home router and make sure the firewall is enabled they usually are by default but you might need to open up a couple ports for staking so for the eth1 node you're probably going to need to open port 30303 and that basically is a port from your that sent that forwards traffic to your staking computer and then you're going to forward port 9000 or if you're running prison ports 12 000 and 13 000 so you're going to send those pow those those ports forwarded from your home router to your staking machine and now we're at your staking machine

and you'll need to run a program on your staking machine called ufw that stands for stands for uncomplicated and it is honestly god's gift to firewalls if you've ever if you've been around linux a while you know that we used to use something called iptables and uh it's it's uh cryptic to say the least to get iptables uh set up perfectly ufw uncomplicated firewall is a really simple system that allows you to manage open ports and with uncomplicated firewall you're going to allow those same couple of ports uh port three zero three zero three

and then nine thousand or twelve and 13 000 if you're using prism uh and so that's going to allow traffic from the internet to connect to only those ports and that's okay because you have a service on your staking machine that is ready to answer those ports so let's talk about um let's say i'm running lighthouse and i open port 9000 on my home firewall and i open port 9000 on ufw then traffic can come through port 9000 and when it hits 9000 on your local box it's going to find lighthouse it's going to say hey here i am lighthouse and everybody's happy you don't have to worry about hackers getting through that open port that's

just not the way things work so we have a firewall on our home router and we have uncomplicated firewall on our local machine and if you're not sure about those rules if you look at the guides from samara sat or if you look at the guide from coin cashew and there are probably others they walk you right through setting up ufw and it's it really is a breeze and so that is port security for staking and validating now here's the wild card you're going to want to administer your server that means you're going to want to log in sometimes and do things let me tell you that the best way to do

that is by sitting in front of it if you can so let's say that your is running on a shelf the best way to administer that is by plugging in a monitor and a keyboard and administering it there but a lot of people aren't going to do that a lot of people let's say you're a windows user and you're going to maybe secure shell or ssh into that server and to do that you're going to need to open up ssh on your staking machine and so i know that both of those guides that i referenced um samara salt and uh coin cashew tell you how to change the default port for ssh that's a great idea i really want you to do that

um and so from that point you also need to set a really secure administrator password well or if you're using ubuntu your password the main user needs to have a really secure password because that's how you're going to get into that system and so let's say i'm on windows at my home and i want to connect to my staking server and so i'm going to use ssh dash port and i'm going to set the port to something really high but below 65 000. so i'm going to set the port to like 50 000 great and so i can secure shell 450 000 and then i can get into my validator now from that situation you can

administer your staking machine from within your local network you will allow ufw connections for port 50 000 in that example and computers on your home network can use port 50 000 to get in in that situation your home router or your home firewall is blocking port 50 000 from the outside and i strongly suggest that you leave it that way i do not recommend that you pull that you forward ssh ports from outside to inside your network this means that you can only administer your staking machine inside your home network

if you go on vacation for a week and your staking machine goes down in the middle of the week it's okay relax when you come home you can get it going again let me tell you about the risk or the problem with enabling ssh through your home on the internet there are bots running 24 7 with no other purpose than to try to get ssh access to a machine and these are not people they're bots that just run continuously and they will scan every port over and over if they if they scan anything on your home network and they see something like

that looks interesting they'll continue to scan every port and if they find that ssh port they will test it with every service and when they find that ssh is an open service they will then begin to attempt every uh username and password combination they actually have like these long lists where they'll try root root root admin and they'll try everything and so on one hand that's like gonna throw it's it's gonna increase your logs it's gonna cause some problems on the other hand if they discover a vulnerable a vulnerability in ssh and they get into your machine they'll have access to your validators it's really not worth the risk as a home staker

to leave that port open your best bet is just to administer your server from home uh i think that's kind of everything that i wanted to say security is this um kind of big nebulous scary thing but it's not difficult when you look at those guides by uh sameer and by coin cashew you see that it's really about four commands to enable ufw and then put it up and you kind of don't have to worry about anything after that when those are done it is wise to always update your server and to always keep the latest client version

running but as long as you've done those things you can relax about security now i'm not saying have relaxed security i'm saying you can relax worrying about the security because if your ports are closed and if your system is configured correctly following those guides you really don't have anything to worry about as an example to that let me tell you that so far the first week into the beacon chain there have been 14 slashings and they've all been caused by running redundant uh validators none of those have been caused

by people who were somehow hacked and someone using their their keys maliciously so it's not a problem you need to worry about but it is something you need to be kind of aware of i talked a lot i talked quickly i'm not going to edit this but i hope you learned something and i appreciate you letting me unload the pressure that i'm feeling from this because i hope that will let me relax so again thanks for your time i always enjoy this if you have any suggestions for videos i might create please feel free to drop a comment um i hope you'll watch these every day or every day that i create them so please feel free to subscribe and set a reminder

all right take care bye