How can I take steps to prevent/detect bad employees stealing my money?
I'm running bitcoind on a VPS with Ubuntu 14.04. Only ports open are 22, 80 and 443. I have fail2ban and auditd enabled.
Anyone have any other practical tips?
2 Answers
The only real solution is to not keep private keys on that server. Keep them on a computer that only you can access, or offline in a paper wallet.
Encrypting the wallet will help somewhat, but a malicious administrator could log your passphrase when you unlock the wallet, or extract the decrypted private key from the server's memory.
If the server must have private keys (e.g. because it has to make payments), then your software should be designed to keep only the minimum balance necessary in the server's wallet, and sweep the rest to addresses whose keys you hold elsewhere.
answered Sep 4, 2014 at 22:47
You could hold your keys on another server and just pull them across to your VPS server when needed, if you used something like sx tools then you could have your private key data on a separate server to your bitcoind software. When you need to make a payment the separate server could provide the raw transaction data required to push just that transaction to the network. Using sx tools you can create a raw transaction and submit it to a bitcoind node.
Of course this just passes the responsibility to another server but not having to run a bitcoin node on it at least means it's a bit more below the radar if that's what you're worried about.
