Harden node configuration, prevent secret leakage, and restrict RPC defaults - #1168
Open
magqqgq wants to merge 6 commits into
Open
Harden node configuration, prevent secret leakage, and restrict RPC defaults#1168magqqgq wants to merge 6 commits into
magqqgq wants to merge 6 commits into
Conversation
…efaults This PR addresses several critical security vulnerabilities and configuration anti-patterns within the node environment, specifically focusing on secret management, engine authentication, and RPC attack surface reduction. **Secrets & Configuration Management:** * Removed `node/.env`, `node/.env.mainnet`, and `node/.env.sepolia` from the repository to eliminate hardcoded, committed engine JWT secrets. * Updated `node/.gitignore` to strictly exclude local `.env` files while allowing safe templates (`*.example`). * Added redacted `.env.mainnet.example` and `.env.sepolia.example` templates that require operators to generate their own unique 32-byte hexadecimal deployment secrets. * Updated `README.md` with explicit instructions on generating and configuring these unique L2 engine secrets. **Engine Authentication Validation:** * Updated `node/execution-entrypoint` to validate the `BASE_NODE_L2_ENGINE_AUTH_RAW` input before writing the secret file. Node startup will now fail-closed if the value is missing or is not exactly 64 hexadecimal characters, preventing silent deployments with malformed authentication material. **RPC Attack Surface Reduction:** * Replaced wildcard (`*`) HTTP CORS and WebSocket origins with restricted defaults (`http://localhost`) in `node/execution-entrypoint`, which can be explicitly overridden via `RETH_HTTP_CORS_DOMAINS` and `RETH_WS_ORIGINS`. * Reduced the default privileged HTTP and WebSocket APIs from `web3,eth,net,debug,txpool,miner` to a least-privilege default of `web3,eth,net`.
Collaborator
🟡 Heimdall Review Status
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR addresses several critical security vulnerabilities and configuration anti-patterns within the node environment, specifically focusing on secret management, engine authentication, and RPC attack surface reduction.
Secrets & Configuration Management:
node/.env,node/.env.mainnet, andnode/.env.sepoliafrom the repository to eliminate hardcoded, committed engine JWT secrets.node/.gitignoreto strictly exclude local.envfiles while allowing safe templates (*.example)..env.mainnet.exampleand.env.sepolia.exampletemplates that require operators to generate their own unique 32-byte hexadecimal deployment secrets.README.mdwith explicit instructions on generating and configuring these unique L2 engine secrets.Engine Authentication Validation:
node/execution-entrypointto validate theBASE_NODE_L2_ENGINE_AUTH_RAWinput before writing the secret file. Node startup will now fail-closed if the value is missing or is not exactly 64 hexadecimal characters, preventing silent deployments with malformed authentication material.RPC Attack Surface Reduction:
*) HTTP CORS and WebSocket origins with restricted defaults (http://localhost) innode/execution-entrypoint, which can be explicitly overridden viaRETH_HTTP_CORS_DOMAINSandRETH_WS_ORIGINS.web3,eth,net,debug,txpool,minerto a least-privilege default ofweb3,eth,net.