Read wallet password from the file

[themantre]

Describe the problem you'd like to have solved

Currently, to start the node, the user must provide the wallet password as an argument to the pactus-daemon executable. This approach is particularly vulnerable, even if pactus-daemon is run as sudo by a non-root user. For example, if the server gets compromised, it is easy to retrieve the wallet password without needing the sudo password by using a command like:

ps -p $(pidof pactus-daemon) -o args

Describe the ideal solution

To improve the security of the node, we can store the password in a file that is readable only by sudo. Then, the pactus-daemon process can be run with sudo and read the password from this file. This approach enhances security by protecting the wallet password with the sudo password.

[Ja7ad]

Describe the problem you'd like to have solved

Currently, to start the node, the user must provide the wallet password as an argument to the pactus-daemon executable. This approach is particularly vulnerable, even if pactus-daemon is run as sudo by a non-root user. For example, if the server gets compromised, it is easy to retrieve the wallet password without needing the sudo password by using a command like:

ps -p $(pidof pactus-daemon) -o args

Describe the ideal solution

To improve the security of the node, we can store the password in a file that is readable only by sudo. Then, the pactus-daemon process can be run with sudo and read the password from this file. This approach enhances security by protecting the wallet password with the sudo password.

@b00f Currently, we have switched from reading the password using --password foobar to defining a new switch, --password-from-file /home/user/password.txt, to read the password from a file.

By defining a file with root access, no significant logic changes are required. We simply need a switch to read the file and extract the password from its content.

echo "your-secure-password" > /etc/pactus/wallet-password
chmod 600 /etc/pactus/wallet-password
chown root:root /etc/pactus/wallet-password