Security

Chapter 31: Node Security Fundamentals

Overview

Securing blockchain nodes is critical to protect your infrastructure and prevent unauthorized access.

---

31.1 Security Principles

┌─────────────────────────────────────────────────────────────────┐
│                    NODE SECURITY LAYERS                          │
├─────────────────────────────────────────────────────────────────┤
│                                                                  │
│   ┌─────────────────────────────────────────────────────────┐  │
│   │              1. NETWORK SECURITY                         │  │
│   │   - Firewall rules                                       │  │
│   │   - VPN/VPC isolation                                   │  │
│   │   - Port restrictions                                    │  │
│   └─────────────────────────────────────────────────────────┘  │
│                              │                                   │
│                              ▼                                   │
│   ┌─────────────────────────────────────────────────────────┐  │
│   │              2. ACCESS CONTROL                         │  │
│   │   - Authentication                                      │  │
│   │   - Authorization                                        │  │
│   │   - Rate limiting                                        │  │
│   └─────────────────────────────────────────────────────────┘  │
│                              │                                   │
│                              ▼                                   │
│   ┌─────────────────────────────────────────────────────────┐  │
│   │              3. DATA SECURITY                          │  │
│   │   - Encryption at rest                                  │  │
│   │   - TLS/SSL                                             │  │
│   │   - Key management                                      │  │
│   └─────────────────────────────────────────────────────────┘  │
│                              │                                   │
│                              ▼                                   │
│   ┌─────────────────────────────────────────────────────────┐  │
│   │              4. SYSTEM HARDENING                       │  │
│   │   - Run as non-root                                     │  │
│   │   - Regular updates                                      │  │
│   │   - Monitoring/alerting                                  │  │
│   └─────────────────────────────────────────────────────────┘  │
│                                                                  │
└─────────────────────────────────────────────────────────────────┘

---

31.2 Network Security

Firewall Configuration

# Allow only necessary ports
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow SSH
sudo ufw allow 22/tcp

# Allow P2P
sudo ufw allow 30303/tcp

# Allow RPC only from specific IP
sudo ufw allow from YOUR_IP to any port 8545

# Enable firewall
sudo ufw enable

Bind RPC to Localhost

# DON'T do this (exposes to public):
geth --http --http.addr 0.0.0.0

# DO this (only local access):
geth --http --http.addr 127.0.0.1

---

31.3 Key Management

Secure Key Storage

Method	Security	Use Case
Hardware Wallet	Highest	Validators
Keystore File	Medium	Development
Mnemonic	Medium	Backup
Private Key	Low	Never use

Best Practices

1. Never store private keys on RPC nodes
2. Use hardware wallets for validators
3. Keep backups in secure locations
4. Never share private keys

---

31.4 TLS Configuration

Enable TLS for RPC

# Generate certificates
openssl req -x509 -newkey rsa:4096 \
  -keyout key.pem -out cert.pem \
  -days 365 -nodes

# Use with Nginx proxy

---

31.5 Rate Limiting

Why Rate Limit?

• Prevent DDoS attacks
• Protect node resources
• Ensure fair usage

Nginx Rate Limiting

http {
    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=100r/s;

    server {
        location / {
            limit_req zone=api_limit burst=200;
        }
    }
}

---

31.6 System Hardening

Run as Non-Root

# Create dedicated user
sudo useradd -r -s /sbin/nologin ethereum

# Set ownership
sudo chown -R ethereum:ethereum /data/ethereum

Systemd Service

[Service]
User=ethereum
Group=ethereum
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/data/ethereum

---

31.7 Interview Questions

Question	Answer
How to secure RPC endpoint?	Bind to localhost, use TLS, rate limiting
Why run as non-root?	Limit damage if compromised
What is key management?	Secure storage and handling of private keys

---

Summary

• Network security: firewall, restrict ports
• Access control: rate limiting, authentication
• Key management: never expose keys on RPC nodes
• System hardening: run as non-root, regular updates

---

Next Chapter

In Chapter 32: Key Management & Wallets, we’ll explore key management.

---

Last Updated: 2026-02-20