1

When using geth as client and web3(javascript api) to interact with it through a web browser, other nodes in the network can access the client given the IP and the port on which the client is running.

How can this be prevented?

How can the access be restricted to the node(computer) running the client and not the others in the same network?

the flow is as follows

Browser(user)----->Server(running the node)------>GETH

the first link is http and the second link is rpc. the http link makes it possible for other computers to access my node which is to be stopped.

Only the node(computer) running the geth client should access the geth client.

  • Not sure, but I think --rpccorsdomain may help. – Prashant Prabhakar Singh Jul 19 '17 at 5:18
  • I am a bit confused here. My connection is such User(browser)----(http)--->Computer Server(node running the client geth)----(rpc)----->geth now other computers in the network can access my geth client through the app hosted by my computer...I want to restrict that – anonymous Jul 19 '17 at 6:17
3

This can be prevented by introducing a middleware, which will talk to your geth node and let your UI talk to the middleware instead of talking to geth node directly.

I faced a similar issue and I solved it by creating a middleware in Node.js

With this, your geth node won't be exposed to the public and that saves us from some security issues.

enter image description here You can check this project for reference - https://github.com/Imaginea/lms

  • I am new to this. Can you tell me about some references that can help me understand exactly how this is to be done – anonymous Jul 21 '17 at 10:19
  • 1
    Edited my answer for your better understanding of my proposed architecture. Also, for reference you can look into the Github URL I've shared, this is built on the same architecture I've shared. let me know if you find difficulty understanding it. – Sanchit Jul 21 '17 at 11:56
  • Is the middleware similar to an http server?. I have an http server running on node.js. My problem is all people having access to the server hosted app can communicate with the geth client. Also thanks a lot for your help. – anonymous Jul 21 '17 at 13:38
  • 1
    yes, it is similar to an HTTP server and if your geth node is running on port 8545 which is not accessible outside of the box(machine), that means your UI/or any one else can't interact with geth node by any chance apart from node.js server(which is on the same machine) – Sanchit Jul 21 '17 at 13:56
  • 1
    Implement authentication, only authenticated users shall be able to execute commands. – Sanchit Jul 23 '17 at 14:44
0

I think rpccorsdomain may be the thing you are looking for.

--rpccorsdomain: value Comma separated list of domains from which to accept cross origin requests (browser enforced)

You can specify rpc doamins like:

geth --rpccorsdomain 'http://localhost:8080', 'http://xxx:8080'
  • This is a worthwhile security measure, but can easily be faked. – Thomas Clowes Jul 19 '17 at 15:49
0

Some misc thoughts.

Things can be faked. A committed attacker can interact with a public node. Simple as - that is the nature of a public node.

That said you can do things to make it harder. The RPC configuration options - --rpccorsdomain for example, and --rpcport to restrict how your node can be accessed.

Another option is to 'hide' your node behind a proxy.

You could for example use nginx with a proxy configuration location.

location /node {

      proxy_pass http://node-ip:node-port;
}

That way only the proxy address is exposed to the end user.

For securing Ether, do not 'save' accounts on a publicly accessible node. If you do, do not unlock them for longer than necessary. Ideally use a hardware wallet to store value.

If there is nothing to target or steal no-one will attack you..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.