From e64f152d3155cc816cfa61353ed579e056207901 Mon Sep 17 00:00:00 2001 From: Jens Ahrensfeld Date: Sun, 26 Jul 2026 10:16:16 +0200 Subject: [PATCH] Remove stale dyndns hosts kack and test instead of migrating them Neither had shown real recent activity (kack not since Feb 2024, test with no traffic in the per-vhost log's short history), so rather than give them dedicated per-host logins like vpn/uschi, removed their DNS records, TSIG keys, update-policy grants, and .htpasswd accounts outright. Backed up before removal; jens/uschi/vpn unaffected. Co-Authored-By: Claude Sonnet 5 --- TODO.md | 30 ++++++++++++++++++++++++------ 1 file changed, 24 insertions(+), 6 deletions(-) diff --git a/TODO.md b/TODO.md index 9f55bf7..be2d4c2 100644 --- a/TODO.md +++ b/TODO.md @@ -83,18 +83,36 @@ Nothing here is urgent; all are low-risk, no-downtime changes. pre-change records exactly. **Follow-up**: the `jens` legacy fallback (and its `.htpasswd` account) should stay only until every real device — including - whichever ones are still authenticating as `jens` to update `kack`/ - `test`/`uschi` — has been reconfigured with its own dedicated login. - Once `dyndns legacy shared-key update` stops appearing in `syslog`, - remove the fallback `grant` and the `jens` account can be scoped down - to just its own host too. + whichever ones are still authenticating as `jens` to update `uschi` + — has been reconfigured with its own dedicated login. Once `dyndns + legacy shared-key update` stops appearing in `syslog`, remove the + fallback `grant` and the `jens` account can be scoped down to just + its own host too. **`vpn` migrated 2026-07-26**: home FritzBox reconfigured with the new `vpn` login and confirmed live — after a WAN IP change (real connection recycle, not a test), the access log shows a genuine `Fritz!Box DDNS/1.0.3` request authenticated as `vpn` updating `vpn.dyndns.jayfield.org` to the new IP (`217.229.60.187`), and `dig` confirms the zone picked it up. First host fully off the legacy - fallback. `kack`/`test`/`uschi` still need migrating. + fallback. `uschi`'s device was reconfigured too but hasn't sent a + real authenticated update yet (FritzBox only re-registers on WAN IP + change or manual renew, neither has happened since) — not yet + confirmed live. + **`kack`/`test` removed 2026-07-26** instead of migrated: `kack` + hadn't updated since Feb 2024 and `test` showed no real traffic in + the (short) per-vhost access log history either — both looked like + stale/unused entries rather than active devices, so removed outright + rather than given dedicated logins. Deleted their `A`/`AAAA`/`TXT` + records via `nsupdate` (using the legacy shared key), dropped their + `update-policy` grants and `include` lines from + `named.conf.default-zones`, moved their per-host TSIG key files and + `.htpasswd` entries (`htpasswd -D`) out. Backed up to + `/root/removed-configs-backup/dyndns-remove-kack-test-20260726101439/`. + Validated with `named-checkconf`/`apache2ctl configtest`, applied via + `rndc reload`/`systemctl reload apache2`, confirmed both names now + resolve to nothing (`dig` empty) and `jens`/`uschi`/`vpn` untouched; + `rndc sync` forced the on-disk zone file to reflect it immediately + rather than waiting for BIND's next periodic dump. - [x] **dyndns/default-vhost access logging is a no-op** — done 2026-07-25 found 2026-07-20 while investigating the command injection below.