Putting electrs behind auth

[torkelrogstad]

Is it possible to put electrs behind auth, i.e. require that clients provide authorization before requests are served?

[romanz]

IIUC there is no such feature in the Electrum protocol (as of today).
We may try to add a new command - or change server.version behavior to allow only specific clients to connect.
@Kixunil WDYT?

[Kixunil]

I don't see any sane way to do it. Tunnels are fine IMO, we just need better support from integrators (yes, that includes myself).

[antonilol]

could this be achieved with an electrum server behind a proxy that requires username/password?

[torkelrogstad]

That's been my thinking as well, but I'm not sure how to accomplish that with a protocol that relies on raw TCP connections. If this was an HTTP server I could pass something into the headers, but is that even possible with TCP?

[Kixunil]

The only way is to use some kind of tunneling - VPN, SSH, Tor, or whatever else you can think of. We have some of them documented. I personally use SSH tunnel because it's simple and supports key authentication - no passwords, every client gets its own key. If you're worried about race conditions and such use a private network namespace in Linux (IDK what about other OSes).

[dlukt]

Does electrs need to be publicly accessible?

[romanz]

No - I personally suggest running it on a private network.

[dlukt]

But Roman, doesn't it need to speak to other Electrum nodes? Or is it just a client to bitcoind middleware? I'm asking because I'm new to the whole thing.
I'm having trouble to connect from my arch desktop box and from android via Wireguard provided VPN address.
Why do you advise for a private network?
Are you afraid there might be security issues you can't forsee and someone might exploit e.g. off by one or similar, or is the consideration more on the DoS side of things, electrs not being able to handle tcp flooding?

[Kixunil]

It's just an additional index for your bitcoind. "middleware" might not be entirely accurate but it's pretty close, yeah. There's no DoS protection, so someone could make it stuck or something.

I don't know exactly how Wireguard works but I think you need to set electrs to be bound to that address. E.g. if the address of VPN interface is 10.1.2.3 then you need to set the listen address to 10.1.2.3 (rather than 127.0.0.1 which is the default).