https://elastos-wiki.netlify.app/assets/js/631e66b5.d469e7ba.js

1"use strict";(self.webpackChunk=self.webpackChunk||[]).push([[2929],{3905:(e,t,n)=>{n.d(t,{Zo:()=>c,kt:()=>k});var r=n(7294);function i(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function o(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function a(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?o(Object(n),!0).forEach((function(t){i(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):o(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function l(e,t){if(null==e)return{};var n,r,i=function(e,t){if(null==e)return{};var n,r,i={},o=Object.keys(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||(i[n]=e[n]);return i}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(i[n]=e[n])}return i}var s=r.createContext({}),u=function(e){var t=r.useContext(s),n=t;return e&&(n="function"==typeof e?e(t):a(a({},t),e)),n},c=function(e){var t=u(e.components);return r.createElement(s.Provider,{value:t},e.children)},p="mdxType",m={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},d=r.forwardRef((function(e,t){var n=e.components,i=e.mdxType,o=e.originalType,s=e.parentName,c=l(e,["components","mdxType","originalType","parentName"]),p=u(n),d=i,k=p["".concat(s,".").concat(d)]||p[d]||m[d]||o;return n?r.createElement(k,a(a({ref:t},c),{},{components:n})):r.createElement(k,a({ref:t},c))}));function k(e,t){var n=arguments,i=t&&t.mdxType;if("string"==typeof e||i){var o=n.length,a=new Array(o);a[0]=d;var l={};for(var s in t)hasOwnProperty.call(t,s)&&(l[s]=t[s]);l.originalType=e,l[p]="string"==typeof e?e:i,a[1]=l;for(var u=2;u<o;u++)a[u]=n[u];return r.createElement.apply(null,a)}return r.createElement.apply(null,n)}d.displayName="MDXCreateElement"},3631:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>s,default:()=>k,frontMatter:()=>l,metadata:()=>u,toc:()=>p});var r=n(7462),i=n(3366),o=(n(7294),n(3905)),a=["components"],l={title:"Basic Security Considerations"},s=void 0,u={unversionedId:"nodes/security",id:"nodes/security",title:"Basic Security Considerations",description:"Environment",source:"@site/../docs/5.nodes/security.md",sourceDirName:"5.nodes",slug:"/nodes/security",permalink:"/nodes/security",draft:!1,editUrl:"https://github.com/elastos/Elastos.Wiki/edit/master/website/../docs/5.nodes/security.md",tags:[],version:"current",lastUpdatedBy:"racollette",lastUpdatedAt:1678417269,formattedLastUpdatedAt:"Mar 10, 2023",frontMatter:{title:"Basic Security Considerations"},sidebar:"nodesSidebar",previous:{title:"Detailed Setup",permalink:"/nodes/advanced"},next:{title:"Explanation of config.json",permalink:"/nodes/config"}},c={},p=[{value:"Environment",id:"environment",level:3},{value:"Personnel",id:"personnel",level:3},{value:"Facilities",id:"facilities",level:3},{value:"Communication",id:"communication",level:3},{value:"Login",id:"login",level:3},{value:"System",id:"system",level:3},{value:"Ports",id:"ports",level:3},{value:"Version",id:"version",level:3},{value:"Service",id:"service",level:3},{value:"Logs",id:"logs",level:3},{value:"Backup",id:"backup",level:3}],m={toc:p},d="wrapper";function k(e){var t=e.components,n=(0,i.Z)(e,a);return(0,o.kt)(d,(0,r.Z)({},m,n,{components:t,mdxType:"MDXLayout"}),(0,o.kt)("h3",{id:"environment"},"Environment"),(0,o.kt)("ul",null,(0,o.kt)("li",{parentName:"ul"},"Use WIFI in public areas with caution (such as hotels, coffee shops, etc.)"),(0,o.kt)("li",{parentName:"ul"},"Avoid using unencrypted wireless