keosd

Introduction

keosd is a key manager service daemon for storing private keys and signing digital messages. It provides a secure key storage medium for keys to be encrypted at rest in the associated wallet file. keosd also defines a secure enclave for signing transaction created by cleos or a third part library.

Operation

When a wallet is unlocked with the corresponding password, cleos can request keosd to sign a transaction with the appropriate private keys.

Audience

keosd is intended to be used by developers only.

Keosd Usage

Recommended Usage For most users, the easiest way to use keosd is to have cleos launch it automatically. Wallet files will be created in the default directory (~/eosio-wallet).

Launching keosd manually

keosd can be launched manually from the terminal by running:

$ keosd

By default, keosd creates the folder ~/eosio-wallet and populates it with a basic config.ini file. The location of the config file can be specified on the command line using the --config-dir argument. The configuration file contains the HTTP server endpoint for incoming HTTP connections and other parameters for cross-origin resource sharing.

Auto-locking

By default, keosd is set to lock your wallet after 15 minutes of inactivity. This is configurable in the config.ini by setting the timeout seconds in unlock-timeout. Setting it to 0 will cause keosd to always lock your wallet.

Stopping keosd

The most effective way to stop keosd is to find the keosd process and send a SIGTERM signal to it.

Other options

For a list of all commands known to keosd, simply run it with no arguments:

$ keosd --help

Application Options:
Config Options for eosio::http_plugin:
  --unix-socket-path arg (=keosd.sock)  The filename (relative to data-dir) to 
                                        create a unix socket for HTTP RPC; set 
                                        blank to disable.
  --http-server-address arg             The local IP and port to listen for 
                                        incoming http connections; leave blank 
                                        to disable.
  --https-server-address arg            The local IP and port to listen for 
                                        incoming https connections; leave blank
                                        to disable.
  --https-certificate-chain-file arg    Filename with the certificate chain to 
                                        present on https connections. PEM 
                                        format. Required for https.
  --https-private-key-file arg          Filename with https private key in PEM 
                                        format. Required for https
  --access-control-allow-origin arg     Specify the Access-Control-Allow-Origin
                                        to be returned on each request.
  --access-control-allow-headers arg    Specify the Access-Control-Allow-Header
                                        s to be returned on each request.
  --access-control-max-age arg          Specify the Access-Control-Max-Age to 
                                        be returned on each request.
  --access-control-allow-credentials    Specify if Access-Control-Allow-Credent
                                        ials: true should be returned on each 
                                        request.
  --max-body-size arg (=1048576)        The maximum body size in bytes allowed 
                                        for incoming RPC requests
  --http-max-bytes-in-flight-mb arg (=500)
                                        Maximum size in megabytes http_plugin 
                                        should use for processing http 
                                        requests. 503 error response when 
                                        exceeded.
  --verbose-http-errors                 Append the error log to HTTP responses
  --http-validate-host arg (=1)         If set to false, then any incoming 
                                        "Host" header is considered valid
  --http-alias arg                      Additionaly acceptable values for the 
                                        "Host" header of incoming HTTP 
                                        requests, can be specified multiple 
                                        times.  Includes http/s_server_address 
                                        by default.
  --http-threads arg (=2)               Number of worker threads in http thread
                                        pool
Config Options for eosio::wallet_plugin:
  --wallet-dir arg (=".")               The path of the wallet files (absolute 
                                        path or relative to application data 
                                        dir)
  --unlock-timeout arg (=900)           Timeout for unlocked wallet in seconds 
                                        (default 900 (15 minutes)). Wallets 
                                        will automatically lock after specified
                                        number of seconds of inactivity. 
                                        Activity is defined as any wallet 
                                        command e.g. list-wallets.
  --yubihsm-url URL                     Override default URL of 
                                        http://localhost:12345 for connecting 
                                        to yubihsm-connector
  --yubihsm-authkey key_num             Enables YubiHSM support using given 
                                        Authkey
Application Config Options:
  --plugin arg                          Plugin(s) to enable, may be specified 
                                        multiple times
Application Command Line Options:
  -h [ --help ]                         Print this help message and exit.
  -v [ --version ]                      Print version information.
  --print-default-config                Print default configuration template
  -d [ --data-dir ] arg                 Directory containing program runtime 
                                        data
  --config-dir arg                      Directory containing configuration 
                                        files such as config.ini
  -c [ --config ] arg (=config.ini)     Configuration file name relative to 
                                        config-dir
  -l [ --logconf ] arg (=logging.json)  Logging configuration file name/path 
                                        for library users