Security Best Practices for your ETH staking validator node
Quick steps to secure your node.
Completing this guide will provide a solid baseline to protect and secure your staking node.
- Ubuntu Server or Ubuntu Desktop installed on a local computer. Bonus points for increasing decentralization of Ethereum and not relying on cloud providers.
- a SSH client or terminal window access
In case you need a SSH client for your operating system, refer to:
If you're using Ubuntu Desktop then you're likely currently on your staking node. Simply open a terminal window from anywhere by typing Ctrl+Alt+T.
Otherwise, begin by connecting to Ubuntu Server with your SSH client.
Create a new user called ethereum
sudo useradd -m -s /bin/bash ethereum
Set the password for ethereum user
sudo passwd ethereum
Add ethereum to the sudo group
sudo usermod -aG sudo ethereum
If you're using Ubuntu Desktop locally, you can skip this section.
The basic rules of hardening SSH are:
- No password for SSH access (use private key)
- Don't allow root to SSH (the appropriate users should SSH in, then
su
orsudo
) - Use
sudo
for users so commands are logged - Log unauthorized login attempts (and consider software to block/ban users who try to access your server too many times, like fail2ban)
- Lock down SSH to only the ip range your require (if you feel like it)
Create a new SSH key pair on your local machine. Run this on your local machine. You will be asked to type a file name in which to save the key. This will be your keyname.
ssh-keygen -t ed25519
Your SSH key pair is stored in your home directory. For example, if your keyname was mySSHkey, then your private SSH key is
mySSHkey
and your public SSH key is mySSHkey.pub
IMPORTANT: Make multiple backup copies of your private SSH key file to external storage, such as a USB backup key, for recovery purposes.
Verify the contents of your private SSH key file before moving on.
cat <keyname>
It should look similar to this example.
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACBAblzWLb7/0o62FZf9YjLPCV4qFhbqiSH3TBvZXBiYNgAAAJCWunkulrp5
LgAAAAtzc2gtZWQyNTUxOQAAACBAblzWLb7/0o62FZf9YjLPCV4qFhbqiSH3TBvZXBiYNg
AAAEAxT+yCmifGWgbFnkauf0HyOAJANhYY5EElEX8fI+M4B0BuXNYtvv/SjrYVl/1iMs8J
XioWFuqJIfdMG9lcGJg2AAAACWV0aDJAZXRoMgECAwQ=
-----END OPENSSH PRIVATE KEY-----
Transfer the public key to your remote node. Replace <keyname.pub> appropriately.
ssh-copy-id -i $HOME/<keyname.pub> [email protected]
Login with your new ethereum user
ssh ethe[email protected]
Disable root login and password based login. Edit the
/etc/ssh/sshd_config file
sudo nano /etc/ssh/sshd_config
Locate PubkeyAuthentication and update to yes. Delete the #, if needed.
PubkeyAuthentication yes
Locate PasswordAuthentication and update to no
PasswordAuthentication no
Locate PermitRootLogin and update to prohibit-password
PermitRootLogin prohibit-password
Locate PermitEmptyPasswords and update to no
PermitEmptyPasswords no
Optional: Locate Port and customize it your random port.
Port <your random port number>
A valid random port # ranges from 1024 thru 49141.
Check that the port is not already used by other services. Replace <port> with your random port #.
sudo ss -ntlp | grep :<port>
Empty response means the port is good.
A response with red numbers means the port is already used. Choose another port.
Validate the syntax of your new SSH configuration.
sudo sshd -t
If no errors with the syntax validation, restart the SSH process
sudo systemctl restart sshd
Verify the login still works
Standard SSH Port 22
Custom SSH Port
ssh [email protected] -p <custom random port number>
Optional: Make logging in easier by updating your local ssh config.
To simplify the ssh command needed to log in to your server, consider updating your local
$HOME/.ssh/config
file:Host ethereum-server
User ethereum
HostName <staking.node.ip.address>
Port <custom random port number>
This will allow you to log in with
ssh ethereum-server
rather than needing to pass through all ssh parameters explicitly.It's critically important to keep your system up-to-date with the latest patches to prevent intruders from accessing your system.
sudo apt-get update -y && sudo apt dist-upgrade -y
sudo apt-get autoremove
sudo apt-get autoclean
Enable automatic updates so you don't have to manually install them.
sudo apt-get install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades
Reboot your system to enable the upgrades.
sudo reboot
The standard UFW firewall can be used to control network access to your node.
