Hardening the Distribution Cookie & Node Access
Lock down which nodes can connect to your cluster using cookies, allowed-node lists, and network isolation to prevent unauthorized access.
Hardening the Distribution Cookie & Node Access is a free Erlang OTP: Distributed & Fault-Tolerant Systems Programming lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Erlang OTP: Distributed & Fault-Tolerant Systems Programming learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
How Nodes Authenticate
Erlang nodes form a cluster by sharing a secret cookie. Any node that knows the cookie and can reach the port may connect — and once connected, can run arbitrary code. This makes the cookie a critical secret.
The Magic Cookie
By default each node reads its cookie from ~/.erlang.cookie. If two nodes share it, they trust each other completely.
erlang:get_cookie().The Danger of Defaults
A weak or default cookie on a publicly reachable distribution port is a full remote-code-execution hole. Treat the cookie like a root password.
Setting a Strong Cookie
Set a long, random cookie explicitly at startup rather than relying on the file default.
erlang:set_cookie(node(), 'a-very-long-random-secret').Protecting the Cookie File
The cookie file must be readable only by its owner. Erlang refuses to start if permissions are too open.
chmod 400 ~/.erlang.cookieRestricting Node Names
Use net_kernel options and firewall rules so only known hostnames can even attempt a connection. Distribution should never be exposed to the open internet.
Binding the Distribution Port
Pin the distribution to specific ports and bind EPMD to a private interface so the cluster is unreachable from outside the trusted network.
erl -kernel inet_dist_listen_min 9100 inet_dist_listen_max 9105Monitoring Connections
nodes/0 lists currently connected nodes. Periodically auditing this list helps detect an unexpected peer.
nodes().Reacting to New Nodes
Subscribe to node up/down events with net_kernel:monitor_nodes/1 to log or reject connections you did not expect.
net_kernel:monitor_nodes(true).Hidden Nodes
Start tooling or monitoring nodes as hidden with -hidden so they connect without joining the full mesh, reducing the trust surface of your cluster.
erl -hidden -name tool@10.0.0.5 -setcookie SECRETDefense in Depth
Cookies alone are not enough. Combine them with TLS distribution, a private network (VPN/VLAN), firewalled EPMD, and least-privilege node placement.
Quick Check
Test your node security knowledge.
Recap
You learned to harden node access:
- The shared cookie is the cluster password — keep it long, random, secret
- Protect
~/.erlang.cookiewith 400 permissions - Bind distribution and EPMD to private interfaces; firewall them
- Audit connected nodes with
nodes/0and monitor events - Layer cookies with TLS and network isolation
Frequently asked questions
Is the “Hardening the Distribution Cookie & Node Access” lesson free?
Yes — the full text of “Hardening the Distribution Cookie & Node Access” is free to read here on the web, and the Erlang OTP: Distributed & Fault-Tolerant Systems Programming course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Erlang OTP: Distributed & Fault-Tolerant Systems Programming course, upgrade to CoddyKit PRO.
What will I learn in “Hardening the Distribution Cookie & Node Access”?
Lock down which nodes can connect to your cluster using cookies, allowed-node lists, and network isolation to prevent unauthorized access. You practise Erlang OTP: Distributed & Fault-Tolerant Systems Programming with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Erlang OTP: Distributed & Fault-Tolerant Systems Programming?
No prior experience is required. Erlang OTP: Distributed & Fault-Tolerant Systems Programming on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Hardening the Distribution Cookie & Node Access” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Erlang OTP: Distributed & Fault-Tolerant Systems Programming lesson?
Yes. Every Erlang OTP: Distributed & Fault-Tolerant Systems Programming lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Secure Node Communication (TLS)
- Authentication & Authorization
- Protecting Sensitive Data
- Hardening the Distribution Cookie & Node Access