Validator Node Operations: Security Best Practices

How we secure Cardano stake pools in production — and what the industry's best operators do across Ethereum, Solana, and Cosmos.

---

Why Validator Security Matters

Running a validator is one of the highest-trust roles in any proof-of-stake network. You're not just operating a server — you're securing other people's capital. A compromised validator can result in lost delegation, reputational damage, and in extreme cases, harm to network consensus itself.

This guide is rooted in our experience running Cardano stake pool infrastructure. We start with the practices we use every day, then show how these patterns translate across Ethereum, Solana, and Cosmos-based chains.

---

The Relay/Block Producer Architecture

The single most important architectural decision for any Cardano stake pool is separating your block producer from the public network. This isn't a recommendation — it's a requirement for production operations.

Your block producer connects only to your own relay nodes. Its IP address should never be publicly known. Your relay nodes (two minimum) handle all public-facing network traffic, peer with the broader Cardano network via P2P, and route blocks and transactions to your block producer.

This is Cardano's equivalent of the Cosmos "sentry node architecture" — your relays absorb any DDoS attacks while your block producer stays invisible. The firewall configuration is straightforward:

# Block Producer firewall — only allow YOUR relays
sudo ufw default deny incoming
sudo ufw allow from <relay1_ip> to any port 6000
sudo ufw allow from <relay2_ip> to any port 6000
sudo ufw allow 2222/tcp comment 'SSH from management IP'
sudo ufw enable

Public IPs should only be exposed on relay nodes. Your block producer communicates exclusively over encrypted WireGuard tunnels.

---

Cardano's Cold/Hot Key Hierarchy

Cardano has the most explicit key separation model of any major PoS chain, and understanding it is critical to operating securely.

• Cold keys never touch an internet-connected machine. They live on an air-gapped device — a laptop with no network card, a Raspberry Pi with WiFi disabled, or similar. You use the cold key to sign operational certificates, pool registration, and pool updates. Data transfers happen via USB drive. This is non-negotiable.

• KES (Key Evolving Signature) keys are the hot keys that sit on your block producer and sign blocks. They expire after roughly 62 days. If you miss the rotation window, your pool stops producing blocks entirely — with no warning. This is one of the most common mistakes new SPOs make.

• VRF keys participate in the slot leader lottery that determines when your pool can produce blocks. They stay on the block producer alongside the KES keys.

The rotation workflow is: generate new KES keys on the air-gapped machine, sign a new operational certificate with your cold key, transfer both to the block producer via USB, restart the node, and verify block production resumes. Automate the reminder. Set calendar alerts. Monitor KES expiry in your Grafana dashboard.

# Check KES period — run this regularly
cardano-cli query kes-period-info --mainnet --op-cert-file node.cert

Human memory is not a valid operational strategy.

---

Server Hardening

Every server in our Cardano infrastructure gets the same hardening treatment. The goal is defense in depth — multiple layers so that no single failure compromises the system.

SSH configuration is the first line of defense. Disable password authentication entirely. Use ED25519 keys exclusively — they're faster and more secure than RSA. Change the default port, limit authentication attempts, and restrict access to a dedicated cardano user.

# /etc/ssh/sshd_config essentials
PubkeyAuthentication yes
PasswordAuthentication no
PermitRootLogin prohibit-password
Port 2222
MaxAuthTries 3
AllowUsers cardano

Brute force protection via fail2ban bans IPs after 3 failed attempts. Combined with a non-standard SSH port, this eliminates the vast majority of automated attacks.

Additional hardening includes removing unnecessary packages and services, disabling IPv6 if not needed, securing shared memory with noexec flags, running cardano-node as a dedicated non-root user, and enabling automatic OS security patches while managing node software updates manually. Never run validator software as root.

