diff --git a/README.md b/README.md index aeaf6d2..09af1df 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ ## Motivation -Due to hosting my nginx webserver at home my IP is subject to change as my isp does not afford me a static one +Due to hosting my Nginx webserver at home my IP is subject to change as my ISP does not afford me a static one Said webserver hosts tobiastime.xyz and the pages you are currently viewing @@ -10,7 +10,7 @@ Initially I wanted to create a Bash script to interact with Namecheap's API allo However Namecheap charges $50 to interact with their API, and I have heard even if you cough up the money it is very poor and limited -Consequently I began to run my own nameservers (ns1/2.tobiastime.xyz) for full autonomy and control over my domain utilizing PowerDNS as the backend +Consequently I began to run my own nameservers (ns1/2.tobiastime.xyz) on headless Debian, with PowerDNS, for full autonomy and control over my domain utilizing PowerDNS as the backend ## Dependencies @@ -27,7 +27,7 @@ However persistently storing the password to a protected key in non-volatile mem Consequently I generated a new SSH key without password protection and linked it to a user with nologin shell -Said user is appropriately named jaileduser and their sole purpose is to transfer the public IP of my NGINX server to my master nameserver +Said user is appropriately named jaileduser and their sole purpose is to transfer the public IP of my Nginx server to my master nameserver ## Set up on the nameserver @@ -37,7 +37,7 @@ Create jaileduser as a system user useradd -r -s /usr/sbin/nologin jaileduser ``` -Create jaileduser's home directory and give root ownership +If it hasn't been automatically created, then create jaileduser's home directory and give root ownership Root must be given ownership due to chroot modifications we will make in the SSH config @@ -46,13 +46,7 @@ mkdir /home/jaileduser chown root:root /home/jaileduser ``` -Then edit their home directory in /etc/passwd so it looks something like - -``` -jaileduser:x:999:999::/home/jaileduser:/usr/sbin/nologin -``` - -Create a subdirectory within jaileduser's home directory where the file storing the public IP of the NGINX server will reside +Create a subdirectory within jaileduser's home directory where the file storing the public IP of the Nginx server will reside And give jaileduser only read/execute permissions for the directory (no write so they cannot create more files) @@ -62,7 +56,7 @@ chown jaileduser:jaileduser /home/jaileduser/nginx chmod 500 /home/jaileduser/nginx ``` -Create the file within that directory with which the public IP of the nginx server will be stored +Create the file within that directory with which the public IP of the Nginx server will be stored Then give jaileduser read and write permissions for the file so it can be modified via SFTP @@ -79,7 +73,7 @@ Lastly we generate the SSH key for jaileduser so it can be used to authenticate And create the appropriate files within jaileduser's home directory -The private key will need to be transfered and stored onto the nginx server +The private key will need to be transfered and stored onto the Nginx server ``` mkdir /home/jaileduser/.ssh @@ -114,16 +108,16 @@ In reference to the above changes - The rest are standardized deny permissions to further bolster security and prevent jaileduser bypassing the restrictions in place -With all of this done the preliminary steps are complete and we can place the scripts on the nginx server and nameserver +With all of this done the preliminary steps are complete and we can place the scripts on the Nginx server and nameserver -## Script ran on NGINX server to send public IP to nameserver: +## Script ran on Nginx server to send public IP to nameserver: ``` #!/bin/bash #define path to private key keypath=/path/to/jailed/key -#define where you want your publicip file to be stored on the nginx server +#define where you want your publicip file to be stored on the Nginx server thetext=/home/user/publicip ip1=$(curl icanhazip.com 2>/dev/null) @@ -177,7 +171,7 @@ echo -e "Subject: domain.name updated A record\nYour home ip has changed!" | ssm } -#though we made sure on the nginx server not to send the file if it was empty +#though we made sure on the Nginx server not to send the file if it was empty #we will implement a double check here for redundancy #only run the following *if* homeip is not empty @@ -202,15 +196,15 @@ Finally we need to schedule these scripts to automatically run using cronjobs I will configure the DDNS to run its check once every hour matching up with the 3600 TTL -This means the public ip of the nginx server at home will be checked and the record will be changed if needed every hour +This means the public ip of the Nginx server at home will be checked and the record will be changed if needed every hour -I have made a 2 minute gap between when the IP sending script runs on the NGINX server and when the record updating script runs on the nameserver +I have made a 2 minute gap between when the IP sending script runs on the Nginx server and when the record updating script runs on the nameserver This is to afford time for transferring the files and in case the dig fall back method runs, which first waits for 60 seconds By default without further permission modifications root must run the script on the nameserver as root is required to modify the SQLite3 database PowerDNS utilizes -In /etc/crontab for the nginx server place: +In /etc/crontab for the Nginx server place: ``` 0 * * * * youruser /path/to/ip/sending/script