<p>The only real solution is to not keep private keys on that server. Keep them on a computer that only you can access, or offline in a paper wallet.</p>

<p>Encrypting the wallet will help somewhat, but a malicious administrator could log your passphrase when you unlock the wallet, or extract the decrypted private key from the server's memory.</p>

<p>If the server must have private keys (e.g. because it has to make payments), then your software should be designed to keep only the minimum balance necessary in the server's wallet, and sweep the rest to addresses whose keys you hold elsewhere.</p>

CC BY-SA 3.0
2014-09-04T22:47:40.920Z
2014-09-04T22:47:40.920Z
Nate Eldredge
<p>You could hold your keys on another server and just pull them across to your VPS server when needed, if you used something like <a href="https://github.com/spesmilo/sx" rel="nofollow">sx tools</a> then you could have your private key data on a separate server to your bitcoind software. When you need to make a payment the separate server could provide the raw transaction data required to push just that transaction to the network. Using sx tools you can create a raw transaction and submit it to a bitcoind node.</p>

<p>Of course this just passes the responsibility to another server but not having to run a bitcoin node on it at least means it's a bit more below the radar if that's what you're worried about.</p>

CC BY-SA 3.0
2014-09-05T01:29:30.697Z
2014-09-05T01:29:30.697Z
George
<p>How can I take steps to prevent/detect bad employees stealing my money?</p>

<p>I'm running bitcoind on a VPS with Ubuntu 14.04. Only ports open are 22, 80 and 443. I have fail2ban and auditd enabled.</p>

<p>Anyone have any other practical tips?</p>

<wallet><encryption>
Nosey/disgruntled employees at my VPS company
Eamorr
# Nosey/disgruntled employees at my VPS company

(Asked by: username_0 on 2014-09-04)

How can I take steps to prevent/detect bad employees stealing my money?

I'm running bitcoind on a VPS with Ubuntu 14.04. Only ports open are 22, 80 and 443. I have fail2ban and auditd enabled.

Anyone have any other practical tips?

**Tags:** wallet, encryption


---

## 2 answers

### Answer by username_1 on 2014-09-04. Score: 2

The only real solution is to not keep private keys on that server. Keep them on a computer that only you can access, or offline in a paper wallet.

Encrypting the wallet will help somewhat, but a malicious administrator could log your passphrase when you unlock the wallet, or extract the decrypted private key from the server's memory.

If the server must have private keys (e.g. because it has to make payments), then your software should be designed to keep only the minimum balance necessary in the server's wallet, and sweep the rest to addresses whose keys you hold elsewhere.


---

### Answer by username_2 on 2014-09-05. Score: 0

You could hold your keys on another server and just pull them across to your VPS server when needed, if you used something like [sx tools](https://github.com/spesmilo/sx) then you could have your private key data on a separate server to your bitcoind software. When you need to make a payment the separate server could provide the raw transaction data required to push just that transaction to the network. Using sx tools you can create a raw transaction and submit it to a bitcoind node.

Of course this just passes the responsibility to another server but not having to run a bitcoin node on it at least means it's a bit more below the radar if that's what you're worried about.


---

