From 69fe39720ce49a2c385de59903dea512313ae9bc Mon Sep 17 00:00:00 2001 From: ljm42 Date: Tue, 12 Mar 2024 14:17:35 -0700 Subject: [PATCH] Disable UpdateDNS --- emhttp/languages/en_US/helptext.txt | 24 +- emhttp/plugins/dynamix/ManagementAccess.page | 24 +- emhttp/plugins/dynamix/include/UpdateDNS.php | 356 +------------------ etc/rc.d/rc.nginx | 4 - 4 files changed, 20 insertions(+), 388 deletions(-) diff --git a/emhttp/languages/en_US/helptext.txt b/emhttp/languages/en_US/helptext.txt index 8b0d603c8..b878ec9af 100644 --- a/emhttp/languages/en_US/helptext.txt +++ b/emhttp/languages/en_US/helptext.txt @@ -1203,7 +1203,7 @@ SSL certificate. Use this URL to access your server: Note that use of a self-signed SSL certificate will generate a browser warning. -Select **Strict** to enable *exclusive* use of an Unraid.net SSL +Select **Strict** to enable *exclusive* use of a myunraid.net SSL certificate for https access (see **Provision** below). Note that a DNS server must be reachable. @@ -1267,10 +1267,10 @@ To adjust URLs or redirects, see the help text for "Use SSL/TLS". :end :mgmt_certificate_expiration_help: -**Provision** may be used to install a *free* Unraid.net SSL Certificate from +**Provision** may be used to install a *free* myunraid.net SSL Certificate from [Let's Encrypt](https://letsencrypt.org/). -The Unraid.net SSL certificate can be used in two ways. First, +The myunraid.net SSL certificate can be used in two ways. First, having the certificate present enables your server to respond to an alternate URL of the form: @@ -1284,24 +1284,20 @@ set to `*..myunraid.net` thus validating the https connection. You may enable this URL exclusively on your LAN by setting **Use SSL/TLS** to **Strict**. -The second use for an Unraid.net certificate is to enable secure -remote access available through the My Servers plugin feature. Note +The second use for a myunraid.net certificate is to enable secure +remote access available through the Unraid Connect plugin feature. Note that it is possible to use secure remote access in conjunction with insecure local access. -After an Unraid.net SSL Certificate has been installed, two -background services are activated while the server is signed in to unraid.net: - -- *updatedns* - This starts 30 seconds after server reboot has completed and contacts the Lime Technology -DNS service to register the servers local IP address. Thereafter it wakes up every 10 minutes in case -the local IP address has changed. +After a myunraid.net SSL Certificate has been installed, a +background service is activated: - *renewcert* - This starts 60 seconds after server reboot has completed and contacts the Lime Technology -certificate renewal service to determine if your Unraid.net SSL certificate needs to be renewed. +certificate renewal service to determine if your myunraid.net SSL certificate needs to be renewed. Thereafter it wakes up every 24 hours. If within 30 days of expiration, a new certificate is automatically provisioned and downloaded to your server. -**Delete** may be used to delete the Unraid.net certificate file. +**Delete** may be used to delete the myunraid.net certificate file. **nginx certificate handling details** @@ -1309,7 +1305,7 @@ nginx makes use of two certificate files stored on the USB flash boot device:
_unraid_bundle.pem` -- an Unraid.net certificate: `config/ssl/certs/certificate_bundle.pem` +- a myunraid.net certificate: `config/ssl/certs/certificate_bundle.pem` The self-signed SSL certificate file is automatically created when nginx starts; and re-created if the server hostname or local TLD is changed. diff --git a/emhttp/plugins/dynamix/ManagementAccess.page b/emhttp/plugins/dynamix/ManagementAccess.page index 5cd235e18..c381155b0 100644 --- a/emhttp/plugins/dynamix/ManagementAccess.page +++ b/emhttp/plugins/dynamix/ManagementAccess.page @@ -5,8 +5,8 @@ Icon="icon-key" Tag="expeditedssl" --- _(Update DNS)_"); - var failure = function(data) { - var status = data.status; - var obj = data.responseJSON; - var msg = "_(Sorry, an error occurred updating unraid.net DNS records)_. _(The error is)_: "+obj.error+"."; - $(button).prop("disabled", false).html("_(Update DNS)_"); - swal({title:"_(Oops)_",text:msg,type:"error",html:true,confirmButtonText:"_(Ok)_"}); - }; - var success = function(data) { - $(button).prop("disabled", false).html("_(Update DNS)_"); - - swal({title:"",text:"",type:"success",html:true,confirmButtonText:"_(Ok)_"}); - }; - $.post("/webGui/include/UpdateDNS.php",success).fail(failure); -} - function