From 9ea26af65f32cf6f80808edb7136aefc3e4da16f Mon Sep 17 00:00:00 2001 From: Jens Ahrensfeld Date: Sun, 26 Jul 2026 10:24:46 +0200 Subject: [PATCH] Retire dyndns legacy shared-key fallback entirely uschi's device should be using its own dedicated login now, and with jens/kack/test's own hostnames already removed, nothing needed the fallback anymore. Removed the update-policy fallback grant, retired the original shared TSIG key (in production since March 2022), and deleted the now-dead legacy code path from nsupdate.php and its ipv4/ ipv6 variants. Per-host auth binding for dyndns is now unconditional with no exceptions. Verified jens can no longer update any host, while uschi/vpn continue to update themselves normally. Co-Authored-By: Claude Sonnet 5 --- TODO.md | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/TODO.md b/TODO.md index 99af268..c7dfb62 100644 --- a/TODO.md +++ b/TODO.md @@ -130,6 +130,30 @@ Nothing here is urgent; all are low-risk, no-downtime changes. `uschi`'s own current real IP back so nothing actually changed) that the `jens`→`uschi` legacy path still returns `0`. `named-checkconf`/ `rndc reload` clean throughout. + **Legacy fallback removed entirely 2026-07-26** — confirmed the + `jens` fallback wasn't needed for `uschi` anymore (its own dedicated + login/key from the original fix is what should be used going + forward), and with `jens`'s and `kack`/`test`'s own hostnames already + gone, nothing was left depending on it. Removed the + `grant "dyndns.jayfield.org" subdomain dyndns.jayfield.org. ANY;` + fallback grant and its key `include` from `named.conf.default-zones`; + retired the original shared TSIG key itself + (`/etc/bind/dyndns.jayfield.org.key`, in production since March 2022) + to + `/root/removed-configs-backup/dyndns-remove-legacy-fallback-20260726102228/`; + removed the now-dead legacy-path branch from + `nsupdate.php`/`nsupdate_ipv4.php`/`nsupdate_ipv6.php` — `nsupdate()` + now unconditionally rejects (`-1`) any request where the + authenticated user doesn't match the requested host, no exceptions. + Verified: `jens` attempting to update `uschi` now fails immediately + (`ret=-1`, no BIND round-trip at all — rejected in PHP before ever + building an `nsupdate` command), while `uschi` and `vpn` updating + themselves still succeed (`ret=0`, confirmed via `dig` against their + real IPs). Per-user auth binding for dyndns is now unconditional, + closing this item out completely — no more grandfathered exceptions + of any kind. The `jens` `.htpasswd` account itself was left in place + (not asked to remove it, and it's now inert for DNS updates anyway + since it has no hostname or grant left to use). - [x] **dyndns/default-vhost access logging is a no-op** — done 2026-07-25 found 2026-07-20 while investigating the command injection below.