This guide is built with a combination of information from:
- https://www.coincashew.com/coins/overview-eth/guide-or-how-to-setup-a-validator-on-eth2-testnet-prater
- https://www.coincashew.com/coins/overview-eth/guide-or-security-best-practices-for-a-eth2-validator-beaconchain-node
- https://www.coincashew.com/coins/overview-eth/guide-or-how-to-setup-a-validator-on-eth2-mainnet/monitoring-your-validator-with-grafana-and-prometheus
- https://someresat.medium.com/guide-to-staking-on-ethereum-2-0-ubuntu-prater-teku-3249f1922385
- https://docs.teku.consensys.net/en/stable/
- https://ethereum.org/en/eth2/staking/
- https://launchpad.ethereum.org/en/
This guide has references to "Prater," an Ethereum Testnet. Mainnet setup is nearly identical with only a few configurations and parameters changed. Make sure any external interactions through Metamask, Launchpad, beaconcha.in, etc. match your network expectations.
- Set BIOS to power-on on power restore
- Disable Intel® TurboBoost1 in BIOS (Performance -> Power Settings)
- Install Ubuntu from USB: https://ubuntu.com/download/server
- SFTP and SSH clients for remote administration
- Additional USB to transfer files from key-generating machine to staking machine if not using local network
- Goerli Testnet ETH
- Validator keys and deposit files - Steps 1 and 2 OR you can skip all the hard stuff and use the Wagyu GUI. No matter what process you pick, please generate these validator keys on a secure machine.
- Assign a static IP to your staking machine on either your local network or your WAN if possible.
- Open ports on router for SSH access (default port 22) (optional if not managing locally), p2p (9000), and eth1 (30303)
This is personal thing, – no one else needs this.
git clone https://github.com/jaseg/lolcat.git
cd lolcat
sudo apt install make
sudo apt install gcc
make
sudo make install
cd ..
rm -rf lolcatRunning this command for the first time after a new install is always smart. It will be necessary to update your machine regularly (and manually, repeating these steps) to keep abreast of security and critical package updates.
sudo apt-get update -y && sudo apt dist-upgrade -y
sudo apt-get autoremove && sudo apt-get autocleansudo passwd -l rootBy default, deny all incoming and outgoing traffic
sudo ufw default deny incoming
sudo ufw default allow outgoingAllow ssh access
sudo ufw allow ssh #22/tcpAllow p2p ports
sudo ufw allow 9000/tcp comment p2p
sudo ufw allow 9000/udp comment p2pAllow eth1 port
sudo ufw allow 30303/tcp comment eth1
sudo ufw allow 30303/udp comment eth1Allow grafana web server port
sudo ufw allow 3000/tcp comment grafanaEnable prometheus endpoint port
sudo ufw allow 9090/tcp comment prometheusEnable teku api
sudo ufw allow 5051 comment teku-rest-apiEnable firewall
sudo ufw enableCheck firewall status:
sudo ufw status numberedOutput should look like:
Status: active
To Action From
-- ------ ----
[ 1] 22/tcp ALLOW IN Anywhere
[ 2] 9000/tcp ALLOW IN Anywhere # p2p
[ 3] 9000/udp ALLOW IN Anywhere # p2p
[ 4] 30303/tcp ALLOW IN Anywhere # eth1
[ 5] 30303/udp ALLOW IN Anywhere # eth1
[ 6] 3000/tcp ALLOW IN Anywhere # grafana
[ 7] 9090/tcp ALLOW IN Anywhere # prometheus
[ 8] 5051 ALLOW IN Anywhere # teku-rest-api
[ 9] 22/tcp (v6) ALLOW IN Anywhere (v6)
[10] 9000/tcp (v6) ALLOW IN Anywhere (v6) # p2p
[11] 9000/udp (v6) ALLOW IN Anywhere (v6) # p2p
[12] 30303/tcp (v6) ALLOW IN Anywhere (v6) # eth1
[13] 30303/udp (v6) ALLOW IN Anywhere (v6) # eth1
[14] 3000/tcp (v6) ALLOW IN Anywhere (v6) # grafana
[15] 9090/tcp (v6) ALLOW IN Anywhere (v6) # prometheus
[16] 5051 (v6) ALLOW IN Anywhere (v6) # teku-rest-apiCheck current configuration:
df -h #
sudo lvdisplay #Change configuration:
sudo lvm
lvm> lvextend -l +100%FREE /dev/ubuntu-vg/ubuntu-lv
lvm> lvextend -l +100%FREE -r /dev/ubuntu-vg/ubuntu-lv
lvm> exit
sudo resize2fs /dev/ubuntu-vg/ubuntu-lvCheck new configuration:
df -h #
sudo lvdisplay #nano, a command you will see referenced from here on out, is a text editor. Here are some basics you will need to know:
- The bottom bar once you launch nano shows possible commands, based on context. The carrot symbol (
^) means the "Control" key on your keyboard. So,^Xmeans press theControlkey and thexkey at the same time to exit. - To save a file, or as nano calls it, "Write Out",
^O(Control + O). - Navigation is accomplished with the arrow keys, or
^Yfor page-up,^Vfor page-down. - To search, press
^W("Where Is"), then type in your search and hit Enter. - To exit nano,
^X. If changes have been made, but not yet saved, nano will prompt to confirm changes, or if you want to discard or cancel the exit operation altogether.
