Intro
I know my old Cisco router only has built-in support for two dynamic DNS services, dyndns.org and TZO.com. Nowadays you have to pay for those, if even they work (the web site domain names seem to have changed, but perhaps they still support the old domain names. Or perhaps not!). Maybe this could be fixed by firmware upgrades (to hopefully get more choices and hopefully a free one, or a newer router, or running DD-WRT. I didn’t do any of those things. Being a network person at heart, I wrote my own. I found the samples out there on the Internet needed some updating, so I am sharing my recipe. I didn’t think it was too hard to pull off.
What I used
– GoDaddy DNS hosting (basically any will do)
– my Amazon AWS virtual server running CentOS, where I have sudo access
– my home Raspberry Pi
– a tiny bit of php programming
– my networking skills for debugging
As I have prior experience with all these items this project was right up my alley.
Delegating our DDNS domain from GoDaddy
Just create a nameserver record from the domain, say drj.com, called, say, raspi, which you delegate to your AWS server. Following the example, the subdomain would be raspi.drj.com whose nameserver is drj.com.
DNS Setup on an Amazon AWS server
/etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
options {
// listen-on port 53 { 127.0.0.1; };
// listen-on port 53;
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };
recursion no;
dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
include "/var/named/dynamic.conf";
include "/etc/named.root.key"; |
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
options {
// listen-on port 53 { 127.0.0.1; };
// listen-on port 53;
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };
recursion no;
dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
include "/var/named/dynamic.conf";
include "/etc/named.root.key";
/var/named/dynamic.conf
zone "raspi.drj.com" {
type master;
file "/var/named/db.raspi.drj.com";
// designed to work with nsupdate -l used on same system - DrJ 10/2016
// /var/run/named/session.key
update-policy local;
}; |
zone "raspi.drj.com" {
type master;
file "/var/named/db.raspi.drj.com";
// designed to work with nsupdate -l used on same system - DrJ 10/2016
// /var/run/named/session.key
update-policy local;
};
/var/named/db.raspi.drj.com
$ORIGIN .
$TTL 1800 ; 30 minutes
raspi.drj.com IN SOA drj.com. postmaster.drj.com. (
2016092812 ; serial
1700 ; refresh (28 minutes 20 seconds)
1700 ; retry (28 minutes 20 seconds)
1209600 ; expire (2 weeks)
600 ; minimum (10 minutes)
)
NS drj.com.
$TTL 3600 ; 1 hour
A 125.125.73.145 |
$ORIGIN .
$TTL 1800 ; 30 minutes
raspi.drj.com IN SOA drj.com. postmaster.drj.com. (
2016092812 ; serial
1700 ; refresh (28 minutes 20 seconds)
1700 ; retry (28 minutes 20 seconds)
1209600 ; expire (2 weeks)
600 ; minimum (10 minutes)
)
NS drj.com.
$TTL 3600 ; 1 hour
A 125.125.73.145
Named re-starting program
Want to make sure your named restarts if it happens to die? nanny.pl is a good, simple monitor to do that. Here is the version I use on my server. Note the customized variables towards the top.
#!/usr/bin/perl
#
# Copyright (C) 2004, 2007, 2012 Internet Systems Consortium, Inc. ("ISC")
# Copyright (C) 2000, 2001 Internet Software Consortium.
#
# Permission to use, copy, modify, and/or distribute this software for any
# purpose with or without fee is hereby granted, provided that the above
# copyright notice and this permission notice appear in all copies.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.
# $Id: nanny.pl,v 1.11 2007/06/19 23:47:07 tbox Exp $
# A simple nanny to make sure named stays running.
$pid_file_location = '/var/run/named/named.pid';
$nameserver_location = 'localhost';
$dig_program = 'dig';
$named_program = '/usr/sbin/named -u named';
fork() && exit();
for (;;) {
$pid = 0;
open(FILE, $pid_file_location) || goto restart;
$pid = <FILE>;
close(FILE);
chomp($pid);
$res = kill 0, $pid;
goto restart if ($res == 0);
$dig_command =
"$dig_program +short . \@$nameserver_location > /dev/null";
$return = system($dig_command);
goto restart if ($return == 9);
sleep 30;
next;
restart:
if ($pid != 0) {
kill 15, $pid;
sleep 30;
}
system ($named_program);
sleep 120;
} |
#!/usr/bin/perl
#
# Copyright (C) 2004, 2007, 2012 Internet Systems Consortium, Inc. ("ISC")
# Copyright (C) 2000, 2001 Internet Software Consortium.
#
# Permission to use, copy, modify, and/or distribute this software for any
# purpose with or without fee is hereby granted, provided that the above
# copyright notice and this permission notice appear in all copies.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.
