Systemd Method - Starfish

This guide walks you through setting up Ethereum Sepolia using systemd services with UFW firewall. You will:

Install Geth and Prysm binaries
Configure systemd services
Set up UFW firewall
Monitor and maintain your node

This method provides a simple, direct system setup. Best for users who prefer simplicity and don’t mind higher memory usage.

1. Installation

a. Install Dependencies

Ensure you have the required software: Prerequisites Setup

b. Install Geth (Execution Client)

Download the Geth binary:

wget https://gethstore.blob.core.windows.net/builds/geth-linux-amd64-1.15.11-36b2371c.tar.gz

Extract the archive:

tar -xvf geth-linux-amd64-1.15.11-36b2371c.tar.gz

Move the Geth binary to system path:

sudo mv geth-linux-amd64-1.15.11-36b2371c/geth /usr/bin/geth

c. Install Prysm (Consensus Client)

Download the Prysm Beacon Chain binary:

wget https://github.com/OffchainLabs/prysm/releases/download/v6.0.1/beacon-chain-v6.0.1-linux-amd64

Make the binary executable:

chmod +x beacon-chain-v6.0.1-linux-amd64

Move the Prysm binary to system path:

mv beacon-chain-v6.0.1-linux-amd64 /usr/bin/prysm

2. Environment Setup

a. Create User and Directories

Create a dedicated user for running Ethereum nodes:

sudo useradd -m -s /bin/bash ethereum

Create and set permissions for Geth data directory:

sudo mkdir -p /data/geth-sepolia && sudo chown -R ethereum:ethereum /data/geth-sepolia

Create and set permissions for Prysm data directory:

sudo mkdir -p /data/prysm && sudo chown -R ethereum:ethereum /data/prysm && sudo chmod -R 755 /data/prysm

Generate JWT secret for secure communication between execution and consensus clients:

openssl rand -hex 32 | sudo tee /data/jwt.hex && sudo chown ethereum:ethereum /data/jwt.hex && sudo chmod 600 /data/jwt.hex

3. Systemd Configuration

a. Configure Geth Service

Create a systemd service file for Geth:

sudo nano /etc/systemd/system/geth.service

Add the following content:

[Unit]
Description=Geth Sepolia Execution Client
After=network.target
[Service]
User=ethereum
Group=ethereum
Type=simple
Restart=always
RestartSec=5
ExecStart=/usr/bin/geth --sepolia --datadir /data/geth-sepolia \
--http --http.addr "0.0.0.0" --http.port 8545 \
--http.api "eth,net,web3" \
--authrpc.addr "127.0.0.1" --authrpc.port 8551 \
--authrpc.jwtsecret /data/jwt.hex \
--http.corsdomain "*" \
--http.vhosts "*"\
--cache=2048 \
--syncmode snap
MemoryLimit=8G
MemorySwapMax=0

[Install]
WantedBy=multi-user.target

b. Configure Prysm Service

Create a systemd service file for Prysm:

sudo nano /etc/systemd/system/prysm.service

Add the following content:

[Unit]
Description=Prysm Beacon Chain Sepolia
After=network.target geth.service
Requires=geth.service

[Service]
User=ethereum
Group=ethereum
Type=simple
Restart=always
RestartSec=5
ExecStart=/usr/bin/prysm --datadir=/data/prysm --sepolia \
--execution-endpoint=http://localhost:8551 \
--rpc-host=0.0.0.0 --rpc-port=4000 \
--grpc-gateway-host=0.0.0.0 --grpc-gateway-port=3500 \
--jwt-secret=/data/jwt.hex \
--genesis-beacon-api-url=https://lodestar-sepolia.chainsafe.io \
--checkpoint-sync-url=https://sepolia.checkpoint-sync.ethpandaops.io \
--accept-terms-of-use \
--http-modules=beacon,config,node \
--min-sync-peers=1
MemoryLimit=10G
MemoryHigh=8G
MemorySwapMax=0

[Install]
WantedBy=multi-user.target

4. Start Services

Reload systemd to recognize the new service files:

sudo systemctl daemon-reload

Enable services to start on boot:

sudo systemctl enable geth.service
sudo systemctl enable prysm.service

Start both services:

sudo systemctl start geth.service
sudo systemctl start prysm.service

5. Monitoring

a. Check Logs

Monitor Geth logs:

sudo journalctl -fu geth

Monitor Prysm logs:

sudo journalctl -fu prysm

b. Check Sync Status

Check Geth sync status:

curl -s -X POST --data '{"jsonrpc":"2.0","method":"eth_syncing","params":[],"id":1}' \
-H "Content-Type: application/json" http://localhost:8545 | jq

