diff --git a/2A_Setting_Up_a_Bitcoin-Core_VPS_by_Hand.md b/2A_Setting_Up_a_Bitcoin-Core_VPS_by_Hand.md index 4a45a36..96ef9da 100644 --- a/2A_Setting_Up_a_Bitcoin-Core_VPS_by_Hand.md +++ b/2A_Setting_Up_a_Bitcoin-Core_VPS_by_Hand.md @@ -1,145 +1,438 @@ -# 2A - Setting up a Bitcoin-Core VPS by Hand # +# 2A - Setting Up a Bitcoin-Core VPS by Hand -> NOTE: This is a draft in progress, so that I can get some feedback from early reviewers. It is not yet ready for learning. +> **NOTE:** This is a draft in progress, so that I can get some feedback from early reviewers. It is not yet ready for learning. -> NOTE: These notes are not as current as [2B - Setting Up a Bitcoin-Core VPS with StackScript.md](./2B_Setting_Up_a_Bitcoin-Core_VPS_with_StackScript.md) +This document explains how to set up a VPS (Virtual Private Sever) to run a Bitcoin node on cloud computer by hand. You'll need to set up your computer yourself, but then this document will provide you with important commands to secure your VPS and to get it running Bitcoin. -A pruned bitcoin node is a full node (in particular, a pruned node is NOT an SPV node), but it is smaller as doesn’t have all the history. +> **WARNING:** Don’t use a VPS for a bitcoin wallet with significant real funds; see http://blog.thestateofme.com/2012/03/03/lessons-to-be-learned-from-the-linode-bitcoin-incident/ . It is very nice to be able experiment with real bitcoin transactions on a live node without tying up a self-hosted server on a local network. I’ve also found it useful to be able to use an iPhone or iPad to communicate via SSH to my VPS to do some simple bitcoin tasks. But a higher level of safety is required for significant funds. -In addition, the bitcoin.conf settings suggested here will minimalize the initial and ongoing bandwidth requirements, allow a $5 - $10 a month VPS to be great for learning and testing with bitcoin. +If you want to instead have a script do the setup for you, specifically at Linode.com, read the parallel HOWTO file, [2A - Setting up a Bitcoin-Core VPS with StackScript](./2B_Setting_Up_a_Bitcoin-Core_VPS_with_StackScript.md). -This info works with both Linode and Digital Ocean, so should work with more VPSs and local virtual machines. +If you already have a Bitcoin node running, instead read the next HOWTO file, [3 - Playing with Bitcoin Core](—link—). -> WARNING: Don’t use a VPS for a bitcoin wallet with significant real funds — see http://blog.thestateofme.com/2012/03/03/lessons-to-be-learned-from-the-linode-bitcoin-incident/ . It is just very nice to be able experiment with real bitcoin transactions on a live node without tying up a self-hosted server on a local network. I’ve also found it useful to be able to use an iPhone or iPad to communicate via SSH to my VPS to do some simple bitcoin tasks. -> +## Choosing Your Bitcoin Setup -If you don’t have a Linode or DG account, signup using these codes will give you roughly a month of free time. +Before you start, you should choose between five possible Bitcoin setups. -* Linode Referral Code: https://www.linode.com/?r=3c7fa15a78407c9a3d4aefb027539db2557b3765 -* Digital Ocean: http://www.digitalocean.com/?refcode=a6060686b88a +You'll actually encode this choice at the end, when you start up Bitcoin, but in the meantime your choice will impact a few commands. -I slightly prefer Linode, because there is a scripting capability called a "StackScript" for creating VPS'es that I plan to use to automate some of these installation functions. +Your options are: -> IMPORTANT: First, you’ll should to copy the httpS URL for most recent bitcoin linux distribution from https://bitcoin.org/en/download as well the most recently httpS URL for the signatures for that release, and you will need the URL for the bitcoin signing keys for versionpast v0.11.