Core Lightning Security Check: Was Your Node Exposed?

This guide helps you determine whether your Core Lightning (CLN) node may have been exposed to a security breach. You will learn how to inspect logs, verify configuration, and check for signs of unauthorized access. By following these steps, you can assess your node’s security posture and take corrective action if needed.

What You’ll Need

• Access to your Core Lightning node’s command line (SSH or local terminal).
• Basic familiarity with Linux commands (ls, grep, cat).
• The ability to run lightning-cli commands (or equivalent) as the node user.
• Your node’s data directory path (default: ~/.lightning or /var/lib/lightning).

Step-by-Step

1. Check your node’s public exposure. First, determine if your node is reachable from the internet. Run: lightning-cli getinfo and look at the binding and addresses fields. If the addresses show a public IP (not 127.0.0.1 or a private range like 10.x.x.x, 192.168.x.x), your node is exposed. Also, check if your node’s RPC port (default 9735) is open on your firewall.
2. Review your configuration file. Open your config file (usually config in the data directory). Look for lines like bind-addr=0.0.0.0:9735 or announce-addr= with a public IP. If you see bind-addr=0.0.0.0, it means your node listens on all interfaces, which is necessary for public nodes, but you must ensure your firewall only allows the required ports. Also check for rpc-file-mode and rpc-bind settings—if RPC is bound to 0.0.0.0, that is a serious exposure.
3. Inspect the logs for anomalies. Core Lightning writes logs to a file (usually lightningd.log in the data directory) or to syslog. Look for entries with UNUSUAL or BROKEN levels. Specifically, search for lines containing peer connected, new connection, or error. Use grep -i "error\|fail\|denied\|invalid" ~/.lightning/lightningd.log to find potential issues. Pay attention to repeated failed authentication attempts or unexpected disconnects.
4. Check for unexpected peer connections. Run lightning-cli listpeers and review the list. If you see peers you don’t recognize, that could indicate someone connected to your node. However, be aware that any node can connect to a public node, so this alone isn’t proof of a breach. Look for peers with high error counts or unusual channel activity.
5. Verify your node’s identity and keys. Run lightning-cli getinfo and note the id (node public key). If you have a backup of your node’s identity from before, compare them. If the key has changed, it could mean your node was reset or compromised. Also, check the hsm_secret file permissions—it should be readable only by the node user (e.g., ls -la ~/.lightning/hsm_secret should show -rw-------).
6. Examine system logs for suspicious activity. Look at your system’s auth log (e.g., /var/log/auth.log on Debian/Ubuntu) for SSH login attempts or other access. If you see successful logins from unknown IPs, that’s a red flag. Also check journalctl -u lightningd if your node runs as a systemd service.
7. Check for unexpected files or changes. Look in your data directory for files you don’t recognize. Use find ~/.lightning -type f -mtime -7 to see files modified in the last week. If you see new files that shouldn’t be there, investigate them.
8. Review your channel and on-chain activity. Run lightning-cli listfunds to see your UTXOs. If there are transactions you didn’t initiate, that’s a serious sign. Also, lightning-cli listchannels can show if your node is routing unexpected amounts.
9. Check your node’s uptime and restart history. If your node was restarted without your knowledge, it could indicate a crash or an attacker gaining control. Use uptime and last reboot to see system reboots, and check lightningd’s logs for shutdown messages.
10. Run a security scanner (optional). Tools like cln-grpc or the lightning-cli check command (if available) can help. You can also use lightning-cli help to see available commands. Some nodes have a dev plugin that provides more diagnostics, but use with caution.

Common Mistakes

• Assuming public exposure equals breach. A public node is meant to be reachable; connections from unknown peers are normal. Focus on anomalies, not the mere presence of connections.
• Ignoring the RPC interface. The RPC socket is a more critical attack surface than the peer-to-peer port. If RPC is exposed to the network, that’s a major vulnerability.
• Not checking file permissions. The hsm_secret file contains your node’s private keys. If it’s readable by other users, your funds are at risk.
• Overlooking logs. Logs are your best friend. Many node operators don’t review them regularly, missing early signs of trouble.
• Panicking and disconnecting everything. If you suspect a breach, don’t immediately disconnect all peers or move funds without a plan. You might lose evidence.

Tips

• Keep your node updated. Core Lightning releases security patches regularly. Use lightning-cli version to check, and update to the latest stable version.
• Use a firewall. Restrict incoming connections to only the necessary ports (9735 for peer-to-peer, and possibly 8080 for REST if you use it). Never expose the RPC port (usually 9735? Actually RPC is a Unix socket, but if using --rpc-bind, it’s a TCP port).
• Enable TLS for RPC if using network RPC. Core Lightning supports TLS for RPC, but it’s not enabled by default. If you must expose RPC, use a VPN or SSH tunnel.
• Backup your node regularly. This includes the hsm_secret and the database. If you suspect a breach, you can restore from a known good backup.
• Monitor your node’s activity. Set up alerts for unexpected restarts or large channel movements. You can use scripts that parse logs.
• Use a separate user for your node. Don’t run lightningd as root. Create a dedicated user with limited privileges.

Troubleshooting

What if I find suspicious activity? If you see clear signs of unauthorized access (e.g., unknown transactions, changed keys), immediately disconnect your node from the network (lightning-cli stop), then investigate. Move funds to a safe wallet if possible, and consider restoring from a backup.

What if I can’t access my node? If you’re locked out, check if the node is still running (systemctl status lightningd). If it’s not, try starting it manually. If you’ve lost access to the machine, you may need to contact your hosting provider.

What if the logs are empty or missing? Check if logging is enabled. In your config, you can set log-file=lightningd.log or use log-level=debug for more detail. If logs are missing, check file permissions and disk space.

What if I see repeated failed connection attempts? This could be a brute-force attack, but it’s often just other nodes trying to connect. If the attempts are from a single IP, you can block it with a firewall. But don’t assume it’s a breach—it’s normal for public nodes to receive many connection attempts.

What if my node’s ID changed? This is a strong indicator that your hsm_secret was replaced or your node was reset. If you have a backup, restore it. If not, your node is effectively new, and you’ll need to re-establish channels.

Frequently Asked Questions

Can I tell if someone accessed my node’s RPC?

If your RPC is only a Unix socket with proper permissions, remote access is impossible. If you’ve exposed RPC over TCP, check logs for connections to that port. The lightningd.log may show RPC requests, but not always. Use network monitoring tools like ss -tnlp to see active connections.

Is it safe to have a public node?

Yes, many nodes are public and secure. The key is to follow best practices: keep your node updated, use a firewall, and never expose the RPC interface without strong authentication (like a VPN).

What should I do if I suspect a breach?

First, stop the node to prevent further damage. Then, check your funds (lightning-cli listfunds) and move them if possible. Review logs and configuration to identify how the breach occurred. Finally, restore from a backup or create a new node with a fresh identity.

Can a lightning node be hacked without my knowledge?

It’s possible if you have weak passwords, exposed RPC, or unpatched software. However, Core Lightning is designed with security in mind, and most attacks target misconfigured nodes. Regular monitoring is essential.

Do I need to worry about the Lightning Network gossip protocol?

No, the gossip protocol is public and doesn’t expose sensitive data. However, an attacker could use it to map the network, but that’s not a direct threat to your node.

How often should I check my node’s security?

At minimum, review logs monthly. If you notice unusual activity, check immediately. Also, after any software update or configuration change, verify your settings.

Related

• Why No Wireless Charging on These Devices?
• Safari Security Flaws vs Major Browsers
• Debian 12 to 13 Upgrade: Safe Step-by-Step Guide