floridavilla.blogg.se - Dyn updater linux command line

#DYN UPDATER LINUX COMMAND LINE HOW TO#
#DYN UPDATER LINUX COMMAND LINE INSTALL#
#DYN UPDATER LINUX COMMAND LINE UPDATE#
#DYN UPDATER LINUX COMMAND LINE FULL#
#DYN UPDATER LINUX COMMAND LINE PASSWORD#

# key: the URL path that the client script invokes Import sys import subprocess import ipaddress # secret path mapping

#DYN UPDATER LINUX COMMAND LINE FULL#

The IP address belonging to the new record is extracted from the HTTP request environment, so the client script does not have to include it in the request body.īelow is the full code with comments, extended with the ability to deal with multiple dynamic subdomains. If we would not delete the old record, we would just accumulate a list of historic IP addresses, since DNS records do not have to be unique.

Zone selection ( ., note the trailing dot).

DNS server secret (the one generated by keymgr above).

This is an executable binary, so we use the Python function n.

#DYN UPDATER LINUX COMMAND LINE UPDATE#

When the URL has been validated, the script needs to generate a DNS update request and send it to Knot via the command knsupdate.

#DYN UPDATER LINUX COMMAND LINE PASSWORD#

I used my password manager to generate a random alphanumeric string. To keep things simple, secret URL paths will do. To prevent unauthorized use, we can utilize multiple techniques, ranging from HTTP Basic Authentication to client certificates. It is important that the script only accepts update requests from legitimate clients. The Python script will reside at /var/Thanks to the WSGIScriptAlias directive in the Apache configuration, all requests below will be routed to that script. $ certbot -d -apacheĪctually deploy the client and server side scripts that process update requests.Īs you may have guessed from the above configuration, I have used Python and WSGI. Turns out, each zone needs to start with a SOA record (“Start of Authority”). It took me a while to figure out the basic configuration in the zone file. When Knot receives a query for a domain, it looks for the entries in that zone file. In the definition I configure the storage directory /var/lib/knot together with the file pattern that means that the zone file has the full path /var/lib/knot/. The default template is called, well, default, and is applied automatically to all zones that do not specify another template. While it is possible to define it without using a zone template, I put it here because you may have additional zones you want to serve (like me) and it quickly becomes confusing without using templates. Make sure to give the same key name in acl.key as in key.id.Īgain, the ACL identifier can be chosen arbitrarily. Next we need to declare an access control list to allow local updates to the zone. Paste the key section into the config and ignore the comment for now, which contains the same secret but in a different format. You can choose any identifier in place of sftdyn. Secret: kFJd7k6xH8FYToPRgJf7AAkiMUmSoiX2aAAvoUSHcttgn7slf2REBNsw8tvvawCYOIpSr3cgEvoa7fpOKpEXNQ= # hmac-sha512:sftdyn:kFJd7k6xH8FYToPRgJf7AAkiMUmSoiX2aAAvoUSHcttgn7slf2REBNsw8tvvawCYOIpSr3cgEvoa7fpOKpEXNQ=

Here it is in its entirety, which I will explain in detail below: The configuration file sits at /etc/knot/nf.īy default, it is quite small, and we have to extend it substantially.

#DYN UPDATER LINUX COMMAND LINE INSTALL#

We start with choosing a DNS server software.įor me, Knot DNS fit the bill, and I installed it with apt install knot on an Ubuntu machine.

add a cronjob to the local clients to make HTTP requests to the web server.

on the same DNS server also install a web server that processes updates, and.

make sure that the parent zone (here: domain.tld) contains an NS record pointing to the server,.

install a DNS server that is authoritative for a subdomain (here: ) of some domain,.

There did not seem to be any off-the-shelf solution for this use case whose popularity I had underestimated.Īnyhow, nothing a bit of glue, duct tape, and Python can’t fix.īut note that I did not want to wrangle DNSSEC, so I’m conveniently leaving that part out. While browsing the web for possible existing implementations, I quickly realized that while there are tons of DNS server implementations, I actually had to build my own script to update the configuration. The configuration is maintained manually.Īlso, a dynamic DNS server obviously needs to have a stable IP address, so I had to resort to use a virtual machine somewhere in a datacenter. I already have a local DNS server running, but I used it for recursive lookups and ad-blocking purposes.

I found the existing providers I had used in the past to be annoying.

In order to reach my home server from the outside, I decided to build my own dynamic DNS service.

#DYN UPDATER LINUX COMMAND LINE HOW TO#

How to build your own personal DynDNS serviceĬonsumer-grade internet subscriptions typically come with NAT and dynamically-assigned IP addresses. How to build your own personal DynDNS service Lars Hupel.