when I use the web3 interface to sign on msgs, it tell me that the account should be unlocked, how can I manage this with geth and what exactly does unlocking mean?
By default, your accounts in Geth are "locked," which means that you can't send transactions from them. You need to unlock an account in order to send transactions from it through Geth directly or via RPC (though web3 does not support this). In order to unlock an account, you'll need to provide the password, which is used to decrypt the private key associated with your account, hence allowing you to sign transactions.
With that being said, how do you unlock an account? There are a couple different ways you can do it, which are highlighted in the Geth documentation. I'll provide an overview:
Unlock account when you run Geth. The password parameter is optional. If you don't provide it, you'll be prompted to type in the password.
geth --unlock <YOUR_ACCOUNT_ADDRESS> --password <YOUR_PASSWORD>
Just to add to the excellent accepted answer.
You can also unlock the account from Web3 directly:
And lock it back:
For more details refer to the
what exactly does unlocking mean?
A Geth node implementation contains built-in account management, that is, it maintains the account's private key, which is stored on disk in encrypted form. Unlocking an account means decrypting its private key and storing it in memory (it is never stored decrypted on disk).
⚠ This means you should take extra care not to allow anyone access your Geth node via HTTP-RPC, WS-RPC or IPC, because these interfaces allow transferring ether from any unlocked account! ⚠