node: use readonly macaroon by default

This means that calls to `openchannels` and `update-fees` will fail. A
custom lndmanage.macaroon can be created with
`scripts/bakemacaroon.sh` to enable the commands.

README.md

@@ -413,11 +413,15 @@ This can be done when compiling with minimal build tags of `make && make install
 tags="routerrpc signrpc walletrpc"`. If you use precompiled binaries, you can 
 ignore this.
 
-#### Admin Macaroon and TLS cert needed
+#### Macaroon and TLS cert needed
 If you run this tool from a different host than the lnd host, 
-make sure to copy `/path/to/.lnd/data/chain/bitcoin/mainnet/admin.macaroon`
- and `/path/to/.lnd/tls.cert` to your local machine, which you need for later
- configuration.
+make sure to copy `/path/to/.lnd/data/chain/bitcoin/mainnet/readonly.macaroon`
+and `/path/to/.lnd/tls.cert` to your local machine, which you need for later
+configuration.
+
+Note that if you want to run `update-fees` or `openchannels` you will need to
+create a custom macaroon, see `scripts/bakemacaroon.sh`. Don't use
+`admin.macaroon`, which is not recommended for best security practices.
 
 #### Signature verification
 Commits and releases are signed with key `1965 063F C13B EBE2` available via

lndmanage/lib/configure.py

@@ -36,7 +36,7 @@ def check_or_create_configuration(home_dir):
     :type home_dir: str
     """
     if not os.path.exists(home_dir):  # user runs for the first time
-        print(f"Running lndmanage for the first time.")
+        print("Running lndmanage for the first time.")
         print(f"Creating configuration folder at {home_dir}.")
         print("The default path can be overridden by setting the "
               "LNDMANAGE_HOME environment variable.")
@@ -44,17 +44,18 @@ def check_or_create_configuration(home_dir):
         lnd_home = os.path.expanduser('~/.lnd')
         lnd_grpc_host = 'localhost:10009'
 
-        admin_macaroon_path = os.path.join(
-            lnd_home, 'data/chain/bitcoin/mainnet/admin.macaroon')
+        macaroon_path = os.path.join(
+            lnd_home, 'data/chain/bitcoin/mainnet/readonly.macaroon')
         tls_cert_path = os.path.join(
             lnd_home, 'tls.cert')
         if os.path.exists(lnd_home):
             remote = False
             print(f"Detected a local lnd configuration folder {lnd_home}.", )
-            print("Will use admin.macaroon and tls.cert from this directory.")
+            print("Will use macaroon and tls.cert from this directory.")
         else:
             remote = True
-            print(f"IF LND RUNS ON A REMOTE HOST, CONFIGURE {home_dir}/config.ini.")
+            print(
+                f"IF LND RUNS ON A REMOTE HOST, CONFIGURE {home_dir}/config.ini.")
 
         # build config file
         config = configparser.ConfigParser()
@@ -64,7 +65,7 @@ def check_or_create_configuration(home_dir):
         config.read(config_template_path)
 
         config['network']['lnd_grpc_host'] = str(lnd_grpc_host)
-        config['network']['admin_macaroon_file'] = str(admin_macaroon_path)
+        config['network']['macaroon_file'] = str(macaroon_path)
         config['network']['tls_cert_file'] = str(tls_cert_path)
 
         config_path = os.path.join(home_dir, 'config.ini')

lndmanage/lib/lncli.py

@@ -21,7 +21,7 @@ class Lncli(object):
 
         cert_file = os.path.expanduser(config['network']['tls_cert_file'])
         macaroon_file = \
-            os.path.expanduser(config['network']['admin_macaroon_file'])
+            os.path.expanduser(config['network']['macaroon_file'])
         lnd_host = config['network']['lnd_grpc_host']
 
         # assemble the command for lncli for execution with flags

lndmanage/lib/node.py

@@ -90,7 +90,7 @@ class LndNode:
             bitcoin_network = 'regtest' if self.regtest else 'mainnet'
             self.macaroon_file_path = os.path.join(
                 self.lnd_home, 'data/chain/bitcoin/',
-                bitcoin_network, 'admin.macaroon')
+                bitcoin_network, 'readonly.macaroon')
             if self.lnd_host is None:
                 raise ValueError(
                     'if lnd_home is given, lnd_host must be given')
@@ -99,7 +99,7 @@ class LndNode:
                 self.config['network']['tls_cert_file']
             )
             self.macaroon_file_path = os.path.expanduser(
-                self.config['network']['admin_macaroon_file']
+                self.config['network']['macaroon_file']
             )
             self.lnd_host = self.config['network']['lnd_grpc_host']
 
@@ -120,7 +120,7 @@ class LndNode:
                 macaroon_bytes = f.read()
                 macaroon = codecs.encode(macaroon_bytes, 'hex')
         except FileNotFoundError:
-            logger.error("admin.macaroon not found, please configure %s.",
+            logger.error("macaroon not found, please configure %s.",
                          self.config_file)
             exit(1)
 

lndmanage/templates/config_sample.ini

@@ -1,9 +1,11 @@
 # network settings
 [network]
 lnd_grpc_host = IP:10009
-# tls and admin macaroon can be found in .lnd folder
+# tls and macaroon can be found in .lnd folder
 tls_cert_file = /path/to/tls.cert
-admin_macaroon_file = /path/to/admin.macaroon
+# see `scripts/bakemacaroon.sh` to create an lndmanage macaroon to use
+# openchannels and update-fees
+macaroon_file = /path/to/readonly.macaroon
 
 [logging]
 loglevel = INFO
@@ -19,4 +21,4 @@ loglevel = INFO
 [excluded-channels-fee-opt]
 # channels which are excluded from the fee optimization via the update-fees
 # command can be listed here by their channel ids, e.g.,
-# 635263839283742663=ignore
+# 635263839283742663=ignore

scripts/bakemacaroon.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+
+# This command creates a macaroon containing permissions to call all the
+# enpoints lndmanage uses. This is more secure than using an admin macaroon.
+
+lncli bakemacaroon \
+	--save_to lndmanage.macaroon \
+        uri:/lnrpc.Lightning/GetInfo \
+        uri:/lnrpc.Lightning/GetChanInfo \
+        uri:/lnrpc.Lightning/GetNodeInfo \
+	uri:/lnrpc.Lightning/DescribeGraph \
+	uri:/lnrpc.Lightning/ListChannels \
+	uri:/lnrpc.Lightning/FeeReport \
+	uri:/lnrpc.Lightning/UpdateChannelPolicy \
+	uri:/lnrpc.Lightning/ForwardingHistory \
+	uri:/lnrpc.Lightning/ClosedChannels \
+	uri:/lnrpc.Lightning/BatchOpenChannel \
+	uri:/lnrpc.Lightning/ConnectPeer \
+	uri:/walletrpc.WalletKit/ListUnspent \
+	uri:/routerrpc.Router/QueryMissionControl