From fd4d386108b1127c27dc01c47884c1184c271f8a Mon Sep 17 00:00:00 2001 From: Jens Ahrensfeld Date: Sun, 26 Jul 2026 12:41:11 +0200 Subject: [PATCH] Rotate unused jens dyndns password for hygiene Account has no hostname or key left to act on since the auth-binding fix, but its password predated the whole migration - rotated it via htpasswd -b. Verified new password works, old one is rejected, and the account is still fully inert for DNS updates either way. Co-Authored-By: Claude Sonnet 5 --- TODO.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/TODO.md b/TODO.md index cbd034f..18232da 100644 --- a/TODO.md +++ b/TODO.md @@ -173,6 +173,15 @@ Nothing here is urgent; all are low-risk, no-downtime changes. `vpn` have now each been confirmed live across a real IP change with their own dedicated login; this item is fully done, nothing further to track. + **`jens` password rotated 2026-07-26**: since the account is now + unused (no hostname or key left to act on) and its old password + predates this whole migration, rotated it for hygiene via + `htpasswd -b`. Old `.htpasswd` backed up to + `/root/removed-configs-backup/dyndns-jens-rotate-20260726124040/`. + Verified: new password authenticates fine (`200`), old password now + gets `401`, and — as expected since the fix — even a successful + `jens` login still can't perform any DNS update (`badauth`). Account + kept around (not asked to remove it), but fully inert either way. - [x] **dyndns/default-vhost access logging is a no-op** — done 2026-07-25 found 2026-07-20 while investigating the command injection below.