checkPorts(form) { var portsInUse = []; var range = [], list = [], duplicates = []; @@ -429,7 +411,7 @@ _(CA-signed certificate file)_:   -: +: :mgmt_certificate_expiration_help: diff --git a/emhttp/plugins/dynamix/include/UpdateDNS.php b/emhttp/plugins/dynamix/include/UpdateDNS.php index 5c6a350fe..c33893561 100644 --- a/emhttp/plugins/dynamix/include/UpdateDNS.php +++ b/emhttp/plugins/dynamix/include/UpdateDNS.php @@ -1,6 +1,6 @@ 1) && $argv[1] == "-v") { - $verbose = true; - $anon = true; -} -if ($cli && ($argc > 1) && $argv[1] == "-vv") { - $verbose = true; -} -$var = (array)@parse_ini_file('/var/local/emhttp/var.ini'); -$nginx = (array)@parse_ini_file('/var/local/emhttp/nginx.ini'); -$is69 = version_compare(_var($var,'version'),"6.9.9","<"); -$reloadNginx = false; -$dnserr = false; -$icon_warn = "⚠️ "; -$icon_ok = "✅ "; - -$myservers_flash_cfg_path='/boot/config/plugins/dynamix.my.servers/myservers.cfg'; -$myservers = (array)@parse_ini_file($myservers_flash_cfg_path,true); -// ensure some vars are defined here so we don't have to test them later -if (empty($myservers['remote']['apikey'])) { - $myservers['remote']['apikey'] = ""; -} -if (empty($myservers['remote']['wanaccess'])) { - $myservers['remote']['wanaccess'] = "no"; -} -if (empty($myservers['remote']['wanport'])) { - $myservers['remote']['wanport'] = 443; -} -// remoteaccess, externalport if ($cli) { - $remoteaccess = empty($nginx['NGINX_WANFQDN']) ? 'no' : 'yes'; - $externalport = $myservers['remote']['wanport']; -} else { - $remoteaccess = _var($_POST,'remoteaccess','no'); - $externalport = intval(_var($_POST,'externalport',443)); - - if ($remoteaccess != 'yes') { - $remoteaccess = 'no'; - } - - if ($externalport < 1 || $externalport > 65535) { - $externalport = 443; - } - - if ($myservers['remote']['wanaccess'] != $remoteaccess) { - // update the wanaccess ini value - $orig = file_exists($myservers_flash_cfg_path) ? parse_ini_file($myservers_flash_cfg_path,true) : []; - if (!$orig) { - $orig = ['remote' => $myservers['remote']]; - } - $orig['remote']['wanaccess'] = $remoteaccess; - $text = ''; - foreach ($orig as $section => $block) { - $pairs = ""; - foreach ($block as $key => $value) if (strlen($value)) $pairs .= "$key=\"$value\"\n"; - if ($pairs) $text .= "[$section]\n".$pairs; - } - if ($text) file_put_contents($myservers_flash_cfg_path, $text); - // need nginx reload - $reloadNginx = true; - } + exit("success".PHP_EOL); } -$isRegistered = !empty($myservers['remote']['username']); - -// protocols, hostnames, ports -$internalprotocol = 'http'; -$internalport = _var($nginx,'NGINX_PORT'); -$internalhostname = _var($nginx,'NGINX_LANMDNS'); -$externalprotocol = 'https'; -// keyserver will expand *.hash.myunraid.net or add www to hash.unraid.net as needed -$externalhostname = _var($nginx,'NGINX_CERTNAME'); -$isLegacyCert = preg_match('/.*\.unraid\.net$/', _var($nginx,'NGINX_CERTNAME')); -$isWildcardCert = preg_match('/.*\.myunraid\.net$/', _var($nginx,'NGINX_CERTNAME')); -$internalip = _var($nginx,'NGINX_LANIP'); - -if (_var($nginx,'NGINX_USESSL')=='yes') { - // When NGINX_USESSL is 'yes' in 6.9, it could be using either Server_unraid_bundle.pem or certificate_bundle.pem - // When NGINX_USESSL is 'yes' in 6.10, it is is using Server_unraid_bundle.pem - $internalprotocol = 'https'; - $internalport = _var($nginx,'NGINX_PORTSSL'); - if ($is69 && _var($nginx,'NGINX_CERTNAME')) { - // this is from certificate_bundle.pem - $internalhostname = _var($nginx,'NGINX_CERTNAME'); - } -} -if (_var($nginx,'NGINX_USESSL')=='auto') { - // NGINX_USESSL cannot be 'auto' in 6.9, it is either 'yes' or 'no' - // When NGINX_USESSL is 'auto' in 6.10, it is using certificate_bundle.pem - $internalprotocol = 'https'; - $internalport = _var($nginx,'NGINX_PORTSSL'); - // keyserver will expand *.hash.myunraid.net as needed - $internalhostname = _var($nginx,'NGINX_CERTNAME'); -} - -// My Servers version -$plgversion = file_exists("/var/log/plugins/dynamix.unraid.net.plg") ? trim(exec('/usr/local/sbin/plugin version /var/log/plugins/dynamix.unraid.net.plg 2>/dev/null')) - : (file_exists("/var/log/plugins/dynamix.unraid.net.staging.plg") ? trim(exec('/usr/local/sbin/plugin version /var/log/plugins/dynamix.unraid.net.staging.plg 2>/dev/null')) - : 'base-'._var($var,'version')); - -// only proceed when when signed in or when legacy unraid.net SSL certificate exists -if (!$isRegistered && !