Configuring an Air-gapped, Offline Computer
Store and safeguard the sensitive secret (private) keys for your stake pool using an air-gapped, offline computer. The most effective technique to prevent private key exposure is to guarantee that a necessary private key is never held for any length of time on any Internet-connected computer, also known as a hot node. Your air-gapped, offline computer may also be referred to as a cold environment.
Your air-gapped, offline computer:
Protects against key-logging attacks; malware- or virus-based attacks; and, other firewall or security exploits
Must not have a wired or wireless network connection
Is not a virtual machine (VM) on a computer having a network connection
Is physically isolated from the rest of your network
Read more about requirements to Air Gap.
System Requirements
The system requirements for the air-gapped, offline computer that you use to support your stake pool operation are minimal. The computer must support the same operating system that you install on your hot nodes. For example, you may use a Raspberry Pi or an upcycled older computer or laptop.
Your cold environment requires a USB port to facilitate transporting files to and from your block-producing node using a USB stick or other removable media.
Copying the cardano-cli Binary
Copy the cardano-cli
binary that you produced when Compiling Cardano Node to your air-gapped, offline computer.
To copy the cardano-cli binary to your cold environment:
Insert the removable media that you want to use to transfer files into a hot node where you compiled the
cardano-cli
binary.If you followed the Coin Cashew guide, then copy the
cardano-cli
binary located in the folder/usr/local/bin/
to the removable media that you inserted in step 1
If you do not know the location of the cardano-cli
binary, then type which cardano-cli
Eject the removable media from your hot node, and then insert the removable media into your air-gapped, offline computer.
On your air-gapped, offline computer, copy the
cardano-cli
binary from the removable media to the/usr/local/bin/
folder.To give execute permissions to the
cardano-cli
binary, type:
Setting the NODE_HOME Environment Variable
For convenience when following the Coin Cashew guide, create a NODE_HOME
environment variable on your air-gapped, offline computer set to the same file path that you set on your block-producing and relay nodes when Installing GHC and Cabal.
To create a NODE_HOME environment variable:
On your air-gapped, offline computer, open the file
$HOME/.bashrc
using a text editor, and then add the following line at the end of the file:
To create the folder set for the
NODE_HOME
environment variable in the$HOME/.bashrc
file, type:
To reload your shell profile, type:
Installing libsecp256k1
To use the cardano-cli
binary on your air-gapped, offline computer you must also install the libsecp256k1
library that you installed on your hot nodes. Use the following procedure to install libsecp256k1
without connecting your air-gapped, offline computer to the Internet.
Alternately, thanks to TerminadaPool, if you prefer you can create your own Debian (DEB) package to install libsecp256k1
offline.
To install the libsecp256k1
library on your air-gapped, offline computer:
On the air-gapped, offline computer, open the
$HOME/.bashrc
file using a text editor, and then add the following lines at the end of the file:
Save and close the
$HOME/.bashrc
file.To reload the
$HOME/.bashrc
file, type:
On the air-gapped, offline computer, if the
/usr/local/lib/pkgconfig
folder does not exist, then type the following command to create the folder:
Using removable media, copy the following four files from a block-producing or relay node where you installed
libsecp256k1
to the same location on your air-gapped, offline computer:
To set file permissions and ownership for the
libsecp256k1
library files on the air-gapped, offline computer, type the following commands using a terminal window:
To create symbolic links, type:
Type
ls -la
and then confirm that in step 7 you created the following symbolic links:
To update available symbolic links for currently shared libraries, type:
Installing the blst Library
To install the blst
library on your air-gapped, offline computer without connecting to the Internet:
Using removable media, copy the
blst
folder from a block-producing or relay node where you installed the library to your air-gapped, offline computer.Type the following commands: