Security checklist — Vordium Docs

Follow these before you register — most are one-time hardening steps.

Keys (most important)

Your validator signing key and VRF seed are generated ON the node itself at first boot. Never copy, paste, transport, or reuse a private key.
NEVER run two nodes with the same validator key. Double-signing is equivocation — 5% of your bond is slashed and you are permanently tombstoned (you can never rejoin). One node per key, always. This is the single biggest risk.
Back up the key files encrypted (e.g. age or gpg) off-box; store the passphrase separately.
Keep the operator/withdrawal wallet that holds your 1,000,000 VORD bond in a hardware wallet, separate from the node. The node never needs your withdrawal private key.

Dedicated server — do not co-host other apps or websites on it.
Firewall: allow inbound only the BFT gossip port (9000) and SSH; bind the RPC/admin ports (9002, 8545) to 127.0.0.1 — never expose them publicly.
SSH: key-only authentication; disable password login and root-password login; enable fail2ban.
Enable unattended security updates; keep the OS minimal.

16 GB RAM. If swap is 0, add swap or memory alerting — an out-of-memory kill takes the node down silently, and downtime is slashed.
SSD storage, stable network, static public IP.
Sync the clock with NTP — BFT consensus is timing-sensitive.
Run the node under systemd with auto-restart; rotate logs.

Alert on: node process down, block height falling behind the network, and rising missed-slot count.
Missed slots accrue toward downtime slashing (jail).