---

Monitoring: You Can't Secure What You Can't See

Our monitoring stack combines real-time visibility with proactive alerting:

• gLiveView for terminal-based real-time dashboards — sync status, peer connections, block height
• Grafana + Prometheus for comprehensive metrics with pre-built dashboards from Guild Operators
• CNCLI for block production schedules, leader logs, and pool performance tracking
• PoolTool.io for external monitoring and block production comparison

Critical alerts we configure for every pool:

• Node sync status more than 10 slots behind chain tip
• Peer count dropping below 3 connected peers
• CPU above 80%, RAM above 90%, disk above 85%
• Any missed scheduled block
• KES key expiry within 7 days

Route critical alerts to PagerDuty or Opsgenie for 24/7 on-call. Non-critical alerts go to Slack or Telegram. And critically — monitor your monitoring. If your Prometheus instance goes down, who alerts you? Set up a dead man's switch as a secondary, independent check.

---

Cross-Chain Comparison

The patterns we use for Cardano translate across chains, but each network has its own security model.

Ethereum validators have signing keys (hot, for attestations) and withdrawal keys (cold, controlling the 32 ETH deposit). Unlike Cardano, Ethereum has real slashing — double-signing loses a portion of your stake, with penalties that escalate during correlated failures. This makes failover much more dangerous; you must wait at least 2 epochs (~13 minutes) before starting a backup to avoid double-signing. Offline validators also leak ETH at roughly their earning rate.

Solana validators are necessarily public (unlike Cardano's hidden block producer model), but RPC endpoints should be separated from validator duties. The withdrawer key should live in a hardware wallet or multisig. Solana doesn't have protocol-level slashing yet, but social slashing and delegation loss are real risks.

Cosmos chains use sentry node architecture conceptually identical to Cardano's relay/block producer pattern. But Cosmos has aggressive slashing: double-signing triggers a 5% slash and permanent jailing. For key management, the ecosystem recommends Hardware Security Modules. Consider Horcrux — a multi-party computation signing solution that distributes the signing key across multiple machines, preventing any single compromised server from producing valid signatures.

Cardano has a significant advantage: no protocol-level slashing. Your delegators' ADA is never at risk of being burned due to operator error. This makes failover less terrifying, but doesn't make security optional — a compromised pool means missed blocks, lost rewards, and eroded delegator trust.

---

What the Industry Leaders Do Differently

Professional operators like Chorus One, Figment, P2P Validator, and Blockdaemon manage billions in staked assets. Their practices offer lessons for operators at every scale.

They run multi-cloud, multi-region by default — distributing validators across AWS, GCP, and bare metal providers. Figment is confident enough in their setup to offer slashing coverage as a product. They employ dedicated security teams focused solely on validator infrastructure, conducting regular penetration testing and maintaining SOC 2 compliance.

They use MPC and threshold signing rather than storing a single validator key on a single machine. They run 24/7 operations centers with defined escalation paths and SLA commitments. And they enforce separation of duties — no single person can access all critical keys or make unilateral changes to production infrastructure.

The gap between amateur and professional operations isn't talent — it's process. You can adopt most of these practices at any scale.

---

Lessons from the Field

Automate the things that can kill you. KES rotation, certificate expiry, disk space alerts — if forgetting it causes downtime, automate it.

Test your failover before you need it. Every operator says they have a failover plan. Few have actually executed it. Run a failover drill quarterly.

The 3 AM test. Can a groggy engineer execute your runbook at 3 AM without making mistakes? If not, simplify the runbook.

Don't optimize for cost at the expense of reliability. The cheapest VPS will cost you more in missed blocks and lost delegation than a properly provisioned server.

Community matters. The Cardano SPO Telegram workgroup and Guild Operators community are invaluable. Join them.

Security is a practice, not a state. There is no point at which your validator is "secure." There are only degrees of preparedness. Conduct regular reviews, update your threat model, and assume you've missed something — because you probably have.

---

Related Reading

• How to Set Up a Cardano Stake Pool: A Complete Guide — Step-by-step setup guide for the infrastructure discussed here
• Building High-Performance Cardano Indexers — The data layer that runs on top of your node infrastructure

---

QBT Labs provides managed node infrastructure and validator operations. We handle the ops so you can focus on your protocol. Get in touch.