0

I'm interested in setting up a P2Pool node (which requires running bitcoind) to run a little mining pool for myself. Before you ask, nope I'm not even trying to break even, I know I'll lose money on this. Just want to play around and get a feel for how these things work.

My question is: I hear over and over again that it's important to take security precautions with bitcoind and wallets, but I've had trouble teasing out exactly what those security precautions are. If I have bitcoind not accepting RPC calls (as is the default), is there any danger to using the out-of-the-box unencrypted wallet?

If the information helps, I'll probably run the node in EC2, and have a cron job that frequently transfers any bitcoins earned through mining into an account in an exchange so I can play around with that side of things as well (so I'm not worried about large sums of bitcoin building up in my bitcoind wallet).

Improve this question
1
  • Thanks for the edit; my question clarified itself as I was writing it and I forgot to change the title. :)
    – ConstableJoe
    Commented Mar 10, 2015 at 1:39

2 Answers 2

Reset to default
1

Turning off RPC will prevent that particular attack vector, but if the coins are on a machine connected to the internet, that's a lot of vulnerabilities and attack vectors to consider.

That said, if you're running a node on EC2, you're not going to generate enough bitcoins to be worth stealing. If the point is to figure out how everything works, I wouldn't worry about the bitcoins you'll be mining since it'll be so little (at most $10 per year).

Improve this answer
1
  • I'm not interested in the money but I am interested in the security considerations. Could you elaborate on some of the vulnerabilities/attack vectors you mention?
    – ConstableJoe
    Commented Mar 10, 2015 at 2:16
0

Whether bitcoind is accepting RPC calls has very little bearing on whether it's secure. By default, bitcoind only accepts connections originating from the local computer. In most situations where an attacker can make connections to RPC, they would have the ability to look in your wallet folder and copy your wallet off. (There are a bunch of tricky exceptions to that. For example, it's possible to take away a user's SSH privileges without taking away their ability to use SSH port forwarding.)

Additionally, if you turn on RPC, bitcoin will generate a password for it which is too long to be guessed. (This password is different from wallet encryption.)

If your wallet was encrypted, then you wouldn't be able to use a cron script to automatically transfer your Bitcoins to your exchange account.

I would call leaving your wallet unencrypted an acceptable security risk.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.