3 Commits

Include renames

Author	SHA1	Message	Date
archipelagoandClaude Opus 5	0a1d314ffa	feat(security): add LND macaroon rotation for the /lnd-connect-info leak ... Operator tool for the fix in a05956c4. GET /lnd-connect-info answered unauthenticated callers with the LND ADMIN MACAROON, the TLS cert, the gRPC/REST ports and the node's onion address. Every macaroon on an affected node must be treated as known to an attacker. Rotation removes the macaroon root key from macaroons.db plus the issued macaroon files; LND mints a fresh root key on unlock, so every previously issued macaroon — including any the attacker holds — stops verifying. Coins live in wallet.db and channel state in channel.db, and macaroons are bearer tokens rather than keys, so neither database is touched, opened or moved. Safety properties, in the order they matter: - Detect-only by DEFAULT. --apply additionally requires --yes. - An ORDERING GUARD refuses to rotate on a node whose binary lacks the fix, because the new macaroon would leak through the same door within seconds and the operator would believe they were safe. Overridable only via an explicit --force-unpatched. - It backs up the old material to a 0700 dir OUTSIDE the dir LND rescans, verifies the backup file count matches, and refuses to delete anything if it does not. - It never reads, prints or copies a macaroon's CONTENT. Everything it reports is a SHA-256 digest, so the material is proven changed without disclosing it to the terminal or scrollback. lncli runs INSIDE the container and reads the macaroon off its own disk, so the secret never crosses into this script's output. - It records the node identity pubkey and channel census BEFORE, and aborts loudly if the identity or the OPEN channel total changed. Two deliberate non-assertions, both of which would otherwise produce frightening false alarms on a completely healthy rotation: - wallet.db is NOT asserted byte-identical. btcwallet records chain sync progress inside it, so it legitimately changes on every start. - num_active_channels alone is NOT asserted. It counts channels whose peer is currently online and so legitimately dips after any restart while peers reconnect. The safety invariant is the ACTIVE+INACTIVE total, which is what gets asserted; a changed active count is reported as normal post-restart behaviour. Enumeration runs under sudo rather than as a shell glob: the LND data dir is 0700 owned by the container's mapped uid, so "$LND_DIR"/*.macaroon does not expand in an unprivileged shell — it stays literal, which would have made both the backup and the removal loop silent no-ops. Verified on a live node: sudo find returns 9 files where the glob returns 0. Exercised in detect mode against a real LND on a live node: correctly reported the binary as unpatched, live-probed :18083 as LEAKING (200), read both digests and the node identity, and exited 2 without changing anything. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-02 16:28:09 -04:00
archipelagoandClaude Opus 5	0ed9334f15	feat(10-04): let a deployed node report — and fix — fleet-shared host keys ... 10-03 closed the build half of F-03: the ISO no longer bakes SSH host keys or a TLS keypair into the shared rootfs, and first-boot regeneration fails closed. Nodes already in the field receive none of that — the first-boot script is installed by the installer, not shipped by OTA — so a node that hit the old fail-open path is still running key material that every downloader of its ISO also holds, and its completion marker guarantees it will never try again. scripts/security/host-secrets-audit.sh decides, from the node's own disk alone, which of those it is. Four signals in a fixed precedence: missing material can never be shared material; the fail-open fingerprint (marker present plus the literal `WARNING: TLS regeneration failed` / `WARNING: ssh-keygen -A failed` lines the old script emitted) is direct evidence and outranks timestamps and also names WHICH class survived; then key mtime against a first-boot anchor (.secrets-regenerated, falling back to the installer's LUKS key then machine-id). Verdicts are per-node / shared / fail-closed-missing / unknown, and every one of them carries the evidence strings that produced it, each naming the file it was read from. per-node is never claimed from an absent signal. No anchor means `unknown`, and a standing first-boot-secrets.failed record also means `unknown` — a clean mtime is not evidence that generation succeeded. That is T-10-37: a false per-node verdict leaves an exposed node looking clean, which is worse than no verdict at all. Rotation (D-06: detect-report-then-apply, recorded in docs/security/KEY-02-FLEET-ROTATION.md): - --detect is the default and is read-only; it always exits 0, because detection is informational and must never fail a boot. - --apply without --yes writes nothing at all, not even its own verdict file. "Touches nothing" is worth being able to say without a footnote. - --apply --yes refuses unless the verdict is `shared`, so the wrong node cannot be rotated even deliberately. - It stages the full replacement TLS pair AND host-key set before touching anything live and aborts if either fails; records the OLD fingerprints before the swap; does TLS first (a dead web UI is recoverable over SSH, the converse is not); replaces host keys by mv-onto-the-existing-path rather than rm-then-mv, so the directory is never momentarily empty; and RELOADS sshd, never restarts it, so the operator's own session survives its own rotation. bootstrap.rs ships the boot unit through the existing run_runtime_assets promotion and enables it --now, so the verdict lands with the OTA rather than at the next reboot. handle_system_stats gains a host_secrets object read from the on-disk verdict — cheap, never an error however malformed the file, and deliberately carrying no fingerprints, because a payload polled every few seconds does not need digests an operator on the node can already read. tests/first-boot-secrets/rotation-tests.sh: 8 cases against temp roots through the HOST_SECRETS_ROOT seam. Negative controls run and reverted, each reddening exactly one case: dry run writing its verdict file (STATE-DIR-CHANGED); the old fingerprints recorded after the swap instead of before (caught by an ordering observation, not a content comparison — the systemctl stub records whether the file existed at the moment of the first reload); a tolerated generation failure leaving a half-rotated node; and `per-node` claimed with no anchor. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-02 15:03:02 -04:00
archipelagoandClaude Opus 5	527f602322	feat(10-02): add read-only-by-default RPC exposure probe (C-6 / KEY-01) ... - Measures EXPOSURE (auth.isOnboardingComplete) and SESSION ENFORCEMENT (seed.status) separately; the audit's C-6 probed with seed.status alone, which is not allowlisted and returns 401 by design, so its "Fail: 200" criterion could never fire. - Read-only by construction: methods come from a fixed READONLY_METHODS array, never from an argument; the one mutating request is behind --destructive with a red disposable-nodes-only banner. - The refusal check uses the published BIP-39 all-abandon/art test vector, so no real key material is ever generated, handled or printed. - No node address, onion address or credential embedded. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-02 14:19:15 -04:00