|
Title: Security advantage to run Bitcoin daemon as something else other than root Post by: Chick on July 02, 2011, 09:48:58 PM I'm setting up an sever dedicated for the Bitcoin daemon to start storing my Bitcoins. I just wanted to know if there were any security advantages to run the daemon as another user other than root. Since the daemon will be the only thing running on the system, I don't see why not?
The only way anybody will be connecting to the server is via an internal IP through json-rpc api calls. Thanks Title: Re: Security advantage to run Bitcoin daemon as something else other than root Post by: kokjo on July 02, 2011, 09:55:31 PM the light over this:
root is a administrative user, and should not be used, unless the powers of being root is necessary. it is really very simple to make another user: Code: adduser <username> but in this case a cant see why you cant use root. but don't do it anyway Title: Re: Security advantage to run Bitcoin daemon as something else other than root Post by: qwk on July 02, 2011, 10:02:32 PM I just wanted to know if there were any security advantages to run the daemon as another user other than root. Since the daemon will be the only thing running on the system, I don't see why not? Return question: where is the advantage in running it as root? I don't see why? Generally, it is always a good idea to run services with the minimal privileges required. Just good, common practice. Title: Re: Security advantage to run Bitcoin daemon as something else other than root Post by: Chick on July 02, 2011, 10:03:05 PM the light over this: root is a administrative user, and should not be used, unless the powers of being root is necessary. it is really very simple to make another user: Code: adduser <username> but in this case a cant see why you cant use root. but don't do it anyway I'm not talking about the simplicity of creating another user on the system. I just don't see a reason not to host the daemon on root because I don't see any reason to do so. But I don't believe the Bitcoin daemon needs any administrative powers, so I'll go ahead and make an account for it. Thanks Title: Re: Security advantage to run Bitcoin daemon as something else other than root Post by: JoelKatz on July 02, 2011, 10:34:29 PM I'm not talking about the simplicity of creating another user on the system. I just don't see a reason not to host the daemon on root because I don't see any reason to do so. If the daemon runs as root, someone who compromises the daemon can also load a kernel module to hide his tracks, modify system log files, and so on. I admit, it's a small issue, since if he can steal your wallet, the rest doesn't much matter. |