Oracle Node Hardening Guide — community resource for operators

[BaumerCrypto]

I published a step-by-step VPS security hardening guide for DigiDollar oracle operators in my oracle tools repo.

I've been hardening Linux VPS instances for years across different blockchain projects — masternodes, staking nodes, full nodes, mining infrastructure. Every one of my VPS setups gets the same security treatment. This guide is that process refined and applied specifically to a DigiDollar oracle node.

It covers everything I run on my own oracle — SSH lockdown (custom port, key-only auth, AllowUsers whitelist), UFW firewall, Fail2Ban with 24-hour bans, kernel hardening via sysctl, shared memory restrictions, systemd service hardening, wallet file permissions, and automatic security updates.

Every setting is tested and reboot-verified on my live oracle VPS. The guide has already been tested by community members on Ubuntu 26.04 LTS — all commands work across Ubuntu LTS versions, with version-specific notes where minor differences apply (thanks to DanGB for catching the ssh.socket difference on 26.04).

There's also an over-hardening section — things that generic hardening guides recommend but will actually break an oracle node (restricting outbound traffic kills your price feed, rate-limiting the P2P port blocks peer connections, etc.).

Guide: ORACLE_HARDENING_GUIDE.md

Full repo (monitoring scripts, setup tutorials, contributing guidelines, security policy): digidollar-oracle-tools

Linux VPS focused. Operators running on home Windows/Mac PCs won't be able to follow the steps directly, but the guide explains why a VPS is the recommended path for a frozen-roster oracle.

MIT licensed — fork it, use it, improve it. Happy to have it linked from the official setup docs if it's useful.

— digibyte-maxi (Oracle Slot 17) | AKA: BaumerCrypto2.0

[sueun-dev]

This looks worth linking from the setup docs as an operator-hardening appendix, not as required consensus setup. The DigiDollar-specific bits are stronger than the generic VPS checklist: NTP/freshness, not blocking outbound price feeds, and not rate-limiting P2P into breakage. Those are exactly the places a normal Linux hardening guide can accidentally hurt an oracle.

Small thing I’d add near the top: a “minimum safe open ports” table for mainnet/testnet plus SSH admin access, because people tend to copy firewall rules without reading the over-hardening section. The home-guide split is good too, since router/NAT risk is a different problem from VPS SSH exposure.

[BaumerCrypto]

@sueun-dev appreciate the feedback, solid points.

I'll be Adding a "Minimum Safe Open Ports — Read This First" section and PORTs table near the top of the VPS guide today.
The key ports: 12024 inbound (mainnet P2P), 12033 inbound (testnet P2P), 5520 inbound (SSH admin), and all outbound left open.
That outbound row is the one that catches people.

If Jared or the team want to link either guide from the official setup docs as an operator-hardening appendix, happy to have that.

[JohnnyLawDGB]

Thanks for the efforts here. Great guide!