From 560a2f61b0887fba912fb72e891f23cf0c0f7cc5 Mon Sep 17 00:00:00 2001 From: Jens Ahrensfeld Date: Sun, 26 Jul 2026 10:09:22 +0200 Subject: [PATCH] Note vpn dyndns migration confirmed live FritzBox reconfigured with its dedicated per-host login; a real WAN IP change after recycling the connection produced a genuine authenticated update, confirmed in the access log and via dig. First device fully migrated off the legacy shared-key fallback. Co-Authored-By: Claude Sonnet 5 --- TODO.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/TODO.md b/TODO.md index 975befa..9f55bf7 100644 --- a/TODO.md +++ b/TODO.md @@ -88,6 +88,13 @@ Nothing here is urgent; all are low-risk, no-downtime changes. Once `dyndns legacy shared-key update` stops appearing in `syslog`, remove the fallback `grant` and the `jens` account can be scoped down to just its own host too. + **`vpn` migrated 2026-07-26**: home FritzBox reconfigured with the + new `vpn` login and confirmed live — after a WAN IP change (real + connection recycle, not a test), the access log shows a genuine + `Fritz!Box DDNS/1.0.3` request authenticated as `vpn` updating + `vpn.dyndns.jayfield.org` to the new IP (`217.229.60.187`), and `dig` + confirms the zone picked it up. First host fully off the legacy + fallback. `kack`/`test`/`uschi` still need migrating. - [x] **dyndns/default-vhost access logging is a no-op** — done 2026-07-25 found 2026-07-20 while investigating the command injection below.