<html>
<h1>Introduction</h1>
<p><br></p>
<p><strong>TL;DR:</strong> Example security measures to help keep your Linux-based VPS masternode running, and earning.</p>
<p><br></p>
<h3>Who's this guide for?</h3>
<p><br></p>
<p>You've carefully accumulated enough coins to stake a masternode. Time to get started with a VPS, and get that masternode up and running.</p>
<p>But, you've never run a Linux-based server before. Or, perhaps you have, but only at home on your local network - never a server out by itself on the Internet at large.</p>
<p><br></p>
<h3>The Narrow View - Why do *I* need to secure my VPS?</h3>
<p><br></p>
<p>The Internet's a dangerous place - any publicly available server will, at the very least, be subjected to a constant 'background noise' of automated hacking attempts. </p>
<p>Bots will routinely test your defences, and report back any vulnerabilities to their masters. They may even automatically exploit a vulnerability and subvert your VPS for their own ends there and then.</p>
<p>Common exploits include co-opting your VPS for sending spam, hosting malware, or participating in DDoS (Distributed Denial of Service) attacks on unlucky third parties.</p>
<p>All of the above are likely to get your VPS blacklisted and shut down by your provider. It's possible they may even drop you as a customer, and deny you access to your VPS and its data.</p>
<p><em><strong>A masternode that's offline, is a masternode that isn't earning</strong></em><strong>.</strong></p>
<p>Looking for another VPS provider after a security issue and setting up all of your masternode software from scratch is presumably not how you'd like to invest your time.</p>
<p><br></p>
<h3>Wider Considerations</h3>
<p><br></p>
<p>If naked self-interest isn't sufficient motivation for you, consider the following: </p>
<p><em><strong>How successful can a PoS cryptocurrency be if many of its masternodes are run insecurely?</strong></em></p>
<p><em><strong>What will happen to that currency if the mass shutdown of significant numbers of its masternodes can be orchestrated by a bad actor?</strong></em></p>
<p><em><strong>How do vulnerable masternodes increase the likelihood of a successful '51%' attack?</strong></em></p>
<p><br></p>
<h3>Sleep Soundly</h3>
<p><br></p>
<p>A good night's sleep can be hard to come by in crypto-land. A little effort at the outset when setting up your VPS masternode can go a long way to protecting it and will ensure that you can lie in bed at night, in a cold sweat, worrying about more important issues.</p>
<p>This article will show you, step by step, some simple security measures you can take to significantly reduce the risk of your VPS being security compromised.</p>
<p><br></p>
<h3>Disclaimer</h3>
<p><br></p>
<p><em>The information in this article is provided in good faith as a list of examples of some simple best-practice security measures that can be applied to a Linux-based server. It is not designed to be fully comprehensive or exhaustive and by no means constitutes a complete security strategy. This information is provided without warranty, express or implied, and can be used only at the reader's own risk. Best effort has been made to ensure the accuracy of all information provided, but no guarantee of accuracy is provided. By using this guide, in part or in totality, you indemnify the author against any liability for any and all losses arising from, or connected to, usage of the content contained herein.</em></p>
<p>Be careful. Use at your own risk.</p>
<p><br></p>
<h3>Assumptions</h3>
<p><br></p>
<p>This guide is written under the assumption that you're using <strong>Ubuntu 16.04</strong> as the version of Linux on your VPS (as it seems to be popular among the crypto community) but I've tried to include variations in commands for <strong>CentOS 7</strong> where applicable.</p>