Expected output when synced:

{
    "jsonrpc": "2.0",
    "id": 1,
    "result": false
}

Check Prysm sync status:

curl -s http://localhost:3500/eth/v1/node/syncing | jq

Expected output when synced:

{
    "data": {
        "head_slot": "7601769",
        "sync_distance": "0",
        "is_syncing": false,
        "is_optimistic": false,
        "el_offline": false
    }
}

c. Resource Monitoring

Check memory usage:

free -h

Check disk usage:

df -h

Monitor processes:

htop

6. RPC Endpoints

Once both services are running and synced, you can use the following RPC endpoints:

Execution Layer (Geth) HTTP RPC: http://your-server-ip:8545
Consensus Layer (Prysm) HTTP API: http://your-server-ip:3500

7. Troubleshooting

Services fail to start: Check the logs for errors with journalctl -fu geth or journalctl -fu prysm
Network connectivity: Check your firewall rules
JWT secret: Verify that the JWT secret is accessible by both clients
Disk space: Check free space with df -h

8. Security Configuration

a. Configure UFW Firewall

Enable UFW and set default policies:

sudo ufw enable
sudo ufw default deny incoming
sudo ufw default allow outgoing

Allow SSH (critical, do this first!):

sudo ufw allow 22/tcp

Allow Geth and Prysm for Docker local use via docker0:

sudo ufw allow in on docker0 to any port 8545 proto tcp
sudo ufw allow in on docker0 to any port 30303 proto tcp
sudo ufw allow in on docker0 to any port 30303 proto udp
sudo ufw allow in on docker0 to any port 3500 proto tcp
sudo ufw allow in on docker0 to any port 4000 proto tcp
sudo ufw allow in on docker0 to any port 13000 proto tcp
sudo ufw allow in on docker0 to any port 12000 proto udp

Allow specific external IP access (replace 123.123.123.123 with your trusted IP):

sudo ufw allow from 123.123.123.123 to any port 8545 proto tcp
sudo ufw allow from 123.123.123.123 to any port 30303 proto tcp
sudo ufw allow from 123.123.123.123 to any port 30303 proto udp
sudo ufw allow from 123.123.123.123 to any port 3500 proto tcp
sudo ufw allow from 123.123.123.123 to any port 4000 proto tcp
sudo ufw allow from 123.123.123.123 to any port 13000 proto tcp
sudo ufw allow from 123.123.123.123 to any port 12000 proto udp

Allow specific subnet access (replace 123.123.0.0/16 with your trusted subnet):

sudo ufw allow from 123.123.0.0/16 to any port 8545 proto tcp
sudo ufw allow from 123.123.0.0/16 to any port 30303 proto tcp
sudo ufw allow from 123.123.0.0/16 to any port 30303 proto udp
sudo ufw allow from 123.123.0.0/16 to any port 3500 proto tcp
sudo ufw allow from 123.123.0.0/16 to any port 4000 proto tcp
sudo ufw allow from 123.123.0.0/16 to any port 13000 proto tcp
sudo ufw allow from 123.123.0.0/16 to any port 12000 proto udp

Check UFW status:

sudo ufw status verbose

b. Security Best Practices

Replace placeholder IPs (123.123.123.123) with your actual trusted IPs. Don’t just copy and paste!
Use strong passwords for your system
Keep your software updated regularly
Consider setting up TLS/SSL for secure connections to your RPC endpoints (Nginx + Cloudflare Proxied + Certbot)

9. FAQ

a. Pruning Mechanism

Geth (Execution Client):

Uses the default pruning mechanism (gcmode=full)
Keeps only the latest state trie and automatically prunes old state data to save disk space

Prysm (Consensus Client):

No manual pruning method
Prysm automatically manages finalized state and retains only the necessary data required for consensus
Discards finalized data as per Ethereum consensus rules

b. RPC Request Limitations

By default, there’s no limitation. However:

With UFW enabled: You must whitelist your friends’ IP addresses so only they can access your RPC endpoint
Without UFW: Your RPC endpoint will be open to the public, meaning anyone who discovers it can freely access it

Recommendation

Always secure your RPC endpoint with a firewall or IP whitelist to prevent abuse.

c. Sync Time

On a 1Gbps port speed, a full sync typically takes more than 3 hours. It might be faster if you’re using a 10Gbps port.

d. Storage Requirements

As of 12/05/2025, the total storage usage for a fully synced Sepolia node (Geth + Prysm) is approximately 637GB.