$isLegacyCert) { - response_complete(406, ['error' => _('Nothing to do')]); -} - -// keyfile -$keyfile = empty($var['regFILE']) ? false : @file_get_contents($var['regFILE']); -if ($keyfile === false) { - response_complete(406, ['error' => _('Registration key required')]); -} -$keyfile = @base64_encode($keyfile); - -// build post array -$post = [ - 'keyfile' => $keyfile, - 'plgversion' => $plgversion -]; -if ($isLegacyCert) { - // sign in not required to maintain local ddns for unraid.net cert - // enable local ddns regardless of use_ssl value - $post['internalip'] = $internalip; - // if host.unraid.net does not resolve to the internalip and DNS Rebind Protection is disabled, disable caching - if (host_lookup_ip(generate_internal_host(_var($nginx,'NGINX_CERTNAME'), $post['internalip'])) != $post['internalip'] && rebindDisabled()) $dnserr = true; -} -if ($isRegistered) { - // if signed in, send data needed to maintain My Servers Dashboard - $post['internalhostname'] = $internalhostname; - $post['internalport'] = $internalport; - $post['internalprotocol'] = $internalprotocol; - $post['remoteaccess'] = $remoteaccess; - $post['servercomment'] = _var($var,'COMMENT'); - $post['servername'] = _var($var,'NAME'); - if ($isWildcardCert) { - // keyserver needs the internalip to generate the local access url - $post['internalip'] = $internalip; - } - if ($remoteaccess == 'yes') { - // include wanip in the cache file so we can track if it changes - $post['_wanip'] = trim(@file_get_contents("https://wanip4.unraid.net/")); - $post['externalhostname'] = $externalhostname; - $post['externalport'] = $externalport; - $post['externalprotocol'] = $externalprotocol; - // if wanip.hash.myunraid.net or www.hash.unraid.net does not resolve to the wanip, disable caching - if (host_lookup_ip(generate_external_host($post['externalhostname'], $post['_wanip'])) != $post['_wanip']) $dnserr = true; - } -} - -// if remoteaccess is enabled in 6.10.0-rc3+ and WANIP has changed since nginx started, reload nginx -if (_var($post,'_wanip') != _var($nginx,'NGINX_WANIP') && version_compare(_var($var,'version'),"6.10.0-rc2",">")) $reloadNginx = true; -// if remoteaccess is currently disabled (perhaps because a wanip was not available when nginx was started) -// BUT the system is configured to have it enabled AND a wanip is now available -// then reload nginx -if ($remoteaccess == 'no' && _var($nginx,'NGINX_WANACCESS') == 'yes' && !empty(trim(@file_get_contents("https://wanip4.unraid.net/")))) $reloadNginx = true; -if ($reloadNginx) { - exec("/etc/rc.d/rc.nginx reload &>/dev/null"); -} - -// maxage is 36 hours -$maxage = 36*60*60; -if ($dnserr || $verbose) $maxage = 0; -$datafile = "/tmp/UpdateDNS.txt"; -$datafiletmp = "/tmp/UpdateDNS.txt.new"; -$dataprev = @file_get_contents($datafile) ?: ''; -$datanew = implode("\n",$post)."\n"; -if ($datanew == $dataprev && (time()-filemtime($datafile) < $maxage)) { - response_complete(204, null, _('No change to report')); -} -file_put_contents($datafiletmp,$datanew); -rename($datafiletmp, $datafile); - -// do not submit the wanip, it will be captured from the submission if needed for remote access -unset($post['_wanip']); - -// report necessary server details to limetech for DNS updates -$ch = curl_init('https://keys.lime-technology.com/account/server/register'); -curl_setopt($ch, CURLOPT_POST, 1); -curl_setopt($ch, CURLOPT_POSTFIELDS, $post); -curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); -$result = curl_exec($ch); -$httpcode = curl_getinfo($ch, CURLINFO_HTTP_CODE); -$error = curl_error($ch); -curl_close($ch); - -if ( ($result === false) || ($httpcode != "200") ) { - // delete cache file to retry submission on next run - @unlink($datafile); - response_complete($httpcode ?? "500", ['error' => $error]); -} - -response_complete($httpcode, $result, _('success')); +header('Content-Type: application/json'); +http_response_code(204); +exit(0); ?> diff --git a/etc/rc.d/rc.nginx b/etc/rc.d/rc.nginx index 9562e13ca..be1d7fc03 100755 --- a/etc/rc.d/rc.nginx +++ b/etc/rc.d/rc.nginx @@ -686,8 +686,6 @@ nginx_reload(){ if nginx_check; then log "Reloading $DAEMON configuration..." kill -HUP $(cat $PID) - # update DNS - php -f /usr/local/emhttp/webGui/include/UpdateDNS.php sleep 3 else log "Invalid configuration, $DAEMON not reloaded" @@ -705,8 +703,6 @@ nginx_renew(){ build_ssl # start unconditionally $NGINX -c $CONF 2>/dev/null - # update DNS - php -f /usr/local/emhttp/webGui/include/UpdateDNS.php } nginx_update(){