With genesis right around the corner I recently decided to get more serious about learning the ins and outs of staking. I'm very much a "prepare for the worst, hope for the best" kind of guy, and so as part of that process I wanted to give security the proper attention it deserves. Considering the fact that a single validator could be worth a lot more, even in the near future, than it is today I think becoming informed here is worthwhile even for the single validator club.
Unfortunatly I came to realize that there aren't many consolidated resources that discuss network basics, machine setups, and other relevant security considerations. For those like myself who have little experience in these areas, it can be a daunting task to try and compile all of the relevant information or even know where to start in order to bring yourself up to speed. In some cases it might even make the difference in people deciding whether or not they feel comfortable participating. I've spent the past few days attempting to give myself a crash course on these subjects and this post will basically be a dump of that information. To be clear, this isn't a guide on how to set things up, it's an overview on the components and options you may want to look at when considering security.
My hope for this post is that it:
- (1) Provides people who have no prior knowledge with some useful starter info. Some of the actual staking guides go into how to accomplish the things mentioned below, but they assume a base level of knowledge, and don't go into why you're doing certain things or how it works. Personally speaking, knowledge gaps like that make me uncomfortable. This will hopefully clear some of that up and give those people a base level of understanding.
- (2) Encourages people more knowledgable than myself to share their knowledge and correct any flaws in my understanding.
- (3) Addresses some security considerations that don't come up in guides, or may be addressed in a multitude of other places without being consolidated anywhere.
- (4) Sparks discussion on which setups people believe are preferable and what they plan to use themselves. For example, a lot of people more knowledgeable than myself might think that some of these considerations are overkill and not worth worrying about. Hearing the opinions of other stakers when it comes to security can be a useful tool for any potential staker, from those that are still evaluating what their setup is going to look like, to those who may have not considered all of angles.
I found it helpful for my own understanding to break up the various considerations into logical layers. The attached image is a quick drawing I made to help me visualize things, and may be useful to look at while reading the rest of this post: https://imgur.com/a/FGeUeYA I. Local Network Considerations:
Starting with your local network, your ISP provides you with a router that enables you to use their internet service. In addition to acting as a gateway between your devices and the internet, that router creates a local network (LAN) for all of your devices to attach to. Each of the devices on your local network is assigned a local
IP address which can be used to monitor and interact with other devices in
the network. It's not hard from a device within your network to monitor activity of other devices that are also in that network, and doesn't require any kind of special configuration. On the other hand, actual communication
between devices on your network does require configuration. Assuming your staking device is a linux machine as most are, it comes with a built in firewall. In order for your firewall to allow communication from other network devices into your staking machine you must open ports, which are basically tunnels in the firewall that allow specific types of traffic. One example of this is SSH, which allows you to log into and control one device in your network from a different device in the network. This could be helpful in diagnosing problems on your staker if something goes wrong and you lose access to the graphical user interface, or if the device is headless (no graphical user interface; only a text console).
Opening ports works fine for enabling communication between devices in general, but sometimes it's important to achieve a finer grain of control over that traffic. For instance, maybe you want other devices on your network to be able to SSH into your staker, but you don't
want your staker to be able to SSH into the rest of your network. One option to accomplish this is to write very specific rules for programs (iptables/nftables) that configure the built in firewalls of linux machines. In this case you might create rules on those other devices that say: "allow outbound traffic on my open SSH port but disallow inbound traffic". Writing these rules tends to heir on the advanced side of things, but luckily there are also user-friendly tools that act as front ends to these programs (UFW/Firewalld) which make the process of setting up these rules easier. Apart from writing firewall rules another option could be to make use of your router settings. Some routers come with the ability to segregate your network into virtual networks (VLANs) and define which devices are allowed to access which VLAN. By segregating your staking device into its own VLAN you may be able to prevent access the rest of your network more easily than you would by writing firewall rules at the device level.
