- Regarding the bitnodes data:
I use bitnodes to validate that my node is reachable and I get the following response (all good)"
X.X.36:8333 /Satoshi:0.21.1(FutureBit-Apollo-Node)/
The response shows that everything is good. However is there a way to change the FutureBit-Apollo-Node string? I don't think I want to advertise what software the node is running as to reduce the attack vector.
Advertising bitcoind version (0.21.1 in your case) is harmless. Every bitcoin node out there advertises its version so it can efficiently communicate with other compatible nodes. However, when you reinstall system, "FutureBit-Apollo-Node" string will disappear and your node will become generic bitcoind. This setting is configurable somewhere in bitcoin.conf, read the docs for bitcoind if you want to change it or keep it after reinstall.
I am using the firewall to prevent all communication from other ports to the miner, but still there's potential risk that someone could try to exploit bitcoind through the open port in an attempt to break out to ubuntu root.
You assumed bitcoind is running in Apollo as root? I don't think that's the case. You can verify this in ssh session, just run htop.
Are my fears unfounded? Thanks
I suggest reinstalling OS on Apollo, see below. You can run bitcoind as a separate user (to decrease escape risk) with generic version string, that's what I do.
(also on the same line is there a way to update ubuntu to the latest security patches? I don't want to run an update and risk breaking everything. The miner runs like clockwork so the less I have to mess with it the better.
That was my very concern when I first put my hands on this machine. I have reinstalled Armbian Ubuntu (default system in Apollo) to Armbian Debian, headless, ssh access only. See my post with details:
https://bitcointalksearch.org/topic/m.57531106You can do something like that. For me, not applying security updates on Internet-exposed machine is a big no-no. That's why I reinstalled. Since this post, I upgraded system to latest Armbian-Debian 11, did even more Telegram stats, it's been running great. Also I moved it to another country, so I am bitcoin node operator in two countries now
Also, should I holdoff on installing TOR and LND on my own? how far is the next update :-)?
Finally I think I want to replace the 500GB for a TB, any recommendations on which one to get that will provide the performance and years of worry free operation? :-)
If you decide to go reinstall route, you have endless possibilities. I have 1TB USB spinning HDD connected as a node drive, formatted to Btrfs, so I have checksum warnings, had this drive already so cost was free. If you need to have it nice and tidy without extra equipment next to it, as it was, just buy any 1TB SSD, if will be all right. Bitcoind is barely using SSD bandwidth and speed anyway. Have fun