search

ydns / bash-updater

YDNS Bash Updater Script
GNU General Public License v3.0
80 stars 43 forks source link

Duplicate name over a domain #15

Open marcorighi opened 9 years ago

marcorighi commented 9 years ago

Hi, with my account I have registered the host name in the domain ydns.eu. After that, I tried to contact my host dream.ydns.eu. The contact failed. The dnslookup dream.ydns.eu answered providing more IP for my computer. I suppose that is was due to a duplicated host name in the domain ydns.eu. Do you check the unicity property for each hostname+domain?

rnhmjoj commented 9 years ago

I have the same issue. In my case there are 2 records associated with the domain. One is correct and the other is the one before the last update. So many times I end up on someone else host.

commx commented 9 years ago

This should not be possible. Hosts are unique and bound to a specific user account. That means if you have for example "a.ydns.eu" then nobody else than you will be able to create hosts and records for "a.ydns.eu". Records are bound to hosts - you should never be able to alter records of a host you don't own. However, I'll verify if this works as expected tonight.

marcorighi commented 9 years ago

Hi, some mounth ago I tried to registry dream.ydns.eu. After some test I noticed that the registered IP of my host (associated to dream.ydns.eu) was different from the IP of my host.

I changed the name of my host in ddd.ydns.eu and dream.ydns.eu was still pingable (now it is still pingable).

So, with my account I recorded a name of a hos that was in use by another user.

Write me if I can help you.

Thanks in advance Marco

Il 14/01/2015 15:29, Christian Jurk ha scritto:

This should not be possible. Hosts are unique and bound to a specific user account. That means if you have for example "a.ydns.eu" then nobody else than you will be able to create hosts and records for "a.ydns.eu". Records are bound to hosts - you should never be able to alter records of a host you don't own. However, I'll verify if this works as expected tonight.

— Reply to this email directly or view it on GitHub https://github.com/commx/ydns/issues/15#issuecomment-69923247.

Think Marco, think different web site:http://www.di.unipi.it/~righi/

rnhmjoj commented 9 years ago

@commx You didn't understand. I mean there are two dinstinct A records in the domain. One record has the current address and the other has the previous IP address I had. Since I have a dynamic IP address the old one is usually reassigned to someone else. It happened several times that the browser or ssh client picked the wrong A record and tried to connect to the old address. If it's not in use or there is not such service on that host, after the timeout, the other record is picked and succefully connects however it happened I ended up on someone else's router configuration page.

rnhmjoj commented 9 years ago

@marcorighi I scanned some of the existing level 3 domains for ydns.eu and made a list. I tried adding some of those to my account. For some I got "The specified address is already taken" I could take backup.ydns.eu server.ydns.eu example.ydns.eu security.ydns.eu and many others (I kept the same A record not to breaks things in case these are actually in use.). I don't know if those are expired but they all have valid records set (I checked with dig).

@commx Can you verify?

rnhmjoj commented 9 years ago

@commx Hey?

commx commented 9 years ago

@marcorighi Of course, "dream.ydns.eu" currently has two A records, but with the same content. How did you update? Using the API (any updater client) or via the web page?

@Rnhmjoj What steps did you do to accomplish this, so I can reproduce the scenario?

marcorighi commented 9 years ago

Il 05/02/2015 22:25, Christian Jurk ha scritto:

@marcorighi https://github.com/marcorighi Of course, "dream.ydns.eu" currently has two A records, but with the same content. How did you update? Using the API (any updater client) or via the web page? Hi, I have a laptop that I call dream but I was not able to use dream.ydns.eu. When I tried to use this name I noticed that it was already in use so I register my laptop using another name. In other words, after my update there was the IP of another computer (not my laptop IP) associated to the name dream.ydns.eu.

In order to update my IP I perform an test an I require an update only if the IP has changed. I use cron and a couple of script.