With any new installation, ufw is disabled by default. Enable it with the following settings.
- If you used a custom random SSH port, replace "22" with your actual port #.
Lighthouse
Prysm
Teku
Nimbus
Lodestar
# By default, deny all incoming and outgoing traffic
sudo ufw default deny incoming
sudo ufw default allow outgoing
# Allow ssh access
sudo ufw allow 22/tcp
# Allow consensus client port
sudo ufw allow 9000
# Allow execution client port
sudo ufw allow 30303
# Enable firewall
sudo ufw enable
# By default, deny all incoming and outgoing traffic
sudo ufw default deny incoming
sudo ufw default allow outgoing
# Allow ssh access
sudo ufw allow 22/tcp
# # Allow consensus client port
sudo ufw allow 13000/tcp
sudo ufw allow 12000/udp
# Allow execution client port
sudo ufw allow 30303
# Enable firewall
sudo ufw enable
# By default, deny all incoming and outgoing traffic
sudo ufw default deny incoming
sudo ufw default allow outgoing
# Allow ssh access
sudo ufw allow 22/tcp
# Allow consensus client port
sudo ufw allow 9000
# Allow execution client port
sudo ufw allow 30303
# Enable firewall
sudo ufw enable
# By default, deny all incoming and outgoing traffic
sudo ufw default deny incoming
sudo ufw default allow outgoing
# Allow ssh access
sudo ufw allow 22/tcp
# Allow consensus client port
sudo ufw allow 9000
# Allow execution client port
sudo ufw allow 30303
# Enable firewall
sudo ufw enable
# By default, deny all incoming and outgoing traffic
sudo ufw default deny incoming
sudo ufw default allow outgoing
# Allow ssh access
sudo ufw allow 22/tcp
# Allow consensus client port
sudo ufw allow 9000
# Allow execution client port
sudo ufw allow 30303
# Enable firewall
sudo ufw enable
Confirm the settings are in effect.
sudo ufw status numbered
Example of properly configured ufw status for Lighthouse.
To Action From-- ------ ----[ 1] 22/tcp ALLOW IN Anywhere[ 2] 9000 ALLOW IN Anywhere[ 3] 30303 ALLOW IN Anywhere[ 4] 22/tcp (v6) ALLOW IN Anywhere (v6)[ 5] 9000 (v6) ALLOW IN Anywhere (v6)[ 6] 30303 (v6) ALLOW IN Anywhere (v6)
Port Forwarding Tip: You'll need to forward and open ports to your validator.
Verify port forwarding is working with
As an example, for Lighthouse, you would verify ports 9000 and 30303 are reachable.
For advice on configuring port forwarding with routers, refer to this general port forwarding guide.
[ Optional ] Whitelisting, which means permitting connections from a specific IP, can be setup via the following command.
sudo ufw allow from <your local daily laptop/pc>
# Example
# sudo ufw allow from 192.168.50.22
Fail2ban is an intrusion-prevention system that monitors log files and searches for particular patterns that correspond to a failed login attempt. If a certain number of failed logins are detected from a specific IP address (within a specified amount of time), fail2ban blocks access from that IP address.
sudo apt-get install fail2ban -y
Edit a config file that monitors SSH logins.
sudo nano /etc/fail2ban/jail.local
Add the following lines to the bottom of the file.
Whitelisting IP address tip: The
🔥
ignoreip
parameter accepts IP addresses, IP ranges or DNS hosts that you can specify to be allowed to connect. This is where you want to specify your local machine, local IP range or local domain, separated by spaces.# Example
ignoreip = 192.168.1.0/24 127.0.0.1/8
[sshd]
enabled = true
port = <22 or your random port number>
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
# whitelisted IP addresses
ignoreip = <list of whitelisted IP address, your local daily laptop/pc>
Save/close file.
Restart fail2ban for settings to take effect.
sudo systemctl restart fail2ban