<blockquote>
  <p>if anyone guesses my server and credentials, he/she is welcome to mine
  for my wallet.</p>
</blockquote>

<p>He/she can also call all other RPC commands. For example, <code>sendtoaddress</code>. So, if your wallet is unlocked you can loose your coins.</p>

CC BY-SA 3.0
2014-01-30T08:57:03.763Z
Of course, that is right.
Markus
CC BY-SA 3.0
2014-01-29T18:25:27.087Z
2014-01-29T18:25:27.087Z
qehgt
<p>When running (btc-/ltc-/whatever) wallet as daemon, I have to set "rpcuser" and "rpcpassword".</p>

<p>There is the option "rpcallowip", it is recommended to have this value very strict, e.g. "127.0.0.1".</p>

<p>I cannot see any danger setting this value to "<em>.</em>.*.*" - if anyone guesses my server and credentials, he/she is welcome to mine for my wallet.</p>

<p>So, is there any danger opening rpcallowip?</p>

CC BY-SA 3.0
2014-01-29T13:02:38.343Z
I'm not sure if the * is allowed, but as a general rule it would seem thatthe danger is in the scope of the RPC and what it can do.
T9b
CC BY-SA 3.0
2014-01-29T14:14:45.507Z
* (Wildcard) is allowed, I tested suggested setup. Common usecase for wildcard ist 192.168.0.*, but *.*.*.* works, too.
Markus
<wallet><daemon>
Wallet as daemon, what's the security-concern about "rpcallowip"?
Markus
# Wallet as daemon, what's the security-concern about "rpcallowip"?

(Asked by: username_0 on 2014-01-29)

When running (btc-/ltc-/whatever) wallet as daemon, I have to set "rpcuser" and "rpcpassword".

There is the option "rpcallowip", it is recommended to have this value very strict, e.g. "127.0.0.1".

I cannot see any danger setting this value to "*.*.\*.\*" - if anyone guesses my server and credentials, he/she is welcome to mine for my wallet.

So, is there any danger opening rpcallowip?

**Tags:** wallet, daemon

> **Comments:**
> **username_1**: I'm not sure if the * is allowed, but as a general rule it would seem thatthe danger is in the scope of the RPC and what it can do.  
> **username_0**: * (Wildcard) is allowed, I tested suggested setup. Common usecase for wildcard ist 192.168.0.*, but *.*.*.* works, too.  

---

## 1 answers

### Answer by username_2 on 2014-01-29. Score: 3

> if anyone guesses my server and credentials, he/she is welcome to mine
> for my wallet.

He/she can also call all other RPC commands. For example, `sendtoaddress`. So, if your wallet is unlocked you can loose your coins.

> **Comments:**
> **username_0**: Of course, that is right.  

---

