Monzero core node, command-line wallet, consensus code, and release tooling. https://code.monzero.org/monzero-core.git/atom?h=v0.14.1.2 2019-04-15T09:10:29Z 2019-04-15T09:10:29Z moneromooo-monero moneromooo-monero@users.noreply.github.com 2019-03-29T10:47:30Z urn:sha1:82e510f15ea6fc469d62b5a9bba3c4d8c9f6742b 2019-04-07T03:47:06Z Lee Clagett code@leeclagett.com 2019-03-12T02:01:03Z urn:sha1:a3b0284837c9ea10865e6ddeb7f1244d621ae5c0 Specifying SSL certificates for peer verification does an exact match, making it a not-so-obvious alias for the fingerprints option. This changes the checks to OpenSSL which loads concatenated certificate(s) from a single file and does a certificate-authority (chain of trust) check instead. There is no drop in security - a compromised exact match fingerprint has the same worse case failure. There is increased security in allowing separate long-term CA key and short-term SSL server keys. This also removes loading of the system-default CA files if a custom CA file or certificate fingerprint is specified. 2019-03-24T15:58:57Z rbrunner7 rbrunner@dreamshare.ch 2019-03-21T10:03:24Z urn:sha1:c23ea7962debe4e66fd3c0e7719117dcb7966d1f 2019-03-17T15:56:04Z Riccardo Spagni ric@spagni.net 2019-03-17T15:56:04Z urn:sha1:848591c4d85ae73c42b3317d9dab192267bc2737 551104fb daemon: add --public-node mode, RPC port propagation over P2P (xiphon) 2019-03-05T21:05:34Z binaryFate binaryfate@users.noreply.github.com 2019-03-05T21:05:34Z urn:sha1:1f2930ce0bec07e28958c059444151ad4968e1e6 2019-03-05T13:16:08Z Martijn Otto git@martijnotto.nl 2018-06-14T22:44:48Z urn:sha1:057c279cb4d5c16990570d281bd1bc568796cbb2 RPC connections now have optional tranparent SSL. An optional private key and certificate file can be passed, using the --{rpc,daemon}-ssl-private-key and --{rpc,daemon}-ssl-certificate options. Those have as argument a path to a PEM format private private key and certificate, respectively. If not given, a temporary self signed certificate will be used. SSL can be enabled or disabled using --{rpc}-ssl, which accepts autodetect (default), disabled or enabled. Access can be restricted to particular certificates using the --rpc-ssl-allowed-certificates, which takes a list of paths to PEM encoded certificates. This can allow a wallet to connect to only the daemon they think they're connected to, by forcing SSL and listing the paths to the known good certificates. To generate long term certificates: openssl genrsa -out /tmp/KEY 4096 openssl req -new -key /tmp/KEY -out /tmp/REQ openssl x509 -req -days 999999 -sha256 -in /tmp/REQ -signkey /tmp/KEY -out /tmp/CERT /tmp/KEY is the private key, and /tmp/CERT is the certificate, both in PEM format. /tmp/REQ can be removed. Adjust the last command to set expiration date, etc, as needed. It doesn't make a whole lot of sense for monero anyway, since most servers will run with one time temporary self signed certificates anyway. SSL support is transparent, so all communication is done on the existing ports, with SSL autodetection. This means you can start using an SSL daemon now, but you should not enforce SSL yet or nothing will talk to you. 2019-02-24T23:40:23Z xiphon xiphon@protonmail.com 2019-02-24T08:47:49Z urn:sha1:551104fbf1d2d82cad57d5ea240d1b7be2810ea1 2019-02-02T20:05:33Z moneromooo-monero moneromooo-monero@users.noreply.github.com 2018-06-14T22:44:48Z urn:sha1:24569454086a366e0bd0cd9b33b0b34661fe7af8 RPC connections now have optional tranparent SSL. An optional private key and certificate file can be passed, using the --{rpc,daemon}-ssl-private-key and --{rpc,daemon}-ssl-certificate options. Those have as argument a path to a PEM format private private key and certificate, respectively. If not given, a temporary self signed certificate will be used. SSL can be enabled or disabled using --{rpc}-ssl, which accepts autodetect (default), disabled or enabled. Access can be restricted to particular certificates using the --rpc-ssl-allowed-certificates, which takes a list of paths to PEM encoded certificates. This can allow a wallet to connect to only the daemon they think they're connected to, by forcing SSL and listing the paths to the known good certificates. To generate long term certificates: openssl genrsa -out /tmp/KEY 4096 openssl req -new -key /tmp/KEY -out /tmp/REQ openssl x509 -req -days 999999 -sha256 -in /tmp/REQ -signkey /tmp/KEY -out /tmp/CERT /tmp/KEY is the private key, and /tmp/CERT is the certificate, both in PEM format. /tmp/REQ can be removed. Adjust the last command to set expiration date, etc, as needed. It doesn't make a whole lot of sense for monero anyway, since most servers will run with one time temporary self signed certificates anyway. SSL support is transparent, so all communication is done on the existing ports, with SSL autodetection. This means you can start using an SSL daemon now, but you should not enforce SSL yet or nothing will talk to you. 2019-01-28T19:35:20Z moneromooo-monero moneromooo-monero@users.noreply.github.com 2019-01-11T19:09:39Z urn:sha1:acfff8d0ce56cb9145514d85e13c38bea1e646f9 2019-01-22T20:30:51Z moneromooo-monero moneromooo-monero@users.noreply.github.com 2018-04-29T22:30:51Z urn:sha1:b750fb27b0f20e9443827732b69a504a76036430 The blockchain prunes seven eighths of prunable tx data. This saves about two thirds of the blockchain size, while keeping the node useful as a sync source for an eighth of the blockchain. No other data is currently pruned. There are three ways to prune a blockchain: - run monerod with --prune-blockchain - run "prune_blockchain" in the monerod console - run the monero-blockchain-prune utility The first two will prune in place. Due to how LMDB works, this will not reduce the blockchain size on disk. Instead, it will mark parts of the file as free, so that future data will use that free space, causing the file to not grow until free space grows scarce. The third way will create a second database, a pruned copy of the original one. Since this is a new file, this one will be smaller than the original one. Once the database is pruned, it will stay pruned as it syncs. That is, there is no need to use --prune-blockchain again, etc.