<p>In the event that you haven't actually chosen a VPS provider yet, here's a <a href="https://m.do.co/c/74208983ec71">$10 credit referral link</a> for 'Digital Ocean'. You could do worse than them, and I get some sort of credit too if you use that link. Which is nice.</p>
<p>I'm assuming also that you have gained SSH access to your VPS, which will allow you to type the commands listed below. </p>
<p>If you're using Linux or Mac OS on your own machine, this will likely be via their respective command lines (usually via an application labelled 'Terminal'). </p>
<p>On Windows, I expect you'll be using the '<a href="https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html">putty</a>' application which provides SSH capability.</p>
<p><br></p>
<h3>Step 1 - Change The Root Password - 'Change The Front Door Locks'</h3>
<p><br></p>
<p>Your VPS provider likely sent you an e-mail with the IP address of your new VPS, and the password for the all-powerful 'root' user.</p>
<p>There's only one person that should know the root password for your VPS, and that's you!</p>
<p>As e-mail should be considered an <a href="https://en.wikipedia.org/wiki/Email_privacy">insecure method</a> of communication, the first priority is changing the password for the root user.</p>
<p>The new password should be strong, long, random, and unique. Never, ever, re-use a password you've already used elsewhere. If you have difficulty keeping track of hundreds of strong, long, random and unique passwords in your head, consider using a password manager (which can both store, and generate passwords for you) such as:</p>
<p><a href="https://keepass.info/download.html">KeePass</a></p>
<p>To change the password, SSH into your VPS as the 'root' user and run the following command:</p>
<pre><code>passwd</code></pre>
<p><br></p>
<p>You'll then be prompted to enter a new password, and then re-enter it as confirmation. </p>
<p>You should see the message 'password updated successfully' as per the screenshot below:</p>
<p><img src="https://www.bollock.stream/images/1passwd.png" width="362" height="115"/></p>
<p>Tip: It's probably easiest to copy/paste this new value (from your password manager program) rather than trying to type it out manually.</p>
<p><br></p>
<h3>Step 2 - Change The Default SSH Port - 'Hide The Door Handle'</h3>
<p><br></p>
<p>The default port assigned to SSH is <strong>22</strong> and your VPS will sit and listen on this port for incoming connections. </p>
<p>Unfortunately, malicious users ('hackers', 'script kiddies', whatever) know this and there does exist a 'background noise' of automated attack malware on the Internet that will scan random IP addresses to see if port <strong>22</strong> is open, and if it is, attempt a barrage of automated SSH logins using common, weak, guessable passwords.</p>
<p>Seeing as you've already completed 'Step 1' above and have selected a strong, long, random and unique password you've already protected yourself somewhat against this attack vector, but the aim here is to avoid even appearing, on cursory inspection, to be a VPS running SSH. </p>
<p><em><strong>A burglar can't check if your door is locked if he can't find the door handle.</strong></em></p>
<p>To change the port SSH is running on, SSH into your VPS as the 'root' user. We're going to edit the configuration file '/etc/ssh/sshd_config' using the 'nano' text editor. To do so, type:</p>
<pre><code>nano /etc/ssh/sshd_config</code></pre>
<p><br></p>
<p>If you receive the error message 'nano: command not found' it just means that the nano text editor hasn't been installed on your VPS. To install it, run:</p>
<pre><code>apt-get update</code></pre>
<pre><code>apt-get install nano</code></pre>
<p><br></p>
<p>or if you're using CentOS 7 instead of Ubuntu:</p>
<pre><code>yum update</code></pre>
<pre><code>yum install nano</code></pre>
<p><br></p>
<p>You should see the configuration file opened inside nano:</p>
<p><img src="https://www.bollock.stream/images/2nano.png" width="1166" height="740"/></p>
<p><br></p>
<p>About the fifth line down should be:</p>
<p><code>Port 22</code></p>
