DHCP Kea - Security und Firewall Labor: Unterschied zwischen den Versionen

Aus Xinux Wiki
Zur Navigation springen Zur Suche springen
← Zum vorherigen Versionsunterschied
 
(11 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt)
Zeile 2: Zeile 2:
* Damit Hosts im LAN automatisch eine IP-Adresse erlangen, konfigurieren wir nun einen DHCP Server (Befehle ab hier finden auf der '''Firewall''' statt!)
* Damit Hosts im LAN automatisch eine IP-Adresse erlangen, konfigurieren wir nun einen DHCP Server (Befehle ab hier finden auf der '''Firewall''' statt!)
;Debian
;Debian
* '''apt install -y kea'''
* '''apt install -y kea-dhcp4-server'''
;Rocky
;Rocky
* '''dnf install -y kea'''
* '''dnf install -y kea'''
Zeile 19: Zeile 19:
       "name": "/var/lib/kea/kea-leases4.csv"
       "name": "/var/lib/kea/kea-leases4.csv"
     },
     },
     "valid-lifetime": 600,
     "valid-lifetime": 7200,
    "max-valid-lifetime": 7200,
     "option-data": [
     "option-data": [
       { "name": "domain-name-servers", "data": "10.88.$OKT.21" },
       { "name": "domain-name-servers", "data": "10.88.2XX.21" },
       { "name": "domain-name", "data": "it$OKT.int" },
       { "name": "domain-name", "data": "it2XX.int" },
       { "name": "domain-search", "data": "it$OKT.int" }
       { "name": "domain-search", "data": "it2XX.int" }
     ],
     ],
     "subnet4": [
     "subnet4": [
       {
       {
         "id": 1,
         "id": 1,
         "subnet": "172.26.$OKT.0/24",
         "subnet": "172.26.2XX.0/24",
         "pools": [ { "pool": "172.26.$OKT.50 - 172.26.$OKT.100" } ],
         "pools": [ { "pool": "172.26.2XX.50 - 172.26.2XX.100" } ],
         "option-data": [ { "name": "routers", "data": "172.26.$OKT.1" } ],
         "option-data": [ { "name": "routers", "data": "172.26.2XX.1" } ],
         "reservations": [  
         "reservations": [  
           { "hw-address": "aa:bb:cc:dd:ee:ff", "ip-address": "172.26.$OKT.10", "hostname": "client" }  
           { "hw-address": "aa:bb:cc:dd:ee:ff", "ip-address": "172.26.2XX.10", "hostname": "client" }  
         ]
         ]
       }
       }
Zeile 47: Zeile 46:
}
}
</syntaxhighlight>
</syntaxhighlight>
* '''systemctl enable --now kea-dhcp4.service'''
* '''systemctl enable --now kea-dhcp4-server.service'''


=Status=
=Status=
* systemctl status kea-dhcp4.service
* systemctl status kea-dhcp4-server.service
<pre>
<pre>
● kea-dhcp4.service - Kea IPv4 DHCP daemon
● kea-dhcp4.service - Kea IPv4 DHCP daemon
Zeile 58: Zeile 57:


=Den DHCP neustarten=
=Den DHCP neustarten=
* systemctl restart kea-dhcp4.service
* systemctl restart kea-dhcp4-server.service
=Debugging=
*systemctl status kea-dhcp4-server
*journalctl -n 20 -fu kea-dhcp4-server
*tail -f /var/log/kea/kea-dhcp4.log
*ss -lnup | grep 67

Aktuelle Version vom 29. Juli 2026, 07:08 Uhr

Installation

  • Damit Hosts im LAN automatisch eine IP-Adresse erlangen, konfigurieren wir nun einen DHCP Server (Befehle ab hier finden auf der Firewall statt!)
Debian
  • apt install -y kea-dhcp4-server
Rocky
  • dnf install -y kea

Konfiguration

  • vim /etc/kea/kea-dhcp4.conf 
{
  "Dhcp4": {
    "interfaces-config": {
      "interfaces": [ "enp0s9" ]
    },
    "lease-database": {
      "type": "memfile",
      "persist": true,
      "name": "/var/lib/kea/kea-leases4.csv"
    },
    "valid-lifetime": 7200,
    "option-data": [
      { "name": "domain-name-servers", "data": "10.88.2XX.21" },
      { "name": "domain-name", "data": "it2XX.int" },
      { "name": "domain-search", "data": "it2XX.int" }
    ],
    "subnet4": [
      {
        "id": 1,
        "subnet": "172.26.2XX.0/24",
        "pools": [ { "pool": "172.26.2XX.50 - 172.26.2XX.100" } ],
        "option-data": [ { "name": "routers", "data": "172.26.2XX.1" } ],
        "reservations": [ 
          { "hw-address": "aa:bb:cc:dd:ee:ff", "ip-address": "172.26.2XX.10", "hostname": "client" } 
        ]
      }
    ],
    "loggers": [
      {
        "name": "kea-dhcp4",
        "output_options": [ { "output": "/var/log/kea/kea-dhcp4.log" } ],
        "severity": "INFO"
      }
    ]
  }
}
  • systemctl enable --now kea-dhcp4-server.service

Status

  • systemctl status kea-dhcp4-server.service
● kea-dhcp4.service - Kea IPv4 DHCP daemon
     Loaded: loaded (/usr/lib/systemd/system/kea-dhcp4.service; enabled)
     Active: active (running) since Wed 2025-04-16 09:27:35 CEST; 29min ago

Den DHCP neustarten

  • systemctl restart kea-dhcp4-server.service

Debugging

  • systemctl status kea-dhcp4-server
  • journalctl -n 20 -fu kea-dhcp4-server
  • tail -f /var/log/kea/kea-dhcp4.log
  • ss -lnup | grep 67
Abgerufen von „https://wiki.ixheim.de/index.php?title=DHCP_Kea_-_Security_und_Firewall_Labor&oldid=72319“