jens/docs-alpha.jayfield.org
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove stale jens.dyndns.jayfield.org hostname, keep jens login active

Browse Source 
Same treatment as kack/test: no device had actually updated jens's own
record since Feb 2024. Removed the DNS record and its dedicated
update-policy grant/key, but deliberately kept the jens login and the
legacy shared-key fallback grant in place, since uschi's device still
depends on it. Re-verified the jens->uschi fallback path still works
after the change.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
jens
2026-07-26 10:20:31 +02:00
co-authored by Claude Sonnet 5
parent e64f152d31
commit e82bcb15da
1 changed files with 17 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
TODO.md
+17
View File
@@ -113,6 +113,23 @@ Nothing here is urgent; all are low-risk, no-downtime changes.
resolve to nothing (`dig` empty) and `jens`/`uschi`/`vpn` untouched; resolve to nothing (`dig` empty) and `jens`/`uschi`/`vpn` untouched;
`rndc sync` forced the on-disk zone file to reflect it immediately `rndc sync` forced the on-disk zone file to reflect it immediately
rather than waiting for BIND's next periodic dump. rather than waiting for BIND's next periodic dump.
**`jens.dyndns.jayfield.org` hostname removed 2026-07-26** — same
story as `kack`: stale since Feb 2024, no device actually updating
it (the only `jens`-authenticated traffic ever seen was the legacy
fallback updating *other* hosts, never its own). Deleted the record,
dropped its dedicated `update-policy` grant and key `include` line,
moved `jens.dyndns.jayfield.org.key` to
`/root/removed-configs-backup/dyndns-remove-jenshost-20260726101844/`.
Important distinction from the `kack`/`test` removal: this only
removed the *hostname*. The `jens` **login** and the legacy shared-key
fallback grant (`grant "dyndns.jayfield.org" subdomain
dyndns.jayfield.org. ANY;`) were deliberately left in place, since
`uschi`'s device still authenticates as `jens` through that fallback
— removing the login would have broken it immediately. Re-verified
after this change (direct `nsupdate()` call as `www-data`, writing
`uschi`'s own current real IP back so nothing actually changed) that
the `jens`→`uschi` legacy path still returns `0`. `named-checkconf`/
`rndc reload` clean throughout.
- [x] **dyndns/default-vhost access logging is a no-op** — done 2026-07-25 - [x] **dyndns/default-vhost access logging is a no-op** — done 2026-07-25
found 2026-07-20 while investigating the command injection below. found 2026-07-20 while investigating the command injection below.