Update README.md
This commit is contained in:
34
README.md
34
README.md
@@ -2,7 +2,7 @@
|
|||||||
|
|
||||||
## Motivation
|
## Motivation
|
||||||
|
|
||||||
Due to hosting my nginx webserver at home my IP is subject to change as my isp does not afford me a static one
|
Due to hosting my Nginx webserver at home my IP is subject to change as my ISP does not afford me a static one
|
||||||
|
|
||||||
Said webserver hosts tobiastime.xyz and the pages you are currently viewing
|
Said webserver hosts tobiastime.xyz and the pages you are currently viewing
|
||||||
|
|
||||||
@@ -10,7 +10,7 @@ Initially I wanted to create a Bash script to interact with Namecheap's API allo
|
|||||||
|
|
||||||
However Namecheap charges $50 to interact with their API, and I have heard even if you cough up the money it is very poor and limited
|
However Namecheap charges $50 to interact with their API, and I have heard even if you cough up the money it is very poor and limited
|
||||||
|
|
||||||
Consequently I began to run my own nameservers (ns1/2.tobiastime.xyz) for full autonomy and control over my domain utilizing PowerDNS as the backend
|
Consequently I began to run my own nameservers (ns1/2.tobiastime.xyz) on headless Debian, with PowerDNS, for full autonomy and control over my domain utilizing PowerDNS as the backend
|
||||||
|
|
||||||
|
|
||||||
## Dependencies
|
## Dependencies
|
||||||
@@ -27,7 +27,7 @@ However persistently storing the password to a protected key in non-volatile mem
|
|||||||
|
|
||||||
Consequently I generated a new SSH key without password protection and linked it to a user with nologin shell
|
Consequently I generated a new SSH key without password protection and linked it to a user with nologin shell
|
||||||
|
|
||||||
Said user is appropriately named jaileduser and their sole purpose is to transfer the public IP of my NGINX server to my master nameserver
|
Said user is appropriately named jaileduser and their sole purpose is to transfer the public IP of my Nginx server to my master nameserver
|
||||||
|
|
||||||
## Set up on the nameserver
|
## Set up on the nameserver
|
||||||
|
|
||||||
@@ -37,7 +37,7 @@ Create jaileduser as a system user
|
|||||||
useradd -r -s /usr/sbin/nologin jaileduser
|
useradd -r -s /usr/sbin/nologin jaileduser
|
||||||
```
|
```
|
||||||
|
|
||||||
Create jaileduser's home directory and give root ownership
|
If it hasn't been automatically created, then create jaileduser's home directory and give root ownership
|
||||||
|
|
||||||
Root must be given ownership due to chroot modifications we will make in the SSH config
|
Root must be given ownership due to chroot modifications we will make in the SSH config
|
||||||
|
|
||||||
@@ -46,13 +46,7 @@ mkdir /home/jaileduser
|
|||||||
chown root:root /home/jaileduser
|
chown root:root /home/jaileduser
|
||||||
```
|
```
|
||||||
|
|
||||||
Then edit their home directory in /etc/passwd so it looks something like
|
Create a subdirectory within jaileduser's home directory where the file storing the public IP of the Nginx server will reside
|
||||||
|
|
||||||
```
|
|
||||||
jaileduser:x:999:999::/home/jaileduser:/usr/sbin/nologin
|
|
||||||
```
|
|
||||||
|
|
||||||
Create a subdirectory within jaileduser's home directory where the file storing the public IP of the NGINX server will reside
|
|
||||||
|
|
||||||
And give jaileduser only read/execute permissions for the directory (no write so they cannot create more files)
|
And give jaileduser only read/execute permissions for the directory (no write so they cannot create more files)
|
||||||
|
|
||||||
@@ -62,7 +56,7 @@ chown jaileduser:jaileduser /home/jaileduser/nginx
|
|||||||
chmod 500 /home/jaileduser/nginx
|
chmod 500 /home/jaileduser/nginx
|
||||||
```
|
```
|
||||||
|
|
||||||
Create the file within that directory with which the public IP of the nginx server will be stored
|
Create the file within that directory with which the public IP of the Nginx server will be stored
|
||||||
|
|
||||||
Then give jaileduser read and write permissions for the file so it can be modified via SFTP
|
Then give jaileduser read and write permissions for the file so it can be modified via SFTP
|
||||||
|
|
||||||