Install apcupsd (optional for UPS backups - requires USB cable)
If you do not have a UPS skip this step.
If your UPS does not have a USB connection to allow it to be plugged into the staking machine, skip this step.
sudo apt-get install apcupsdEdit the name and device in apcupsd.conf configuration:
sudo nano /etc/apcupsd/apcupsd.confReboot the machine:
sudo rebootsudo nano /etc/ssh/sshd_configEdit sshd_config:
KbdInteractiveAuthentication no
PasswordAuthentication no
PermitRootLogin prohibit-password
PermitEmptyPasswords noConfirm sshd's configuration is error-free (there should be no output from this command):
sudo sshd -tsudo nano /etc/fstabAdd the following line to fstab:
tmpfs /run/shm tmpfs ro,noexec,nosuid 0 0Reboot the machine:
sudo rebootThis helps provide more legible log output
sudo apt install cczesudo apt-get install fail2ban -y
sudo nano /etc/fail2ban/jail.localAdd the following to jail.local:
[sshd]
enabled = true
port = 22
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
ignoreip = 127.0.0.0/8 10.0.0.0/8 192.168.0.0/16sudo systemctl restart fail2banThis is Two-Factor Authentication for use with an app like Google Authenticator or Authy for an added layer of security to access the machine. The first layer, is, of course, SSH keys – a process not explained in this guide. Supplemental information about this process can be found here.
sudo apt install libpam-google-authenticator -yEdit the sshd file:
sudo nano /etc/pam.d/sshdAdd the following to the sshd file:
auth required pam_google_authenticator.soFind and comment out the below line by adding # in front of it:
#@include common-auth
Restart the sshd service:
sudo systemctl restart sshdEdit the sshd_config file:
sudo nano /etc/ssh/sshd_configFind and set the following within the sshd_config file:
KbdInteractiveAuthentication yes
UsePAM yesAdd the following to the sshd_config file:
AuthenticationMethods publickey,keyboard-interactiveConfirm sshd's configuration is error-free (there should be no output from this command):
sudo sshd -tSet up 2FA:
google-authenticatorAnswers to google-authenticator setup:
- yes
- yes
- yes
- no
- yes
Restart the sshd service:
sudo systemctl restart sshdLog out of the server:
exitLog back in to server via SSH to see 2FA in action.
Synchronized time management is important. Chrony handles that better than the in-built system service.
sudo apt install chronyNow, we need to edit the chrony service file to use a better time server.
sudo nano /etc/chrony/chrony.conf# replacing original ubuntu servers by Google servers
# pool ntp.ubuntu.com iburst maxsources 4
# pool 0.ubuntu.pool.ntp.org iburst maxsources 1
# pool 1.ubuntu.pool.ntp.org iburst maxsources 1
# pool 2.ubuntu.pool.ntp.org iburst maxsources 2
server time1.google.com iburst minpoll 4 maxpoll 6 polltarget 16
server time2.google.com iburst minpoll 4 maxpoll 6 polltarget 16
server time3.google.com iburst minpoll 4 maxpoll 6 polltarget 16
server time4.google.com iburst minpoll 4 maxpoll 6 polltarget 16
# rest of the doc ...
# leapsectz right/UTCFinally, restart the chrony service:
sudo systemctl restart chrony.serviceSince we are running Teku (and possibly Besu) we need to install Java:
sudo apt install openjdk-17-jdkDetermine the latest release version by visiting: https://github.com/prometheus/prometheus/releases
As of this writing, the latest release is v2.32.1
Replace any occurance of an incorrect release version below with the latest.
