How to Secure Your Masternode VPS!

Published in

Automation Avengers

11 min readFeb 19, 2018

Master your HODLING )

In the cryptosphere, they say only those who can finely analyze the market or are day traders can make money. But that’s not true!!

In the cryptosphere, there are several ways by which you can make profits and earn a handsome amount of money. And the best thing is that you can choose the best way that works for you and can accordingly adjust your reward/risk ratio.

One such way of earning in cryptosphere is by running a masternode, but before I tell you how to do that it is imperative that you first understand what a masternode is.

What is Masternode?

Masternode is simply a cryptocurrency full node or computer wallet that keeps the full copy of the blockchain in real-time, just like your have Bitcoin full nodes and is always up & running.

But masternodes are considerably different in their functionality than normal nodes. You can run masternodes with just only POS consensus coins.

They are different because they perform several other functions apart from just keeping the full blockchain and relaying blocks/transactions as a full node does in Bitcoin/Litcoin.

Some of the special functions that these nodes perform are:

Increasing privacy of transactions
Doing instant transactions
Participating in governance and voting
Enable budgeting and treasury system in cryptos

These masternodes are not standalone but they are always communicating with other such nodes to make a decentralized network and are often referred in short form as MN.

Note: Mostly the masternodes perform the tasks that I have listed above but it can slightly vary from cryptocurrency to cryptocurrency depending upon how masternodes have been implemented. But more or less they perform these functions in a cryptocurrency.

What is a proof of stake?

Proof of stake is a different way to validate transactions based and achieve the distributed consensus.

It is still an algorithm, and the purpose is the same of the proof of work, but the process to reach the goal is quite different.

Unlike the proof-of-Work, where the algorithm rewards miners who solve mathematical problems with the goal of validating transactions and creating new blocks, with the proof of stake, the creator of a new block is chosen in a deterministic way, depending on its wealth, also defined as stake.

No block reward

Also, all the digital currencies are previously created in the beginning, and their number never changes.

This means that in the PoS system there is no block reward, so, the miners take the transaction fees.

This is why, in fact, in this PoS system miners are called forgers, instead.

“So these precious machines need some attention and security hedge”

VPS Security Tips

Block your all open ports of vps except ssh and masternode port. (AWS in Security Groups, Google Cloud from vps and Vultr from vps besides these options are cost effective options for unix vps)
I recommend cold wallet (controller) + node design for masternode operations. You may locate your wallet and coins on your local computer, vm or another vps other than 7/24 online node vps.
Online node will just require your collateral amount of tokens transfer tx hash and index id. You may set automatic snapshot for your controller vps to make automatic bakcup for wallet and controller OS.
Change vps default ssh port number 22 to different unused port number to prevent attacks from common known ssh port.

Open sshd config file
vim /etc/ssh/sshd_configchange port number and remove #sembol. 
#Port 22Save your changes and close the sshd_config file.
Restart sshd service to makeservice sshd restart*The # symbol tells the server to ignore anything after it on the same line, so we will need to remove that character.

4. Prevent making connection with password ( use instead ssh key-based authentication ) and disable root account login.

First configure SSH Key-Based Authentication from below link;

How To Configure SSH Key-Based Authentication on a Linux Server | DigitalOcean

SSH, or secure shell, is an encrypted protocol used to administer and communicate with servers. When working with a…

www.digitalocean.com

To disable this setting, you can do the following:

nano /etc/ssh/sshd_configIn this file, set the following settings to the following values. If these settings are already in the file, set them to “no” rather than add new lines.ChallengeResponseAuthentication no
PasswordAuthentication no
PermitRootLogin no
UsePAM noOnce this is done, restart the SSH daemon to apply the settings./etc/init.d/sshd restart

5. Run Anti-ddos script (Change mnport with your masternode communication port)

#!/bin/sh# For debugging use iptables -v.
IPTABLES="/sbin/iptables"
IP6TABLES="/sbin/ip6tables"
MODPROBE="/sbin/modprobe"
RMMOD="/sbin/rmmod"
ARP="/usr/sbin/arp"# Logging options.
#------------------------------------------------------------------------------
LOG="LOG --log-level debug --log-tcp-sequence --log-tcp-options"
LOG="$LOG --log-ip-options"# Defaults for rate limiting
#------------------------------------------------------------------------------
RLIMIT="-m limit --limit 3/s --limit-burst 8"# Unprivileged ports.
#------------------------------------------------------------------------------
PHIGH="1024:65535"
PSSH="1000:1023"# Load required kernel modules
#------------------------------------------------------------------------------
$MODPROBE ip_conntrack_ftp
$MODPROBE ip_conntrack_irc# Mitigate ARP spoofing/poisoning and similar attacks.
#------------------------------------------------------------------------------
# Hardcode static ARP cache entries here
# $ARP -s IP-ADDRESS MAC-ADDRESS# Kernel configuration.
#------------------------------------------------------------------------------# Disable IP forwarding.
# On => Off = (reset)
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 0 > /proc/sys/net/ipv4/ip_forward# Enable IP spoofing protection
for i in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $i; done# Protect against SYN flood attacks
echo 1 > /proc/sys/net/ipv4/tcp_syncookies# Ignore all incoming ICMP echo requests
echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all# Ignore ICMP echo requests to broadcast
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts# Log packets with impossible addresses.
for i in /proc/sys/net/ipv4/conf/*/log_martians; do echo 1 > $i; done# Don't log invalid responses to broadcast
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses# Don't accept or send ICMP redirects.
for i in /proc/sys/net/ipv4/conf/*/accept_redirects; do echo 0 > $i; done
for i in /proc/sys/net/ipv4/conf/*/send_redirects; do echo 0 > $i; done# Don't accept source routed packets.
for i in /proc/sys/net/ipv4/conf/*/accept_source_route; do echo 0 > $i; done# Disable multicast routing
# for i in /proc/sys/net/ipv4/conf/*/mc_forwarding; do echo 0 > $i; done# Disable proxy_arp.
for i in /proc/sys/net/ipv4/conf/*/proxy_arp; do echo 0 > $i; done# Enable secure redirects, i.e. only accept ICMP redirects for gateways
# Helps against MITM attacks.
for i in /proc/sys/net/ipv4/conf/*/secure_redirects; do echo 1 > $i; done# Disable bootp_relay
for i in /proc/sys/net/ipv4/conf/*/bootp_relay; do echo 0 > $i; done# Default policies.
#------------------------------------------------------------------------------# Drop everything by default.
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -P OUTPUT DROP# Set the nat/mangle/raw tables' chains to ACCEPT
$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -P OUTPUT ACCEPT
$IPTABLES -t nat -P POSTROUTING ACCEPT$IPTABLES -t mangle -P PREROUTING ACCEPT
$IPTABLES -t mangle -P INPUT ACCEPT
$IPTABLES -t mangle -P FORWARD ACCEPT
$IPTABLES -t mangle -P OUTPUT ACCEPT
$IPTABLES -t mangle -P POSTROUTING ACCEPT# Cleanup.
#------------------------------------------------------------------------------# Delete all
$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -t mangle -F# Delete all
$IPTABLES -X
$IPTABLES -t nat -X
$IPTABLES -t mangle -X# Zero all packets and counters.
$IPTABLES -Z
$IPTABLES -t nat -Z
$IPTABLES -t mangle -Z# Completely disable IPv6.
#------------------------------------------------------------------------------# Block all IPv6 traffic
# If the ip6tables command is available, try to block all IPv6 traffic.
if test -x $IP6TABLES; then
# Set the default policies
# drop everything
$IP6TABLES -P INPUT DROP 2>/dev/null
$IP6TABLES -P FORWARD DROP 2>/dev/null
$IP6TABLES -P OUTPUT DROP 2>/dev/null# The mangle table can pass everything
$IP6TABLES -t mangle -P PREROUTING ACCEPT 2>/dev/null
$IP6TABLES -t mangle -P INPUT ACCEPT 2>/dev/null
$IP6TABLES -t mangle -P FORWARD ACCEPT 2>/dev/null
$IP6TABLES -t mangle -P OUTPUT ACCEPT 2>/dev/null
$IP6TABLES -t mangle -P POSTROUTING ACCEPT 2>/dev/null# Delete all rules.
$IP6TABLES -F 2>/dev/null
$IP6TABLES -t mangle -F 2>/dev/null# Delete all chains.
$IP6TABLES -X 2>/dev/null
$IP6TABLES -t mangle -X 2>/dev/null# Zero all packets and counters.
$IP6TABLES -Z 2>/dev/null
$IP6TABLES -t mangle -Z 2>/dev/null
fi# Custom user-defined chains.
#------------------------------------------------------------------------------# LOG packets, then ACCEPT.
$IPTABLES -N ACCEPTLOG
$IPTABLES -A ACCEPTLOG -j $LOG $RLIMIT --log-prefix "ACCEPT "
$IPTABLES -A ACCEPTLOG -j ACCEPT# LOG packets, then DROP.
$IPTABLES -N DROPLOG
$IPTABLES -A DROPLOG -j $LOG $RLIMIT --log-prefix "DROP "
$IPTABLES -A DROPLOG -j DROP# LOG packets, then REJECT.
# TCP packets are rejected with a TCP reset.
$IPTABLES -N REJECTLOG
$IPTABLES -A REJECTLOG -j $LOG $RLIMIT --log-prefix "REJECT "
$IPTABLES -A REJECTLOG -p tcp -j REJECT --reject-with tcp-reset
$IPTABLES -A REJECTLOG -j REJECT# Only allows RELATED ICMP types
# (destination-unreachable, time-exceeded, and parameter-problem).
# TODO: Rate-limit this traffic?
# TODO: Allow fragmentation-needed?
# TODO: Test.
$IPTABLES -N RELATED_ICMP
$IPTABLES -A RELATED_ICMP -p icmp --icmp-type destination-unreachable -j ACCEPT
$IPTABLES -A RELATED_ICMP -p icmp --icmp-type time-exceeded -j ACCEPT
$IPTABLES -A RELATED_ICMP -p icmp --icmp-type parameter-problem -j ACCEPT
$IPTABLES -A RELATED_ICMP -j DROPLOG# Make It Even Harder To Multi-PING
$IPTABLES  -A INPUT -p icmp -m limit --limit 1/s --limit-burst 2 -j ACCEPT
$IPTABLES  -A INPUT -p icmp -m limit --limit 1/s --limit-burst 2 -j LOG --log-prefix PING-DROP:
$IPTABLES  -A INPUT -p icmp -j DROP
$IPTABLES  -A OUTPUT -p icmp -j ACCEPT# Only allow the minimally required/recommended parts of ICMP. Block the rest.
#------------------------------------------------------------------------------# TODO: This section needs a lot of testing!# First, drop all fragmented ICMP packets (almost always malicious).
$IPTABLES -A INPUT -p icmp --fragment -j DROPLOG
$IPTABLES -A OUTPUT -p icmp --fragment -j DROPLOG
$IPTABLES -A FORWARD -p icmp --fragment -j DROPLOG# Allow all ESTABLISHED ICMP traffic.
$IPTABLES -A INPUT -p icmp -m state --state ESTABLISHED -j ACCEPT $RLIMIT
$IPTABLES -A OUTPUT -p icmp -m state --state ESTABLISHED -j ACCEPT $RLIMIT# Allow some parts of the RELATED ICMP traffic, block the rest.
$IPTABLES -A INPUT -p icmp -m state --state RELATED -j RELATED_ICMP $RLIMIT
$IPTABLES -A OUTPUT -p icmp -m state --state RELATED -j RELATED_ICMP $RLIMIT# Allow incoming ICMP echo requests (ping), but only rate-limited.
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -j ACCEPT $RLIMIT# Allow outgoing ICMP echo requests (ping), but only rate-limited.
$IPTABLES -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT $RLIMIT# Drop any other ICMP traffic.
$IPTABLES -A INPUT -p icmp -j DROPLOG
$IPTABLES -A OUTPUT -p icmp -j DROPLOG
$IPTABLES -A FORWARD -p icmp -j DROPLOG# Selectively allow certain special types of traffic.
#------------------------------------------------------------------------------# Allow loopback interface to do anything.
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT# Allow incoming connections related to existing allowed connections.
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT# Allow outgoing connections EXCEPT invalid
$IPTABLES -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT# Miscellaneous.
#------------------------------------------------------------------------------# We don't care about Milkosoft, Drop SMB/CIFS/etc..
$IPTABLES -A INPUT -p tcp -m multiport --dports 135,137,138,139,445,1433,1434 -j DROP
$IPTABLES -A INPUT -p udp -m multiport --dports 135,137,138,139,445,1433,1434 -j DROP# Explicitly drop invalid incoming traffic
$IPTABLES -A INPUT -m state --state INVALID -j DROP# Drop invalid outgoing traffic, too.
$IPTABLES -A OUTPUT -m state --state INVALID -j DROP# If we would use NAT, INVALID packets would pass - BLOCK them anyways
$IPTABLES -A FORWARD -m state --state INVALID -j DROP# PORT Scanners (stealth also)
$IPTABLES -A INPUT -m state --state NEW -p tcp --tcp-flags ALL ALL -j DROP
$IPTABLES -A INPUT -m state --state NEW -p tcp --tcp-flags ALL NONE -j DROP# TODO: Some more anti-spoofing rules? For example:
# $IPTABLES -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
# $IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
# $IPTABLES -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
$IPTABLES -N SYN_FLOOD
$IPTABLES -A INPUT -p tcp --syn -j SYN_FLOOD
$IPTABLES -A SYN_FLOOD -m limit --limit 2/s --limit-burst 6 -j RETURN
$IPTABLES -A SYN_FLOOD -j DROP# TODO: Block known-bad IPs (see http://www.dshield.org/top10.php).
# $IPTABLES -A INPUT -s INSERT-BAD-IP-HERE -j DROPLOG# Drop any traffic from IANA-reserved IPs.
#------------------------------------------------------------------------------$IPTABLES -A INPUT -s 0.0.0.0/7 -j DROP
$IPTABLES -A INPUT -s 2.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 5.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 7.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 10.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 23.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 27.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 31.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 36.0.0.0/7 -j DROP
$IPTABLES -A INPUT -s 39.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 42.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 49.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 50.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 77.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 78.0.0.0/7 -j DROP
$IPTABLES -A INPUT -s 92.0.0.0/6 -j DROP
$IPTABLES -A INPUT -s 96.0.0.0/4 -j DROP
$IPTABLES -A INPUT -s 112.0.0.0/5 -j DROP
$IPTABLES -A INPUT -s 120.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 169.254.0.0/16 -j DROP
$IPTABLES -A INPUT -s 172.16.0.0/12 -j DROP
$IPTABLES -A INPUT -s 173.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 174.0.0.0/7 -j DROP
$IPTABLES -A INPUT -s 176.0.0.0/5 -j DROP
$IPTABLES -A INPUT -s 184.0.0.0/6 -j DROP
$IPTABLES -A INPUT -s 192.0.2.0/24 -j DROP
$IPTABLES -A INPUT -s 197.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 198.18.0.0/15 -j DROP
$IPTABLES -A INPUT -s 223.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 224.0.0.0/3 -j DROP# Selectively allow certain outbound connections, block the rest.
#------------------------------------------------------------------------------# Allow outgoing Masternode requests.
$IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport ${mnport} -j ACCEPT# Allow outgoing DNS requests. Few things will work without this.
#$IPTABLES -A OUTPUT -m state --state NEW -p udp --dport 53 -j ACCEPT
#$IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 53 -j ACCEPT# Allow outgoing HTTP requests. Unencrypted, use with care.
#$IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT# Allow outgoing HTTPS requests.
#$IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT# Allow outgoing "submission" (RFC 2476) requests.
#$IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 587 -j ACCEPT# Allow outgoing SSH requests.
$IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 14855 -j ACCEPT# Selectively allow certain inbound connections, block the rest.
#------------------------------------------------------------------------------# Allow incomming Masternode requests.
$IPTABLES -A INPUT -m state --state NEW -p tcp --dport ${mnport} -j ACCEPT# Allow incoming DNS requests.
#$IPTABLES -A INPUT -m state --state NEW -p udp --dport 53 -j ACCEPT
#$IPTABLES -A INPUT -m state --state NEW -p tcp --dport 53 -j ACCEPT# Allow incoming HTTP requests.
#$IPTABLES -A INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT# Allow incoming HTTPS requests.
#$IPTABLES -A INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT# Allow incoming SSH requests.
$IPTABLES -A INPUT -m state --state NEW -p tcp --dport 14855 -j ACCEPT# Explicitly log and reject everything else.
#------------------------------------------------------------------------------# Use REJECT instead of REJECTLOG if you don't need/want logging.
$IPTABLES -A INPUT -j REJECTLOG
$IPTABLES -A OUTPUT -j REJECTLOG
$IPTABLES -A FORWARD -j REJECTLOG#------------------------------------------------------------------------------
# Testing the firewall.
#------------------------------------------------------------------------------# You should check/test that the firewall really works, using
# iptables -vnL, nmap, ping, telnet, ...# Exit gracefully.
#------------------------------------------------------------------------------exit 0