+ . I have included what they were as of writing this tutorial, but you should not rely on them — always verify your bitcoin distribution! +**Mainnet.** This will download the entirety of the Bitnet blockchain. That's 120G of data (and getting more every day). -On the the VPS, create the minimal (~$5/m) VPS with Debian 8. Startup the VPS and use the IP address that your VPS dashboard shows you. +**Pruned Mainnet.** This will cut the blockchain you're storing down to just the last 550 blocks. If you're not mining or running some other Bitcoin service, this should be plenty for validation. + +**Testnet.** This gives you access to an alternative Bitcoin blockchain where the Bitcoins don't actually have value. It's intended for experimentation and testing. + +**Pruned Testnet.** This is just the last 550 blocks of Testnet ... because the Testnet blockchain is pretty big now too. + +**Private Regtest.** This is Regression Testing Mode, which lets you run a totally local Bitcoin server. It allows for even more in-depth testing. There's no pruning needed here, because you'll be starting from scratch. + +## Getting Started at a Cloud Provider + +First you'll need to choose a cloud provider. The commands in this document are derived from the script we use at linode.com, and they should also work at digitalocean.com. + +### Set Up an Account + +After you've selected your cloud provider, you'll need to setup an account, if you don't already have one. If you wish, the following referral codes can be used to earn about a month of free time: ``` -ssh root@162.243.130.224 - -uname -a # Should be "Linux debian", and give distribution release "4.8.6-x86_64-linode78" -lsb_release -a #Should report 8.6 or better (this script tested on debian 8.6) - - -hostnamectl set-hostname bitcoincore-pruned.local # You may not need to do this on Digital Ocean - -nano /etc/hosts #add "127.0.0.1 bitcoincore-pruned.local" to hosts file. - -dpkg-reconfigure tzdata - -date # confirm that this shows your correct time zone - -# we should update debian to latest security fixes - -apt-get update; apt-get upgrade; apt-get dist-upgrade - -# keep debian updates -echo "unattended-upgrades unattended-upgrades/enable_auto_updates boolean true" | debconf-set-selections -apt-get -y install unattended-upgrades - -# we need to update iptables to use bitcoin ports - -iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT -iptables -A INPUT -p tcp --dport 8333 -j ACCEPT -iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT -iptables -A INPUT -i lo -j ACCEPT -iptables -P INPUT DROP -iptables -P FORWARD DROP - -ip6tables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT -ip6tables -A INPUT -p tcp --dport 8333 -j ACCEPT -ip6tables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT -ip6tables -A INPUT -i lo -j ACCEPT -ip6tables -P INPUT DROP -ip6tables -P FORWARD DROP - -echo "iptables-persistent iptables-persistent/autosave_v4 boolean true" | debconf-set-selections -echo "iptables-persistent iptables-persistent/autosave_v6 boolean true" | debconf-set-selections -apt-get -y install iptables-persistent - -adduser user1 - -adduser user1 sudo - -reboot - -ssh user1@45.33.46.147 - -sudo apt-get install haveged # Installs random number tools — otherwise gpg will not have enough randomness on a VPS - -## TODO: rng-tools may be installed by haveged -- if working remove these -#sudo apt-get install rng-tools -#/etc/init.d/rng-tools start -#sudo /usr/sbin/rngd -r /dev/urandom # Initialize randomness pool -#cat /dev/urandom | rngtest -c 1000 # check randomness pool - -## TODO: make sure haveged is properly initialized, and that it will be started on boot - -gpg --gen-key # create a key for this VPS (I don't the name of this machine as the email address — all other questions I press return - #TODO: I'm not absolutely sure that we need to do this — it is