sudo useradd --no-create-home --shell /bin/false prometheus
sudo useradd --no-create-home --shell /bin/false node_exporter
sudo mkdir /etc/prometheus
sudo mkdir /var/lib/prometheus
sudo chown -R prometheus:prometheus /etc/prometheus
sudo chown -R prometheus:prometheus /var/lib/prometheus
cd ~
curl -LO https://github.com/prometheus/prometheus/releases/download/v2.32.1/prometheus-2.32.1.linux-amd64.tar.gz
tar xvf prometheus-2.32.1.linux-amd64.tar.gz
sudo cp prometheus-2.32.1.linux-amd64/prometheus /usr/local/bin/
sudo cp prometheus-2.32.1.linux-amd64/promtool /usr/local/bin/
sudo cp -r prometheus-2.32.1.linux-amd64/consoles /etc/prometheus
sudo cp -r prometheus-2.32.1.linux-amd64/console_libraries /etc/prometheus
sudo chown -R prometheus:prometheus /etc/prometheus/consoles
sudo chown -R prometheus:prometheus /etc/prometheus/console_libraries
rm -rf prometheus-2.32.1.linux-amd64
rm prometheus-2.32.1.linux-amd64.tar.gzEdit the prometheus.yml file:
sudo nano /etc/prometheus/prometheus.ymlMake sure the prometheus.yml file includes the below configuration. Pay special attention to spacing. Two spaces are required for each indentation.
Optionally, change scrape_interval: 5s and scape_timeout: 3s for faster metrics updating at the expense of CPU load.
Also note, you probably aren't running geth and besu. Both configurations are included here as an example, however.
global:
scrape_interval: 15s
scrape_configs:
- job_name: "prometheus"
static_configs:
- targets: ["localhost:9090"]
- job_name: "node_exporter"
static_configs:
- targets: ["localhost:9100"]
- job_name: "geth"
scrape_timeout: 3s
metrics_path: /debug/metrics/prometheus
scheme: http
static_configs:
- targets: ['localhost:6060']
- job_name: "besu"
scrape_timeout: 3s
metrics_path: /metrics
scheme: http
static_configs:
- targets: ["localhost:9545"]
- job_name: "teku"
scrape_timeout: 3s
metrics_path: /metrics
scheme: http
static_configs:
- targets: ["localhost:8008"]Change permissions on the prometheus.yml file:
sudo chown -R prometheus:prometheus /etc/prometheus/prometheus.ymlEdit the prometheus.service file:
sudo nano /etc/systemd/system/prometheus.serviceAdd the following to the prometheus.service file:
[Unit]
Description=Prometheus
Wants=network-online.target
After=network-online.target
[Service]
Type=simple
User=prometheus
Group=prometheus
Restart=always
RestartSec=5
ExecStart=/usr/local/bin/prometheus \
--config.file /etc/prometheus/prometheus.yml \
--storage.tsdb.path /var/lib/prometheus/ \
--web.console.templates=/etc/prometheus/consoles \
--web.console.libraries=/etc/prometheus/console_libraries
[Install]
WantedBy=multi-user.targetReload prometheus:
sudo systemctl daemon-reload
sudo systemctl start prometheusCheck the status. There should be a green active in the output:
sudo systemctl status prometheusEnable the service:
sudo systemctl enable prometheusDetermine the latest release version by visiting: https://github.com/prometheus/node_exporter/releases
As of this writing, the latest release is v1.3.1
Replace any occurance of an incorrect release version below with the latest.
