Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Document secure-validator mode #5346

Merged
merged 4 commits into from
Nov 9, 2023
Merged

Document secure-validator mode #5346

Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
393786b
Document secure-validator mode
mrcnski Nov 8, 2023
cc674f8
Make requirement use a bit less technical language
mrcnski Nov 8, 2023
cb400af
Add warning about disabling secure mode
mrcnski Nov 8, 2023
8baefca
minor edits, grammar check
filippoweb3 Nov 9, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions docs/maintain/maintain-guides-secure-validator.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,32 @@ behavior.

:::

### Secure-Validator Mode

Parity Polkadot has a Secure-Validator Mode which enables several protections for keeping keys
secure. The protections include highly strict filesystem, networking, and process sandboxing, on top
of the existing wasmtime sandbox.

This mode is **on by default** if the machine meets the following requirements. If not, there is an
error message with instructions on disabling Secure-Validator Mode.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Which is not recommended for obvious reasons ... would be a good addition here.


#### Requirements

1. **Linux on x86-64 family** (usually Intel or AMD).
2. **seccomp enabled**. You can check that this is the case by running the following command:

```
cat /boot/config-`uname -r` | grep CONFIG_SECCOMP=
```

The expected output, if enabled, is:

```
CONFIG_SECCOMP=y
```

3. OPTIONAL: **Linux 5.13**. Provides access to even more strict filesystem protections.

## Monitoring Tools

- [Telemetry](https://github.com/paritytech/substrate-telemetry) This tracks your node details
Expand Down