Bonus

Make sure your daemon is not stuck on the same block (checks block number every 30th minute)

#!/bin/bash
# checkdaemon.sh
# Make sure the daemon is not stuck.
# Add the following to the crontab (i.e. crontab -e)
# */30 * * * * ~/yourcurrency/checkdaemon.sh previousBlock=$(cat ~/yourcurrency/blockcount)
currentBlock=$(yourcurrency-cli getblockcount)yourcurrency-cli getblockcount > ~/yourcurrency/blockcountif [ “$previousBlock” == “$currentBlock” ]; then
   yourcurrency-cli stop 
   sleep 10 
   yourcurrencyd
fi

2. Clear your log files once a day

#!/bin/bash
# clearlog.sh
# Clear debug.log every other day
# Add the following to the crontab (i.e. crontab -e)# 0 0 */2 * * ~/yourcurrency/clearlog.sh /bin/date > ~/.yourcurrency/debug.log

3. Create a cronjob for making sure yourcurrencyd is always running

#!/bin/bash
# makerun.sh
# Make sure yourcurrencyd is always running.
# Add the following to the crontab (i.e. crontab -e)
# */1 * * * * ~/yourcurrency/makerun.sh process=yourcurrencyd
makerun="yourcurrencyd" 
if ps ax | grep -v grep | grep $process > /dev/null
then
  exit
else  
  $makerun &
fi

Stay ordinary