cd ~
curl -LO https://github.com/prometheus/node_exporter/releases/download/v1.3.1/node_exporter-1.3.1.linux-amd64.tar.gz
tar xvf node_exporter-1.3.1.linux-amd64.tar.gz
sudo cp node_exporter-1.3.1.linux-amd64/node_exporter /usr/local/bin
sudo chown -R node_exporter:node_exporter /usr/local/bin/node_exporter
rm -rf node_exporter-1.3.1.linux-amd64
rm node_exporter-1.3.1.linux-amd64.tar.gz
sudo nano /etc/systemd/system/node_exporter.serviceAdd the following to the node_exporter.service file:
[Unit]
Description=Node Exporter
Wants=network-online.target
After=network-online.target
[Service]
User=node_exporter
Group=node_exporter
Type=simple
ExecStart=/usr/local/bin/node_exporter
[Install]
WantedBy=multi-user.targetReload node exporter:
sudo systemctl daemon-reload
sudo systemctl start node_exporterCheck the status. There should be a green active in the output:
sudo systemctl status node_exporterEnable the service:
sudo systemctl enable node_exportercurl -s -0 https://packages.grafana.com/gpg.key | sudo apt-key add -
sudo add-apt-repository "deb https://packages.grafana.com/oss/deb stable main"
sudo apt update
sudo apt install grafana
sudo systemctl start grafana-serverCheck the status. There should be a green active in the output:
sudo systemctl status grafana-serverEnable the service:
sudo systemctl enable grafana-serversudo nano /etc/grafana/grafana.ini
;min_refresh_interval = 1s
sudo systemctl restart grafana-server- Open
http://localhost:3000orhttp://<your validator's ip address or name>:3000in your local browser. - Login with
admin/admin - Change password
- Click the
configuration gearicon, thenAdd Data Source - Select
Prometheus - Set Name to "Prometheus"
- Set URL to
http://localhost:9090 - Click
Save & Test - Download and save your consensus client's json file: Teku
- Download and save your execution client's json file: Geth
- Download and save a node-exporter dashboard for general system monitoring.
- Click Create
+icon >Import - Add the consensus client dashboard via
Upload JSON file - If needed, select Prometheus as
Data Source. - Click the
Importbutton. - Repeat steps 12-15 for the execution client dashboard.
- Repeat steps 12-15 for the node-exporter dashboard.
sudo mkdir -p /var/lib/ethereum
openssl rand -hex 32 | tr -d "\n" | sudo tee /var/lib/ethereum/jwttoken
sudo chmod +r /var/lib/ethereum/jwttokenWarning Only install Geth or Besu or Nethermind. Not each.
sudo add-apt-repository -y ppa:ethereum/ethereum
sudo apt-get update -y
sudo apt dist-upgrade -y
sudo apt install geth -ySet permissions for geth:
sudo useradd --no-create-home --shell /bin/false goeth
sudo mkdir -p /var/lib/goethereum
sudo chown -R goeth:goeth /var/lib/goethereumConfigure geth:
sudo nano /etc/systemd/system/geth.serviceAdd the following to the geth.service file:
[Unit]
Description=Ethereum go client
After=network.target
Wants=network.target
[Service]
User=goeth
Group=goeth
Type=simple
Restart=always
RestartSec=5
ExecStart=geth --goerli --http --datadir /var/lib/goethereum --metrics --pprof
[Install]
WantedBy=default.targetReload geth:
sudo systemctl daemon-reload
sudo systemctl start gethCheck the status. There should be a green active in the output:
sudo systemctl status gethEnable the service:
sudo systemctl enable gethWait for Geth to sync and monitor with:
sudo journalctl -fu geth -o cat | ccze -AMonitoring of the sync process which must be complete before proceeding can also be performed with the following commmands and looking for a return value of false. Anything else means syncing is still in progress