A couple more things you might overlook when it comes to your local network security is how easy you make it for other poeple to access your network. One example is how frequently you hand out your WiFi password to guests. A lot of people do this without a second thought, but as you can imagine allowing anyone into your network isn't the best practice especially if the person you're letting in happens to be tech savy. They could monitor or interact with your devices in ways you woundn't want, for informational purposes or otherwise. So aside from telling your guests that they can't use your WiFi what can you do? WiFi security in general is an area I still don't know much about. Based on my initial research I believe most people's WiFi connections come with 2 signals, (5G/2G) and it may be possible to separate those signals into two separate networks. This would allow you to keep your staker and other important devices on one network, and your Alexas/Googles/guest-devices on the other. If this is the case you could still give out your WiFi password as much as you want and it would be a cheaper than buying a separate internet connection to accomplish the same thing. I believe VLANs may also help here as well, but I'd have to look into it further to say for certain. Another example of making it easier for people to access your network is that many people never change the password or other publicly viewable information that was initally set on their router. If this password isn't complicated it might make it easier people to brute force their way into your network, especially if you live in an apartment complex where your network likely extends into multiple other people's homes who you don't know. If the router or network ID is something standard that gives away the model of the router this might make it easier for someone to know what to do to give themselves admin privileges or change settings. This one is easy to get around, just log into your router and change the defaults. II. Internet Connection Considerations
Lets talk about allowing inbound traffic from outside of your network. Your router has its own built in firewall, which is the primary line of defense for your local network. By default it allows certain types of internet traffic to and from your devices, allowing you to do things like browse the internet, while also disallowing other types of traffic such as incoming SSH connections from outside of your network. But let's say you're going on extended vacation and want to be able to remotely access your staker to check on it. There are two ways that I know of to allow this kind of access from outside of your network. The first one involves port-forwarding from your router. Aside from your network devices having ports, your router has ports as well. You could open the routers' SSH port and forward all traffic from that port to the open SSH port of your staker. This is not without risks. There are plenty of malicious individuals and scripts that specifically watch for open ports and attempt to brute force their way into people's networks. Certain precautions can be taken to make this SSH access more secure, such as: disabling SSH login for the root user of your staker, using pubkey authentication instead of username/password, using 2FA, installing fail2ban which will blacklist IP addresses after a certain amount of failed login attempts, whitelisting certain IP addresses, and more. Allowing this kind of inbound access to your staker would be a prime example of why you might want to create firewall rules or use a VLAN as mentioned above; to disallow access from the staker to the rest of your network in the case that someone is able to get into the device. Another way to allow secure access to a device in your network would be to install VPN (virtual private network) software on your device. This would allow you to log in to the VPN from outside of the network and have full access to the rest of your network devices. This is typically considered more secure than opening up an SSH port at the router level, since it can't be watched for, but common sense practices like making a hard to crack username/password still apply.
Now let's talk about outbound traffic to the internet. As I said earlier your router acts as a gateway or middleman to the internet for all of other the devices on your network and routes that traffic outward. Your router itself has its own public IP address which is how you are identified on the internet. The standard way this works is that traffic from your device is first sent to the router, then out to your ISP's data center, and then from there that traffic is routed its destination on the internet. Your ISP provider is able to see your routers public IP address (obviously) and can see the location on the internet that you are sending information to and receiving information from. Sometimes the contents of what you're sending and receiving is encrypted (https when browsing the web for example) and in those cases they have no way of seeing the actual contents of that web traffic, only see the destination. In the case of staking it's likely that other validators or staking peers will be able to see your IP address. Is that dangerous? People have mixed opinions. In general your IP address will only give a rough geographical location, it won't tell them your exact home address. For people trying to find your location through your IP address without any other information, the trail usually ends at your ISP's data center. Additional web browsing or internet activity like logins to social media platforms may allow certain entities to match an IP with your identity, but that's a different discussion and probably not relevant to staking.