<p>We're going to change this to something else. Any value in the range 1000-49151 is probably a good value, as long as it's not already well known as being used for something else (see <a href="https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers#Registered_ports">this list</a> of known ports for guidance).</p>
<p>Let's choose, say, <strong>9707</strong>. Change the line to read:</p>
<p><code>Port 9707</code></p>
<p>Then, hit <code>Ctrl-O</code> to save the file and <code>Ctrl-X</code> to exit the nano editor.</p>
<p>Now, we have to restart SSH on the VPS so that it'll re-read the configration file and switch to the new port. To do this, type:</p>
<pre><code>service ssh restart</code></pre>
<p><br></p>
<p>Now, let's test that actually worked. Don't log out of your existing SSH session. Instead, attempt a fresh login on the new port. </p>
<p><br></p>
<p><strong>MacOS/Linux</strong></p>
<p>If your home computer is running Mac OS or Linux, you'd use:</p>
<pre><code>ssh root@xxx.xxx.xxx.xxx -p 9707</code></pre>
<p><br></p>
<p>(where 'xxx.xxx.xxx.xxx' is the IP address of your VPS) instead of your usual:</p>
<pre><code>ssh root@xxx.xxx.xxx.xxx</code></pre>
<p><br></p>
<p><strong>Windows</strong></p>
<p>In putty in Windows, change the '<code>port</code>' box to contain the new value, like so:</p>
<p><img src="https://www.bollock.stream/images/3putty.png"/><img src="https://www.bollock.stream/images/3-putty.png" width="452" height="436"/></p>
<p><br></p>
<p>From now on, this is the port that you will log into SSH with. Connections using port 22 will no longer function.</p>
<p>If for some reason you can't get the new login to work on the new port, use the existing SSH session that you left open to reverse the change above (edit with nano back to 'Port 22', save, and restart SSH).</p>
<p><br></p>
<h3>Step 3 - Use Key-Based SSH - 'Build Another Front Door With A Dead Bolt'</h3>
<p><br></p>
<p>At present, anyone with the password to your VPS can log in with root privileges (i.e. with complete and total control). As such, your VPS is only as secure as your storage of that password. </p>
<p>Key-based authentication adds an extra layer of security. A public encryption key is placed on the server. To be able to SSH into that server, a user must possess the corresponding private (secret) key. </p>
<p>That is to say, ownership of the VPS is 'proven' by possession of the private key in question.</p>
<p>If this sounds familiar, it's because it is - public-key cryptography is the basis of cryptocurrency. Only, in this case we're using it to prove ownerhship of a server rather than Bitcoin, Litecoin, or Doge.</p>
<p>Furthermore, the private key can only be used once it is unlocked via a passphrase (just like unlocking a Bitcoin wallet). </p>
<p>The end result will be a server that can only be accessed by a user who has both the secret key, and the corresponding passphrase for that secret key.</p>
<p>This removes any possibility of an attacker brute-forcing access by simply guessing the password for the server. If they don't have the key, they can't log in.</p>
<p>I'll detail first how to set this up on Windows, and then describe how to do it if your Desktop/Laptop is running Mac OS or Linux.</p>
<p><br></p>
<p><strong>Key Generation - Windows</strong></p>
<p>First, we need to generate your public and private keys. This can be done using the putty companion program, 'PuttyGen' which you can find as a direct link <a href="https://the.earth.li/~sgtatham/putty/latest/w32/puttygen.exe">here </a>or in the <a href="https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html">list of all putty programs</a>.</p>
<p>On running that program, let's choose '<code>RSA</code>' as the key type and indulge in some healthy paranoia by upping the number of bits in the key to <code>4096</code> as shown:</p>
<p><img src="https://www.bollock.stream/images/4puttygen.png" width="484" height="469"/></p>
<p><br></p>