geth attach http://127.0.0.1:8545
> eth.syncingDownload the latest version of Besu and extract:
cd ~
wget https://hyperledger.jfrog.io/artifactory/besu-binaries/besu/22.7.0/besu-22.7.0.tar.gz
tar xvf besu-22.7.0.tar.gz
rm besu-22.7.0.tar.gz
sudo cp -a besu-22.7.0/. /usr/local/bin/besu
rm -rf ./besu-22.7.0Create a user for besu:
sudo useradd --no-create-home --shell /bin/false besu
sudo mkdir -p /var/lib/besu
sudo mkdir -p /etc/besu
sudo chown -R besu:besu /var/lib/besu
sudo chown -R besu:besu /etc/besuCreate the Besu service configuration:
sudo nano /etc/besu/besu.tomlAdd the following to besu.toml:
network="mainnet"
sync-mode="X_CHECKPOINT"
rpc-ws-enabled=true
rpc-http-enabled=true
rpc-http-port="8545"
rpc-http-host="0.0.0.0"
rpc-http-api=["TXPOOL"]
engine-rpc-port="8551"
engine-host-allowlist=["localhost","127.0.0.1"]
data-path="/var/lib/besu"
data-storage-format="BONSAI"
metrics-enabled=true
engine-jwt-secret="/var/lib/ethereum/jwttoken"Create the Besu service:
sudo nano /etc/systemd/system/besu.service
Add the following to the besu.service definition:
[Unit]
Description=Besu Ethereum Client
After=network.target
Wants=network.target
[Service]
User=besu
Group=besu
Type=simple
Restart=always
RestartSec=5
ExecStart=/usr/local/bin/besu/bin/besu \
--config-file=/etc/besu/besu.toml
[Install]
WantedBy=default.targetRe/Start Besu:
sudo systemctl daemon-reload
sudo systemctl start besuCheck the status. There should be a green active in the output:
sudo systemctl status besuEnable the service:
sudo systemctl enable besuMonitor Beacon Chain syncing progress, peers, and other information:
sudo journalctl -fu besu -o cat | ccze -AComing Soon
cd ~
git clone https://github.com/Consensys/teku.git
cd teku
sudo ./gradlew installDist
cd ~
sudo cp -a teku/build/install/teku/. /usr/local/bin/teku
sudo useradd --no-create-home --shell /bin/false teku
sudo mkdir -p /var/lib/teku
sudo mkdir -p /etc/teku
sudo chown $(whoami):$(whoami) /var/lib/teku- Generate Validator keys and deposit files - Steps 1 and 2 OR you can skip all the hard stuff and use the Wagyu GUI. No matter what process you pick, please generate these validator keys on a secure machine.
- Create password files for validator keys:
- Copy every
keystore-m*.jsonfile and rename the copies to have.txtas the file extension - Open each file and replace all contents with the keystore password created in Step 1.
- Copy every
- Use an SFTP program or a USB key to move files to the NUC in your home folder
Move validator keys from your home folder to Teku:
sudo cp -r $HOME/validator_keys /var/lib/teku
sudo rm /var/lib/teku/validator_keys/deposit_data*Set permissions for keys:
sudo chown -R teku:teku /var/lib/teku
sudo chown -R teku:teku /etc/teku
sudo chmod -R 700 /var/lib/teku/validator_keys👉 You will need to sign up for a free Infura (https://www.infura.io) account and create a new ETH1 project and a new ETH2 project.
Create the Teku configuration:
sudo nano /etc/teku/teku.yamlAdd the following to teku.yaml:
# EXAMPLE FILE - DO NOT CUT AND PASTE WITHOUT CHANGES
data-base-path: "/var/lib/teku"
network: "prater"
# if quick-sync is desired, replace the state URL with your information from Infura
initial-state: "https://XXX:XXX@eth2-beacon-prater.infura.io/eth/v1/debug/beacon/states/finalized"
validator-keys: "/var/lib/teku/validator_keys:/var/lib/teku/validator_keys"
# change this to your Ethereum withdrawal address (or any other address you'd like proposal fees to go
validators-proposer-default-fee-recipient: "0x..."