Having said that, for some people exposing their IP address is a concern. Namely individuals that don't trust their ISP providers to not sell their data, and individuals who have ISPs that throttle connections for certain types of internet activity. In the case of stakers it could also apply to those who don’t want to reveal their IP address to other stakers. For these people there are a few options. The two most prevalent are to either use a VPN (virtual private network) service, or to use a VPS (virtual private server) service with your own self-hosted VPN software. A VPN or virtual private network encrypts all of your internet traffic and forwards it to your VPN provider who then sends it to its destination. Many VPN providers exist outside of the US, have no log policies, are open source and audited, and allow a lot of configuration when it comes to which of their servers you want your traffic to exit from. Some common practices are to: choose a VPN with plenty of available exit servers so that if one server goes down it's easy to switch; choose an exit server with a lot of traffic for better protection against tracking; and choose an exit point that is closer to your location for better speed. Some concerns with VPNs are: they might make your connection slower depending on your location, and you have to trust the VPN provider to not sell or hand over your data the same way your ISP hypothetically could. On that last point and as a general rule of thumb, if a product is free then you are the product. The other common option is to use a VPS or virtual private server and set up your own self-hosted VPN software. This is probably cheaper and faster than using a commercial VPN service, and may be better for privacy and control over logs kept, and thing of that nature. The downside is that it's more advanced to set up and requires maintenance. In both of these cases your ISP would no longer know that you were staking or where your traffic is going, they would only see the VPN or VPS as the destination for your traffic. Keep in mind however, no matter which option you choose you're either trusting your ISP provider, VPN provider, or VPS provider. III. Physical Security Considerations:
Physical security of your device is an aspect of security that should not be overlooked. What happens in the case of theft, or if someone gets access to your staker while you're away from home? As a best practice you may want to consider encrypting the hard drive of your staker. This can be done using software (a lot of time pre-packaged in the linux distro installer setup) such as LUKS, which basically requires a password to unencrypt your hard drive any time your device is turned on. How is this more secure than a standard username and password when I log in? When you encrypt your drive you are completely obscuring the contents stored on the drive. Nothing can be read from it at all until those contents are unlocked with your password. A standard username/password on your user can easily be beaten by anyone with access to your machine. Anyone that knows how (it's not hard at all) could easily connect a usb drive with a stock linux install on it, boot into that drive, mount your SSD or HDD on their installed linux operating system, and pretty much have full access to your system. The only concern here is that if you lose your encryption password you'll never get into your staking machine again. The benefit definitely outweighs the risk here in my opinion.
Security of your private keys should also be considered. For ETH 2 stakers there are actually two different types of keys. The first is your validator key. This key is used to sign on chain operations such as block attestations and proposals for your validator. This must be kept on your staking machine in order for your validator to participate and earn rewards. The second key is your withdrawal key, which enables you to withdraw your ETH from your validator to another wallet. Security of both keys is important, but this one more so. It might be worth considering keeping this key stored separately from your validator, so that in the case of theft or someone accessing your machine that shouldn't, they aren't able to withdraw your stake to a wallet. More important than both of those keys is your mnemonic seed phrase
. This seed phrase is your master key
and is used to link the withdrawal key and multiple validator keys, so that for each of your validators you only need one withdrawal key. My understanding is that in the event that all of your other keys are lost, the mnemonic seed phrase can still be used to generate all of your other keys. This is the most important thing to keep safe, should absolutely be kept separate from your other keys, and held in whatever form of storage you consider to be the most safe. IV. Unknown/Misc. Considerations:
A final area of concern I've seen mentioned is that other stakers may be able to determine how many validators your staker is running, which might make you a target. My knowledge on this is limited, and I don't know how easily it could be done. My understanding is that the risk points could come from using a single ETH address to make all of your validator deposits, or perhaps from a way of linking all validators that were created from the same master key, and therefore being able to determine how many validators you're running by looking at your attestations. Assuming that my understanding is correct here, possible solutions might be to use Tornado cash to make your validator deposits originate from different ETH addresses, and perhaps to generate each validator from its own mnemonic phrase if you're really paranoid. If anyone has more knowledge on this subject it would be much appreciated, since I'm not sure know how accurate my understanding is here.
Well that's it. If you stuck around until the end hopefully it was useful to you. Keeping in mind that some of this is information learned recently, feel free to correct any misunderstandings or point out anything you think I missed. And for those that have their plans ironed out already: how to do plan on running your staker with these concerns in mind? Do you consider any of these concerns to be overkill? Are you more worried about one area than the others? Any feedback would be much appreciated, not just by me, but others who are still considering how they want to setup their operation.