Staking Evo on FreeBSD
FreeBSD is a very powerful operating system, it has a great history of reliability, security and stability. Here we show how it can be used to stake Evo in a secure way.
Isolating Evod in a FreeBSD jail
FreeBSD jails are a very powerful feature, in summary, your jail instance is more protected as it's like having a separate OS just for Evo with reduced privileges.
Here's a good read on Jails: https://www.freebsd.org/doc/handbook/jails.html
FreeBSD version used for this tutorial is 11.2, download it from the official FreeBSD mirrors:
Important: Make sure to install and enable NTP, it's necesary to stay synchronized to network clocks.
Install FreeBSD as normal, however, the following hardening settings are recommended during install:
Create a user with permissions "operator wheel"
Please remember to do all these commands as root
Allow sockets and upgrades in jail
Notice that we've added some settings for firewall, these will enable IPFW and basic settings to secure our Jail, allowing only ports 22(ssh) and 40000(Evo) to be accessed.
Resource limits for Jails
Creating our Jail for staking
zfs create -o mountpoint=/jail zroot/jail
(Change zroot for whatever name you chose for your zfs pool)
zfs create -o mountpoint=/jail/evo zroot/jail/evo
Now we've created our jail for staking Evo, let's fetch and install FreeBSD on it!
cd /jail/evo/ && fetch -o - http://ftp.freebsd.org/pub/FreeBSD/releases/amd64/11.2-RELEASE/base.txz | tar --unlink -xpJf - -C /jail/evo
We've now installed FreeBSD into /jail/evo
Typing ls /jail/evo/ should show the filesystem of our Evo FreeBSD Jail
Now, let's create the jail configuration file:
host.hostname = evo.local;
ip4.addr = 192.168.0.99;
interface = em0;
path = /jail/evo;
exec.start = "/bin/sh /etc/rc";
exec.stop = "/bin/sh /etc/rc.shutdown";
Ok now it's time to launch our jail!
service jail start evo
We've just started our Evo jail, We can now get into our Evo jail to finish configuration, install Evo and launch the wallet.
jexec evo /bin/csh
cp /usr/share/zoneinfo/YOURTIMEZONE/ /etc/localtime
This is very important, if the time info is incorrect, we'll produce orphan blocks or will be unable to sync
Create our basic /etc/rc.conf for our Evo Jail
Add dns nameservers to /etc/resolv.conf
echo "nameserver 18.104.22.168" >> /etc/resolv.conf
echo "nameserver 22.214.171.124" >> /etc/resolv.conf
Now that we've got our jail up and running, we need to install Evo. There's 2 options on doing this, we can use the pkg repository or the powerful FreeBSD ports which are usually updated faster:
pkg update -f
pkg install -y evo
portsnap fetch extract
cd /usr/ports/net-p2p/evo && make install clean
The above will ask for a lot of configuration options, it might be better to use make config-recursive to set all options before compiling.
If you want to use default settings just type
cd /usr/ports/net-p2p/evo && make install clean BATCH="YES"
Launching Evo is just like in any other *NIX operating system, however there's a minor difference here due to how FreeBSD jails work. First, we need to create a evo.conf file with the following contents:
This config is necessary, otherwise calling the daemon will return errors.
Then we can launch with
Set up firewall on host (you cannot setup a firewall inside a jail) and enable only the ports you need (22 and 40000) This is done in the host rc.conf at the top of this tutorial
Disable history, this will completely disable console history and it's a way to help secure your staking box, type the following on your FreeBSD console:
unset history; unset savehist
- Disable password authentication
- If using the FreeBSD box on your home network, force it to listen on local network only.