validators-graffiti: "XXX"
# optionally use a file for graffiti, but make sure it is world-readable
# validators-graffiti-file: "/home/USERDIR/graffiti.txt"
p2p-port: 9000
p2p-peer-upper-bound: 100
log-destination: "CONSOLE"
metrics-enabled: true
metrics-port: 8008
# if you are using beaconcha.in to monitor your machine, include the appropriate URL below
metrics-publish-endpoint: "https://beaconcha.in/api/v1/client/metrics?apikey=APIKEY&machine=MACHINENAME"
# replace hostname with the name of your staking machine
rest-api-host-allowlist: ["localhost", "127.0.0.1", "hostname"]
rest-api-enabled: true
rest-api-docs-enabled: true
# we're testing or post-merge, so the following two lines are required. Be sure to comment out/remove the eth1-endpoint line above
ee-endpoint: "http://localhost:8551"
ee-jwt-secret-file: "/var/lib/ethereum/jwttoken"Create the Teku service definition:
sudo nano /etc/systemd/system/teku.serviceAdd the following to teku.service:
[Unit]
Description=Teku Client
Wants=network-online.target
After=network-online.target
[Service]
Type=simple
User=teku
Group=teku
Restart=always
RestartSec=5
Environment="JAVA_OPTS=-Xmx5g"
ExecStart=/usr/local/bin/teku/bin/teku --config-file=/etc/teku/teku.yaml
[Install]
WantedBy=multi-user.targetRe/Start Teku:
sudo systemctl daemon-reload
sudo systemctl start tekuCheck the status. There should be a green active in the output:
sudo systemctl status tekuEnable the service:
sudo systemctl enable tekuMonitor Beacon Chain syncing progress, peers, and other information:
sudo journalctl -fu teku -o cat | ccze -ATeku needs to sync to the Beacon Chain before proceeding with the funding of validators.
If an initial-state is set in the teku.yaml configuration file, syncing should happen very rapidly.
This is an external process describe in various referenced guides. Please follow directions at https://www.coincashew.com/coins/overview-eth/guide-or-how-to-setup-a-validator-on-eth2-testnet-prater#2.-signup-to-be-a-validator-at-the-launchpad, steps 3-6.
Watch prater.beachoncha.in and wait for deposits to clear.
The staking machine requires regular manual maintanence.
https://gist.github.com/yorickdowne/3323759b4cbf2022e191ab058a4276b2
https://github.com/ethereum/go-ethereum/releases
Just in case, update the installed geth package to make sure it sees the latest stable version:
sudo apt updateNow, update and restart geth!
sudo apt upgrade -y && sudo apt autoremove && sudo apt autoclean && sudo systemctl restart gethMake sure geth is ok (should see a green "active" message):
sudo systemctl status gethhttps://github.com/ConsenSys/teku/releases
Pull the latest source and build it.
cd ~/teku
git pull
./gradlew distTar installDistVerify the build completed by checking the new version number.
cd ~/teku/build/install/teku/bin
./teku --versionRestart beacon chain and validator as per normal operating procedures.
Make sure the validators are in an acceptable state to be stopped before proceeding2
cd ~
sudo systemctl stop teku && sudo cp -a teku/build/install/teku/. /usr/local/bin/teku && sudo systemctl start tekuDownload the latest release from https://github.com/hyperledger/besu/releases
Change any URL or filename below with the appropriate release number/file
cd ~
wget https://hyperledger.jfrog.io/artifactory/besu-binaries/besu/22.7.1/besu-22.7.1.tar.gzUnzip:
tar xvf besu-22.7.1.tar.gzStop the existing client, copy the new release to the appropriate location, start the client:
sudo systemctl stop besu && sudo cp -a besu-22.7.1/. /usr/local/bin/besu && sudo systemctl start besuClean up:
rm besu-22.7.1.tar.gz
rm -rf ./besu-22.7.1Download the latest release from https://github.com/NethermindEth/nethermind/releases
Change any URL or filename below with the appropriate release number/file
sudo su -l nethermind
wget https://github.com/NethermindEth/nethermind/releases/download/1.25.0/nethermind-1.25.0-db6ecc76-linux-x64.zip
unzip nethermind-1.25.0-db6ecc76-linux-x64.zip -d ./build/
rm nethermind-1.25.0-db6ecc76-linux-x64.zip
exit
sudo systemctl restart nethermindMake sure the validators are in an acceptable state to be stopped before proceeding2
sudo apt update -y && sudo apt upgrade -y
sudo apt autoremove && sudo apt autocleanA reboot may be necessary: sudo reboot
CGO_CFLAGS="-O -D__BLST_PORTABLE__" go install github.com/flashbots/mev-boost@latest
sudo systemctl stop mevboost && sudo cp ~/go/bin/mev-boost /usr/local/bin && sudo chown mevboost:mevboost /usr/local/bin/mev-boost && sudo systemctl start mevboostFootnotes
-
TurboBoost seems unnecessary and will make your NUC run hot and loud. ↩
-
Install ethdo and then use the status script to make sure timing is ok for a restart or update. ↩ ↩2