2

Hello Tezos community,

I read about Tezos public port to open for mainnet, and try to achieve a good security. I understand the default port to open is 9732.

  1. Is it a good practice to open this port to the world if you are baking, or maybe change to another port?
  2. Or should I simply block all ports?
  3. What about the private mode, is it something recommended for production, if so, I will need two Tezos node VPS, one public (node), one private (private node + baker).

Thank you for your answers. Good day! Greg

2
  1. Yes, open this port to the world. It allows others tezos nodes to discover and connect to you.
  2. Block all ports except 9732
  3. Private mode simply tells other nodes that you do not accept incoming connections. This will lower the number of nodes that you stay connected to.

There are no security concerns regarding the node itself. The node has nothing to do with signing blocks, nothing to do with private keys, etc. The node just sends messages around to other nodes.

One public node + (private node & baker) doesn't gain much additional security unless your private node has absolutely zero exposure to the public internet (ie: must use VPN to connect to private node)

Provided that your baking key is encrypted and you are using something like tezos-signer or other cloud-based HSM, you can run everything securely on a single public node.

  • Thanks for your answer! Is there any cloud-based HSM solution ready for production? github.com/ecadlabs/signatory seem to be quite good, but in beta. – greg Nov 4 '20 at 16:11
  • gitlab.com/polychainlabs/tezos-hsm-signer is another one. The thing to point out is that the cloud HSMs sign anything so be sure to use a tezos-signer implementation that integrates with the HSM so that you get watermark protection. – utdrmac Nov 4 '20 at 21:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.