Securing Quorum Geth Node

Question

I have a dapp node which uses web3js to send transactions to quorum geth node. The html pages shows the http provider and the ports. In theory anyone can use these ip and public address in the html to do postman rpc json calls to transfer assets away.

How can someone secure these ports when they are required to be opened for web3js to send transactions to? By openiny these ports anyone can connect to.

Of course one can firewall to allow only the dapp instance to connect to. But the dapp static html page will still hold thr connection details. One can also use an active directory or nginx to secure the access to the dapp and/or json rpc api.

Are there any other solutions on top of the above mentioned to secure quorum geth nodes?

Answer 1

basically, the only security for rpc right now is exactly what you said: secure and lock down the access to the box.

Next version of Quorum will include secure rpc end-points, tho I do not have implementation timeline for you just yet. Additionally, cakeshop offers secured API that maps rpc into rest / socket based APIs.

Answer 2

Quorum nodes now offer Json-rpc call in https. it works with OAtuth2. Please check this documentation page for the same. There is still nothing mentioned about secure the node.

https://docs.goquorum.consensys.net/en/latest/HowTo/Use/JSON-RPC-API-Security/