11

simplewallet has a RPC mode that allows you to access it via an API. This is intended for local use only.

Is there a way to use simplewallet remotely in a secure way?

Improve this question

2 Answers 2

Reset to default
9

In Monero 'Wolfram Warptangent' (v0.10.0.0-release), use this flag

--user-agent arg

It is used to Restrict RPC to clients using this user agent. Make sure to set the user agent to something that cannot be guessed. i.e. a random UUID.

That way only RPC clients that set the User-Agent in the HTTP header can access the wallet.

However, this requires that all RPC clients and RPC server share the same secret. If at least one of them leaks said secret, all the monero in your wallet will be gone. Also, all the User-Agent values sent to your servers will be visible.

A better option is to use something like this or this, to keep your RPC behind a proxy which needs authentication. I will write a tutorial on how to do this when I find some time.

Improve this answer
1
  • 2
    Using a shared user-agent as a form of authentication is very risky and not recommended at all. The connection is not encrypted and any attacker can read this user-agent (and MITM all data). The only way of running a wallet safely over the internet is having an encrypted VPN connection between your device and the wallet.
    – James Cameron
    Sep 23, 2016 at 13:08
5

There is no built-in secure way to use simplewallet (renamed monero-cli-wallet) remotely.

However, you could rely on a trusted third party software to secure the transport, like ssh, stunnel, nginx ...

BTW, SimpleWallet is very light so there is no (or very few) need to use it remotely.

Improve this answer
2
  • 2
    "BTW, SimpleWallet is very light so there is no (or very few) need to use it remotely." I was thinking about devices that simplewallet doesn't support yet, such as mobile devices.
    – PyRulez
    Sep 22, 2016 at 1:55
  • 1
    Current ARM binaries will run on Android phones. reddit.com/r/Monero/comments/53hug9/… I agree, the wallet is already lightweight, I see no reason to run it remotely. But if I were to do so, I'd use stunnel with a pair of self-generated certificates, and turn on cert authentication in stunnel.
    – hyc
    Oct 15, 2016 at 17:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.