# JSON-RPC password

Post by: satoshi on July 18, 2010, 08:49:22 PM

I uploaded to SVN my changes to add a password to JSON-RPC.  If you're set up to build, please test it.

The -server switch is replaced with -rpcpw=<password\>, which is also used with bitcoind.<br>
bitcoin -rpcpw=<password\> &nbsp;&nbsp;&nbsp;-- runs with JSON-RPC port open<br>
bitcoind -rpcpw=<password\> &nbsp;&nbsp;-- daemon with password

If you have a better idea for the switch name, let me know, but keep in mind there will eventually be a password for encrypting the database too. &nbsp;I'm not sure but I think they may want to use different passwords for the two.

It gives a warning if you don't set a password.

All commands now require the password as the first parameter. &nbsp;It'll tell you that if you run "bitcoind help".

The central code:

&nbsp;&nbsp;// Check password<br>
&nbsp;&nbsp;if (params.size() < 1 || params[0\].type() != str_type)<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;throw runtime_error("First parameter must be the password.");<br>
&nbsp;&nbsp;if (params[0\].get_str() != strRPCPassword)<br>
&nbsp;&nbsp;{<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if (strRPCPassword.size() < 15)<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Sleep(50);<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;begin = strRequest.end();<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;printf("ThreadRPCServer incorrect password attempt\n");<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;throw runtime_error("Incorrect password.");<br>
&nbsp;&nbsp;}

Any comments on these decisions?

1) if (strRPCPassword.size() < 15) Sleep(50); &nbsp;-- this means if it's a short password, it'll wait 50ms after each attempt. &nbsp;This might be used as a DoS attack, but I figured if it's a short password, it's more important to protect against brute force password scan. &nbsp;This may tell outsiders whether the password is less than 15 characters, but less than 15 isn't all that noteworthy, most passwords are less than 15. &nbsp;If you want to close the DoS possibility, just use a password 15 characters or longer.

2) begin = strRequest.end(); &nbsp;-- if it's a single request with multiple invocations, I throw away the rest if one has a bad password. &nbsp;This is so you can't stuff it with millions of password attempts in one packet. &nbsp;What do you think, is this the right thing to do? &nbsp;(multiple invocation is probably almost never used anyway)

I also fixed the two duplicated commands listed in the help:

getaddressesbylabel <pw\> <label\><br>
getbalance <pw\><br>
getblockcount <pw\><br>
getblocknumber <pw\><br>
getconnectioncount <pw\><br>
getdifficulty <pw\><br>
getgenerate <pw\><br>
getinfo <pw\><br>
getlabel <pw\> <bitcoinaddress\><br>
getnewaddress <pw\> [label\]<br>
getreceivedbyaddress <pw\> <bitcoinaddress\> [minconf=1\]<br>
getreceivedbylabel <pw\> <label\> [minconf=1\]<br>
help <pw\><br>
listreceivedbyaddress <pw\> [minconf=1\] [includeempty=false\]<br>
listreceivedbylabel <pw\> [minconf=1\] [includeempty=false\]<br>
sendtoaddress <pw\> <bitcoinaddress\> <amount\> [comment\] [comment-to\]<br>
setgenerate <pw\> <generate\> [genproclimit\]<br>
setlabel <pw\> <bitcoinaddress\> <label\><br>
stop <pw\>

---

Source file: bitcoin-forum-satoshi-nakamoto.tgz

External link: https://bitcointalk.org/index.php?topic=461.msg4059#msg4059