nano-docs icon indicating copy to clipboard operation
nano-docs copied to clipboard

Add more information about using docker and an exposed RPC address

Open guilhermelawless opened this issue 4 years ago • 2 comments

The node prints this message when "::ffff:0.0.0.0" is set as address an control is enabled: WARNING: control-level RPCs are enabled on non-local address ::ffff:0.0.0.0, potentially allowing wallet access outside local computer

We should add more information on this in the documentation and include the link in the printed message.

If not using docker:

  • A non-local address exposes the RPC
  • A firewall is necessary to properly manage exposure
  • Recommended to use a proxy, V22 will bring management using API-keys but should be used with SSL or a proxy

If using docker:

  • A non-local address is the default and required for other applications to use the RPC
  • The setting by itself does not expose the RPC to outside the local machine, this depends on how the run command is created
  • We have a warning against redirecting other addresses than localhost to the RPC port
  • Docker overrides ufw - even if rules are defined in ufw to only allow certain IPs through the RPC port, docker overrides this unless a special configuration is used.

guilhermelawless avatar Feb 10 '20 15:02 guilhermelawless

@guilhermelawless Is there a good reason we don't want to get this in now so we can update the log message with the link in V21?

zhyatt avatar May 14 '20 17:05 zhyatt

The only reason would be that we do not ship a proxy I think. In any casse, looking for more expertise on the subject.

guilhermelawless avatar Aug 31 '20 07:08 guilhermelawless