Merge branch 'v1.4' of https://github.com/rootzoll/raspiblitz into v1.4

README.md

@@ -756,7 +756,7 @@ If done successfully, simply put the SD card into the RaspiBlitz and power on ag
 
 A ready to use SD card image of the RaspiBlitz for your RaspberryPi is provided as download by us to get everybody started quickly (see above). But if you want to build that image yourself - here is a quick guide:
 
-* Get a fresh Rasbian RASPBIAN STRETCH WITH DESKTOP card image: [DOWNLOAD](https://www.raspberrypi.org/downloads/raspbian/)
+* Get a fresh Rasbian RASPBIAN BUSTER WITH DESKTOP card image: [DOWNLOAD](https://www.raspberrypi.org/downloads/raspbian/)
 * Write image to a SD card: [TUTORIAL](https://www.raspberrypi.org/documentation/installation/installing-images/README.md)
 * Add a file called `ssh` to the root of the SD card when mounted to enable SSH login
 * Start card in Raspi and login per SSH with `ssh pi@[IP-OF-YOUR-RASPI]` password is `raspberry`

build_sdcard.sh

@@ -679,12 +679,14 @@ if [ "${baseImage}" = "raspbian" ] || [ "${baseImage}" = "armbian" ] || [ "${bas
 fi
 if [ "${baseImage}" = "raspbian" ]; then
   # create /home/admin/setup.sh - which will get executed after reboot by autologin pi user
-  cat > /home/admin/setup.sh <<EOF
+  cat > /tmp/setup.sh <<EOF
 
   # make LCD screen rotation correct
   sudo sed --in-place -i "57s/.*/dtoverlay=tft35a:rotate=270/" /boot/config.txt
 
 EOF
+  sudo cp /tmp/setup.sh /home/admin/setup.sh
+  sudo chown admin.admin /home/admin/setup.sh
   sudo chmod +x /home/admin/setup.sh
 fi
 
@@ -698,7 +700,7 @@ fi
 
 echo ""
 echo "*** HARDENING ***"
-# based on https://github.com/Stadicus/guides/blob/master/raspibolt/raspibolt_20_pi.md#hardening-your-pi
+# based on https://stadicus.github.io/RaspiBolt/raspibolt_21_security.html
 
 # fail2ban (no config required)
 sudo apt-get install -y --no-install-recommends python3-systemd fail2ban
@@ -729,12 +731,12 @@ echo "*** LCD DRIVER ***"
 
 echo "--> Downloading LCD Driver from Github"
 cd /home/admin/
-git clone https://github.com/goodtft/LCD-show.git
-sudo chmod -R 755 LCD-show
-sudo chown -R admin:admin LCD-show
+sudo -u admin git clone https://github.com/goodtft/LCD-show.git
+sudo -u admin chmod -R 755 LCD-show
+sudo -u admin chown -R admin:admin LCD-show
 cd LCD-show/
 # set comit hard to a8de38f (7 Nov 2019) for security
-sudo git reset --hard a8de38f41586e153a8e03adcf7708c8b5974ffc8
+sudo -u admin git reset --hard a8de38f41586e153a8e03adcf7708c8b5974ffc8
 
 # install xinput calibrator package
   echo "--> install xinput calibrator package"

home.admin/config.scripts/blitz.setpassword.sh

@@ -201,6 +201,15 @@ elif [ "${abcd}" = "b" ]; then
   sed -i "s/^rpcpassword=.*/rpcpassword=${newPassword}/g" /home/admin/.${network}/${network}.conf 2>/dev/null
   sed -i "s/^${network}d.rpcpass=.*/${network}d.rpcpass=${newPassword}/g" /mnt/hdd/lnd/lnd.conf 2>/dev/null
   sed -i "s/^${network}d.rpcpass=.*/${network}d.rpcpass=${newPassword}/g" /home/admin/.lnd/lnd.conf 2>/dev/null
+  # RTL - will change to RTL-Conf.json and deprecate "DEFAULT auth type"
+  sed -i "s/^rtlPass=.*/rtlPass=${newPassword}/g" ./RTL/RTL.conf 2>/dev/null
+  # electrs
+  RPC_USER=$(cat /mnt/hdd/bitcoin/bitcoin.conf | grep rpcuser | cut -c 9-)
+  sed -i "s/^cookie = \"$RPC_USER.*\"/cookie = \"$RPC_USER:${newPassword}\"/g" /home/electrs/.electrs/config.toml 2>/dev/null
+  # BTC-RPC-Explorer
+  sed -i "s/^BTCEXP_BITCOIND_URI=$network:\/\/$RPC_USER:.*@127.0.0.1:8332?timeout=10000/BTCEXP_BITCOIND_URI=$network:\/\/$RPC_USER:${newPassword}@127.0.0.1:8332\?timeout=10000/g" /home/bitcoin/.config/btc-rpc-explorer.env 2>/dev/null
+  sed -i "s/^BTCEXP_BITCOIND_PASS=.*/BTCEXP_BITCOIND_PASS=${newPassword}/g" /home/bitcoin/.config/btc-rpc-explorer.env 2>/dev/null
+  sed -i "s/^BTCEXP_BASIC_AUTH_PASSWORD=.*/BTCEXP_BASIC_AUTH_PASSWORD=${newPassword}/g" /home/bitcoin/.config/btc-rpc-explorer.env 2>/dev/null
 
   echo "OK -> RPC Password B changed"
   echo "if services are running - reboot is needed to activate new settings"

home.admin/config.scripts/bonus.rtl.sh

@@ -53,7 +53,7 @@ if [ "$1" = "1" ] || [ "$1" = "on" ]; then
     rm -r /home/admin/RTL 2>/dev/null
     git clone https://github.com/ShahanaFarooqui/RTL.git /home/admin/RTL
     cd /home/admin/RTL
-    git reset --hard v0.6.1
+    git reset --hard v0.6.3
     # from https://github.com/Ride-The-Lightning/RTL/commits/master
     # git checkout 917feebfa4fb583360c140e817c266649307ef72
     if [ -d "/home/admin/RTL" ]; then
@@ -89,10 +89,14 @@ if [ "$1" = "1" ] || [ "$1" = "on" ]; then
     # prepare RTL.conf file
     echo "*** RTL.conf ***"
     cp ./RTL/sample-RTL.conf ./RTL/RTL.conf
+    chmod 600 ./RTL/RTL.conf || exit 1
     sudo sed -i "s/^macroonPath=.*/macroonPath=\/mnt\/hdd\/lnd\/data\/chain\/${network}\/${chain}net/g" ./RTL/RTL.conf
     sudo sed -i "s/^lndConfigPath=.*/lndConfigPath=\/mnt\/hdd\/lnd\/lnd.conf/g" ./RTL/RTL.conf
     sudo sed -i "s/^nodeAuthType=.*/nodeAuthType=DEFAULT/g" ./RTL/RTL.conf
-    sudo sed -i "s/^rtlPass=.*/rtlPass=/g" ./RTL/RTL.conf
+    # getting ready for the phasing out of the "DEFAULT" auth type
+    # will need to change blitz.setpassword.sh too
+    PASSWORD_B=$(sudo cat /mnt/hdd/${network}/${network}.conf | grep rpcpassword | cut -c 13-)
+    sudo sed -i "s/^rtlPass=.*/rtlPass=$PASSWORD_B/g" ./RTL/RTL.conf
     echo ""
 
     # open firewall