When ordinary people hear the term “cryptocurrency”, they can assume that every aspect of the protocol is encrypted and therefore completely private, allowing users to remain anonymous and safe. Of course not, and privacy-conscious users need to take extra steps to protect themselves. Network watchers are a particular threat vector that Bitcoin and Lightning users should be aware of. By transparently sending data over the standard IPV4 and IPV6 networks, complex companies can find patterns related to your financial activities and they can use your computer’s IP address to probe the vulnerabilities and your location and determine location identification.
How should we protect ourselves?
By sharing as little data as possible with third parties. By ensuring that all data sent and received by a node is routed over a confidential network.
The full node offers the best data protection model to prevent data leakage. With a full node, you can download all data from the blockchain and only search for addresses/transactions where local network observers cannot detect your interest.
However, if we want to manage our own nodes, we still need to share data (e.g. send transactions) with colleagues on the network. How can we protect ourselves from this? enter gate. Tor Project officials said you can think of Tor as “a person who refuses to follow you down a winding, difficult-to-follow road, and then periodically wipes your fingerprints.” Your traffic will be mixed with the traffic of other Tor users. As Tor grows its global user base, the road gets more and more twisty.
In order for you to run network services (from web servers to peer nodes) on Tor, you need to create a hidden service that acts as a bridge between the Tor network and the specific software running on it. your machine.
bitcoin core
As of Bitcoin Core 0.12, if a node can connect to the local Tor daemon, a hidden service will automatically run. However, we need to ensure that certain settings are correct in order for the node and daemon to be able to communicate with each other. So, in 2016, I first explored how my bitcoin node works on the Tor network and wrote this guide:
How to run Bitcoin as a Tor hidden service on Ubuntu
Why run hidden bitcoin services on nodes? * This increases the privacy of other bitcoin users who anonymize their bitcoin…
Although some additional configuration is required to disable communication over IPV4 and IPV6, the guide above will help you get there. When configuring Bitcoin Core to power Lightning nodes, the bitcoin.conf file should contain the following lines:
# [core]
# Maintain a full transaction index (improve performance) txindex = 1 daemon = 1 disablewallet = 1 maxuploadtarget = 1000 # [rpc]
# Accept command line and JSON RPC commands. server=1 rpcauth=[redacted]::[redacted]
# [zeromq]
# Transactions cannot be published in [address]
zmqpubrawtx = tcp://127.0.0.1:28333 # Check this option to publish the raw block in hexadecimal [address]. zmqpubrawblock=tcp://127.0.0.1:28332# privacybinding=127.0.0.1:8333# Allows DNS lookups for -addnode, -seednode, and -connect values. dns=0 # If the address is low, query the peer address via DNS lookup. dnsseed=0 # Provide your own public IP address. externalip =[redacted].onion # Use a separate SOCKS5 proxy to reach the peer via Tor. onion=127.0.0.1:9050 proxy=127.0.0.1:9050 proxyrandomize=1 # Connect to peer only via Tor. onlynet=onion listenonion=1 listen=0 # help the peer device to perform initial synchronization addnode=gyn2vguc35viks2b.onion addnode=kvd44sw7skb5folw. onion addnode = nkf5e6b7pl4jfd4a.onion addnode = yu7sezmixhmyljn4kaddion6 Zwiebel addnode = yu7sezmixhmyljn4546 addnode = yu7sezmixhmyljn4546addion6addnodesaddnode = yu7sezmixhmyljn4546addnodesaddnode = yu7sezmixhmyljn4546addionkaddnode = Führung yu7sezaddion5 .onion addnode = 77mx2jsxaoyesz2p.onion addnode = 7g7j54btiaxhtsiy.onion addnode = a6obdgzn67l7exu3.onion addnode = ab64h7olpl7qpxci.onion addnode = am4a4rahem Zwiebel addnode = bk7yp6epnmcllq72. onion addnode = bmutjfrj5btseddb.onion addnode = ceeji4qpfs3ms3zc. onion addnode = ab64h7olpl7qpxci.onion addnode = am4a4rahem onion addnode = bk7yp6epnmcllq72. onion addnode = bmutjfrj5btseddb.onion addnode = ceeji4qpfs3ms3zc. onion addnode = ab64h7olpl7qpxci.onion addnode = am4a4rahem onion addnode = bk7yp6epnmcllq72. onion addnode = bmutjfrj5btseddb.onion addnode = ceeji4qpfs3ms3zc.
Note that the two lines have [redacted] This information must be dynamically defined by you.
rpcauth =[redacted]::[redacted]
The rpcauth value must be set by running this Python script.
externalip =[redacted].onion
You can find the hidden bitcoin service address that needs to be set as an external address by running the following command while the node is running: bitcoin-cli getnetworkinfo | grepaddress ”
All you have to do is wait for Bitcoin to finish syncing. It will take at least a few days depending on various factors.
