Menu

ddClient (openDNS): Password special character escaping. Causing badauth response

Help
2017-10-08
2018-03-09
  • Mathys J Taljaard

    I spent some time today trying to resolve the following issue

    Oct  8 14:17:47 timex ddclient[22783]: FAILED:   updating ***********: authorization failed (HTTP/1.1 401 Unauthorized
    Oct  8 14:17:47 timex ddclient[22783]: FAILED:    Server: nginx
    Oct  8 14:17:47 timex ddclient[22783]: FAILED:    Date: Sun, 08 Oct 2017 18:17:47 GMT
    Oct  8 14:17:47 timex ddclient[22783]: FAILED:    Content-Type: text/html; charset=UTF-8
    Oct  8 14:17:47 timex ddclient[22783]: FAILED:    Content-Length: 7
    Oct  8 14:17:47 timex ddclient[22783]: FAILED:    Connection: close
    Oct  8 14:17:47 timex ddclient[22783]: FAILED:    WWW-Authenticate: Basic realm="RESTRICTED"
    Oct  8 14:17:47 timex ddclient[22783]: FAILED:    Accept-Ranges: bytes
    Oct  8 14:17:47 timex ddclient[22783]: FAILED:    X-Varnish: 1261054288
    Oct  8 14:17:47 timex ddclient[22783]: FAILED:    Age: 0
    Oct  8 14:17:47 timex ddclient[22783]: FAILED:    Via: 1.1 varnish
    Oct  8 14:17:47 timex ddclient[22783]: FAILED:
    Oct  8 14:17:47 timex ddclient[22783]: FAILED:    badauth)
    Oct  8 14:17:50 timex ddclient[22788]: WARNING:  file /var/cache/ddclient/ddclient.cache, line 4: Invalid Value for keyword 'ip' = ''
    Oct  8 14:17:50 timex ddclient[22788]: WARNING:  skipping update of *********** from <nothing> to **.***.***.**.
    Oct  8 14:17:50 timex ddclient[22788]: WARNING:   last updated <never> but last attempt on Sun Oct  8 14:17:47 2017 failed.
    

    Looking at the client request to the update.opendns.com server, it seems that it the Authorization: Basic **** header wasn't being honered. After looking through a number of discussions, this thread mentioned that a client (I assumed the OpenDNS updater cannot handle special character, but they require your password to have them :shrug:). I went and updated my password and removed all special characters except for one, and it seemed to work. I am not sure if this is due to the updater web server /nic/update?system=dyndns&hostname=&myip= HTTP/1.0 or the ddclient itself.

    This is just a reaching out to give some context on something I found out today, and just wanted to make your team aware.

    Thanks for the client and best of luck.

     
  • Jonathan Daley

    Jonathan Daley - 2017-10-18

    See the Note 3 where it talks about escaping characters.

    https://support.opendns.com/hc/en-us/articles/227987727

    (by the way, I see that you have a myip= in your URI - from my discussions with opendns support a couple months, they broke that feature 6 months ago or so. The requests have to come from the IP, and can no longer use the myip= parameter)

     
  • Jonathan Daley

    Jonathan Daley - 2017-10-18

    Actually, I see that opendns is deprecating their API, and switching to dnsomatic.com. I just switched my client to use updates.dnsomatic.com instead of updates.opendns.com, maybe that will fix your problem.

    Though it turns out that though they say they accept the myip= parameter, and return a 200 HTTP status code, after I login to opendns.com, they say, "The IP Address you have supplied to DNS-O-Matic
    differs from the IP Address that you are coming from. OpenDNS does not allow you to update to an IP Address that you don't actually own."

    Too bad.

     

    Last edit: Jonathan Daley 2017-10-18
  • wimpunk

    wimpunk - 2017-10-25

    Do you have an URL where you found the info about deprecation an dswitch to dnsomatic? I think we should change the default on ddclient if that's the case.

     
  • Kevin R. Bulgrien

    updates.opendns.com works, so I don't know why someone said to change it to updates.dnsomatic.com.

    In any event, be careful when changing your OpenDNS email account e-mail if you use it in the ddclient.conf configuration. I got the error message the OP describes when I had login= set to the wrong e-mail address. The username is impervious to e-mail changes, so it might be better to use it there.

     

Log in to post a comment.