# $Id: nanny.pl,v 1.11 2007/06/19 23:47:07 tbox Exp $
# A simple nanny to make sure named stays running.
$pid_file_location = '/var/run/named/named.pid';
$nameserver_location = 'localhost';
$dig_program = 'dig';
$named_program = '/usr/sbin/named -u named';
fork() && exit();
for (;;) {
$pid = 0;
open(FILE, $pid_file_location) || goto restart;
$pid = <FILE>;
close(FILE);
chomp($pid);
$res = kill 0, $pid;
goto restart if ($res == 0);
$dig_command =
"$dig_program +short . \@$nameserver_location > /dev/null";
$return = system($dig_command);
goto restart if ($return == 9);
sleep 30;
next;
restart:
if ($pid != 0) {
kill 15, $pid;
sleep 30;
}
system ($named_program);
sleep 120;
}
The PHP updating program myip-update.php
<?php
# DrJ: lifted from http://pablohoffman.com/dynamic-dns-updates-with-a-simple-php-script
# but with some security improvements
# 10/2016
# PHP script for very simple dynamic DNS updates
#
# this script was published in http://pablohoffman.com/articles and
# released to the public domain by Pablo Hoffman on 27 Aug 2006
# CONFIGURATION BEGINS -------------------------------------------------------
# define password here
$mysecret = 'myBigFatsEcreT';
# CONFIGURATION ENDS ---------------------------------------------------------
$ip = $_SERVER['REMOTE_ADDR'];
$host = $_GET['host'];
$secret = $_POST['secret'];
$zone = $_GET['zone'];
$tmpfile = trim(`mktemp /tmp/nsupdate.XXXXXX`);
if ((!$host) or (!$zone) or (!($mysecret == $secret))) {
echo "FAILED";
unlink($tmpfile);
exit;
}
$oldip = trim(`dig +short $host.$zone @localhost`);
if ($ip == $oldip) {
echo "UNCHANGED. ip: $ip\n";
unlink($tmpfile);
exit;
}
echo "$ip - $oldip";
$nsucmd = "update delete $host.$zone A
update add $host.$zone 3600 A $ip
send
";
$fp = fopen($tmpfile, 'w');
fwrite($fp, $nsucmd);
fclose($fp);
`sudo nsupdate -l $tmpfile`;
unlink($tmpfile);
echo "OK ";
echo `date`;
?> |
<?php
# DrJ: lifted from http://pablohoffman.com/dynamic-dns-updates-with-a-simple-php-script
# but with some security improvements
# 10/2016
# PHP script for very simple dynamic DNS updates
#
# this script was published in http://pablohoffman.com/articles and
# released to the public domain by Pablo Hoffman on 27 Aug 2006
# CONFIGURATION BEGINS -------------------------------------------------------
# define password here
$mysecret = 'myBigFatsEcreT';
# CONFIGURATION ENDS ---------------------------------------------------------
$ip = $_SERVER['REMOTE_ADDR'];
$host = $_GET['host'];
$secret = $_POST['secret'];
$zone = $_GET['zone'];
$tmpfile = trim(`mktemp /tmp/nsupdate.XXXXXX`);
if ((!$host) or (!$zone) or (!($mysecret == $secret))) {
echo "FAILED";
unlink($tmpfile);
exit;
}
$oldip = trim(`dig +short $host.$zone @localhost`);
if ($ip == $oldip) {
echo "UNCHANGED. ip: $ip\n";
unlink($tmpfile);
exit;
}
echo "$ip - $oldip";
$nsucmd = "update delete $host.$zone A
update add $host.$zone 3600 A $ip
send
";
$fp = fopen($tmpfile, 'w');
fwrite($fp, $nsucmd);
fclose($fp);
`sudo nsupdate -l $tmpfile`;
unlink($tmpfile);
echo "OK ";
echo `date`;
?>
In the above file I added the “sudo” after awhile. See explanation further down below.
Raspberry Pi requirements
I’ve assumed you can run your Pi 24 x 7 and constantly and consistently on your network.
