0

I'm learning how to use bitcoind, and want to set up a side project that uses bitcoin to learn along the way. I'll be using the json-rpc with PHP on my server. I want to create a service that will receive bitcoins from users, and will eventually send those bitcoins either back to the users or to my own wallet.

In order to keep things secure, as soon as coins arrive at a user's unique address, I want to automatically forward them to another wallet that doesn't have the private keys on the server.

My questions are thus:

  1. What's the easiest way to handle the bitcoins from an off-server wallet (on my computer or such), without doing absolutely everything by hand? Would it be possible to write a script that does everything I want it to do with the off-server coins, after prompting me for the private keys? For example, a database could hold all the bitcoin commands that would need to be run, but it would need by "OK" to run (requiring the keys). Would the keys be somehow visible if someone got access to the server?

  2. If not the above method, how else can I automate the process as much as possible? The only thing I can think of currently is to do everything by hand: have a private wallet on my home computer, seeing what to do with bitcoins on various addresses, and manually sending them out using my home bitcoin client to the required addresses. This would be extremely tedious with a lot of users on the service. Surely there's a better, secure way?

  3. I don't want to keep private keys on the server for two reasons: a) I don't know anything about server administrations or server security, as I'm just a developer, and b) as a result, I have a managed server (managed by the host), so they could get into the server at any time. I'm wondering, can anyone suggest how to get started in server administration and security so that I can take it into my own hands?

Thank you.

EDIT: To clarify, I mean handling transactions that are off of the server, not actually in "cold storage." The off-server wallet could be hosted on my personal computer--I just don't want it on the server, since it's more prone to attack.

Improve this question
1
  • I wonder if #3 would get better answers at serverfault?
    – Neil Neyman
    Commented Aug 13, 2013 at 21:06

1 Answer 1

Reset to default
-1

Set up a cold storage machine, not connected to the internet but with boitcoin installed. Generate a bunch of addresses on the cold storage machine.

Using a USB drive, copy the addresses from the cold storage machine to the online system's database. No need to do anything with the private keys.

When needed on the online system, just send to 1 of the addresses in the database. This can be totally automated. You don't need a private key to send to an address.

Improve this answer
4
  • Accepting bitcoin is the easy part. My question was regarding automating the bitcoins AFTER they've been received. In other words, after a user has sent the bitcoins, I now how to do stuff with them--I'm not just accepting bitcoins and that's it. I need to be able to send them to other users, to me, or back to the sender.
    – timetofly
    Commented Aug 13, 2013 at 18:26
  • Consider doing as much as possible "off block chain". If there are transactions that take place entirely inside your system (i.e. "sending to yourself" or sending between users of your system) just keep track of balances in your own database. No need to do real blockchain transactions unless money is leaving your system.
    – RentFree
    Commented Aug 13, 2013 at 18:30
  • Also... there is the option of generating transactions on the cold storage machine, then transferring the transactions by USB to the online machine and then publishing them to the network.
    – RentFree
    Commented Aug 13, 2013 at 18:32
  • I do want bitcoins to leave the system, like I said, either to other users or back to the sender. As for the other option, I don't feel comfortable sending transactions that I may potentially not want to approve of (in case of a breach or hacker). I'd rather somehow "build up" what needs to be done, then only do it all after I've approved it. As for the cold storage machine, I meant to say my personal computer, which does have internet. I simply meant "off the server." I've edited my post to clarify that.
    – timetofly
    Commented Aug 13, 2013 at 21:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.