Security Best Practices

To safeguard your node and staked assets, adhere to these critical practices:

1. Server Hardening

Minimal OS: Use a lightweight, security-focused OS (e.g., Ubuntu Server LTS).
Updates: Apply security patches and software updates immediately.
Unused Services: Disable unnecessary ports, daemons, and user accounts.

2. Network Security

Firewalls: Restrict inbound/outbound traffic to essential ports (e.g., P2P port 30333).
SSH Security:
- Use SSH key authentication (disable password login).
- Change the default SSH port and block brute-force attacks with tools like fail2ban.
VPN/Private Network: Operate nodes in a private subnet or behind a VPN to limit exposure.

3. Key Management

Cold Wallets: Store stash keys offline in hardware wallets (e.g., Ledger).
Staking Proxy/Stash Separation: Use separate accounts:
- Stash account: Holds funds; kept offline.
- Staking proxy: Manages node operations; minimal balance.
Session Keys: Rotate keys periodically and never store them on the server.

4. Monitoring & Alerts

Tools: Deploy monitoring (e.g., Prometheus, Grafana) to track node health, RAM/CPU usage, and block production.
Alerts: Set up notifications for downtime, disk space, or slashing risks (use tools like Cabal or Telegram bots).

5. DDoS Mitigation

Cloud Providers: Host nodes only with DDoS-protected providers (e.g., AWS Shield, Google Cloud Armor).

6. Backup & Recovery

Regular Backups: Automate backups of keystores, node data, and configurations.
Disaster Recovery Plan: Test node restoration from backups to minimize downtime.

7. Physical Security

8. Operational Vigilance

Stay Informed: Monitor Analog’s official channels for protocol upgrades or security advisories.
Phishing Scams: Verify all links, software, and communications to avoid social engineering attacks.