networks")),(0,o.kt)("h3",{id:"personnel"},"Personnel"),(0,o.kt)("ul",null,(0,o.kt)("li",{parentName:"ul"},"Need to have professional ability to organize operation and maintenance implementation"),(0,o.kt)("li",{parentName:"ul"},"Need to be familiar with technology, understand process, follow norms"),(0,o.kt)("li",{parentName:"ul"},"Unrelated personnel are prohibited from accessing important network information")),(0,o.kt)("h3",{id:"facilities"},"Facilities"),(0,o.kt)("ul",null,(0,o.kt)("li",{parentName:"ul"},"Choose cloud services from major international companies (AWS Global, Google Cloud, MS Azure, etc.)"),(0,o.kt)("li",{parentName:"ul"},"Subscription to commercial support services to receive technical support as quickly as possible"),(0,o.kt)("li",{parentName:"ul"},"Choose an international geographical area to place facilities in order to obtain good connectivity with the main network"),(0,o.kt)("li",{parentName:"ul"},"Add 2FA login to avoid cloud service account hacking"),(0,o.kt)("li",{parentName:"ul"},"Treat API keys with caution, if there is no need for automation, prohibit or do not generate apikey"),(0,o.kt)("li",{parentName:"ul"},"Use special equipment to operate the facility")),(0,o.kt)("h3",{id:"communication"},"Communication"),(0,o.kt)("ul",null,(0,o.kt)("li",{parentName:"ul"},"Sign and encrypt communication"),(0,o.kt)("li",{parentName:"ul"},"Do not open emails from unknown sources"),(0,o.kt)("li",{parentName:"ul"},"Avoid transmitting private keys over public networks")),(0,o.kt)("h3",{id:"login"},"Login"),(0,o.kt)("ul",null,(0,o.kt)("li",{parentName:"ul"},"Log in to the server using a certificate or a proxy solution (AWS Systems Manager)"),(0,o.kt)("li",{parentName:"ul"},"It is forbidden to log in to the server facility with username and password"),(0,o.kt)("li",{parentName:"ul"},"Lock the IP, only the specific authorized IP can log in to the server facility"),(0,o.kt)("li",{parentName:"ul"},"Eliminate unnecessary network-wide authorization (0.0.0.0/0)")),(0,o.kt)("h3",{id:"system"},"System"),(0,o.kt)("ul",null,(0,o.kt)("li",{parentName:"ul"},"Timely patch the operating system"),(0,o.kt)("li",{parentName:"ul"},"The server uses a new version of the kernel (4.4+)")),(0,o.kt)("h3",{id:"ports"},"Ports"),(0,o.kt)("ul",null,(0,o.kt)("li",{parentName:"ul"},"Do not open unnecessary ports"),(0,o.kt)("li",{parentName:"ul"},"Disable RPC port")),(0,o.kt)("h3",{id:"version"},"Version"),(0,o.kt)("ul",null,(0,o.kt)("li",{parentName:"ul"}

1,"Obtain the software version from official channels"),(0,o.kt)("li",{parentName:"ul"},"Before installing or running the software, check the version source and verify the content")),(0,o.kt)("h3",{id:"service"},"Service"),(0,o.kt)("ul",null,(0,o.kt)("li",{parentName:"ul"},"Enable advanced protection (AWS Shield, Cloudflare, Incapsula, etc.)"),(0,o.kt)("li",{parentName:"ul"},"Enable TLS"),(0,o.kt)("li",{parentName:"ul"},"Enable WAF"),(0,o.kt)("li",{parentName:"ul"},"Prohibit starting node services as privileged users"),(0,o.kt)("li",{parentName:"ul"},"Configure the number of P2P single IP node connections"),(0,o.kt)("li",{parentName:"ul"},"Configure P2P with timeout mechanism")),(0,o.kt)("h3",{id:"logs"},"Logs"),(0,o.kt)("ul",null,(0,o.kt)("li",{parentName:"ul"},"Recording (such as AWS FlowLog) and analyzing network logs"),(0,o.kt)("li",{parentName:"ul"},"Record node log")),(0,o.kt)("h3",{id:"backup"},"Backup"),(0,o.kt)("ul",null,(0,o.kt)("li",{parentName:"ul"},"Make an offline cold backup of the private key")))}k.isMDXComponent=!0}}]);