Cron: /5 * * * \ /root/Script/check_and_update_ip.sh # ydns updater

check_and_update_ip.sh:

!/bin/bash

export log_ip_history=/root/log/ip_history.log export log_ip_last=/root/log/ip_last.log

function myip { ip=$(lwp-request -o text checkip.dyndns.org | awk '{ print $NF }') }

myip

echo "+++++" >> $log_ip_history echo $(date) >> $log_ip_history echo $ip >> $log_ip_history

touch $log_ip_last

old_ip=$(less $log_ip_last)

if [ "$ip" != "$old_ip" ] then source /root/Script/updater.sh echo "update command sent" >> $log_ip_history echo $ip > $log_ip_last else echo "ip already updated" >> $log_ip_history fi

updater.sh:

!/bin/bash

#

yDNS Updater, updates your yDNS host.

Copyright (C) 2013 Christian Jurk cj@ydns.eu

#

This program is free software: you can redistribute it and/or modify

it under the terms of the GNU General Public License as published by

the Free Software Foundation, either version 3 of the License, or

(at your option) any later version.

#

This program is distributed in the hope that it will be useful,

but WITHOUT ANY WARRANTY; without even the implied warranty of

MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

GNU General Public License for more details.

#

You should have received a copy of the GNU General Public License

along with this program. If not, see http://www.gnu.org/licenses/.

Define your yDNS account details and host you'd like to update.

YDNS_USER="marco.righi@gmail.com" YDNS_PASSWD="XXXXXXXXXXXXX" YDNS_HOST="XXXXXXXXXXXXXXXX.ydns.eu"

Don't change anything below.

if ! hash curl 2>/dev/null; then echo "ERROR: cURL is missing." exit 1 fi

if this fails with error 60 your certificate store does not contain

the certificate,

either add it or use -k (disable certificate check

ret=curl --basic \ -u "$YDNS_USER:$YDNS_PASSWD" \ --silent \ https://ydns.eu/api/v1/update/?host=$YDNS_HOST

if [ "$ret" != "ok" ]; then echo "Update failed: $ret" exit 90 fi

That's all. Do you have a dream.ydns.eu updated using my account?

Thanks a lot Marco

rnhmjoj commented 9 years ago

@commx I used a tool to get a list the existing subdomains of ydns.eu and then I tried adding some of them to my account, but if you own ydns.eu you should already know what the subdomains are. I could get several hostnames that already had information registered by some other users. I have just tried again now with these: chat.ydns.eu about.ydns.eu ssh.ydns.eu t.ydns.eu I don't know if these hostname I could add to my account were just expired/old but still valid or actually someone else's still in use. Can you verify?

Anyway the problem with my hostname basically is this one: hostname I set one A record for one hostname but I end up having 2:

$ host maxwell.ydns.eu
maxwell.ydns.eu has address 87.4.91.2
maxwell.ydns.eu has address 79.10.87.13

The first address is the current one, the second is the previous dynamic ip I had before the last update. There should be only one address associated with my hostname and this is causing problems with several applications.

rnhmjoj commented 9 years ago

I'm sorry to bother you but this problem is causing me lots of problems. Could you look into it?

commx commented 9 years ago

@Rnhmjoj I was finally able to find out what's going on. There were loads of orphaned records with unassigned hosts in the database. I deleted those records. However, I wasn't able to locate the cause for this yet, so I'll keep this ticket open until I can provide a permanent fix.

rnhmjoj commented 9 years ago

Ok, thank you.

Gathis commented 9 years ago

This service appears completely broken at the moment. I added a host mac.ydns.com with no errors, but found 'nslookup mac.ydns.com' returning both my IP and the IP of someone in australia (I am in the UK). As I didn't want to upset this antipodean user I removed my host addition. Next I added a new more unique .ydns.com and confirmed only MY IP was returned by nslookup. Then via a tor browser session and a completely different sign-in email address and password, I was able to assign a new IP (the tor exit nodes IP) to the SAME host i had just added to my real account. I hope you realise this is a serious security issue? A malicious attacker could add new records redirecting traffic to their own IP for MY registered host subdomain. I deleted the 2nd test account, and almost deleted my primary real account. Until this flaw is fixed I cannot use this otherwise nice-looking service.

godDLL commented 7 years ago

I second that opinion, the brokenness. Guess I'll show myself out now.