Any safe way to config RPC when running on TOR?

[d4n13]

Background, I'm running a full node, but my Orwellian ISP bans peer to peer (even calls it out in the TOS), they have even warned me when they see ports open through my NAT.  So to counter my ISP, I'm running bitcoin on TOR.  This violates TOS, but they haven't detected my TOR config since I use bridges.  I'm configured with -onlynet=onion so a lot of the exit-node threats would be neutralized.

Running bitcoin on TOR works great... but... this has the side effect of binding EXTERNAL traffic to 127.0.0.1.  My fear is, that opening up RPC requests with -rpcbind=127.0.0.1 would open me up to the world.  Similar to -rpcbind=* (<== bad!!!).

Now on the the one safeguard I have is that TOR only binds specified ports to 127.0.0.1 through their hidden services config.

So if I configure TOR to only bind to 127.0.0.1:8333, then go ahead and open up 127.0.0.1:8332 (locally, not TOR), should I be safe, or would I be foolhardy.  This is my hot wallet I'm talking about.

BTW, the reason I'm not binding RPC to a fake addr like 0.0.0.0 is that I need RPC for walletpassphrase commands.  I never felt good about issuing those through bitcoin-cli since the argument list is in the clear and viewable by any process or service on my box.

PS.. realize this is kind of a TOR specific question, so I will likely cross post to /r/TOR

[1715371605]

1715371605

[onemorexmr]

you could try to add multiple ip's for loopback:
http://askubuntu.com/questions/444124/how-to-add-a-loopback-interface

and bind bitcoin rpc to another one of them.

(i have not tried that and i am not familiar with tor: so please check if it works)

[gmaxwell]

Tor hidden service support can only connect to the specified ports in the tor configuration.

Additional your RPC is protected by the rpcuser/rpcpassword. The binding restriction is just belt and suspenders because, e.g. sometimes users copy their rpcpassword out of example configurations they find on the internet.

Just don't to anything too crazy-- like copy your rpcpassword off the net or reconfigure tor to allow connections to the rpc port-- and you'll be fine.

[goregrind]

Also 0.0.0.0 is not a fake addr. It stands for ALL addresses available on your server.

[Hannu]

Background, I'm running a full node, but my Orwellian ISP bans peer to peer (even calls it out in the TOS), they have even warned me when they see ports open through my NAT.  So to counter my ISP, I'm running bitcoin on TOR.  This violates TOS, but they haven't detected my TOR config since I use bridges.  I'm configured with -onlynet=onion so a lot of the exit-node threats would be neutralized.

Running bitcoin on TOR works great... but... this has the side effect of binding EXTERNAL traffic to 127.0.0.1.  My fear is, that opening up RPC requests with -rpcbind=127.0.0.1 would open me up to the world.  Similar to -rpcbind=* (<== bad!!!).

Now on the the one safeguard I have is that TOR only binds specified ports to 127.0.0.1 through their hidden services config.

So if I configure TOR to only bind to 127.0.0.1:8333, then go ahead and open up 127.0.0.1:8332 (locally, not TOR), should I be safe, or would I be foolhardy.  This is my hot wallet I'm talking about.

BTW, the reason I'm not binding RPC to a fake addr like 0.0.0.0 is that I need RPC for walletpassphrase commands.  I never felt good about issuing those through bitcoin-cli since the argument list is in the clear and viewable by any process or service on my box.

PS.. realize this is kind of a TOR specific question, so I will likely cross post to /r/TOR

You mean something like example ninja stick? Little over 20 dollars. Yep loopback adapter, its slow down littlebit of connection.