0

What are the security Implications of allowing remote RPC connections to Geth Node?

If one absolutely needs to allow remote rpc connections for web3 connection, how can one do this while securing the geth node?

0

I don't see any security implications of allowing RPC connections, as long as there are no accounts created on that node (by default there aren't). You can then use Web3 to connect to that node, handling all the encryption (important security stuff) on that local client.

At this point, your biggest problem is running an "open" geth proxy that others could connect to and potentially utilize its resources without your control.

  • There will be accounrts running on the node. These accounts are already created. If web3 connects to that node dapp rubning on it, would it be secure? Can anyone hijack the node and sign ethers away? – Nathan Aw Jul 29 '18 at 4:49
  • I would never suggest storing any passwords on a "connected" server, seems inevitable until you're hacked. So to handle the secure communications, perhaps you can setup SSL to the RPC port (nginx is a good reverse proxy) and then communicate (and authenticate) over HTTPS or WSS (secure web socket). Bottom line is that you have to send "authentication" over the wire to unlock the geth accounts, so you better do it securely. – nyusternie Jul 29 '18 at 14:12
  • How to send authentication? Via nginx? – Nathan Aw Jul 29 '18 at 15:21
  • i haven't verified this, however, you might want to start here tokenmarket.net/blog/… – nyusternie Jul 31 '18 at 17:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.