So you want to be a witness? Great! You've come to the right place. But before we get down to it, you need to ask yourself a difficult question: Am I ready to be a witness? Witnesses play a vital role for Steem and it's important that a witness be both **trustworthy** and **reliable**. * A **trustworthy** witness has Steem's interest at heart. Other users can trust that the witness isn't trying to game the system for personal gain and wants to support Steem's growth. * A **reliable** witness ensures that their server runs smoothly 24 hours a day, 7 days a week, 365.25 days per year. Witnesses also require a lot of knowledge in order to do their job well. * A witness **must** know what a witness does and **why** witnesses are so integral to the Steem ecosystem. If you can't answer @thecryptofiend's [Witness Questionnaire](https://steemit.com/steemit/@thecryptofiend/witness-questionnaire-a-solution-for-voter-confusion), you're probably not ready for the responsibility being a witness brings. * A witness **must** be comfortable on the command-line, building software from source, hardening a server, and with general server maintenance. If you've never done this before, you're probably not ready. If after reading this stark introduction you feel you have what it takes to be a witness, continue reading, and good luck! # 1. Procure a server When a witness is selected to create and sign a transaction block it must complete this quickly. The following specifications are the **minimum requirements** for a **reliable** witness. Keep in mind that over time this will change. * **CPU:** Dual core @ 2GHz or higher per core * **Memory:** 16GB (32GB to be future-proof) * **Bandwidth:** 1 Gbit/s * **Storage:** 500GB drive This guide assumes you're using Ubuntu 16.04 LTS. You can use other Linux distributions, but there may be slight differences. It's common for witnesses to rent a server from a hosting provider such as [ovh](https://ovh.com) and [Heztner](https://www.hetzner.de/ot/). You can use your own machine, but keep in mind the responsibility you have as a witness. # 2. Harden the server To be both trustworthy and reliable the server must be secure. This section covers some common ways to harden a server. ## Use SSH keys to login It's common for attackers to try and brute-force SSH passwords. Using SSH keys mitigates this since it's much more difficult to brute-force with today's technology. 1. Generate a passphrase-protected SSH for each computer that will connect to your server using `ssh-keygen -t rsa -b 4096 -C "your_email@example.com`. 2. Copy the contents of `~/.ssh/id_rsa.pub` from each computer into individual lines of `~/.ssh/authorized_keys` on the server, or run `ssh-copy-id ` on every computer to which you are granting access (you'll have to enter the server password at the prompt). 3. Test that you can login using SSH keys. This is vital because the next step disables password logins. 4. Disable password authentication in SSH on the server. Open `/etc/ssh/sshd_config`, find the line that says `#PasswordAuthentication yes` and change it to `PasswordAuthentication no`. Restart the SSH server daemon to apply the change with `sudo service ssh restart`. You can only login to your server using SSH keys. If you lose the keys on the clients that connect to the server, you won't be able to login to the machine. Make a backup. ## Disable root login On some systems root login is enabled by default. Before you disable the root login make sure you are able to login via SSH with another account. To disable root login via SSH, open `/etc/ssh/sshd_config` and find the following line: #PermitRootLogin no Uncomment the line by removing the `#` symbol: PermitRootLogin no Then restart the SSH server with: sudo service ssh restart ## Create a steem user account Running `steemd` under its own account offers a last line of defense should your login account be compromised. It also helps protect against mistakes when you're administering the server. ``` -> % sudo useradd steem -> % sudo passwd steem Enter new UNIX password: Retype new UNIX password: passwd: password updated successfully ``` Every time we work with `steemd` we first need to switch user. # 3. Install steem As steem evolves this information will become out of date. You can find