LND
LND is as intelligent as Bitcoin Core and can communicate with the Tor daemon. You just have to tell him to do it. I recommend the following lnd.conf settings:
[Application Options]
minchansize = 100000 Monitoring = Local host accepts key collection = 1 circuit allowed = 1 watchtower.active = 1 # mark unpaid and unpaid bills as deleted gc-canceled-bills-on-start = 1 gc-canceled-bills-on – the-fly = 1 # Avoid synchronizing historical graphics data. Ignore historical gossip filters. = 1 # gRPC socket binding # Avoid high startup overhead stagger-initial-reconnect = 1 # Regenerate RPC TLS certificate automatically. Tlsautorefresh=1 # Do not include the IP in the RPC-TLS certificate. Tlsdisableautofill = 1
[bitcoin]
bitcoin.active = true bitcoin.mainnet = true bitcoin.node = bitcoind bitcoin.minhtlc = 1000 bitcoin.basefee = 1000 bitcoin.feerate = 100
[bitcoin]
bitcoind.rpcuser =[redacted]
bitcoind.rpcpass =[redacted]
bitcoind.zmqpubrawblock=tcp://127.0.0.1:28332 bitcoind.zmqpubrawtx=tcp://127.0.0.1:28333 bitcoind.estimatemode=economy
[routerrpc]
#Set the default probability for a successful transition. Routerpc.apriorihopprob = 0.5 # If the node returns many errors, ignore the node routerpc.aprioriweight = 0.75 # Set the minimum savings required to try to use a cheaper path routerrpc.attemptcost = 10 routerrpc. attemptcostppm = 10 number of historical routing records routerpc.maxmchistory = 10000 # Set the minimum confidence in the path worth trying
[gate]
tor.active = true tor.v3 = true tor.streamisolation = true
Please note that bitcoind.rpcuser and bitcoind.rpcpass must be the values entered when configuring Bitcoin Core in the python script rpcauth, not the output values of the script.
LND offers a variety of configuration options. You might want to see an example of lnd.conf here. Alex Bosworth is also out of detailed advice on configuring computers.
Be sure to set up automatic remote channel backup for disaster recovery. Trust me, you don’t need to do wallet recovery for corrupted data. I have written many articles about extreme cases that I have encountered.
Lightning Wallet Recovery: Lessons Learned
Recovering funds from failed Lightning Network nodes can be technically difficult – this is the experience we have learned from bulk recovery.
This is a simple utility script that you can modify to send the channel backup to another computer via any bash command (e.g. scp). Otherwise, you can use this script I found and modified to automatically backup your channel to Dropbox.
Control mobile nodes via Zeus
Setting up your nodes is great, but what if you want to use them to make payments when you’re around town instead of carrying a laptop?
At the time of writing, Zeus appears to be the only mobile app for iOS and Android that supports direct communication with remote LND, Eclair, and C-Lightning nodes.
Although Zeus can communicate with your node over IPV6, we still insist on using Tor. You must first create another hidden Tor service for the lnd REST interface.
sudo vim /etc/tor/torrc
Add these two lines:
HiddenServiceDir /var/lib/tor/lnd_rest/HiddenServicePort 8080 127.0.0.1:8080
Restart tor and find the hostname of the new onion service you want to inject into Zeus.
sudo service tor restart sudo cat /var/lib/tor/lnd_rest/hostname
Create a badge for authentication.
/path/to/lncli bakemacaroon address: read address: write info: read info: write bill: read bill: write message: read message: logout string: logout string: write string In: read string: peer: read peer: write signer: generate signer : Read
This command will generate a series of hexagons that you need to insert into Zeus. You also need to make sure that “Use Tor” is selected in the Zeus settings.
Now you should be ready to go
But one more thing…
liquidity management
We’re still in the early stages of understanding Lightning Network’s cash management best practices. I hope that the whole book can be written on this subject. However, you should learn the basics. I suggest joining some discussion forums to learn more about the latest best practices.
There are several tools available to help you manage channel liquidity.
Manage Lightning Network liquidity
Understand the concept of liquidity in the Lightning Network and how best to open, manage, balance, and close channels.
Running an LN node on a server – Fabrice Drouin’s advice
We offer here – with the authorization of the author – a summary of a series of thoughts and advice originally posted by Fabrice Drouin (co-founder and CTO of ACINQ ), on the CryptoFR Slack. These posts are about the best way to spin up a Lightning Node when you’re not a developer or Linux expert, preferably using a cheap VPS server.
My intention through this post is simply to say what is for me the best way to do it (and the one that best allows you to train). I am nevertheless aware that, given the Umbrel/Raspiblitz trend on the one hand and LN-as-a-service on the other, my opinion is clearly in the minority. The message I’m trying to get across is not that you necessarily have to run LN nodes at AWS rather than at home, but rather that people take a step back and focus more on their objective:
- Is it about learning how LN works? You don’t need mainnet for that;
- Is it just about using the network? It would then be easier to use a non-custodial mobile wallet;
- Do we want to “help the network”? The operation of LN is very different from that of Bitcoin and multiplying the nodes does not help, when they are not reliable, it is even the opposite;
- Do we hope to make money with LN? “You are going to face big disappointments” (TM).
