Sebastian Korotkiewicz
Posted on July 13, 2020
Tasks
We have example.com server with bing9 server.
At home we have a server with dynamic IP.
Pin the dynamic IP to your own server. -> home.example.com
Server
The document asserts a working BIND setup already in place. Installing and configuring BIND is out of scope here.
Creating a key-pair
To create a key-pair, we'll be using dnssec-keygen.
server$ dnssec-keygen -a HMAC-SHA512 -b 512 -n USER home.example.com.
This creates two files, which will be named differently based on individual runs.
server$ file Khome.example.com.+157+62567.*
Khome.example.com.+157+62567.key: ASCII text
Khome.example.com.+157+62567.private: ASCII text
Notice that the Key: field in the .private file is simply the concatenated key from the .key file.
Key File
Next created a key file at /etc/bind/keys.conf.
key home.example.com. {
algorithm HMAC-SHA512;
secret "Mprj8I76jDiEldj3SgF7/Ph5bWm4eHYZu0nOcUB1vT4wU5PjbYNnp8T9 cb8XqmE0ANotnw+FBBbr3lA8O5uJ8A==";
};
Then add the following line to /etc/bind/named.conf.local to include the new key.
include "/etc/bind/keys.conf";
Dynamic Zone
The key is situated on the server, all that remains is to add a zone for BIND. This is my entry further down in /etc/bind/named.conf.local:
zone "home.example.com" {
type master;
file "/etc/bind/dyndns/home.example.com";
update-policy {
grant home.example.com. name home.example.com. A TXT;
};
};
We have to create the directory /etc/bind/dyndns, give bind permission to write to it, and place the zone home.example.com there.
server$ sudo mkdir /etc/bind/dyndns
server$ sudo chgrp bind /etc/bind/dyndns
server$ sudo chmod g+w /etc/bind/dyndns
Lastly put the /etc/bind/dyndns/home.example.com file into place.
$ORIGIN .
$TTL 14400 ; 4 hours
home.example.com IN SOA ns1.example.com. root.example.com. (
9 ; serial
604800 ; refresh (1 week)
86400 ; retry (1 day)
2419200 ; expire (4 weeks)
604800 ; minimum (1 week)
)
NS ns1.example.com.
Restart BIND with a simple service bind9 restart and it's time for the client side.
Client
First transfer the .key and .private files down to the client system via your transport mechanism of choice. Once situated, chmod each file to 0400.
-r-------- 1 user user 128 Jan 26 17:58 Khome.example.com.+157+62567.key
-r-------- 1 user user 229 Jan 26 17:58 Khome.example.com.+157+62567.private
Update Script
The nsupdate tool in the dnsutilsddns-scripts_nsupdate package will perform the update. I wrote a simple wrapper script in bash to run the update for me.
#!/bin/bash
# -----------------------------------------------------------
# update the dynamic dns for home system
#
# usage: do-nsupdate
# -----------------------------------------------------------
EXT_IP=$(wget -qO- http://ifconfig.co/ip)
KEY="/path/to/Khome.example.com.+157+62567.private"
cat <<EOF | nsupdate -k "$KEY"
server example.com
zone example.com
update delete home.example.com. A
update add home.example.com. 600 A $EXT_IP
show
send
EOF
Running the do-nsupdate script manually will show whether everything is working correctly.
Sources
Posted on July 13, 2020
Join Our Newsletter. No Spam, Only the good stuff.
Sign up to receive the latest update from our blog.