@@ -79,7 +73,7 @@ Lastly we generate the SSH key for jaileduser so it can be used to authenticate
|
|||||||
|
|
||||||
And create the appropriate files within jaileduser's home directory
|
And create the appropriate files within jaileduser's home directory
|
||||||
|
|
||||||
The private key will need to be transfered and stored onto the nginx server
|
The private key will need to be transfered and stored onto the Nginx server
|
||||||
|
|
||||||
```
|
```
|
||||||
mkdir /home/jaileduser/.ssh
|
mkdir /home/jaileduser/.ssh
|
||||||
@@ -114,16 +108,16 @@ In reference to the above changes
|
|||||||
|
|
||||||
- The rest are standardized deny permissions to further bolster security and prevent jaileduser bypassing the restrictions in place
|
- The rest are standardized deny permissions to further bolster security and prevent jaileduser bypassing the restrictions in place
|
||||||
|
|
||||||
With all of this done the preliminary steps are complete and we can place the scripts on the nginx server and nameserver
|
With all of this done the preliminary steps are complete and we can place the scripts on the Nginx server and nameserver
|
||||||
|
|
||||||
## Script ran on NGINX server to send public IP to nameserver:
|
## Script ran on Nginx server to send public IP to nameserver:
|
||||||
|
|
||||||
```
|
```
|
||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
|
|
||||||
#define path to private key
|
#define path to private key
|
||||||
keypath=/path/to/jailed/key
|
keypath=/path/to/jailed/key
|
||||||
#define where you want your publicip file to be stored on the nginx server
|
#define where you want your publicip file to be stored on the Nginx server
|
||||||
thetext=/home/user/publicip
|
thetext=/home/user/publicip
|
||||||
|
|
||||||
ip1=$(curl icanhazip.com 2>/dev/null)
|
ip1=$(curl icanhazip.com 2>/dev/null)
|
||||||
@@ -177,7 +171,7 @@ echo -e "Subject: domain.name updated A record\nYour home ip has changed!" | ssm
|
|||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
#though we made sure on the nginx server not to send the file if it was empty
|
#though we made sure on the Nginx server not to send the file if it was empty
|
||||||
#we will implement a double check here for redundancy
|
#we will implement a double check here for redundancy
|
||||||
#only run the following *if* homeip is not empty
|
#only run the following *if* homeip is not empty
|
||||||
|
|
||||||
@@ -202,15 +196,15 @@ Finally we need to schedule these scripts to automatically run using cronjobs
|
|||||||
|
|
||||||
I will configure the DDNS to run its check once every hour matching up with the 3600 TTL
|
I will configure the DDNS to run its check once every hour matching up with the 3600 TTL
|
||||||
|
|
||||||
This means the public ip of the nginx server at home will be checked and the record will be changed if needed every hour
|
This means the public ip of the Nginx server at home will be checked and the record will be changed if needed every hour
|
||||||
|
|
||||||
I have made a 2 minute gap between when the IP sending script runs on the NGINX server and when the record updating script runs on the nameserver
|
I have made a 2 minute gap between when the IP sending script runs on the Nginx server and when the record updating script runs on the nameserver
|
||||||
|
|
||||||
This is to afford time for transferring the files and in case the dig fall back method runs, which first waits for 60 seconds
|
This is to afford time for transferring the files and in case the dig fall back method runs, which first waits for 60 seconds
|
||||||
|
|
||||||
By default without further permission modifications root must run the script on the nameserver as root is required to modify the SQLite3 database PowerDNS utilizes
|
By default without further permission modifications root must run the script on the nameserver as root is required to modify the SQLite3 database PowerDNS utilizes
|
||||||
|
|
||||||
In /etc/crontab for the nginx server place:
|
In /etc/crontab for the Nginx server place:
|
||||||
|
|
||||||
```
|
```
|
||||||
0 * * * * youruser /path/to/ip/sending/script
|
0 * * * * youruser /path/to/ip/sending/script
|
||||||
|
|||||||
Reference in New Issue
Block a user