Post
Topic
Board Bitcoin Technical Support
Merits 1 from 1 user
Re: Need advice on building a secure Bitcoin Node at motherboard foundation level
by
af_newbie
on 26/11/2023, 13:44:59 UTC
⭐ Merited by ETFbitcoin (1)
I am researching setting up a Bitcoin Node that includes software tools to explore the bitcoin blockchain, store bitcoin, earn bitcoin, spend bitcoin, Bisq to buy Bitcoin and Lightning network software. However, a bump in the road I have encountered relates to disabling the Intel Management Engine (IME) on my Supermicro X11SSH-F motherboard using Coreboot. Listed below are some questions I have:

  • Has anybody out there disabled the IME and if yes what motherboard model did you apply the Coreboot to? I ask just in case I end up bricking my Supermicro motherboard.
  • Does disabling the IME with Coreboot really make a Bitcoin Hub more secure? Or are there tradeoffs that actually make the Bitcoin Hub less secure after installing Coreboot?
  • What Intel chip generation is the correct one to buy so IME is no longer a factor to consider which means no longer having to mess with Coreboot?
  • Is buying an Intel motherboard manufactured before 2006 the only way to 100% totally avoid IME? If yes doesn't such an old motherboard lack the required horsepower needed to operate a robust Bitcoin hub?
  • Is an AMD motherboard a better foundation level security alternative to building a Bitcoin Node? If yes what particular AMD CPU generation / motherboard manufactured year should I be looking at?

As I mentioned, I am researching the task of disabling the IME on a motherboard and not 100% certain if I should continue down this path.  I would appreciated any opinions that will help me figure out the best approach to building a secure Bitcoin node at the motherboard foundation level .  Thank you for your time.

Just buy a machine with coreboot and ME disabled.

https://novacustom.com/
https://system76.com/

Install whatever OS you want and whatever software you want. Front it with a device running pfSense/OPNsense and watch the network
traffic with wireshark on a third, clean device. If everything checks out, install your bisq, bitcoin core node etc.

Re-writing your BIOS chip is not trivial but is doable.
https://yewtu.be/watch?v=WJo8RsJeqxU