1.5 Security¶
Your node will be online 24/7, so lock it down before installing anything else.
Firewall (UFW)¶
Allow only what's needed. Every guide that opens a port adds its own rule later.
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp comment 'SSH'
sudo ufw logging off
sudo ufw enable
ufw enable warns that it may disrupt existing SSH connections. Your SSH rule is already in place, so answer y.
Validation¶
Status: active
Logging: off
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip
To Action From
-- ------ ----
22/tcp ALLOW IN Anywhere # SSH
22/tcp (v6) ALLOW IN Anywhere (v6) # SSH
No ports open on your router
MoneroBox never opens ports on your router: there's no port forwarding in this guide, and UPnP (automatic port opening) is switched off in every service that has it. So a port you open with ufw is only reachable from devices on your home network, never from the internet. Your node still works normally: it makes outgoing connections to its peers.
Check your router's settings too: if it has UPnP turned on, turn it off, so no device on your network can open ports by itself.
Brute-force protection (fail2ban)¶
fail2ban bans IP addresses after repeated failed SSH logins. The default setup protects sshd out of the box:
Validation¶
Status for the jail: sshd
|- Filter
| |- Currently failed: 0
| |- Total failed: 0
| `- Journal matches: _SYSTEMD_UNIT=ssh.service + _COMM=sshd
`- Actions
|- Currently banned: 0
|- Total banned: 0
`- Banned IP list:
Depending on the fail2ban version, the Filter part may list a log file instead of Journal matches. Either is fine, as long as the jail shows up at all.
Automatic security updates¶
Answer Yes. Security patches now install automatically. Monero, P2Pool and XMRig aren't installed through apt, so you still update those by hand. Each guide has an Upgrade section.
Validation¶
Do a dry run to check that it works:
There should be no errors. Past runs are logged in /var/log/unattended-upgrades/.
Reboots
Kernel updates only take effect after a reboot. When one is pending, the file /var/run/reboot-required exists and the login message says "System restart required". Reboot when it suits you, with sudo reboot.
Increase open file limits¶
monerod keeps many peer connections and database files open. Raise the limit:
(The systemd services in this guide also set LimitNOFILE themselves.)
Never expose the unrestricted RPC¶
monerod's unrestricted RPC on port 18081 can stop the daemon, change its settings and more. It stays bound to 127.0.0.1 and is never opened in the firewall. Wallets use the restricted RPC on port 18089 instead, which you set up in 2.1.
Extras (optional)¶
See who logged in, and who tried
SSH logs every login attempt to the system journal:
Accepted lines are successful logins. Check that each one was you.
Reboot automatically after updates
If you'd rather not reboot by hand, let unattended-upgrades do it at a quiet time. Edit /etc/apt/apt.conf.d/50unattended-upgrades and set:
List and remove firewall rules
Troubleshooting¶
I locked myself out with the firewall
Log in at the node's own keyboard and screen, then turn the firewall off, fix the rules and turn it back on:
fail2ban banned my own computer
This happens after a few wrong passwords. From another device or the node's console: