# Best security tips for SPOs and ways to avoid scams for any Cardano users.
Here, \[FRCA๐] will provide you with a full Cardano Stake Pool guide with the best security tips as a bonus! (with the help of Coincashew's stakepool guide as a starting point)
1. We will be adding critical steps to ensure you have the **best security** on your nodes.
2. We will also provide guides on how to **avoid scams and other general security tips**.
Follow all the steps on left side and contact me on twitter if you have any questions.
\[**FRCA๐] Stake Pool twitter page** โก๏ธ [](https://twitter.com/frca_stakepool)
Telegram channel will be coming if enough people feel like discussing all this in real time.
{% content-ref url="/pages/-MXYh4KS0tUb8dTyuDkC" %}
[How to avoid Scams. Must read for beginners!](/avoid-scams)
{% endcontent-ref %}
# How to avoid Scams. Must read for beginners!
List of most used scams and ways to avoid them.
**1. Fake wallets** โ Only download Cardano wallets from trusted sources:
Daedalus Desktop wallet :
yoroi mobile wallet :
{% hint style="warning" %}
`There are currently no Android or iOS versions of Daedalus wallet.`
{% endhint %}
**2. Telegram** โ When joining some crypto groups you will get private messages instantly from scammers trying to get your crypto. They will pose as admins or support members from the group. Donโt even waste your time with them as admins in Cardano especially will never message you first. Scammers create accounts that look like admins.
Edit your Telegram settings:
```
Go to :
''privacy and security''
then :
''Groups & channels''
and change :
''Groupe invite settings'' to ''My contacts''.
```
See [**https://cardano-community.github.io/support-faq/#/no-to-scam?id=being-added-to-a-random-groupchannels**](https://cardano-community.github.io/support-faq/#/no-to-scam?id=being-added-to-a-random-groupchannels) **for more details and pictures.**
**3. Giveaway scams** โ Nobody will ever double your crypto by you sending them an amount to get double back. There are ***no Giveaways or Airdrops*** Videos on YouTube showing Charles Hoskinson and any other high profile people in crypto giving away free crypto are ***all fake!***
{% hint style="warning" %}
`IOHK team : โWe will never ask you for money, your password, your passphrase or your secret folders. Official partnerships/affiliations will always be announced through official channels. Use caution and do your own research before transferring funds. When dealing with Cardano ADA or any other cryptocurrency, it is especially important to be extra cautious.โ`
{% endhint %}
**4. Password/Passphrase** โ Do not share your password, passphrase, or secrets folders with anyone. Report people who ask you to do this to [report@Cardano.org.](mailto:report@Cardano.org)
**5. YouTube Comments** โ All whatsapp numbers or twitter links to investors channels (fund managers) from copies of a youtuber's account are from scammers. Name looks the same, but real comments from the channel owners name have a dark background.
**Extras:**
{% hint style="info" %}
* Do not disclose your balance or portfolio details online. This can make you a target for hackers.
* Always be sure to keep your Daedalus wallet recovery phrase safe and confidential.
* Do not rush into anything, doing a little online research which can reveal a scam or something which has been flagged as negative by the community.
* Always double check website URLs.
* Use 2FA on all sites that you can.
* Donโt store crypto on exchanges
* Use hardware wallets wherever possible
* Please do report any scams directly with the relevant party as well as to [report@Cardano.org.](mailto:report@Cardano.org)
{% endhint %}
# Extra security tips for SPOs.
{% hint style="warning" %}
**Important:** Follow this first :
{% endhint %}
*`And remember, this is the minimum, you cant go wrong with doing more if you wish to.`*
**And now to the extra tips:**
1. Use a hardware wallet for your pledge. See my guide at:
2. Use air-gapped machine for all transactions signing.
3. Keeping the system updated is vital before starting anything on your system. This will prevent people to use known vulnerabilities to enter in your system:
To enable ONLY security updates, do this:
```
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades
```
Edit to look like this:
> ```
> : Unattended-Upgrade::Allowed-Origins {
> : "${distro_id}:${distro_codename}-security";
> : // "${distro_id}:${distro_codename}-updates";
> : // "${distro_id}:${distro_codename}-proposed";
> : // "${distro_id}:${distro_codename}-backports";
> : };
> : // Unattended-Upgrade::Mail "my_user@my_domain.com";
> ```
**I took inspiration in this story from another beloved SPO before i made this guide (remember, this could happen to you too!) :**
{% hint style="danger" %}
So remember to keep more than one copy of your stake pool op keys offline and only in safe places! Let this be a lesson to you!
{% endhint %}
# 2. Harden your server-Coincashew
Quick steps to secure your node.
{% hint style="success" %}
Thank you for your support and kind messages! It really energizes us to keep creating the best crypto guides. Use [cointr.ee to find our donation ](https://cointr.ee/coincashew)addresses and share your message. ๐
{% endhint %}
## ๐ค Pre-requisites
* Ubuntu Server or Ubuntu Desktop installed
* SSH server installed
* a SSH client or terminal window access
In case you need to install SSH server, refer to:
{% embed url="" %}
In case you need a SSH client for your operating system, refer to:
{% embed url="" %}
## ๐งโ Create a non-root user with sudo privileges
{% hint style="info" %}
Make a habit of logging to your server using a non-root account. This will prevent the accidental deletion of files if you make a mistake. For instance, the command rm can wipe your entire server if run incorrectly using by a root user.
{% endhint %}
{% hint style="warning" %}
\*\*\*\*๐ฅ **Tip**: Do NOT routinely use the root account. Use `su` or `sudo`, always.
{% endhint %}
SSH to your server
```bash
ssh username@server.public.ip.address
# example
# ssh myUsername@77.22.161.10
```
Create a new user called cardano
```
useradd -m -s /bin/bash cardano
```
Set the password for cardano user
```
passwd cardano
```
Add cardano to the sudo group
```
usermod -aG sudo cardano
```
## \*\*\*\*๐ **Disable SSH password Authentication and Use SSH Keys only**
{% hint style="info" %}
The basic rules of hardening SSH are:
* No password for SSH access (use private key)
* Don't allow root to SSH (the appropriate users should SSH in, then `su` or `sudo`)
* Use `sudo` for users so commands are logged
* Log unauthorized login attempts (and consider software to block/ban users who try to access your server too many times, like fail2ban)
* Lock down SSH to only the ip range your require (if you feel like it)
{% endhint %}
Create a new SSH key pair on your local machine. Run this on your local machine. You will be asked to type a file name in which to save the key. This will be your **keyname**.
Your choice of [ED25519 or RSA](https://goteleport.com/blog/comparing-ssh-keys/) public key algorithm.
{% tabs %}
{% tab title="ED25519" %}
```
ssh-keygen -t ed25519
```
{% endtab %}
{% tab title="RSA" %}
```bash
ssh-keygen -t rsa -b 4096
```
{% endtab %}
{% endtabs %}
Transfer the public key to your remote node. Update the **keyname**.
```bash
ssh-copy-id -i $HOME/.ssh/.pub cardano@server.public.ip.address
```
Login with your new cardano user
```
ssh cardano@server.public.ip.address
```
Disable root login and password based login. Edit the `/etc/ssh/sshd_config file`
```
sudo nano /etc/ssh/sshd_config
```
Locate **ChallengeResponseAuthentication** and update to no
```
ChallengeResponseAuthentication no
```
Locate **PasswordAuthentication** update to no
```
PasswordAuthentication no
```
Locate **PermitRootLogin** and update to no
```
PermitRootLogin no
```
Locate **PermitEmptyPasswords** and update to no
```
PermitEmptyPasswords no
```
**Optional**: Locate **Port** and customize it your **random** port.
{% hint style="info" %}
Use a **random** port # from 1024 thru 49141. [Check for possible conflicts. ](https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers)
{% endhint %}
```bash
Port
```
Validate the syntax of your new SSH configuration.
```
sudo sshd -t
```
If no errors with the syntax validation, reload the SSH process
```
sudo service sshd reload
```
Verify the login still works
{% tabs %}
{% tab title="Standard SSH Port 22" %}
```
ssh cardano@server.public.ip.address
```
{% endtab %}
{% tab title="Custom SSH Port" %}
```bash
ssh cardano@server.public.ip.address -p
```
{% endtab %}
{% endtabs %}
{% hint style="info" %}
Alternatively, add the `-p ` flag if you used a custom SSH port.
```bash
ssh -i cardano@server.public.ip.address
```
{% endhint %}
**Optional**: Make logging in easier by updating your local ssh config.
To simplify the ssh command needed to log in to your server, consider updating your local `$HOME/.ssh/config` file:
```bash
Host cardano-server
User cardano
HostName
Port
```
This will allow you to log in with `ssh cardano-server` rather than needing to pass through all ssh parameters explicitly.
## \*\*\*\*๐ค **Update your system**
{% hint style="warning" %}
It's critically important to keep your system up-to-date with the latest patches to prevent intruders from accessing your system.
{% endhint %}
```bash
sudo apt-get update -y && sudo apt-get upgrade -y
sudo apt-get autoremove
sudo apt-get autoclean
```
Enable automatic updates so you don't have to manually install them.
```
sudo apt-get install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades
```
## ๐งธ Disable root account
System admins should not frequently log in as root in order to maintain server security. Instead, you can use sudo execute that require low-level privileges.
```bash
# To disable the root account, simply use the -l option.
sudo passwd -l root
```
```bash
# If for some valid reason you need to re-enable the account, simply use the -u option.
sudo passwd -u root
```
## ๐ Setup Two Factor Authentication for SSH
{% hint style="info" %}
SSH, the secure shell, is often used to access remote Linux systems. Because we often use it to connect with computers containing important data, itโs recommended to add another security layer. Here comes the two factor authentication (*2FA*).
{% endhint %}
```
sudo apt install libpam-google-authenticator -y
```
To make SSH use the Google Authenticator PAM module, edit the `/etc/pam.d/sshd` file:
```
sudo nano /etc/pam.d/sshd
```
Add the follow line:
```
auth required pam_google_authenticator.so
```
Now you need to restart the `sshd` daemon using:
```
sudo systemctl restart sshd.service
```
Modify `/etc/ssh/sshd_config`
```
sudo nano /etc/ssh/sshd_config
```
Locate **ChallengeResponseAuthentication** and update to yes
```
ChallengeResponseAuthentication yes
```
Locate **UsePAM** and update to yes
```
UsePAM yes
```
Save the file and exit.
Run the **google-authenticator** command.
```
google-authenticator
```
It will ask you a series of questions, here is a recommended configuration:
* Make tokens โtime-baseโ": yes
* Update the `.google_authenticator` file: yes
* Disallow multiple uses: yes
* Increase the original generation time limit: no
* Enable rate-limiting: yes
You may have noticed the giant QR code that appeared during the process, underneath are your emergency scratch codes to be used if you donโt have access to your phone: write them down on paper and keep them in a safe place.
Now, open Google Authenticator on your phone and add your secret key to make two factor authentication work.
{% hint style="danger" %}
**Note**: If you are enabling 2FA on a remote machine that you access over SSH you need to follow **steps 2 and 3** of [this tutorial](https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu-18-04) to make 2FA work.
{% endhint %}
## ๐งฉ Secure Shared Memory
{% hint style="info" %}
One of the first things you should do is secure the shared [memory](https://www.lifewire.com/what-is-random-access-memory-ram-2618159) used on the system. If you're unaware, shared memory can be used in an attack against a running service. Because of this, secure that portion of system memory.
To learn more about secure shared memory, read this [techrepublic.com article](https://www.techrepublic.com/article/how-to-enable-secure-shared-memory-on-ubuntu-server/).
{% endhint %}
{% hint style="warning" %}
### One exceptional case
There may be a reason for you needing to have that memory space mounted in read/write mode (such as a specific server application like **Chrome** that requires such access to the shared memory or standard applications like Google Chrome). In this case, use the following line for the fstab file with instructions below.
```
none /run/shm tmpfs rw,noexec,nosuid,nodev 0 0
```
The above line will mount the shared memory with read/write access but without permission to execute programs, change the UID of running programs, or to create block or character devices in the namespace. This a net security improvement over default settings.
### Use with caution
With some trial and error, you may discover some applications(**like Chrome**) do not work with shared memory in read-only mode. For the highest security and if compatible with your applications, it is a worthwhile endeavor to implement this secure shared memory setting.
Source: [techrepublic.com](https://www.techrepublic.com/article/how-to-enable-secure-shared-memory-on-ubuntu-server/)
{% endhint %}
Edit `/etc/fstab`
```
sudo nano /etc/fstab
```
Insert the following line to the bottom of the file and save/close.
```
tmpfs /run/shm tmpfs ro,noexec,nosuid 0 0
```
Reboot the node in order for changes to take effect.
```
sudo reboot
```
## \*\*\*\*โ **Install Fail2ban**
{% hint style="info" %}
Fail2ban is an intrusion-prevention system that monitors log files and searches for particular patterns that correspond to a failed login attempt. If a certain number of failed logins are detected from a specific IP address (within a specified amount of time), fail2ban blocks access from that IP address.
{% endhint %}
```
sudo apt-get install fail2ban -y
```
Edit a config file that monitors SSH logins.
```
sudo nano /etc/fail2ban/jail.local
```
Add the following lines to the bottom of the file.
{% hint style="info" %}
๐ฅ **Whitelisting IP address tip**: The `ignoreip` parameter accepts IP addresses, IP ranges or DNS hosts that you can specify to be allowed to connect. This is where you want to specify your local machine, local IP range or local domain, separated by spaces.
```
# Exampleignoreip = 192.168.1.0/24 127.0.0.1/8
```
{% endhint %}
```bash
[sshd]
enabled = true
port = <22 or your random port number>
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
# whitelisted IP addresses
ignoreip =
```
Save/close file.
Restart fail2ban for settings to take effect.
```
sudo systemctl restart fail2ban
```
## \*\*\*\*๐งฑ **Configure your Firewall**
The standard UFW firewall can be used to control network access to your node.
With any new installation, ufw is disabled by default. Enable it with the following settings.
* Port 22 (or your random port #) TCP for SSH connection
* Port 6000 TCP for p2p traffic
* Port 3000 TCP for Grafana web server (if applicable)
* Port 9100 tcp for Prometheus export data
* Port 12798 tcp for Prometheus cardano-node metrics data
```bash
sudo ufw allow <22 or your random port number>/tcp
sudo ufw allow 6000/tcp
sudo ufw enable
sudo ufw status numbered
```
{% hint style="danger" %}
Do not expose Grafana (port 3000) and Prometheus endpoint (port 9100 and 12798) to the public internet as this invites a new attack surface! A secure solution would be to access Grafana through a ssh tunnel with Wireguard.
{% endhint %}
Only open the following ports on nodes behind a network firewall.
\*\*\*\*๐ฅ **It may be dangerous to open these ports on a VPS/cloud node.**
```bash
sudo ufw allow 3000/tcp
sudo ufw allow 9100/tcp
sudo ufw allow 12798/tcp
```
Confirm the settings are in effect.
> ```csharp
> To Action From
> -- ------ ----
> [ 1] 22/tcp ALLOW IN Anywhere
> [ 2] 3000/tcp ALLOW IN Anywhere
> [ 3] 6000/tcp ALLOW IN Anywhere
> [ 4] 22/tcp (v6) ALLOW IN Anywhere (v6)
> [ 5] 3000/tcp (v6) ALLOW IN Anywhere (v6)
> [ 6] 6000/tcp (v6) ALLOW IN Anywhere (v6)
> ```
**\[ Optional but recommended ]** Whitelisting (or permitting connections from a specific IP) can be setup via the following command.
```bash
sudo ufw allow from
# Example
# sudo ufw allow from 192.168.50.22
```
{% hint style="info" %}
๐ **Port Forwarding Tip:** You'll need to forward and open ports to your validator. Verify it's working with or .
{% endhint %}
#### ๐งฑ Extra Hardening Rules for your Block Producer Node
Only your Relay Node(s) should be permitted access to your Block Producer Node.
```bash
sudo ufw allow proto tcp from to any port
# Example
# sudo ufw allow proto tcp from 18.58.3.31 to any port 6000
```
#### ๐งฑ Extra Hardening Rules for your Relay Node(s)
In order to protect your Relay Node(s) from a novel "DoS/Syn" attack, [**Michael Fazio**](https://github.com/michaeljfazio) created iptables entry which restricts connections to a given destination port to 5 connections from the same IP.
Replace `` with your public relay port, replace the 5 with your preferred connection limit.
```bash
iptables -I INPUT -p tcp -m tcp --dport --tcp-flags FIN,SYN,RST,ACK SYN -m connlimit --connlimit-above 5 --connlimit-mask 32 --connlimit-saddr -j REJECT --reject-with tcp-reset
```
{% hint style="warning" %}
Set the connection limit high enough so that your internal relay/block producer node topology remains functional.
{% endhint %}
You can check you current connections with a sorted list. Change the relay node port number, if needed.
```bash
sudo netstat -enp | grep ":6000" | awk {'print $5'} | cut -d ':' -f 1 | sort | uniq -c | sort
```
## ๐ญ Verify Listening Ports
If you want to maintain a secure server, you should validate the listening network ports every once in a while. This will provide you essential information about your network.
```
netstat -tulpn
```
```
ss -tulpn
```
{% hint style="success" %}
Congrats on completing the guide. โจ
Did you find our guide useful? Send us a signal with a tip and we'll keep updating it.
It really energizes us to keep creating the best crypto guides.
Use [cointr.ee to find our donation ](https://cointr.ee/coincashew)addresses. ๐
Any feedback and all pull requests much appreciated. ๐
Hang out and chat with fellow stake pool operators on Discord @
๐
Hang out and chat with our stake pool community on Telegram @
{% endhint %}
## ๐ References
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
# 3. \[FRCA๐] Guide: Setup chrony for good server time sync.
Chrony is a versatile implementation of the Network Time Protocol (NTP). It helps to keep your computer's time synchronized with NTP servers, reference clocks.
## 1. Installation
Install chrony :
```bash
sudo apt-get install chrony -y
```
Create chrony configuration file :
```bash
sudo nano /etc/chrony/chrony.conf
```
Paste the following inside :
```bash
pool time.google.com iburst minpoll 2 maxpoll 2 maxsources 3 maxdelay 0.3
pool time.facebook.com iburst minpoll 2 maxpoll 2 maxsources 3 maxdelay 0.3
pool time.euro.apple.com iburst minpoll 2 maxpoll 2 maxsources 3 maxdelay 0.3
pool time.apple.com iburst minpoll 2 maxpoll 2 maxsources 3 maxdelay 0.3
pool ntp.ubuntu.com iburst minpoll 2 maxpoll 2 maxsources 3 maxdelay 0.3
# This directive specify the location of the file containing ID/key pairs for
# NTP authentication.
keyfile /etc/chrony/chrony.keys
# This directive specify the file into which chronyd will store the rate
# information.
driftfile /var/lib/chrony/chrony.drift
# Uncomment the following line to turn logging on.
#log tracking measurements statistics
# Log files location.
logdir /var/log/chrony
# Stop bad estimates upsetting machine clock.
maxupdateskew 5.0
# This directive enables kernel synchronisation (every 11 minutes) of the
# real-time clock. Note that it canโt be used along with the 'rtcfile' directive.
rtcsync
# Step the system clock instead of slewing it if the adjustment is larger than
# one second, but only in the first three clock updates.
makestep 0.1 -1
# Get TAI-UTC offset and leap seconds from the system tz database
leapsectz right/UTC
# Serve time even if not synchronized to a time source.
local stratum 10
```
Save File and restart chrony in order for config change to take effect :
```bash
systemctl restart chronyd.service
```
# 4. \[FRCA๐] Security Guide: How to add your HW wallet as owner for your pool pledge.
Here we are adding a HW wallet as a second owner on your pool registration certificate so you can pledge from it.
For the latest updates, follow us on twitter! [](https://twitter.com/frca_stakepool)
Make sure you can see your HW wallet on your air-gapped offline machine.
{% tabs %}
{% tab title=" Air-gapped offline machine" %}
```bash
lusb
# LEDGER Cardano-App version 2.1.0+ is needed.
# If you cant see your ledger wallet then visit :
# https://support.ledger.com/hc/en-us/articles/115005165269-Fix-connection-issues
# Linux tab at the bottom.
#
# TREZOR Model-T:
# https://wiki.trezor.io/Udev_rules
# You must install the Trezor Bridge.
#
# OR see "StakePoolOperator Scripts" for clear indications on compatibility if you are unsure:
# https://github.com/gitmachtl/scripts/tree/master/cardano/mainnet#how-to-prepare-your-system-before-using-a-hardware-wallet
```
{% endtab %}
{% endtabs %}
Delegate HW wallet to your pool from either Daedalus or Yoroi.
Export your HW wallet public keys.
{% tabs %}
{% tab title="Air-gapped offline machine" %}
```bash
#Install cardano-hw-cli: https://github.com/vacuumlabs/cardano-hw-cli
cardano-hw-cli address key-gen
--path 1852H/1815H/0H/2/0
--verification-key-file hw-stake.vkey
--hw-signing-file hw-stake.hwsfile
```
{% endtab %}
{% endtabs %}
If you are changing your pool metadata json file, remember to calculate the hash of your metadata file and re-upload the updated metadata json file.
{% tabs %}
{% tab title="Block Producer" %}
```bash
cardano-cli stake-pool metadata-hash --pool-metadata-file poolMetaData.json > poolMetaDataHash.txt
```
{% endtab %}
{% endtabs %}
Find the minimum pool cost value.
{% tabs %}
{% tab title="Block Producer" %}
```bash
minPoolCost=$(cat $NODE_HOME/params.json | jq -r .minPoolCost)
echo minPoolCost: ${minPoolCost}
```
{% endtab %}
{% endtabs %}
Create stake-pool registration certificate including HW wallet as second owner and also making it default reward account.
{% hint style="info" %}
Edit this to your own settings!
{% endhint %}
{% tabs %}
{% tab title="Air-gapped offline machine" %}
```
cardano-cli stake-pool registration-certificate \
--cold-verification-key-file node.vkey \
--vrf-verification-key-file vrf.vkey \
--pool-pledge 150000000000 \ ------your pledge in lovelaces
--pool-cost 340000000 \ ------minimum pool cost value found before
--pool-margin 0.01 \ ------pool fee in fraction ie 0.01 for 1%
--pool-reward-account-verification-key-file hw-stake.vkey \ ------HW wallet key
--pool-owner-stake-verification-key-file stake.vkey \ ------previous CLI key
--pool-owner-stake-verification-key-file hw-stake.vkey \ ------HW wallet key
--mainnet \
--pool-relay-port 6000 \ ------your relay port
--pool-relay-ipv4 IP \ ------your relay IP
--metadata-url \
--metadata-hash $(cat poolMetaDataHash.txt) \
--out-file pool.cert
```
{% endtab %}
{% endtabs %}
Copy pool.cert to your Block Producer.
Find the current tip.
{% tabs %}
{% tab title="Block Producer" %}
```
slotNo=$(cardano-cli query tip --mainnet | jq -r '.slot')
echo slotNo: ${slotNo}
```
{% endtab %}
{% endtabs %}
Calculate payment.addr balance.
{% tabs %}
{% tab title="Block Producer" %}
```
cardano-cli query utxo \
--address $(cat payment.addr) \
--mainnet > fullUtxo.out
tail -n +3 fullUtxo.out | sort -k3 -nr > balance.out
cat balance.out
tx_in=""
total_balance=0
while read -r utxo; do
in_addr=$(awk '{ print $1 }' <<< "${utxo}")
idx=$(awk '{ print $2 }' <<< "${utxo}")
utxo_balance=$(awk '{ print $3 }' <<< "${utxo}")
total_balance=$((${total_balance}+${utxo_balance}))
echo TxHash: ${in_addr}#${idx}
echo ADA: ${utxo_balance}
tx_in="${tx_in} --tx-in ${in_addr}#${idx}"
done < balance.out
txcnt=$(cat balance.out | wc -l)
echo Total ADA balance: ${total_balance}
echo Number of UTXOs: ${txcnt}
```
{% endtab %}
{% endtabs %}
Build raw transaction.
{% tabs %}
{% tab title="Block Producer" %}
```
cardano-cli transaction build-raw \
${tx_in} \
--tx-out $(cat payment.addr)+${total_balance} \
--invalid-hereafter $(( ${currentSlot} + 10000)) \
--fee 0 \
--certificate-file pool.cert \
--out-file tx.tmp
```
{% endtab %}
{% endtabs %}
Calculate transaction fee.
{% tabs %}
{% tab title="Block Producer" %}
```
fee=$(cardano-cli transaction calculate-min-fee \
--tx-body-file tx.tmp \
--tx-in-count ${txcnt} \
--tx-out-count 1 \
--mainnet \
--witness-count 4 \
--byron-witness-count 0 \
--protocol-params-file params.json | awk '{ print $1 }')
echo fee: $fee
```
{% endtab %}
{% endtabs %}
Calculate final txOut.
{% tabs %}
{% tab title="Block Producer" %}
```
txOut=$((${total_balance}-${fee}))
echo txOut: ${txOut}
```
{% endtab %}
{% endtabs %}
Build raw transaction that includes the fee.
{% tabs %}
{% tab title="Block Producer" %}
```
cardano-cli transaction build-raw \
${tx_in} \
--tx-out $(cat payment.addr)+${txOut} \
--invalid-hereafter $(( ${currentSlot} + 10000)) \
--fee ${fee} \
--certificate-file pool.cert \
--out-file tx.raw
```
{% endtab %}
{% endtabs %}
Copy tx.raw to your air-gapped machine for signing.
Create transaction witnesses from all used CLI signing-keys.
{% tabs %}
{% tab title="Air-gapped offline machine" %}
```
cardano-cli transaction witness --tx-body-file tx.raw --signing-key-file node.skey --mainnet --out-file node-cold.witness
cardano-cli transaction witness --tx-body-file tx.raw --signing-key-file stake.skey --mainnet --out-file cli-stake.witness
cardano-cli transaction witness --tx-body-file tx.raw --signing-key-file payment.skey --mainnet --out-file cli-payment.witness
```
{% endtab %}
{% endtabs %}
Create transaction witness from HW wallet signing key. (connect your HW wallet and open Cardano app)
{% hint style="info" %}
Make sure your HW wallet is detected or it will say: `"`Transport not available `"`
{% endhint %}
{% tabs %}
{% tab title="Air-gapped offline machine" %}
```
cardano-hw-cli transaction witness --tx-body-file tx.raw --hw-signing-file hw-stake.hwsfile --mainnet --out-file hw-stake.witness
```
{% endtab %}
{% endtabs %}
Assemble final transaction with all the witnesses.
{% tabs %}
{% tab title="Air-gapped offline machine" %}
```
cardano-cli transaction assemble --tx-body-file tx.raw --witness-file node-cold.witness --witness-file cli-stake.witness --witness-file cli-payment.witness --witness-file hw-stake.witness --out-file tx-pool.multisign
```
{% endtab %}
{% endtabs %}
Copy tx-pool.multisign to your Block Producer.
Submit final transaction.
{% tabs %}
{% tab title="Block Producer" %}
```
cardano-cli transaction submit --tx-file tx-pool.multisign --mainnet
```
{% endtab %}
{% endtabs %}
{% hint style="info" %}
๐ฅ **Critical : Do not move your funds from CLI pledge wallet before HW wallet delegation is active on your pool!!(*****after 2 snapshots)*** **If you move them before, your pledge will show as "pledge not met".**
**ONLY USE THE FIRST ADDRESS showing in Daedalus or Yoroi if you want to keep your pledge address queryable via the CLI.**
{% endhint %}
For the latest updates, follow us on twitter! [](https://twitter.com/frca_stakepool)