面包师设置的安全性

Question

面包师设置的安全性

- 8
- 254 2019-01-30
我已经看到很多人提到用于烘焙的tezos装置.一般的想法是运行少数几个FE节点,这些节点可能在地理位置上分散,然后有一个仅连接到您的FE节点的专用节点.并且如果可能的话,专用节点将使用分类帐进行烘焙/签名操作.

这样的系统对我来说在经济上是行不通的.我也很游荡,以至于我不能只设置家庭系统.所以我想问一下有关我的设置安全性的一般想法.

我在VPS中运行一个节点.它以私有模式运行,其对等方仅为TF对等方.该节点通过专用网络与运行在另一个VPS中的签名者对话.除了我选择的签名者端口之外,签名者的防火墙已被完全阻止,并且ssh仅可通过也是专用网络一部分的隧道计算机使用.

签名者的防火墙仅允许从IP I列入白名单的节点VPS连接到签名者端口.因此,我认为没有必要设置签名者身份验证.

签名人签署我的代表地址,代表地址包含足够的眩晕感(还有一些额外的呼吸空间),以存放estimated-rights.py 脚本.

其余的小家伙生活在其他地方的原始帐户中,该帐户委托给我的代表,帐户密钥存储在分类帐中.

几个问题:

这听起来像一个相当安全的设置吗?

有孔还是我想念的东西?

仅连接到TF节点是否足以使我烘烤的块快速通过网络传播并成功注入的可能性很高?

奖励要点:有人知道作品中是否有一个AWS区块链模板,类似于以太坊的模板吗?请参阅:使用以太坊的AWS区块链模板

(此问题的图表对于我来说在经济上不可行的确切设置我只是个面包师)
I've seen a lot of people mention tezos setups for baking. The general idea would be to run a handful of FE nodes, likely geographically dispersed, and then having a private node which connects to just your FE nodes. And if possible, the private node would use a Ledger for baking/signing operations.

Such a system would be economically infeasible for me. I'm also itinerant enough that I can't just setup a home system. So I wanted to ask about general thoughts regarding the security of my setup.

I run a single node in a VPS. It runs in private mode and its peers are only the TF peers. The node talks to a signer running in another VPS via a private network. The signer's firewall is completely blocked off except for the signer port I chose and ssh is only available via a tunnel machine that is also part of the private network.

The the signer's firewall only allows connections to the signer port from the node VPS who's IP I whitelisted. Because of this, I didn't feel it was necessary to setup signer authentication.

The signer signs for my delegate address and the delegate address contains just enough tezzies (and a little extra for breathing room) to put up the deposits for PRESERVED_CYCLES as output by the estimated-rights.py script.

The rest of the tezzies live in an originated account elsewhere that delegates to my delegate, with the account keys stored on a Ledger.

A few questions:

Does this sound like a reasonably secure setup?

Any holes or anything I'm missing?

Is connecting to just the TF nodes enough to give me a high probability that blocks I bake are propagated through the network quickly and successfully injected?

Bonus points: Does anyone know if there is an AWS blockchain template in the works, similar to how there is for Ethereum? See: Using the AWS Blockchain Template for Ethereum

(This question has a diagram of the exact setup that is economically infeasible for me given that I am just a solo baker)
ledger hsm setup solo-baking

2 个回答

投票数

- 3
- 2019-01-30
签名者的防火墙仅允许从IP I列入白名单的节点VPS连接到签名者端口.因此,我认为没有必要设置签名者身份验证.

我会翻转这个.阻止所有到签名者的传入连接,而是让签名者连接到TF.这样,您不必担心恶意节点试图通过IP劫持等攻击来连接到签名者.

The the signer's firewall only allows connections to the signer port from the node VPS who's IP I whitelisted. Because of this, I didn't feel it was necessary to setup signer authentication.

I would flip this. Block all incoming connections to the signer and instead have the signer connect to the TF. That way you don't have to worry about a malicious node trying to connect to your signer through attacks such as IP hijacking.
- 我不确定我是否理解这一点.签名者需要接受签名请求.签名者本身不连接任何东西,它仅响应签名请求.
  
  I'm not sure I understand this. The signer needs to accept requests to sign. The signer itself doesn't connect to anything, it only responds to signing requests.
  - 3
  - 2019-01-31
  - lostdorje
- 这是在连接级别上.签名者应发出请求.这意味着它可能位于诸如家庭路由器之类的NAT之后,并且您无需打开任何端口即可使签名者可以从外部访问. 这不会影响签发请求的发出方式.它仅影响谁发起TCP连接.
  
  This is on the connection level. The signer should issue the request. It means that it can potentially be behind a NAT, such as a home router, and you don't need to open any port to make the signer accessible from the outside world. This doesn't affect how signing requests are issued. It only affects who initiates the TCP connection.
  - 1
  - 2019-02-01
  - adrian

Luke Youngblood · Accepted Answer · 2019-01-30

6

2019-01-30

签名者的防火墙仅允许从IP I列入白名单的节点VPS连接到签名者端口.因此,我认为没有必要设置签名者身份验证.

这是我要担心的主要安全问题.通常,您的设置相当安全,但是主要风险是:

由于签名者没有身份验证,因此任何可以登录到您的烘焙系统的人都可以通过某种方式与远程签名者签名消息,包括余额转移您的保证金/存款.
您的签名者上的私钥也可能在VPS上运行时有风险,因为许多VPS提供商没有适当地防止旁道攻击,这可能使VPS提供商或其他客户查看内存内容虚拟机并公开私钥.

另一种低成本的安全方法:

获得一台可以在家运行的小型Linux服务器.只要您拥有2GB或更多的内存并且有足够的磁盘空间用于区块链(当前截至2019年1月为73GB),这便可以是一台二手PC.
使用分类帐存储您的私钥.
使用家庭互联网连接,使面包师以--private-mode的方式连接到TF引导节点.

谢谢！嗯,是的,我应该设置身份验证.关于私钥,在输入私钥的密码后,它会不加密地存在于内存中. 关于小型Linux服务器,我的IP是通过DHCP提供的,并且由于我的互联网提供商的原因而经常更改.对于其他与我的节点联系的节点(TF节点),更改IP不会有问题吗?

Thanks! Ah, ok yeah I should setup authentication. And right about the private key, after I enter the password for the key it will live in memory unencrypted. About the small Linux server, my IP is provided via DHCP and changes often for whatever reason due to my internet provider. This changing IP isn't a problem for other nodes (the TF nodes) contacting my node?
- 1
- 2019-01-30
- lostdorje
如果您使用的是" --private-mode",则无论如何连接都是出站的(您的节点将阻止任何意外的入站连接),因此拥有动态IP地址不会有问题.

If you're using `--private-mode` your connections are all outbound anyway (your node will block any unexpected inbound connections) so having a dynamic IP address won't be a problem.
- 1
- 2019-01-30
- Luke Youngblood