<p>The problem with running a network facing daemon as root, is that if in the future there is an exploit found for that daemon then potentially an attacker could execute code on your machine as root. This gives the attacker unlimited accesses to your machine. To fix this you would need to create a user/group that your daemon can run as and also assign that user/group to the files your daemon needs to access. This prevents an attacker from having free reign over your computer should he exploit that daemon.</p>

<p>To create a user/group for your daemon called user <code>bitcoin</code> you can run the following:</p>

<pre><code>$ sudo useradd -U -r -s /bin/false bitcoin
</code></pre>

<ul>
<li><code>-U</code> create a group named bitcoin</li>
<li><code>-r</code> create a system account</li>
<li><code>-s /bin/false</code> sets the login shell to /bin/false (this way no one can potentially login with this user and get a shell</li>
</ul>

<p>Now lets say you have chosen to store all the bitcoind related files in the /var/lib/bitcoind directory.</p>

<pre><code>$ sudo mkdir /var/lib/bitcoind
$ sudo chown -R bitcoin: /var/lib/bitcoind
</code></pre>

<p>This will set <code>bitcoin</code> user and <code>bitcoin</code> group as the owner of all files within that directory as well as the directory itself.</p>

<p>When you run the bitcoind daemon you need to tell it to run as user <code>bitcoin</code> and to use /var/lib/bitcoind as it's data directory. Make sure your files like your wallet or blockchain data are inside /var/lib/bitcoind. Your bitcoin.conf is expected to be stored at /etc/bitcoin/bitcoin.conf in the following system script.</p>

<p>Now you just need to install a script that will start your daemon for you with your intended user. To do this please read the instructions (chances are you are using systemd so follow those instructions): <a href="https://github.com/bitcoin/bitcoin/blob/master/doc/init.md" rel="nofollow">https://github.com/bitcoin/bitcoin/blob/master/doc/init.md</a></p>

<p>I hope this helps!</p>

CC BY-SA 3.0
2016-07-16T17:20:05.953Z
Thanks for your reply and for show me that script to start the daemon, you explained it to me better than tutorials that I see over internet! I just have one doubte yet: in my case I didn't specify a custom directory for bitcoind's files, then should I just execute `sudo chown -R bitcoin: ~/.bitcoin`? Or am I wrong?
John Graham
CC BY-SA 3.0
2016-07-16T19:53:15.573Z
@JohnGraham hey, no problem glad to help. If you're files are already in ~/.bitcoin, you can either simply move them all from there to /var/lib/bitcoind or just edit the bitcoin.service file to use your full home directory /home/<your username>/.bitcoin. If you choose to keep your home directory then make sure you change the owner like your said and make sure your home directory isn't encrypted. If it is then the bitcoin user won't be able to access the files when Ubuntu starts up. Personally since this is a service daemon, I would move all the files to /var/lib/bitcoind.
Brandon
CC BY-SA 3.0
2016-07-16T20:11:12.610Z
Okay perfect, I will follow your advice and I will move them to /var/lib/bitcoind Thanks again!
John Graham
CC BY-SA 3.0
2016-07-16T16:07:48.203Z
2016-07-16T16:36:45.380Z
2016-07-16T16:36:45.380Z
Brandon
<p>I am not an expert of linux systems but I want to learn how to use it on a secure way. I have an vps with ubuntu and I installed bitcoind with the root user. I read into a lot of sites that I should use another user account and install the program which require privileges through <code>sudo</code> command. Is it very bad that I have installed bitcoin daemon as root? If it is very bad, which are the right steps that I should follow to have a clean and secure installation?</p>

<p>Maybe it is a stupid question, but if someone could reply me to improve my knowledges I'd be very grateful</p>

<bitcoind><installation>
Newbie question, bitcoind installation doubte
John Graham
# Newbie question, bitcoind installation doubte

(Asked by: username_0 on 2016-07-16)

I am not an expert of linux systems but I want to learn how to use it on a secure way. I have an vps with ubuntu and I installed bitcoind with the root user. I read into a lot of sites that I should use another user account and install the program which require privileges through `sudo` command. Is it very bad that I have installed bitcoin daemon as root? If it is very bad, which are the right steps that I should follow to have a clean and secure installation?

Maybe it is a stupid question, but if someone could reply me to improve my knowledges I'd be very grateful

**Tags:** bitcoind, installation


---

## 1 answers

### Answer by username_1 on 2016-07-16. Score: 2 | Accepted answer

The problem with running a network facing daemon as root, is that if in the future there is an exploit found for that daemon then potentially an attacker could execute code on your machine as root. This gives the attacker unlimited accesses to your machine. To fix this you would need to create a user/group that your daemon can run as and also assign that user/group to the files your daemon needs to access. This prevents an attacker from having free reign over your computer should he exploit that daemon.

To create a user/group for your daemon called user `bitcoin` you can run the following:

```
$ sudo useradd -U -r -s /bin/false bitcoin

```

* `-U` create a group named bitcoin
* `-r` create a system account
* `-s /bin/false` sets the login shell to /bin/false (this way no one can potentially login with this user and get a shell

Now lets say you have chosen to store all the bitcoind related files in the /var/lib/bitcoind directory.

```
$ sudo mkdir /var/lib/bitcoind
$ sudo chown -R bitcoin: /var/lib/bitcoind

```

This will set `bitcoin` user and `bitcoin` group as the owner of all files within that directory as well as the directory itself.

When you run the bitcoind daemon you need to tell it to run as user `bitcoin` and to use /var/lib/bitcoind as it's data directory. Make sure your files like your wallet or blockchain data are inside /var/lib/bitcoind. Your bitcoin.conf is expected to be stored at /etc/bitcoin/bitcoin.conf in the following system script.

Now you just need to install a script that will start your daemon for you with your intended user. To do this please read the instructions (chances are you are using systemd so follow those instructions): <https://github.com/bitcoin/bitcoin/blob/master/doc/init.md>

I hope this helps!

> **Comments:**
> **username_0**: Thanks for your reply and for show me that script to start the daemon, you explained it to me better than tutorials that I see over internet! I just have one doubte yet: in my case I didn't specify a custom directory for bitcoind's files, then should I just execute `sudo chown -R bitcoin: ~/.bitcoin`? Or am I wrong?  
> **username_1**: @username_0 hey, no problem glad to help. If you're files are already in ~/.bitcoin, you can either simply move them all from there to /var/lib/bitcoind or just edit the bitcoin.service file to use your full home directory /home/<your username>/.bitcoin. If you choose to keep your home directory then make sure you change the owner like your said and make sure your home directory isn't encrypted. If it is then the bitcoin user won't be able to access the files when Ubuntu starts up. Personally since this is a service daemon, I would move all the files to /var/lib/bitcoind.  
> **username_0**: Okay perfect, I will follow your advice and I will move them to /var/lib/bitcoind Thanks again!  

---