<p>Then hit 'Generate' and move your mouse around in the grey window for a while to generate some randomness until the progress bar reaches completion. This may take a few minutes. It's all in the wrist.</p>
<p>You'll see the top box populated with what looks like gibberish when the process completes. Now choose a '<code>Key comment</code>' (your name or something to identify the key) and a passphrase (strong, long, random and unique) as per:</p>
<p><img src="https://www.bollock.stream/images/45puttygen.png" width="482" height="465"/></p>
<p><br></p>
<p>Do not forget the passphrase! Perhaps use a password manager program for storage of such, unless you have a more secure way to hand.</p>
<p>Hit '<code>Save public key</code>' and call it, say '<code>putty_public_key</code>'. Hit '<code>Save private key</code>' and call it '<code>id.ppk</code>'. </p>
<p>Finally, highlight all of the text in the top box (make sure you scroll all the way to the bottom!) copy it, paste it into 'notepad' and save it as '<code>id_rsa.pub</code>' as per:</p>
<p><img src="https://www.bollock.stream/images/5puttgensave.png" width="1265" height="498"/></p>
<p><br></p>
<p>So, you should now have three files:</p>
<p><code>putty_public_key</code></p>
<p><code>id.ppk</code></p>
<p><code>id_rsa.pub</code></p>
<p>Treat '<code>id.ppk</code>' very carefully and store it only where it needs to be used. This is your private key.</p>
<p>'<code>id_rsa.pub</code>' is the public key we're going to drop off on the server.</p>
<p>'<code>putty_public_key</code>' is also the public key, but in weird putty format. It's for backup purposes only.</p>
<p><br></p>
<p><strong>Key Generation - Mac OS/Linux</strong></p>
<p>To generate public and private keys you can just open a terminal on your home computer and type:</p>
<pre><code>ssh-keygen -t rsa -b 4096</code></pre>
<p><br></p>
<p>This will generate two files:</p>
<p><code>id_rsa</code></p>
<p><code>id_rsa.pub</code></p>
<p>in your own, local, '<code>.ssh</code>' directory. For example:</p>
<p><code>/home/bob/.ssh/</code></p>
<p>if '<code>bob</code>' is your username on your home computer.</p>
<p>'<code>id_rsa.pub</code>' is the public key you want to place on the VPS as per the following instructions.</p>
<p><br></p>
<p><strong>Key Installation - All Systems</strong></p>
<p>SSH into your VPS as normal.</p>
<p>Make sure you're in your home directory by typing:</p>
<pre><code>cd ~</code></pre>
<p><br></p>
<p>Then, create the '.ssh' directory to store the key in:</p>
<pre><code>mkdir .ssh</code></pre>
<p><br></p>
<p>You can run the following to check it created OK:</p>
<pre><code>ls -lahtr</code></pre>
<p><br></p>
<p>It should look like this:</p>
<p><img src="https://www.bollock.stream/images/6ssh.png" width="507" height="162"/></p>
<p><br></p>
<p>Now, change the permissions of this directory so only 'root' has access to it (SSH logins will fail if this is set incorrectly):</p>
<pre><code>chmod 700 .ssh/</code></pre>
<p><br></p>
<p>If you now run:</p>
<pre><code>ls -lahtr</code></pre>
<p><br></p>
<p>again, you'll see the permissions have changed:</p>
<p><img src="https://www.bollock.stream/images/7ssh.png" width="516" height="111"/></p>
<p><br></p>
<p>Now, let's get into that directory:</p>
<pre><code>cd .ssh</code></pre>
<p><br></p>
<p>and open a new file which we're going to call '<code>authorized_keys</code>' (the name must be exact):</p>
<pre><code>nano authorized_keys</code></pre>
<p><br></p>
<p>Copy the text of the '<code>id_rsa.pub</code>' file (which you probably still have open in notepad if you're a Windows user, or open it in your text editor of choice for Linux/Mac users) and paste it into nano window. Take care not to clip the beginning or the end of the key as this will render it useless - it must be the entire text.</p>
<p>You'll probably only be able to see the end of it when you've pasted it in as it's effectively one really really long line. To get a better view of it in nano, type:</p>
