Ropsten Geth node consuming max CPU, RAM and DISK and geth logs show "Failed account unlock attempt"

Question

I have been running a Geth node on Ropsten for the past couple of months and it has been running fine; all my transactions go through and it hasn't been too heavy on the system resources either. I use the following command to start the node:

geth --datadir "C:/ropsten-test-net-project/Data/Node" --testnet --rpc --rpcport "8545" --rpcaddr "0.0.0.0" --rpccorsdomain "*" --rpcapi="personal, eth, network, web3, net" --ipcpath "C:/ropsten-test-net-project/Data/Node/geth.ipc" --syncmode "fast" console 2>>"E:/Etherium + Solidity/test-net-project/Logs/myLog1.txt" --cache 2048

For testing purposes, I have enabled port forwarding on my router and added inbound and outbound rules in windows firewall to allow other systems in my network to connect to this node.

The last few days, Geth started getting heavy on the resources, maxing out the CPU, SSD writes and almost maxing out 16 GB of RAM. At first i thought it is just processing new blocks but after a few Geth crashes and out of memory errors, i decided to look at the Geth logs and found the following lines repeated numerous times:

I was not conducting any transactions and my smart contract and server were not running when these logs were generated. To ensure this wasn't an attack, i enabled logging in windows firewall. Upon observing the firewall logs, i did not see any repeating IP addresses that would indicate requests coming from an attacker.

I would like to know if anyone else has experienced this (or similar) issue and how it can be resolved.

Answer 1

I believe I have figured out what's going on (please correct me if I am wrong). All those unlock attempts are caused by brute force attacks on my Ethereum node. The reason for that is that I have exposed my node by using --rpcaddr "0.0.0.0" --rpccorsdomain "*". This allows all IP addresses and all domains to send transactions to the Ethereum blockchain (in this case, the Ropsten test network) through my node.

Some suggestions to prevent such attacks:

1. Specify the address/addresses you want to accept requests from. (See this response for more details)

2. Specify the domains you want to accept requests form. (See this response for more details)

3. Configure your firewall to restrict access to rpc port (8545 in my case)

4. This one is more of a precaution than a solution and would really depend on what you are trying to build but I believe you should avoid keeping private keys in your node's keystore and instead only send signed transactions to your node.

I am still learning and exploring Ethereum. There may be better solutions than the ones I have listed but I am just sharing my own findings and the above solutions solved the problem for me.

Hope it helps.