Hi, I recently reached out to a developer as I am learning the ropes to setting up a Cardano Stake Pool publicly. I asked security questions regarding having an air gapped machine and was curious if the insight they provided was sound? The gentleman explained to me: “You don’t need to setup an air gapped machine. It’s a complicated setup that is deployed by advanced users with a technical background. Your servers should be secure enough that is impossible to be hacked, and let’s say they managed to hack your server, they can’t do anything on the server since the important files and keys are encrypted by your password. You will also have an offline copy of those important files and keys in an encrypted format on your PC or anywhere you want to save, just in case something happens. Your server should be set to its optimal setup, each with a host-based firewall that only necessary ports needed by the node and unique SSH port are open. And it should have an Login detection daemon that prevents any brute force attacks on the server, ie. it blocks the IP address of anyone that attempts to login to the server via SSH for using a wrong password 3 times.” Is this sound advice being given?

Sign pool certs, etc. While the HW secures your pledge, I don’t think it secures your pool itself and someone could maliciously take control of your pool and reassign the rewards address.

How so? Pool config changes need to witnessed by three roles The one who pays the fees The pool’s cold skey Every owner’s skey [image] If the latter two are controlled by a HW wallet, how would an attacker change the pool config. In practise, because HW secured cold keys are still fairly young. It would boil down to an attacker gaining access to the cardano-cli generated cold.skey. Is this our common understanding, that an air gap machine would potentially better secure that single skey?

anyway… it’s better to avoid all of these… so still I believe each PO has his own plan to secure the pool… I can give u an example for cntools (my case) disconnect the server from internet, start cntools in offline mode and create/sign the transactions, then connect the node back to the internet (after all sensitive files were removed) and submit the transaction :slight_smile:

I agree you need the multi sign to generate the pool config, but do you need it to undo that config? i.e. just remove HW address and sign it without it?

Its the cold.skey that matters. With ASTOR an attacker would have to get hold of that key to change pool owners. All my ADA is secured by HW wallet (i.e. I have no payment.skey that could get compromised) - at least none with significant funds.

Read through this: [image] SPOs, Do not repeat my mistakes, Keep your Core Node Safe Stake Pool Security Dear Awesome Cardano Staking Pool Operators, My name is Jun, I am a Korean pool operator of HAPPY. The reason I am posting this to here is to share my mistakes and prevent similar incident happening to you guys. Just consider that I am just a graduate student in Korea, not a security expert, and I think most of you are not expert neither. I made a huge mistake, and make a security breach to my Core node. First, Let me share my security settings. My SSH config: Password disabled, only acc…

I have my systems local with ssh uninstalled. Is this the safest setup? Do you still recommend air gap?

I am not an expert but most people I trust use air gapping.

Having an air gaped machine is essential to a secure operation. It’s as cheap as a raspberry pi in which you sign the transactions on. It has to be a machine that was never connected and will never connect to the internet.

Yes me too mate, and this is a good security step. air gaping concept is good, and should still be applied. A step further is to really have dynamic environment ruled by automated pipelines. This way even you air gap env. only exist few minutes at worst and is then destroyed once his task it done. Any server staying a long time end up being a potential security threat. Relays and Block Producer included. In a nutshell cattles > pets

Is Air Gap Necessary?

Staking & Delegation Stake Pool Security

Donnybaseball 2 July 2021 16:41 11

Read through this:

Topic		Replies	Views
Air Gap required? Stake Pool Security	4	1377	26 January 2021
Stake pool - Air Gap Candidate setup and security? Misc Dev Talk stake-pools	38	2096	4 March 2022
Safe to use an old PC with a fresh OS install for Air Gapped Device? Stake Pool Security	14	1704	14 January 2023
Air Gapping Stake Pool Security	7	1269	3 January 2021
Postponing our stake pool until hacker issue is solved Stake Pool Security	11	2846	11 August 2020

Is Air Gap Necessary?

Related topics