keosd is a key manager service daemon for storing private keys and signing digital messages. It provides a secure key storage medium for keys to be encrypted at rest in the associated wallet file. keosd also defines a secure enclave for signing transaction created by cleos or a third part library.
Operation
When a wallet is unlocked with the corresponding password, cleos can request keosd to sign a transaction with the appropriate private keys.
Audience
keosd is intended to be used by developers only.
Keosd Usage
Recommended Usage For most users, the easiest way to use keosd is to have cleos launch it automatically. Wallet files will be created in the default directory (~/eosio-wallet).
Launching keosd manually
keosd can be launched manually from the terminal by running:
$keosd
By default, keosd creates the folder ~/eosio-wallet and populates it with a basic config.ini file. The location of the config file can be specified on the command line using the --config-dir argument. The configuration file contains the HTTP server endpoint for incoming HTTP connections and other parameters for cross-origin resource sharing.
Auto-locking
By default, keosd is set to lock your wallet after 15 minutes of inactivity. This is configurable in the config.ini by setting the timeout seconds in unlock-timeout. Setting it to 0 will cause keosd to always lock your wallet.
Stopping keosd
The most effective way to stop keosd is to find the keosd process and send a SIGTERM signal to it.
Other options
For a list of all commands known to keosd, simply run it with no arguments:
$keosd--help
Application Options:
Config Options for eosio::http_plugin:
--unix-socket-path arg (=keosd.sock) The filename (relative to data-dir) to
create a unix socket for HTTP RPC; set
blank to disable.
--http-server-address arg The local IP and port to listen for
incoming http connections; leave blank
to disable.
--https-server-address arg The local IP and port to listen for
incoming https connections; leave blank
to disable.
--https-certificate-chain-file arg Filename with the certificate chain to
present on https connections. PEM
format. Required for https.
--https-private-key-file arg Filename with https private key in PEM
format. Required for https
--access-control-allow-origin arg Specify the Access-Control-Allow-Origin
to be returned on each request.
--access-control-allow-headers arg Specify the Access-Control-Allow-Header
s to be returned on each request.
--access-control-max-age arg Specify the Access-Control-Max-Age to
be returned on each request.
--access-control-allow-credentials Specify if Access-Control-Allow-Credent
ials: true should be returned on each
request.
--max-body-size arg (=1048576) The maximum body size in bytes allowed
for incoming RPC requests
--http-max-bytes-in-flight-mb arg (=500)
Maximum size in megabytes http_plugin
should use for processing http
requests. 503 error response when
exceeded.
--verbose-http-errors Append the error log to HTTP responses
--http-validate-host arg (=1) If set to false, then any incoming
"Host" header is considered valid
--http-alias arg Additionaly acceptable values for the
"Host" header of incoming HTTP
requests, can be specified multiple
times. Includes http/s_server_address
by default.
--http-threads arg (=2) Number of worker threads in http thread
pool
Config Options for eosio::wallet_plugin:
--wallet-dir arg (=".") The path of the wallet files (absolute
path or relative to application data
dir)
--unlock-timeout arg (=900) Timeout for unlocked wallet in seconds
(default 900 (15 minutes)). Wallets
will automatically lock after specified
number of seconds of inactivity.
Activity is defined as any wallet
command e.g. list-wallets.
--yubihsm-url URL Override default URL of
http://localhost:12345 for connecting
to yubihsm-connector
--yubihsm-authkey key_num Enables YubiHSM support using given
Authkey
Application Config Options:
--plugin arg Plugin(s) to enable, may be specified
multiple times
Application Command Line Options:
-h [ --help ] Print this help message and exit.
-v [ --version ] Print version information.
--print-default-config Print default configuration template
-d [ --data-dir ] arg Directory containing program runtime
data
--config-dir arg Directory containing configuration
files such as config.ini
-c [ --config ] arg (=config.ini) Configuration file name relative to
config-dir
-l [ --logconf ] arg (=logging.json) Logging configuration file name/path
for library users
