Just noticed I can access 8545 from localhost but fortunately not from the web/internet. Do I need this at all?

e.q. I read about someone who had lost $20 million due to someone else sending a call to port 8545 every 2 seconds. So aren't these things protected by password/account locking?

Ideally I may use 8545 from the net for as long as I know I can protect it with strong pass + firewall ip banning. 10x!

  • 1
    Sorry, I meant to say "steal" not "still"... – kpopguy Aug 13 '18 at 17:17

Someone can take your ether provided:

  1. The eth_* APIs are exposed over RPC (at a minimum). They usually are.
  2. You have at least one unlocked account, or accounts are unlocked during regular node operations (by other scripts, for example, or via the console).

There are a number of bots out there that actively scan for ethereum nodes, and will continuously try and sweep funds, hoping to catch the few seconds when accounts are unlocked.

For safety, your options are:

  1. Keep no keys on the node, and expose the RPC port - This is essentially what services like Infura do
  2. Keep keys on the node, but limit access to the APIs to only trusted parties.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.