only required for fully qualified --verify if an --lsign is done of the import. - -# get current values for these URLs from https://bitcoin.org/en/download — make sure that they are HTTPS not HTTP urls. - -wget https://bitcoin.org/bin/bitcoin-core-0.13.2/bitcoin-0.13.2-x86_64-linux-gnu.tar.gz -wget https://bitcoin.org/bin/bitcoin-core-0.13.2/SHA256SUMS.asc -wget https://bitcoin.org/laanwj-releases.asc - ## TODO: validate the release key, for instance, it is the same as in the keyserver i.e. gpg --recv-keys 0x01EA5486DE18A882D4C2684590C8019E36C2E964 -gpg --import laanwj-releases.asc - gpg --list-keys - gpg --lsign 36C2E964 # laanwj's bitcoin release key just imported ## -gpg --verify SHA256SUMS.asc -# You should see a 'good signature', for example: -# gpg: Signature made Tue 03 Jan 2017 12:20:59 AM PST using RSA key ID 36C2E964 -# gpg: Good signature from "Wladimir J. van der Laan (Bitcoin Core binary release signing key) " - -cat SHA256SUMS.asc -sha256sum bitcoin-0.13.2-x86_64-linux-gnu.tar.gz -# SHA256 hashes should match - -tar xzf bitcoin-0.13.2-x86_64-linux-gnu.tar.gz -sudo install -m 0755 -o root -g root -t /usr/local/bin bitcoin-0.13.2/bin/* -rm bitcoin-0.13.2-x86_64-linux-gnu.tar.gz -rm -rf bitcoin-0.13.2/ - -mkdir ~/.bitcoin -echo -e "server=1\ndbcache=1536\npar=1\nblocksonly=1\nprune=550\nmaxuploadtarget=137\nmaxconnections=16\nrpcuser=bitcoinrpc\nrpcpassword=$(xxd -l 16 -p /dev/urandom)" > ~/.bitcoin/bitcoin.conf -chmod 600 ~/.bitcoin/bitcoin.conf -more ~/.bitcoin/bitcoin.conf - -bitcoind -daemon #start bitcoin - -``` -Note: it may take up to several minutes for Bitcoin Core to start, during which it will display the following message whenever you use bitcoin-cli: - `error: {"code":-28,"message":"Verifying blocks..."}` - -Also useful is this command, the same number (your local getblockcount = the remote blockchain.info's getblockcount) then your pruned node is ready (about a day). - -``` -echo `bitcoin-cli getblockcount 2>&1`/`wget -O - http://blockchain.info/q/getblockcount 2>/dev/null` +Linode Referral Code: https://www.linode.com/?r=3c7fa15a78407c9a3d4aefb027539db2557b3765 +Digital Ocean: http://www.digitalocean.com/?refcode=a6060686b88a ``` -### Useful aliases to add to .bash_profile +### Consider Two-Factor Authentication + +If your cloud provider offers two-factor authentication for their web tools, we highly suggest using it, to ensure that your machine remains secure. + +### Create a Machine + +You should now create your Bitcoin VPS. If you want to install an unPruned Mainnet setup, you'll need more than 120G of disk space. If you instead plan to use a Pruned setup, a much smaller amount will do: we use the smallest disk type, 24G, at Linode. + +We suggest going with the smaller, pruned node unless you're planning to set up a miner or a complex Bitcoin service. + +We also suggest you choose a Debian 8 image when you're creating your machine. These commands were all tested on Debian 8.7 (jessie). + +Afterward, boot your VPS. + +## Configuring Your VPS + +You're now ready to log. You'll need to lookup the IP address of your new machine, and then you should be able to SSH in: ``` +$ ssh root@192.168.1.52 +``` + +You'll need to do some bog-standard configuration, then do some work to improve the security of your machine. + +### Set Up Your Hostname + +Choose a hostname for your machine (e.g. "mybtc") and enter it into your hostname file; afterward, run a few commands to propagate that new info: + +``` +$ echo "mybtc" > /etc/hostname +$ /etc/init.d/hostname.sh start +$ /bin/hostname $HOSTNAME +``` + +Also enter the info into your /etc/hosts file. Note that you should also enter a fully-qualified hostname into your hosts file, as shown below. If you're not making the machine part of a name, just choose a ".local" suffix. + +``` +$ echo "127.0.0.1 localhost" > /etc/hosts +$ echo "127.0.1.1 mybtc.local mybtc" >> /etc/hosts +``` + +### Update Your Timezone + +Make sure your timezone is set correctly. + +The following example sets your machine to the American west coast timezone: + +``` +$ echo "America/Los_Angeles" > /etc/timezone +$ cp /usr/share/zoneinfo/America/Los_Angeles /etc/localtime +``` + +## Protect Your VPS + +Though you're not putting much real value on this server, you should still make sure it's as absolutely secure as possible. + +### Create Firewall Rules + +To start with, create a firewall rules file. For all instructions that look like this, you should just be able to cut from the "cat" all the way down to the EOF, and everything will be placed into the appropriate file. + +``` +$ cat > /etc/iptables.firewall.rules < /etc/ip6tables.firewall.rules +``` + +Afterward, you need to create a file that will run both of these on startup: + +``` +$ cat > /etc/network/if-pre-up.d/firewall <> /etc/hosts.allow +$ echo "sshd: ALL" >> /etc/hosts.deny +``` + +## Setting Up a User + +It's always best to do your work with a user other than root. The following creates a user account for 'user1' + +``` +/usr/sbin/useradd -m -g sudo -s /bin/bash user1 +/usr/bin/passwd user1 +/usr/sbin/adduser user1 sudo +``` + +You'll be asked for a password after the second command. + +### Set Up a SSH Key + +Though it's not required, we suggest copying your SSH key to your user1 account, to simplify access and make it more secure. + +Make the SSH directory: + +``` +$ mkdir ~user1/.ssh +``` + +Then past your SSH key into ~user1/.ssh/authorized_keys + +Afterward give user1 the permissions: + +``` +$ chown -R user1 ~user1/.ssh +``` + + If you haven't setup an SSH key on your local computer yet, there are good instructions for it on [Github](https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/). + +### Create Bitcoin Aliases + +We find a number of Bash aliases helpful to make it easier to use Bitcoin. + +If you are using a Testnet setup, we suggest the following: + +``` +$ sudo -u user1 cat >> ~user1/.bash_profile <> ~user1/.bash_profile <> ~user1/.bitcoin/bitcoin.conf << EOF +server=1 +dbcache=1536 +par=1 +txindex=1 +blocksonly=1 +maxuploadtarget=137 +maxconnections=16 +rpcuser=bitcoinrpc +rpcpassword=$(xxd -l 16 -p /dev/urandom) +EOF +``` + +If you want a pruned copy of the chain (and you probably should), add the following: + +``` +$ cat >> ~user1/.bitcoin/bitcoin.conf << EOF +prune=550 +EOF +``` + +Finally, if you want to use Testnet instead of Mainnet, add the following: + +``` +$ cat >> ~user1/.bitcoin/bitcoin.conf << EOF +testnet=1 +EOF +``` + +_Please note that this setup does not yet support a Private Regtest. That will require a very different setup TBD._ + +Finally, limit permissions to your configuration file: + +``` +$ /bin/chmod 600 ~user1/.bitcoin/bitcoin.conf +``` + +### Start the Daemon! + +After all of that, starting the Bitcoin daemon is anticlimatically simple: + +``` +$ /usr/local/bin/bitcoind -daemon +``` + +You should also add a crontab entry , so that the bitcoin daemon starts up whenever your VPS restarts: + +``` +$ ( /usr/bin/crontab -l -u user1 2>/dev/null; echo "@reboot /usr/local/bin/bitcoind -daemon" ) | /usr/bin/crontab -u user1 - +``` + +## Playing with Bitcoin + +So now you probably want to play with Bitcoin! + +But wait, your Bitcoin daemon is probably still downloading blocks. This alias, from your .bash configuration will tell you how things are going: + +``` +$ btcblock +``` + +If you choose of the pruned mainnet, it will probably take a little over a day to download everything. + +So, it might be time for a few more espressos. + +But, when you're ready to go, continue on with [Playing with Bitcoin](-link-), where we'll talk about the files and how you can start experimenting.### Useful commands ``` bc help