Setting Up and Configuring a Bitcoin Full Node on a VPS: Security and Automatic Updates
TL;DR
In this guide, we will step-by-step configure a full-featured Bitcoin Core Full Node on an Ubuntu 24.04 LTS operating system hosted on a Virtual Private Server (VPS). You will learn how to install and configure the software, ensure basic server security using SSH keys, UFW firewall, and Fail2ban, and set up the system for automatic operating system updates and secure Bitcoin node maintenance to ensure its stable and reliable operation on the Bitcoin network.
- We will configure secure VPS access and a basic firewall.
- We will install and run Bitcoin Core as a system service.
- We will ensure automatic updates of the operating system and its components.
- We will set up monitoring and a maintenance strategy for the Bitcoin node.
- We will prepare for scaling and further optimization.
What we are configuring and why
In this guide, we will focus on installing and configuring a Bitcoin Full Node, using the official Bitcoin Core client, on a Virtual Private Server (VPS) running Ubuntu 24.04 LTS. A full-featured node is a critically important element of the Bitcoin infrastructure, as it fully validates all transactions and blocks, ensuring the decentralization and security of the network.
What the reader will get in the end:
- You will have your own, independent, and fully synchronized copy of the entire Bitcoin blockchain.
- Your node will actively participate in verifying and relaying transactions, as well as in ensuring network security.
- You will be able to use your node to connect light wallets (e.g., Electrum, Sparrow) or to develop your own decentralized applications (dApps), relying on verified data.
- You will gain experience working with Linux servers, security configuration, and maintenance automation.
What alternatives exist and why self-hosted on a VPS:
There are alternatives to running your own node, such as using third-party APIs (e.g., Blockchair, Blockchain.com) or light wallets that rely on other people's nodes. However, these approaches have significant drawbacks:
- Reliance on third parties: You trust someone else to verify transactions and balances, which contradicts the fundamental principles of Bitcoin decentralization. This can lead to loss of privacy and censorship.
- Security risks: Transmitting your data to third-party services increases the attack surface and the risk of compromise.
- Limitations and cost: Many third-party APIs have request limits or require a paid subscription for full use.
Running a self-hosted node on a VPS eliminates these problems. You fully control your data, ensure maximum privacy and security, and actively contribute to network decentralization. A VPS offers an optimal balance between dedicated server control and the flexibility of cloud solutions, making it an ideal choice for most users.
What VPS configuration is needed for this task
Running a Bitcoin Full Node requires certain resources, mainly due to the size of the blockchain and the need for its constant synchronization. By 2026, the size of the Bitcoin blockchain will continue to grow, so it is important to choose a configuration with headroom.
Minimum requirements (current for 2026):
- CPU: 2 cores. Bitcoin Core does not require a very powerful processor, but multiple cores are useful for transaction processing and indexing.
- RAM: 4 GB. Although the node itself can run with 2 GB, 4 GB ensures smoother operation, especially during initial synchronization and when using additional services (e.g., ElectrumX).
- Disk: 2 TB SSD. This is critically important. The Bitcoin blockchain already exceeds 600 GB and continues to grow. By 2026, its size could easily reach 1-1.5 TB, so a 2 TB SSD is a reasonable minimum with several years of headroom. An SSD significantly speeds up initial synchronization and daily node operation.
- Network: 100 Mbit/s or better. Unlimited traffic or a very large limit (several TB per month). Initial synchronization will require downloading the entire blockchain, and then the node will constantly exchange data with the network.
Specific VPS plan for the task:
For stable and productive operation of a Bitcoin Full Node, especially considering blockchain growth by 2026, the following configuration is recommended:
- CPU: 4 cores.
- RAM: 8 GB.
- Disk: 2 TB NVMe SSD. An NVMe SSD will provide the best performance for blockchain read/write operations.
- Network: 1 Gbit/s port with unlimited traffic.
Such a plan will ensure comfortable node operation, fast synchronization, and resource headroom for future needs. You can get a VPS with the specified characteristics.
When a dedicated server is needed, not a VPS:
A dedicated server may be required if you plan to:
- Run multiple resource-intensive Bitcoin services (e.g., multiple nodes, ElectrumX, blockchain explorer, Lightning Network node).
- Handle a very large volume of requests to your node (e.g., for a large application or service).
- Require maximum I/O performance that a VPS cannot always provide.
- You need resource guarantees that a VPS may not always provide due to virtualization.
For most individual users and small teams, a VPS with the specified characteristics will be more than sufficient. If you decide that you need a dedicated server, you can consider a suitable dedicated server.
Location: what it affects:
- Ping and latency: The closer the server is to you, the lower the ping. This is important if you will frequently connect to the server via SSH or use it for interactive applications.
- Network connectivity: Locating the server in a large data center with good communication channels will ensure faster and more stable synchronization with the Bitcoin network.
- Jurisdiction: The choice of country for hosting may be important in terms of legislation and privacy. Make sure the jurisdiction meets your requirements.
For a Bitcoin Full Node, good network connectivity and speed are critically important, so choose a location with reliable communication channels, preferably in a major internet hub.
Server Preparation
Before installing Bitcoin Core, you need to perform basic security configuration and update the operating system. We will be using Ubuntu 24.04 LTS.
1. SSH Connection and New User Creation
Initially, you will most likely connect as root. It is strongly not recommended to use root for daily operations. Let's create a new user with sudo privileges.
# Replace 'youruser' with your desired username
sudo adduser youruser
Enter a password for the new user and confirm the remaining details (you can leave them blank). Now add the user to the sudo group:
sudo usermod -aG sudo youruser
Log out of the root session and log in as the new user:
exit
# Now connect as 'youruser'
ssh youruser@your_vps_ip
2. SSH Key Configuration (Recommended)
Using SSH keys instead of a password significantly enhances security. Generate keys on your local machine (if you haven't already):
# On your local machine
ssh-keygen -t rsa -b 4096
Copy the public key to the server:
# On your local machine
ssh-copy-id youruser@your_vps_ip
Now you can connect without a password. After verifying that key-based login works, disable password login for SSH by editing the /etc/ssh/sshd_config file:
sudo nano /etc/ssh/sshd_config
Find the lines and change/add:
PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM no
It is also recommended to change the standard SSH port (22) to another, for example, 2222. Find the line #Port 22, uncomment it, and change it:
Port 2222
Save changes (Ctrl+O, Enter) and exit (Ctrl+X). Restart the SSH service:
sudo systemctl restart sshd
Now, for the next connection, use the new port: ssh -p 2222 youruser@your_vps_ip.
3. System Update and Basic Utilities Installation
Update the package list and the system itself to the latest versions. Install necessary utilities.
# Update package list
sudo apt update
# Upgrade installed system packages
sudo apt upgrade -y
# Install basic utilities, if not present
sudo apt install -y curl wget git build-essential htop screen unattended-upgrades
4. Firewall Configuration (UFW)
UFW (Uncomplicated Firewall) is a convenient utility for managing iptables. We will configure it to allow only necessary connections.
# Install UFW, if not installed
sudo apt install -y ufw
# Allow SSH (be sure to use your port if you changed it)
# For example, if you are using port 2222
sudo ufw allow 2222/tcp
# Allow incoming connections for Bitcoin P2P (port 8333)
sudo ufw allow 8333/tcp
# Deny incoming connections by default and allow outgoing (outgoing are allowed by default, but can be explicitly stated)
sudo ufw default deny incoming
sudo ufw default allow outgoing
# Enable the firewall
sudo ufw enable
Confirm the action by typing y. Check the firewall status:
sudo ufw status verbose
5. Fail2ban Installation
Fail2ban scans service logs (SSH, web servers, etc.) for suspicious activity (multiple failed login attempts) and temporarily or permanently blocks the IP addresses of offenders.
# Install Fail2ban
sudo apt install -y fail2ban
Create a local Fail2ban configuration so that your changes are not overwritten during updates:
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local
In the jail.local file, find the [sshd] section and ensure it is enabled (enabled = true). If you changed the SSH port, specify it:
[sshd]
enabled = true
port = 2222 # Your SSH port
maxretry = 3 # Number of failed attempts before blocking
bantime = 1h # Ban time (1 hour)
Save changes and restart Fail2ban:
sudo systemctl restart fail2ban
Now your server is ready for Bitcoin Core installation.
Software Installation — Step-by-Step
We will install Bitcoin Core version 26.0 (or newer, current for 2026) from official binary files. This method is preferable to building from source for most users, as it is faster and less resource-intensive. For convenience, we will create a separate user bitcoin, under which the node will operate.
1. Creating the Bitcoin User
We will create a system user bitcoin who will not have shell access or a home directory, which will enhance security.