the latest instructions in the [Steem GitHub repository](https://github.com/steemit/steem/blob/develop/doc/build-ubuntu.md). First install the dependencies: ``` # Required packages sudo apt-get install git make automake cmake g++ libssl-dev autoconf libtool # Boost packages (also required) sudo apt-get install libboost-thread-dev libboost-date-time-dev libboost-system-dev libboost-filesystem-dev libboost-program-options-dev libboost-signals-dev libboost-serialization-dev libboost-chrono-dev libboost-test-dev libboost-context-dev libboost-locale-dev libboost-coroutine-dev libboost-iostreams-dev # Optional packages (not required, but will make a nicer experience) sudo apt-get install doxygen perl libreadline-dev libncurses5-dev ``` Next, clone the source code repository, checkout the latest stable version and update the submodules. In the example below, `v0.14.2` is used as the version. You can find the list of releases [here](https://github.com/steemit/steem/releases). ``` git clone https://github.com/steemit/steem cd steem git checkout v0.14.2 git submodule update --init --recursive ``` And finally, build and install the software ``` cmake -DCMAKE_BUILD_TYPE=Release . make steemd make cli_wallet sudo make install ``` # 4. Configure cli_wallet cli_wallet isn't strictly needed for being a witness, but this guide uses it to automate updating the price feed, so we want to make sure it's setup properly. Login as the steem user: -> % su steem Password: Run cli_wallet. Since we don't have a running node yet, we'll connect to the node managed by @xeroc and @jesta. cli_wallet -s wss://node.steem.ws/ cli_wallet runs an interactive console. First we need to set a password: new >>> set_password "some-secure-password" Then import your `ACTIVE` private key, which you can find on your Steemit profile page under *Permissions*. locked >>> unlock "" import_key # 5. Configure steemd Login as the steem user: -> % su steem Password: Run steemd from the home folder to create the default config file; after a few seconds, stop steemd by pressing `Ctrl+C`. -> % cd ~ -> % steemd -> % ls ~/witness_node_data_dir blockchain config.ini db_version logs node p2p There is now a folder called `witness_node_data_dir` which contains the default config file `config.ini`. This is the file that needs editing. ## Check seed latency The `seed-node` addresses can optionally be checked for latency issues. @arcange encountered a strange issue where `steemd` would crash because a seed node was responding slowly. Check each node using `ping` to see how quickly it responds: -> % ping -U seed.steemd.com PING seed.steemd.com (162.213.199.171) 56(84) bytes of data. 64 bytes from 162.213.199.171: icmp_seq=1 ttl=59 time=138 ms 64 bytes from 162.213.199.171: icmp_seq=2 ttl=59 time=138 ms 64 bytes from 162.213.199.171: icmp_seq=3 ttl=59 time=139 ms 64 bytes from 162.213.199.171: icmp_seq=4 ttl=59 time=138 ms The example above is the node that was causing issues for @arcange. 138ms is a long time in steem land. Compare this to the node run by @pharesim: -> % ping -U steemd.pharesim.me PING steemd.pharesim.me (176.9.85.102) 56(84) bytes of data. 64 bytes from 176.9.85.102: icmp_seq=1 ttl=55 time=19.4 ms 64 bytes from 176.9.85.102: icmp_seq=2 ttl=55 time=15.2 ms 64 bytes from 176.9.85.102: icmp_seq=3 ttl=55 time=15.3 ms 64 bytes from 176.9.85.102: icmp_seq=4 ttl=55 time=14.9 ms Remove nodes from the config file that respond too slow. ## Witness name Set the `witness` setting in the config file to your witness name. For most this is simply your steemit username: # name of witness controlled by this node (e.g. initwitness ) witness = "bitcalm" **Note: The quotation marks surrounding the witness name are required.** ## Private key The private key can be generated using `cli_wallet`. locked >>> unlock "" suggest_brain_key The response looks like the following. suggest_brain_key { "brain_priv_key": "AXTREE DEWLIKE MINICAM NIECE TYLOSE IVYWOOD GAINSAY BORISH OZENA UNTOUGH UPHER LANCED MILEWAY UNTILL STINGY WAGLING", "wif_priv_key": "5Jv8oJuSyHipaoSdTGNHaUpaHXQnBXonJH4Hf3XizRb3SxN3ab2", "pub_key": "STM5BmtqDNg945q7LUhfRrSvb2Ar5fvbW1bKXGRLzs5FiJPyzyVoC" } **Important: Put this information somewhere safe.