1

For my dapp, I want to host a web server (Geth + web3) which allows the users to relay the transactions they signed "offline". Is this safe? Are there other (than unlocked accounts) security concerns with RPC?

1

Yes, in principle it should be fine. Your main concern would be DoS and people sucking up bandwidth, but this only aggravates a concern you already had when running a node, even without opening up your RPC interface.

That said, if you have any resources on the web server that do need to be secure (eg if you have keys managed by some other process that you're using to sign the transactions that you're ultimately sending to Geth) you might be better running Geth on a different server; It shouldn't matter if everything works as designed, but having this extra service open to the world inevitably broadens your attack service.

  • Thanks for your answer. One point is not very clear though. Yes my web server will have other data I want to keep secure. But I don't understand how running Geth on that server -rather than running it on another server- makes a difference. – jeff Mar 2 '17 at 12:17
  • @jeff Running anything extra on your web server - a DNS server, for example - would make it less secure. Attackers simply have more things to look for holes in. If you're not only running Geth, you're also running it in a more permissive way than it's normally run and exposing services on it that aren't usually exposed, that increases the chance that somebody will use it to hack your server. If you run it on another server, people finding a flaw in Geth can hack that server, but not the web server holding the secret. – Edmund Edgar Mar 2 '17 at 14:19
  • 1
    So a bug/security hole in Geth can expose the whole machine it's running on. In this case, running and accessing Geth on a remote machine seems more secure. Thanks! – jeff Mar 2 '17 at 21:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.