<p>You can secure an LND node in the same way how you would secure any host on the internet. You can for example use <code>ufw</code> to set up a firewall. You could also have a physical firewall in front of you node. Also a big step towards security would be to run no other software on the node. </p>

<p>As for backups it is a little bit more tricky. The seedwords will not include the state of all of your channels. With the current channel design you cannot restore an old backup. As an old channel state would - following the protocol - allow your channel partners to claim all bitcoins in that channel. However you can use a distributed file system or a distributed data base to store your channel state. If configured properly writing to the file system or database will certainly be slower as all calls have to be synchronized and blocking. 
Also you could at least have a raid system that helps if a disk crashes.</p>

<p>Generally you can shutdown your lightning node and migrate it to another computer by copying the database. As mentioned again it is tricky as you really have to make sure that you don't migrate old state. I have a <a href="https://www.youtube.com/watch?v=-S7pQOw36vI" rel="nofollow noreferrer">video showing this for c-lightning</a>. The process for lnd should be similar. </p>

CC BY-SA 4.0
2019-01-17T13:14:39.807Z
Thank you Rene for the great anwer. So regular backups make no sense...
TheLast10sat
CC BY-SA 4.0
2019-01-17T18:33:54.323Z
Yes exactly. You will need a better strategy line the ones I mentioned. Maybe others have better strategies
Rene Pickhardt
CC BY-SA 4.0
2019-01-17T12:12:00.583Z
2019-01-17T12:12:00.583Z
Rene Pickhardt
<p>Newer versions (0.6) of LND support channel backups/restore without restarting. So doing a backup of the seed plus channels should help, but I think you need to to frequent backups, maybe with every channel transaction, to have always the latest state of the channels.</p>

<p>Also I secure my LND keeping it into a docker container, with restricted access only to port 9735, and using the GRPC from inside the container or from a private network.</p>

CC BY-SA 4.0
2019-05-01T18:35:12.290Z
2019-05-01T18:35:12.290Z
Mario Medina
<p>Can anyone share a knowledge how to</p>

<p>_ secure LND node </p>

<p>_ backup node with all Channels</p>

<p>I think only a seed will not be sufficient. 
What is your plan B in case of disaster? How to do an  Emergency restore, migration to other server, or set up high availability solution?
thanks</p>

<security><lightning-network><lightning-network-daemon>
LND Security best practices? Disaster recovery?
TheLast10sat
# LND Security best practices? Disaster recovery?

(Asked by: username_0 on 2019-01-17)

Can anyone share a knowledge how to

\_ secure LND node

\_ backup node with all Channels

I think only a seed will not be sufficient.
What is your plan B in case of disaster? How to do an Emergency restore, migration to other server, or set up high availability solution?
thanks

**Tags:** security, lightning-network, lightning-network-daemon


---

## 2 answers

### Answer by username_1 on 2019-01-17. Score: 2 | Accepted answer

You can secure an LND node in the same way how you would secure any host on the internet. You can for example use `ufw` to set up a firewall. You could also have a physical firewall in front of you node. Also a big step towards security would be to run no other software on the node.

As for backups it is a little bit more tricky. The seedwords will not include the state of all of your channels. With the current channel design you cannot restore an old backup. As an old channel state would - following the protocol - allow your channel partners to claim all bitcoins in that channel. However you can use a distributed file system or a distributed data base to store your channel state. If configured properly writing to the file system or database will certainly be slower as all calls have to be synchronized and blocking.
Also you could at least have a raid system that helps if a disk crashes.

Generally you can shutdown your lightning node and migrate it to another computer by copying the database. As mentioned again it is tricky as you really have to make sure that you don't migrate old state. I have a [video showing this for c-lightning](https://www.youtube.com/watch?v=-S7pQOw36vI). The process for lnd should be similar.

> **Comments:**
> **username_0**: Thank you Rene for the great anwer. So regular backups make no sense...  
> **username_1**: Yes exactly. You will need a better strategy line the ones I mentioned. Maybe others have better strategies  

---

### Answer by username_2 on 2019-05-01. Score: 1

Newer versions (0.6) of LND support channel backups/restore without restarting. So doing a backup of the seed plus channels should help, but I think you need to to frequent backups, maybe with every channel transaction, to have always the latest state of the channels.

Also I secure my LND keeping it into a docker container, with restricted access only to port 9735, and using the GRPC from inside the container or from a private network.


---