** Copy the `wif_priv_key` from the output to the `private-key` setting in the config file. # WIF PRIVATE KEY to be used by one or more witnesses or miners private-key = 5Jv8oJuSyHipaoSdTGNHaUpaHXQnBXonJH4Hf3XizRb3SxN3ab2 The public key will be used later when you broadcast your intent to become a witness. ## Updating the price feed We'll provide price feed updates using [steem\_price\_feed.bash](https://github.com/steempty/steem_price_feed.bash) created by @steempty. Login as the steem user: -> % su steem Password: Clone the git repository containing the script: git clone https://github.com/steempty/steem_price_feed.bash Create a file called `lock` in the home folder and add the JSON-RPC command for unlocking the wallet: {"id":0,"method":"unlock","params":[""]} Change the file permissions so it's only readable by the `steem` user: -> % chmod 400 lock The `update_price_feed.bash` script uses `cli_wallet`. We'll run this as a daemon in the next section so it's always available. # 6. Run the witness We need `steemd`, `cli_wallet`, and `steem_price_feed.bash` to all run automatically whenever the machine is rebooted, and restart whenever an error occurs. There are a few options for this and this guide uses [supervisor](http://supervisord.org/). Supervisor is installed by default but if it's not you can install it using `apt-get`: -> % sudo apt-get install supervisor On Ubuntu 16.04 supervisor doesn't startup by default when the system boots. To enable this, run: -> % sudo systemctl enable supervisor Create the file `/etc/supervisor/conf.d/steem.conf` with the following contents, replacing ``. ``` [program:steemd] command=steemd --replay-blockchain directory=/home/steem user=steem startsecs=1800 autostart=true autorestart=true stdout_logfile=AUTO stderr_logfile=AUTO [program:cli_wallet] command=bash -c "sleep 1800 && exec cli_wallet -d --rpc-endpoint 127.0.0.1:8092" directory=/home/steem user=steem startsecs=10 autostart=true autorestart=true stdout_logfile=AUTO stderr_logfile=AUTO [program:steem_price_feed] command=bash -c "sleep 1810 && exec steem_price_feed.bash/steem_price_feed.bash -w " directory=/home/steem user=steem autostart=true autorestart=true stdout_logfile=AUTO stderr_logfile=AUTO ``` **Note: `cli_wallet` and `steem_price_feed` are delayed by 30 minutes to give `steemd` a chance to sync up. This may not be long enough for everyone.** Restart supervisor so it picks up the new config file: -> % sudo service supervisor restart You can also manually start and stop services with the following commands: -> % sudo supervisorctl stop steemd steemd: stopped -> % sudo supervisorctl start steemd steemd: started To monitor the status of all processes managed by supervisor, use the following command: -> % sudo supervisorctl status cli_wallet RUNNING pid 21378, uptime 1:43:07 steem_price_feed RUNNING pid 22685, uptime 1:29:48 steemd RUNNING pid 20787, uptime 6:50:38 Supervisor logs all output to files in `/var/log/supervisor/`. # 7. Broadcast your intent to become a witness The last step is to broadcast your intent to become a witness to the network. Login as the steem user: -> % su steem Password: Start `cli_wallet` and use the `update_witness` command: locked >>> unlock "" update_witness "" "" "" {"account_creation_fee":"10.000 STEEM","maximum_block_size":65536,"sbd_interest_rate":1000} true Your witness is running and you've broadcast your intent. Now what? # 8. Get votes The higher the total vests you have from your witness votes, the higher in the witness table you are, which means you will be selected more often to create an sign blocks; make it to the top 19 and you get selected every round. But getting votes, especially big votes, isn't easy. It takes time to build up a reputation and show people that you are both **trustworthy** and **reliable**. This makes it very hard to give advice other than that you continue being a positive force in the community, interacting and helping your fellow Steemians. --- Many thanks to @aizensou, @klye, @someguy123, @furion, and other in the witness chat for helping me setup my witness and answering my newbie questions. Banner photo by [Sebastien Wiertz](https://www.flickr.com/photos/wiertz/4563720850/) used under the [CC-BY-2.0](https://creativecommons.org/licenses/by/2.0/) license. Changes were made to the original. --- Vote for me as witness to show your support.