jens/docs-alpha.jayfield.org
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refresh docs to reflect completed dyndns per-host auth fix

Browse Source 
README.md's credential-audit table and command-injection writeup still
described the per-user auth binding gap as open; it's been closed since
2026-07-26. SETUP.md's TSIG section still taught the old single-shared-
key pattern for a fresh install - replaced with the per-host key +
update-policy pattern actually running in production now, plus a
pointer to the phased-rollout approach documented in TODO.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
jens
2026-07-26 10:32:21 +02:00
co-authored by Claude Sonnet 5
parent 6ea1b0f5f2
commit 399e3c17a7
2 changed files with 48 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+8 -3
View File
@@ -243,7 +243,7 @@ Audited 2026-07-20 — which public hostnames require credentials:
| Host | Requires credentials? | Notes |
|---|---|---|
| `jayfield.org` / `www.jayfield.org` | No (intentionally public static site) | Was accidentally 401'ing every visitor via a stray `.htaccess` — fixed, see `TODO.md` |
| `dyndns.jayfield.org` | Yes — HTTP Basic Auth | Vhost-level `<Directory>` block, intentional. Had an OS command injection in its update scripts (fixed 2026-07-20, see `TODO.md`); the app itself still has no real per-user auth binding (open `TODO.md` item) |
| `dyndns.jayfield.org` | Yes — HTTP Basic Auth, one dedicated account per hostname | Vhost-level `<Directory>` block, intentional. Had an OS command injection in its update scripts (fixed 2026-07-20) and no real per-user auth binding (fixed 2026-07-26 with per-host TSIG keys — see `TODO.md`) |
| `mail.jayfield.org` | N/A — root is `403` (no content served there) | |
| `mail.jayfield.org/rspamd` | Yes — rspamd's own login page | |
| `cloud.jayfield.org` (Nextcloud) | Yes — redirects to `/login` | |
@@ -385,6 +385,11 @@ broken legitimate dyndns updates — fixed with a POSIX ACL scoped to just
that key file, not group membership, since the `bind` group also owns
`rndc.key` — and (b) that access logging for every real vhost on this
host is currently a no-op, and (c) that the dyndns app has no real
per-user auth binding. (b) and (c) are left open — see `TODO.md`.)
per-user auth binding.
(b) fixed 2026-07-25 — see `TODO.md` for the root cause and the
per-vhost `CustomLog` fix; (c) remains open.
per-vhost `CustomLog` fix. (c) fixed 2026-07-26: every dyndns hostname
now has its own dedicated `.htpasswd` account and TSIG key, with BIND's
`update-policy` (not just an app-level check) refusing any update where
the authenticated user doesn't match the requested hostname — see
`TODO.md` for the full rollout, including the now-retired shared key
and legacy fallback.