1

I have set up a Geth POA network of 2 nodes on different cloud instances. Network was running good for 2 months but now suddenly it's getting connections from unknown peers and mining stops working.

Geth Command:

geth --datadir ethdata/ --syncmode 'full' --port 30312 --rpc --rpcaddr '0.0.0.0' --rpcport 8545 --rpccorsdomain '<URL1>,<URL2>' --rpcapi 'personal,db,eth,net,web3,txpool,miner,admin' --ws --wsport 8546 --wsapi 'eth,net,web3' --wsorigins '<URL1>' --networkid <NETWORKID> --gasprice '1' --unlock <ACCOUNT1> --password pass.txt --mine --etherbase <ACCOUNT1> --allow-insecure-unlock --nat extip:<NODEIP> --nodiscover --netrestrict <NODE2IP>/32

Error Logs:

0|ethNode1  | INFO [10-02|21:10:19.001] 🔨 mined potential block                  number=394283 hash="2ef239…81cd72"
0|ethNode1  | INFO [10-02|21:10:19.002] Commit new mining work                   number=394284 sealhash="3377da…5031cd" uncles=0 txs=0 gas=0 fees=0 elapsed="318.567µs"
0|ethNode1  | INFO [10-02|21:10:19.002] Signed recently, must wait for others
0|ethNode1  | INFO [10-02|21:10:29.002] Imported new chain segment               blocks=1 txs=0 mgas=0.000 elapsed="442.732µs" mgasps=0.000 number=394284 hash="0612d1…139ef9" dirty=0.00B
0|ethNode1  | INFO [10-02|21:10:29.003] 🔗 block reached canonical chain          number=394277 hash="825454…683852"
0|ethNode1  | INFO [10-02|21:10:29.003] Commit new mining work                   number=394285 sealhash="f90c28…da2cd8" uncles=0 txs=0 gas=0 fees=0 elapsed="268.822µs"
0|ethNode1  | INFO [10-02|21:10:39.000] Successfully sealed new block            number=394285 sealhash="f90c28…da2cd8" hash="7f408c…1fe2df" elapsed=9.997s
0|ethNode1  | INFO [10-02|21:10:39.001] Signed recently, must wait for others
0|ethNode1  | INFO [10-02|21:10:39.000] 🔨 mined potential block                  number=394285 hash="7f408c…1fe2df"
0|ethNode1  | INFO [10-02|21:10:39.002] Commit new mining work                   number=394286 sealhash="190914…a34e63" uncles=0 txs=0 gas=0 fees=0 elapsed=1.583ms
0|ethNode1  | INFO [10-02|21:10:43.852] Transaction pool price threshold updated price=1
0|ethNode1  | ERROR[10-02|21:10:43.854] Etherbase account unavailable locally    err="unknown account"
0|ethNode1  | WARN [10-02|21:10:43.854] Served miner_start                       conn=217.227.191.41:61800 reqid=1643 t=2.034872ms err="signer missing: unknown account"
0|ethNode1  | WARN [10-02|21:10:44.863] Gas estimation capped by limited funds   original=8000000 balance=98712 sent=78962 gasprice=1 fundable=19750
0|ethNode1  | WARN [10-02|21:10:44.864] Served eth_sendTransaction               conn=217.227.191.41:61805 reqid=1125 t=3.726913ms err="gas required exceeds allowance (19750)"
0|ethNode1  | WARN [10-02|21:10:45.755] Served eth_sendTransaction               conn=217.227.191.41:61807 reqid=831  t=4.255632ms err="authentication needed: password or unlock"
0|ethNode1  | INFO [10-02|21:10:49.002] Imported new chain segment               blocks=1 txs=0 mgas=0.000 elapsed="301.13µs"  mgasps=0.000 number=394286 hash="5ae579…8ae413" dirty=0.00B
0|ethNode1  | INFO [10-02|21:10:54.250] Deep froze chain segment                 blocks=6 elapsed=7.777ms     number=304285 hash="2951e1…0aa545"

Connection from IP Address "217.227.191.41" seems to be from an unknown node. I've set --nodiscover as well as --netrestrict. Also blocked the IP address from Firewall using command:

ufw deny from 217.227.191.41 to any

But still the issue keeps happening and when I reload geth command, it works for a minute but same issue happens again. I'm also blocking RPC access as you can see in the GETH command. How do I prevent incoming connection that changes my miner account?

1 Answer 1

2

I had some private discussion with the author, but it is related due to the full access to the API's via HTTP, which a bot changed the miner address.
So I would sum it up as this: Do NOT leave Ethereum nodes with all RPC API's open to the public.
(If it wasn't you, then check what can be used to change it.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.