# Create system user 'bitcoin'
sudo adduser --system --group --home /var/lib/bitcoin bitcoin
Let's create a directory for blockchain data and set the correct permissions:
# Create Bitcoin data directory and set owner
sudo mkdir -p /var/lib/bitcoin/.bitcoin
sudo chown -R bitcoin:bitcoin /var/lib/bitcoin
2. Downloading Bitcoin Core
We will navigate to a temporary directory and download the Bitcoin Core binary files. For 2026, version 26.0, 27.0, or higher may be current. You can check the latest stable version on the official Bitcoin Core website or their GitHub repository.
For example, we will use version 26.0, assuming it or its minor updates will be current. Replace the URL with the one current for 2026.
# Navigate to temporary directory
cd /tmp
# Download Bitcoin Core archive (example for Linux x86_64, version 26.0)
# Check the current URL on bitcoincore.org/en/download/
wget https://bitcoincore.org/bin/bitcoin-core-26.0/bitcoin-26.0-x86_64-linux-gnu.tar.gz
# Download signatures file (SHA256SUMS)
wget https://bitcoincore.org/bin/bitcoin-core-26.0/SHA256SUMS
# Download signatures file (SHA256SUMS.asc) for verification
wget https://bitcoincore.org/bin/bitcoin-core-26.0/SHA256SUMS.asc
3. Verifying Downloaded Files
It is crucial to ensure the integrity and authenticity of the downloaded files. We will check the SHA256 sums and GPG signature.
# Check SHA256 sum
sha256sum --check --ignore-missing SHA256SUMS
You should see bitcoin-26.0-x86_64-linux-gnu.tar.gz: OK. If not, the file is corrupted.
Now, let's import the public GPG keys of the Bitcoin Core developers. A list of keys can be found on bitcoincore.org/en/download/.
# Import public GPG keys (example keys for Bitcoin Core developers)
# Use current keys from bitcoincore.org
gpg --keyserver hkps://keys.openpgp.org --recv-keys 01090831DBF626E7C4106593E20F76A000216E14
gpg --keyserver hkps://keys.openpgp.org --recv-keys 898BDDCCEB09F62EE8482A6C1167664B7AB8D654
After importing the keys, let's verify the SHA256SUMS.asc signature:
# Verify GPG signature
gpg --verify SHA256SUMS.asc
You should see a message indicating a good signature (Good signature from "..."). There might be a warning that the key is not fully trusted (This key is not certified with a trusted signature!), which is normal if you have verified the key's fingerprint.
4. Extracting and Installing Binary Files
# Unpack the archive
tar -xzvf bitcoin-26.0-x86_64-linux-gnu.tar.gz
# Copy binary files to /usr/local/bin
sudo install -m 0755 -o root -g root -t /usr/local/bin bitcoin-26.0/bin/
Remove temporary files:
# Remove temporary files
rm -rf bitcoin-26.0 bitcoin-26.0-x86_64-linux-gnu.tar.gz SHA256SUMS SHA256SUMS.asc
5. Creating a systemd Service for Bitcoin Core
We will run Bitcoin Core as a system service, which will allow it to start automatically when the server boots and be managed using systemctl.
# Create service file
sudo nano /etc/systemd/system/bitcoind.service
Insert the following content:
[Unit]
Description=Bitcoin daemon
After=network.target
[Service]
User=bitcoin
Group=bitcoin
Type=forking
PIDFile=/var/lib/bitcoin/.bitcoin/bitcoind.pid
ExecStart=/usr/local/bin/bitcoind -daemon -pid=/var/lib/bitcoin/.bitcoin/bitcoind.pid -conf=/var/lib/bitcoin/.bitcoin/bitcoin.conf -datadir=/var/lib/bitcoin/.bitcoin
ExecStop=/usr/local/bin/bitcoin-cli -conf=/var/lib/bitcoin/.bitcoin/bitcoin.conf -datadir=/var/lib/bitcoin/.bitcoin stop
Restart=on-failure
PrivateTmp=true
TimeoutStopSec=120
LimitNOFILE=8192
[Install]
WantedBy=multi-user.target
Save the file and close the editor.
Reload systemd so it recognizes the new service, and enable its autostart:
# Reload systemd
sudo systemctl daemon-reload
# Enable service autostart on system boot
sudo systemctl enable bitcoind
Bitcoin Core is now installed and ready to run.
