| description |
|---|
Learn what best practices to follow to make sure nobody is gaining unauthorized access to your Lightning Node and satoshis or lose funds in accidents. |
Your Lightning Network node holds a range of cryptographic keys that need to be guarded against error, loss and theft. As a node operator you are solely responsible for your own funds. To guard against any kind of loss or compromise of your Lightning node you will have to take a multi-layered approach considering a variety of risks and strategies.
If your Lightning node is set up on a physical device you control, be mindful of who could gain access to its physical interfaces. If you rented a dedicated server or provisioned a virtual private server, inform yourself about the trustworthiness of the provider, their security policies and track record. You may for example check how your account can be secured and whether hidden administration panels exist that may need to be disabled or locked down separately.
Similarly, all your personal devices that contain Bitcoin wallets, ssh keys or authentication tokens need to be secured as well and accounted for in your threat model.
Your device’s operating system needs to be actively maintained and regularly updated. This includes all services and third-party code that may be used to operate your system, such as OpenSSH.
Use a firewall to limit exposure to your platform and the services running on it. To open port 9375 is not required, but recommended to accept incoming connections and inbound channels. REST and RPC (default ports 8080 and 10009) only need to be exposed when required by an external application you configured.
You may consider making some endpoints only available inside trusted networks, or connect to your node only via SSH or a VPN. Configure your platform to only use keys for authentication, not passwords.
When installing LND, verify the authenticity of the binaries or source code using PGP and git verify-tag as well as that of all dependencies, such as Go.
Just like the operating system of your node and personal device, lnd will need to be regularly updated. You may check the latest releases on Github, check for announcements on the blog or follow Lightning Labs on Twitter to not miss important security announcements.
How you update your LND will depend on how you installed it. You may for example replace the binary on your machine with its latest version, or run the following commands in your lnd git directory when updating from source:
git pull
make clean && make && make install tags="autopilotrpc chainrpc invoicesrpc routerrpc signrpc walletrpc watchtowerrpc wtclientrpc"
When creating your wallet with lncli create, you are given a 24 word long seed phrase. This seed phrase can be used to recover your on-chain Bitcoin, meaning that if it falls into the wrong hands your bitcoin are at risk of being taken. Similarly, if you are not in possession of this seed phrase yourself, you may not be able to regain control over your funds in the event of an error.
You may write your seed phrase, in its correct order, on a piece of paper and store it somewhere securely. Alternatively, you may store it in encrypted storage elsewhere, such as your password manager.
In the event that your hard drive becomes corrupted or the entire device destroyed or deleted, you may recover your on-chain funds using the seed phrase above. Your channels however can’t be backed up directly, though a mechanism exists to recover them separately from your on-chain funds.
You can find your channel backups in the file <lnddir>/data/chain/bitcoin/mainnet/channel.backup
This file is changed every time a channel is opened or closed. You may set up a script that backs up this file whenever it is changed, or copy it manually. It is necessary to back up this file whenever a new channel has been opened.
For backup purposes the channel.db file is not suitable for such backups. Keeping an up-to-date backup of this file is close to impossible, and you may lose your funds when recovering from an outdated channel.db file. This file can only be used when migrating your node, not when restoring.
When operating your node, it is important to note that you not interrupt lncli commands that alter the channel.db file, such as:
openchannel
closechannel and closeallchannels
abandonchannel
updatechanpolicy
restorechanbackup
To safely shut down your Lightning Node, use the command lncli stop
It is not recommended to prune your Bitcoin node, especially not for transactions occurring after the activation of Segwit, August 2017.
LND uses macaroons to authenticate external applications. These may be applications running on the same machine as LND or externally.
By default you will see the admin.macaroon, invoice.macaroon, readonly.macaroon and router.macaroon files in your <lnddir>/data/chain/bitcoin/mainnet/ directory. They each have their own permissions, and you may create your own macaroons with specific purposes. Only share these macaroons with applications on devices you trust.
To recreate macaroons you may delete all of the macaroon files and restart LND. However, this will NOT invalidate old macaroons. To invalidate old macaroons, you will have to delete the macaroon.db file as well before restarting LND.