如何保护烘焙节点免受DDOS之类的攻击？

Question

如何保护烘焙节点免受DDOS之类的攻击？

- 19
- 373 2019-01-31
我想知道tezos-node和baker使用什么端口和协议,以便我只能在防火墙设置中启用那些端口和协议,以防止对服务器进行任何DDos攻击.

I want to know what ports and protocols tezos-node and baker uses so that i can enable only those ports and protocols in my firewall setting to prevent any DDos attack on my server.

node setup baking-node

3 个回答

投票数

- 11
- 2019-02-01
@xtzbaker位于节点使用的端口上.阻止针对烘烤节点的DDoS也是最常见的烘烤设置是拥有带有受信任公共节点的私有烘烤节点的原因之一.

基本上,我们只有面包师和背书人使用的一个节点,并且配置为位于私有模式.专用模式将禁止与其他人的连接,并且还告诉其对等方不要将节点的存在广播给其对等方.为了真正使我们的私有节点保持私有,必须信任私有节点的对等方以不泄露您的私有节点的ip.这意味着您的私有节点需要将显式对等体设置为受信任的节点(而不是仅让该节点选择网络上任何可用的对等体).

节点值得信任是什么意思?好吧,它因人而异,具体取决于您接受的风险级别.但是,如果您想真正信任一个节点,那么唯一的办法就是自己拥有它们.就是说,许多面包师接受基金会的公共节点是足够值得信赖的.

@xtzbaker is spot on with the ports that the node uses. Preventing DDoS for the baking node is also one of the reasons that the most common setup for baking is to have a private baking node with trusted public nodes.

Basically, we have a single node that the baker and endorser uses and it's configured to be on private mode. Private mode will disallow connections from others and also tell its peers to not broadcast the node's existence to their peers. In order to truly keep our private node private, the private node's peers must be trusted to not reveal your private node's ip. This means your private node needs to set explicit peers to trusted nodes(as opposed to just let the node choose any available peers on the network).

What does it mean for a node to be trustworthy? Well, it varies from person to person depending on your accepted level of risk. But if you want to truly trust a node, the only way is to own them yourself. That said, many bakers accept the foundation public nodes to be trustworthy enough.
- 原文
- Frank
- 感谢您提供有关设置的信息.您能解释一下如何使用Docker映像进行此设置吗?我看到mainnet.sh文件具有所有默认配置,但是如何修改这些配置以按照您的说明进行设置?关于使用docker映像完成设置的信息不多.
  
  Thanks for the information about the setup. Can you explain how to do this set using docker images. I see that mainnet.sh file has all the default configurations but how to modify those configuration to have a setup as explained by you? There is not much information regarding setup done using docker images.
  - 0
  - 2019-02-03
  - Sachin Tomar
- 我目前不会将docker用于烘烤专用节点,特别是使用分类帐的原因.但是对于前端公共节点,使用Docker容器更容易维护.核心开发团队会积极维护它们,最多只能在主网分支上最晚几分钟的时间内进行维护.您可以使用[mainnet.sh](https://gitlab.com/tezos/tezos/blob/mainnet/scripts/alphanet.sh),但是我发现运行自定义docker-compose安装程序效果更好,[这就是我使用](https://gist.github.com/sirneb/8419e41aea4f2d5770555301006cea20).
  
  I currently wouldn't use docker for the baking private node, specifically reasons with using a ledger. But for frontend public nodes, using docker containers is much easier to maintain. The core dev team actively maintains them, at most only minutes behind latest on the mainnet branch. You could use the [mainnet.sh](https://gitlab.com/tezos/tezos/blob/mainnet/scripts/alphanet.sh), but I find running a custom docker-compose setup works better, [this is what I use](https://gist.github.com/sirneb/8419e41aea4f2d5770555301006cea20).
  - 1
  - 2019-02-04
  - Frank
- 5
- 2019-02-04
您还可以通过使节点的Internet连接通过受DDoS保护的VPN(例如OctoVPN https://)来增加额外的安全层.octovpn.com

You could also add an extra layer of security by having your node's internet connection go through a DDoS protected VPN, like OctoVPN https://octovpn.com
- 同意,我也认为问题是关于防御DDOS的问题,而不是端口问题:
  
  Agree, I also think that the question was about protecting against DDOS and not so much the question of ports:
  - 0
  - 2019-02-04
  - jdsika
- https://www.cloudflare.com/ddos/
  
  https://www.cloudflare.com/ddos/
  - 0
  - 2019-02-04
  - jdsika

xtzbaker · Accepted Answer · 2019-01-31

20

2019-01-31

9732是P2P连接的默认端口,启动节点时可以使用--net-addr=ADDR:PORT覆盖
8732是RPC连接的默认端口,可以使用--rpc-addr=ADDR:PORT
所有网络均使用TCP.

如果使用iptables,则以下规则应特别适合tezos.

请注意,根据您的配置,您将需要允许其他非tezos网络服务,例如DNS,NTP,DHCP.

 # Allow Tezos RPC
iptables -A INPUT -p tcp --dport 8732 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 8732 -m conntrack --ctstate ESTABLISHED -j ACCEPT

# Allow Tezos P2P connections
iptables -A INPUT -p tcp --dport 9732 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 9732 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 9732 -m conntrack --ctstate ESTABLISHED -j ACCEPT

9732 is the default port for P2P connections, can be overridden with --net-addr=ADDR:PORT when starting the node
8732 is the default port for RPC connections, can be overridden with --rpc-addr=ADDR:PORT
All networking uses TCP.

If using iptables the below rules should suffice for tezos specifically.

Be aware you will need to allow other non tezos network services like DNS,NTP,DHCP depending on your configuration.

# Allow Tezos RPC
iptables -A INPUT -p tcp --dport 8732 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 8732 -m conntrack --ctstate ESTABLISHED -j ACCEPT

# Allow Tezos P2P connections
iptables -A INPUT -p tcp --dport 9732 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 9732 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 9732 -m conntrack --ctstate ESTABLISHED -j ACCEPT

但是关闭未使用的端口并不能保护贝克免受DDOS的侵害,对吗?这样做的标准方法是将面包师(在私有节点配置中)隐藏在许多公共节点的后面.这样做意味着无法直接将面包师作为目标,并且如果存在活动的DDOS,则可以交换公共节点.

But closing unused ports won't safeguard a baker from a DDOS, will it? The standard way of doing that is to hide a baker (in private node config) behind a number of public nodes. Doing so means a baker can't be directly targeted and public nodes can be swapped out if there is an active DDOS.
- 3
- 2019-02-01
- latte_jed
您是正确的,我想OP实际上有2个问题需要回答-一个关于DDOS,另一个关于Tezos端口.该问题应相应地分为两部分.

You are correct, I guess the OP actually has 2 questions to be answered - one on DDOS and one on Tezos ports. The question ought to be split in two accordingly.
- 1
- 2019-02-02
- xtzbaker
当节点处于私有模式时,也可能不允许端口9732上的传入连接,而仅允许相关和已建立的传入连接.无论如何,专用节点将仅建立到受信任节点的连接,而其他非受信任节点将无法连接.

When a node is in private mode, it is also possible to not allow incoming connections on port 9732 and to only allow related and established incoming connections. The private node will only establish connections to trusted nodes anyway and other, non-trusted nodes will not be able to connect.
- 0
- 2019-02-04
- cryptodad