Crontab entry on the Raspberry Pi
Edit the crontab file for periodically checking your IP on the Pi and updating external DNS if it has changed by doing this:
$ crontab ‐e
and adding the line below:
# my own method of dynamic update - DrJ 10/2016
0,10,20,30,40,50 * * * * /usr/bin/curl -s -k -d 'secret=myBigFatsEcreT' 'https://drj.com/myip-update.php?host=raspi&zone=drj.com' >> /tmp/ddns 2>&1 |
# my own method of dynamic update - DrJ 10/2016
0,10,20,30,40,50 * * * * /usr/bin/curl -s -k -d 'secret=myBigFatsEcreT' 'https://drj.com/myip-update.php?host=raspi&zone=drj.com' >> /tmp/ddns 2>&1
A few highlights
Note that I’ve switched to use of nsupdate -l on the local server. This will be more secure than the previous solution which suggested to have updates from localhost. As far as I can tell localhost updates can be spoofed and so should be considered insecure in a modern infrastructure. I learned a lot by running nsupdate -D -l on my AWS server and observing what happens.
And note that I changed the locations of the secret. The old solution had the secret embedded in the URL in a GET statement, which means it would also be embedded in every single request in the web server’s access file. That’s not a good idea. I switched it to a POSTed variable so that it doesn’t show up in the web server’s access file. This is done with the -d switch of curl.
Contents of temporary file
Here are example contents. This is useful when you’re trying to run nsupdate from the command line.
update delete raspi.drj.com A
update add raspi.drj.com 3600 A 51.32.108.37
send |
update delete raspi.drj.com A
update add raspi.drj.com 3600 A 51.32.108.37
send
Permissions problems
If you see something like this on your DNS server:
$ ll /var/run/named
total 8
-rw-r--r-- 1 named www-data 6 Nov 6 03:15 named.pid
-rw------- 1 named www-data 102 Oct 24 09:42 session.key |
total 8
-rw-r--r-- 1 named www-data 6 Nov 6 03:15 named.pid
-rw------- 1 named www-data 102 Oct 24 09:42 session.key
your attempt to run nsupdate by your web server will be foiled and produce something like this:
$ /usr/bin/nsupdate ‐l /tmp/nsupdate.LInUmo
06-Nov-2016 17:14:14.780 none:0: open: /var/run/named/session.key: permission denied
can't read key from /var/run/named/session.key: permission denied |
06-Nov-2016 17:14:14.780 none:0: open: /var/run/named/session.key: permission denied
can't read key from /var/run/named/session.key: permission denied
The solution may be to permit group read permission:
$ cd /var/run/named; sudo chmod g+r session.key
and make the group owner of the file your webserver user ID (which I’ve already done here). I’m still working this part out…
That approach doesn’t seem to “stick,” so I came up with this other approach. Put your web server user in sudoers to allow it to run nsupdate (my web server user is www-data for these examples):
Cmnd_Alias NSUPDATE = /usr/bin/nsupdate
# allow web server to run nsupdate
www-data ALL=(root) NOPASSWD: NSUPDATE |
Cmnd_Alias NSUPDATE = /usr/bin/nsupdate
# allow web server to run nsupdate
www-data ALL=(root) NOPASSWD: NSUPDATE
But you may get the dreaded
sudo: sorry, you must have a tty to run sudo |
sudo: sorry, you must have a tty to run sudo
if you manage to figure out how to turn on debugging.
So if your sudoers has a line like this:
you will need lines like this:
# turn of tty requirements only for www-data user
Defaults:www-data !requiretty |
# turn of tty requirements only for www-data user
Defaults:www-data !requiretty
Debugging
Of course for debugging I commented out the unlink line in the PHP update file and ran the
nsupdate -l /tmp/nsupdate.xxxxx
by hand as user www-data.
During some of the errors I worked through that wasn’t verbose enough so I added debugging arguments:
$ nsupdate ‐D ‐d ‐l /tmp/nsupdate.xxxxx
When that began to work, yet when called via the webserver it wasn’t working, I ran the above command from within PHP, recording the output to a file:
...
`sudo nsupdate -d -D -l $tmpfile > /tmp/nsupdate-debug 2>&1` |
...
`sudo nsupdate -d -D -l $tmpfile > /tmp/nsupdate-debug 2>&1`
That turned out to be extremely informative.
Conclusion
We have shown how to combine a bunch of simple networking tools to create your own DDNS service. The key elements are a Raspberry Pi and your own virtual server at Amazon AWS. We have built upon previous published solutions to this problem and made them more secure in light of the growing sophistication of the bad guys. Let me know if there is interest in an inexpensive commercial service.
References and related
nanny.pl write-up: https://www.safaribooksonline.com/library/view/dns-bind/0596004109/ch05s09.html