<pre><code>Esc</code></pre>
<p>and then:</p>
<pre><code>$</code></pre>
<p>(i.e. shift-4)</p>
<p>This'll enable soft line wrapping and you should see something like this:</p>
<p><img src="https://www.bollock.stream/images/8nano.png" width="623" height="316"/></p>
<p><br></p>
<p>Now, hit:</p>
<pre><code>Ctrl-O</code></pre>
<p><br></p>
<p>To save the file, and:</p>
<pre><code>Ctrl-X</code></pre>
<p><br></p>
<p>to exit nano.</p>
<p><br></p>
<p>You can verify it saved correctly by typing:</p>
<pre><code>cat authorized_keys</code></pre>
<p><br></p>
<p>(this should print out the contents of the <code>authorized_keys</code> file, which should match what you have in notepad on your Windows machine).</p>
<p>Finally, we tighten up the permissions of the <code>authorized_keys</code> file:</p>
<pre><code>chmod 600 authorized_keys</code></pre>
<p><br></p>
<p>(Again, SSH logins will fail if you skip this part).</p>
<p><br></p>
<p><strong>Testing Key-Based Authentication</strong></p>
<p>Right, now let's make sure it works.</p>
<p><br></p>
<p><strong>Windows</strong></p>
<p>Open 'Putty'. On the left hand side, expand the 'SSH' '+' sign and select 'Auth' as per:</p>
<p><img src="https://www.bollock.stream/images/9putty.png" width="454" height="437"/></p>
<p><br></p>
<p>Hit '<code>Browse</code>' and select the '<code>id.ppk</code>' file you generated above. This example shows it has having been saved on the Desktop, but you'll probably have saved it somewhere more secure and organised than that, won't you?</p>
<p>Now, on the left hand side scroll up and select 'Session' as per:</p>
<p><img src="https://www.bollock.stream/images/10putty.png" width="451" height="433"/></p>
<p><br></p>
<p>Type your connection string in the '<code>Host Name</code>' box as usual. This example uses 'xxx.xxx.xxx.xxx' instead of your real IP address.</p>
<p>Enter your port number (as per the above, we changed this to '<code>9707</code>').</p>
<p>Give the profile a name in the '<code>Saved Sessions</code>' box (I've used 'Bob' for this example) and hit '<code>Save</code>'.</p>
<p>Now, when you load putty you can just click on '<code>Bob</code>' and hit '<code>Load</code>' and it'll be primed to connect to your VPS with all of the details populated and your private key ready to go.</p>
<p>Click on '<code>Open</code>' and see if the connection goes through. If all is well, you'll be asked to type your passphrase as per:</p>
<p><img src="https://www.bollock.stream/images/11putty.png" width="394" height="83"/></p>
<p><br></p>
<p>Type in your passphrase (the one you created above when creating the key, not the password for your VPS) and you should be logged in.</p>
<p>If not, the most likely issue is incorrect permissions on the '<code>.ssh</code>' directory or '<code>authorized_keys</code>' file on the VPS (see above for correct settings) or a messed up copy/paste of the public key (clipping at either end is usually the cause).</p>
<p><br></p>
<p><strong>Mac OS / Linux</strong></p>
<p>To test the login, you can just open a terminal and type:</p>
<pre><code>ssh root@xxx.xxx.xxx.xxx -p 9707</code></pre>
<p><br></p>
<p>(where 'xxx.xxx.xxx.xxx' is the IP of your VPS). When you created the keys via '<code>ssh-keygen</code>' above, it'll have put all the local files in the right location for you).</p>
<p>Now that we can log in using key-based authentication, it's time for the next steps. </p>
<p>In Part 2 of this guide, I'll cover turning off password-based authentication entirely and installing a firewall before covering further steps in Part 3.</p>
<p><br></p>
<h3>Buy Me A Beer</h3>
<p><br></p>
<p>If you find this guide at all useful, feel free to buy me a beer. Or part of a beer. Or a keg. Or two:- </p>
<p><code>LTC: LcorMkmmMpbVn2vBy5dUCGNDytnmHSW5vy</code></p>
<p><code>DOGE: D8PUDKoF7ZkHN43ELdRZZGNUv6iZ9xLScL</code></p>
<p><code>BCH: bitcoincash:qq2u2tcmwefpwh5lz5x9pndz30jathm93539m42dkj / 12z7QcbwYXirNj8EhzXHsuDMz6BjY9An6e</code></p>
</html>
hiveblocks