For us [at ACINQ] , the objective is clear: to make LN a network capable of taking a significant share of online/mobile payments in the years to come, without sacrificing the “privacy” and “custody” aspects, and that passes above all by reliability (a payment network that is not * very * reliable is useless), that’s why I’m not a fan of today’s turnkey solutions.
There is also a non-technical but crucial aspect: routing capacity management. A node that only operates a handful of channels at $5 is useless for routing, and it is necessary to analyze how the balances evolve to re-generate incoming or outgoing capacity.
In short, we cannot simply “YOLO” and ignore maintenance (liquidity and errors/channel closures), because a poorly managed node will ultimately be blacklisted by its peers.
My recommendations
From an operator’s point of view, an LN node is a fairly standard service, with standard issues: deploy / configure / update / backup / monitor / debug. There are also a few specifics: backups are a bit tricky to implement, and it takes money.
I advise to preferably use a cheap VPS rather than a machine hosted at home. It is significantly better when it comes to security. It will obviously be necessary to secure this VPS:
- configure SSH in “public key only” mode,
- disable root access, etc.
- install and configure ufw to leave only the SSH port open ,
- install and configure fail2ban .
There are many guides for this. Those written by cloud providers (digital ocean, ovh, linode, etc.) do the trick. Depending on the provider and the VPS used, it will be necessary to optionally add a disk to store the data of the Bitcoin node. Here again, it depends on the suppliers, but that is what risks costing the most (and it also helps to understand why the “Watch Towers” model today is not economically viable).
For the rest, I advise to start in testnet mode, and, when you are happy with the setup, to possibly switch to the mainnet:
- install and configure a bitcoin node,
- do the IBD (quick on testnet) ,
- install and configure an LN node (c-lightning, lnd, eclair). Please note, depending on the implementation chosen, the Bitcoin configuration may be different.
First very important point: data storage and backup
You must save:
- static data (for example the seeds which are used to generate the private keys of the nodes and the channels, a priori it will be one or two small files);
- channel data and payment/audit data. In order of priority, choose if possible to store the data in Postgres, or in sqlite if this is not possible;
- consider a backup solution, which depends on the database used, the implementation and the provider.
When to backup? In the protocol the data must be saved when signing. Some implementations provide a “hook” to be able to call a custom script at this time.
How to backup? The best (and probably the most expensive) is to use a postgres database provided by the cloud provider.
Second important point: check that the LN and bitcoin nodes are working
There are several possible choices:
- rely on OS service management to start and restart automatically in the event of a failure;
- launch everything by hand in a tmux/screen that you find when you reconnect in SSH (for example a tab for Bitcoin Core, a tab for LN, etc…);
- configure alerts when bitcoin/LN nodes are not working. Again, it depends on the provider. With AWS, for example, it’s very easy to run a CRON script that calls an API (bitcoin, LN, etc.) and sends an email if it doesn’t work. And of course we only test the alerts that work.
Third important point: the logs
Archiving the logs is a huge plus in terms of debugging, and being able to consult them without logging on to the machine is a huge plus in terms of security. Here again there are plenty of possibilities that can be combined:
- configure the LN node to use rolling logs (one file/day)
- send the logs to a storage space (S3, …)
- use a logging solution such as logentries/papertrail/…
Once we have that, do a real test:
- open one or two channels,
- simulate a complete crash of the node,
- check that we have the alerts and the logs, and see how to restore.
There are other interesting tests to do:
- do a force-close, check which transactions are published and with which fees,
- reboot with old data and check that dataloss-protect is working properly.
We can go further:
- collect and export metrics (number of open/closed channels, payment, bitcoin/LN node balance, …)
- create alerts if channels close…
Regarding LN, it is interesting to look at the protocol and understand how on-chain transactions are handled:
- Who publishes?
- Who pays the fees?
- What is published in case of mutual-close or force-close?
- What happens when there are payments in progress?
It is also necessary to understand the interactions with the blockchain:
- What should be monitored and what does it entail? (ie why do some implementations require transactions to be indexed? What is the impact of pruning?)
- Is the onchain wallet managed by the bitcoin node (eclair)? By the LN node (c-lightning and lnd)?
- What are the advantages/disadvantages of each of these two solutions?
You don’t need to be a developer to do all this, but you do need to be a bit technical and want to delve into the OS, the services offered on the cloud, and the implementations. This is, in my opinion, very informative and not just for the LN aspect. Besides, it won’t prevent you from switching to a more “turnkey” solution later (except that you will realize that ultimately you don’t need it).
Zero to One Transaction LND (Lightning Network Implementation)
this tutorial in French is a step-by-step guide for the installation and configuration of Bitcoind, LND , and the use of LND until the execution of a transaction: “LND is an implementation complete Lightning network protocol. It’s an open-source project that anyone can contribute to if you follow the instructions. It is maintained and primarily made by Lightning Labs Inc. LND is command-line software, which means there is no built-in graphical user interface.
It is designed to work as a main server (node) for other applications that may bring the GUI. It is also a Bitcoin Mainnet Wallet and a Lightning Network Wallet. »
Leave a Reply