Take the 2-minute tour ×
Bitcoin Stack Exchange is a question and answer site for Bitcoin crypto-currency enthusiasts. It's 100% free, no registration required.

I'm making first, rough concepts of some ideas for bitcoin-enabled services I have in mind.

One thing that I wonder is, is there a best-practise approach on running bitcoind on another server that acts as backend for a particular other server?

I thought of something like that:

I have a vServer A and a plain and simple PHP-Webspace at another host B.

A runs my bitcoind-deamon and only allows RPC-calls from Bs IP.

B makes its RPC-calls to A in a server-proccess which was not triggered by a client/website-visitor.

How safe would you ensure such a scenario? Is it possible that nodes, connected to my vServer A, identify the servers purpose from the transactions and try to attack him?

Even if they do, they would have to use a MiM-attack, because A only accepts Bs IP.

What else can I do to make the communication more secure? HTTP-Auth, SSL?

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

Is it possible that nodes, connected to my vServer A, identify the servers purpose from the transactions and try to attack him?

Yes, if they can see enough of the network, they can figure out whether you are originating a transaction or just passing it on. It's still easier figure out you're running rpc through a port scan though.

There are ways to prevent a port scan from finding this, like using iptables (Ctrl-F 'except'). Be careful, because just using DROP will still tell attackers that there's something special about that port.

share|improve this answer
    
Thanks for your tipp (: I'll wait a little bit longer for other answers before marking yours as solving –  Gundon Jan 26 '13 at 20:49
add comment

If you have SSH access on both machines you can simply create an SSH tunnel from machine B to A and forward port 8332 through it. That way the behavior is just like it would be if bitcoind were installed on both machines, the traffic between the two machines is encrypted with SSH and bitcoind does only have to listen to the loopback interface and would not be accessible from the network.

share|improve this answer
    
Doesn't bitcoind natively speak SSL ? –  David Feb 2 '13 at 11:24
    
Yes it does but you'd still have to open the port to the network. –  cdecker Feb 2 '13 at 11:34
    
I don't see how a SSH tunnel really improves security in that case then. Additonnally I found tools like stunnel to be quite unstable and would, in the general case, avoid adding moving parts to a server setup unless they're absolutely required. –  David Feb 2 '13 at 13:52
add comment

I understand the initial logic to put the bitcoind & wallets onto a separate server, but think about it... if your webserver becomes compromised, then it doesn't matter where your bitcoind is.. it is also compromised.

Example; Bitcoind is on server A, webserver is on server B. webserver B sends requests -> to bitcoind server A . . replies -> back to webserver A.

Thus, if I compromise your websever B, I can tell it to send a message back to the bitcoind server saying sendtoaddress [myhackeraddress] and that's it. Funds gone.

share|improve this answer
    
That is partly true. But it can be further protected.. If I only create a specific set of commands in my own interface which is the only way for both servers to communicate to each other, the attacker can also only use these. Although you are right: Most websites would need to support something like makeTransaction(amount, from, to) –  Gundon Sep 6 '13 at 13:17
    
@Gundon brings up a good point ~ you could setup the bitcoind server to only accept a predefined range of allowable rpc calls, like: getbalance..etc. –  AndreeCrist Sep 7 '13 at 0:46
    
And if time is not critical and it is okay to only make all transactions once a day, you could also password-protect specific rpc-calls. If you write a wrapper on the bitcoind-server that could also be done per user and the password wouldn't need to be stored on your public server –  Gundon Sep 7 '13 at 9:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.