Satoshi Station

"Governments are good at cutting off the heads of centrally controlled networks like Napster, but pure P2P networks like Gnutella and Tor seem to be holding their own."

Satoshi Nakamoto— November 7, 2008

Lightning Node Security Setup

Proper security configuration is critical for Lightning nodes, which manage active payment channels and hold funds. This section covers essential security measures including access control, encryption, firewall configuration, and security monitoring.

Access Control

Properly configured access control protects your node from unauthorized access while still allowing legitimate administration and usage.

Authentication Methods

  • Password Protection: Use strong, unique passwords for all accounts and interfaces.
  • SSH Key Authentication: Disable password login and use key-based authentication for SSH.
  • API Authentication: Implement macaroons (LND) or other API access tokens for granular permissions.
  • TLS Certificates: Configure proper SSL/TLS certificates for API and web interfaces.
  • Two-Factor Authentication: Add 2FA where possible for administration interfaces.

Authorization & Access Restrictions

  • Principle of Least Privilege: Grant only necessary permissions required for each user/service.
  • Role-Based Access: Create different access levels for administration vs. monitoring.
  • IP Restrictions: Limit API access to specific IP addresses or ranges.
  • Command Limitations: Restrict which RPC commands can be executed remotely.
  • Secure Admin Interfaces: Place admin UIs behind VPNs or secure proxies.
LND Macaroon Security Example

LND uses macaroons (specialized cookies) for authorization with fine-grained permissions:

  • admin.macaroon: Full administrative privileges (highest risk)
  • readonly.macaroon: View-only access to node data
  • invoice.macaroon: Only allows creating invoices
  • Custom macaroons: Create purpose-specific tokens with exact permissions needed

When sharing access with services or tools, always use the most restrictive macaroon possible for the task required.

Encryption Configuration

Encryption protects sensitive data both in transit and at rest, ensuring that even if other security measures fail, your data remains protected.

Data Encryption

  • Wallet Encryption: Encrypt wallet files with strong passwords
  • Disk Encryption: Use full disk encryption for the node's system
  • Database Security: Secure channel.db and other critical data stores
  • Secure Memory Management: Limit exposure of sensitive data in memory
  • Key Derivation: Use secure key derivation functions (KDFs) with high work factors

Communication Security

  • TLS Configuration: Use strong TLS cipher suites and protocols
  • Certificate Validation: Properly validate certificates, avoid self-signed certs for important connections
  • Secure RPC: Encrypt all RPC communications with strong TLS
  • API Transport Security: Secure REST and gRPC interfaces
  • VPN Usage: Consider placing administrative interfaces behind a VPN

Key Management

  • Seed Security: Store seed phrases offline in secure locations
  • Key Rotation: Regularly rotate TLS certificates and API keys
  • Hardware Security: Consider hardware security modules (HSMs) for critical keys
  • Key Backups: Securely back up keys with encryption and physical security
  • Compartmentalization: Different keys for different functions

Backup Encryption

  • SCB Encryption: Encrypt Static Channel Backups (LND) or equivalent
  • Encrypted Archives: Use GPG or other strong encryption for backup files
  • Password Management: Use a secure system to manage encryption passwords
  • Encrypted Transfer: Use secure channels when moving backups between systems
  • Offline Storage: Consider cold storage for critical backups

Firewall & Network Security

A properly configured firewall restricts network access to only the services that need to be exposed, limiting the attack surface of your node.

Essential Firewall Rules

Port Access Control

Lightning Services

  • 9735-9736: Lightning protocol (inbound connections)
  • 10009: LND gRPC API (restrict carefully)
  • 8080/8083: REST APIs (highly restrict or VPN only)
  • 9911: Watchtower (if running one)

Bitcoin Services

  • 8333: Bitcoin mainnet p2p
  • 8332: Bitcoin RPC (restrict to localhost)
  • 28333: BIP157 (if enabled)
  • 18333: Bitcoin testnet (if used)
IP Filtering
  • Implement IP whitelisting for admin interfaces
  • Consider geo-blocking for high-risk regions
  • Use fail2ban or similar for brute force protection
  • Allow public P2P ports only if running public node
Rate Limiting
  • Limit connection attempts per IP address
  • Implement anti-DDoS measures
  • Configure connection timeouts appropriately
  • Monitor traffic patterns for anomalies
Network Isolation Strategies
  • VPN Access: Place administrative interfaces behind a VPN for secure remote access.
  • Reverse Proxy: Use a reverse proxy with strong authentication for web interfaces.
  • Network Segmentation: Place your node on a separate network segment from other services.
  • Tor Hidden Services: Consider running services as Tor hidden services for enhanced privacy and security.

Example: Run your node with --listen.inet=127.0.0.1 to only accept connections via Tor, protecting your IP address.

Security Monitoring & Alerts

Active monitoring helps detect potential security issues before they become serious breaches, allowing for rapid response.

Log Monitoring

  • Critical Logs: Monitor debug.log, lnd.log, and other application logs.
  • System Logs: Check auth.log, syslog for unusual access attempts.
  • Bitcoin Logs: Monitor underlying Bitcoin node warnings and errors.
  • Log Centralization: Consider log aggregation for easier monitoring.
  • Log Rotation: Ensure logs are rotated but preserved for security analysis.

Alert System

  • Critical Alerts: Node down, channel forced close, failed authentication.
  • Warning Alerts: Unusual traffic, resource constraints, pending updates.
  • Notification Methods: Email, SMS, Telegram bots, dedicated monitoring apps.
  • Alert Prioritization: Define severity levels to prevent alert fatigue.
  • Response Procedures: Document actions to take for each alert type.

Security Auditing & Review

Regular Security Checks
  • Scheduled Audits: Weekly system and permission checks
  • Software Updates: Regular review of available security patches
  • Configuration Review: Periodic validation of security settings
  • Penetration Testing: Occasional testing of external-facing services
  • Chain Analysis: Review on-chain footprint for privacy leaks
Monitoring Tools
  • Prometheus + Grafana for metrics visualization
  • BOS Scorecard for node quality assessment
  • RTL/ThunderHub for channel monitoring
  • Fail2ban for intrusion prevention
  • Custom script monitors for specific checks
Response Planning
  • Document incident response procedures
  • Maintain up-to-date backups for recovery
  • Plan for different security breach scenarios
  • Test recovery processes periodically
  • Keep contact information for security assistance
Security Monitoring Example

A basic security monitoring setup might include:

  1. Prometheus metrics collection from Bitcoin and Lightning nodes
  2. Grafana dashboard displaying key security metrics and thresholds
  3. Telegram bot sending alerts for suspicious events or outages
  4. Daily log analysis script checking for authentication failures
  5. Weekly security configuration review checklist

Remember: Active monitoring combined with proper security configuration is your best defense against security incidents.

Node Operations