Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen angezeigt.
| Beide Seiten der vorigen Revision Vorhergehende Überarbeitung Nächste Überarbeitung | Vorhergehende Überarbeitung | ||
| linux:kea [18.10.2024 21:02. ] – [Konfigurationsoptionen für unseren DHCPv4-Daemon] django | linux:kea [14.03.2025 13:17. ] (aktuell) – [Ergebniskontrolle] django | ||
|---|---|---|---|
| Zeile 7: | Zeile 7: | ||
| |< 100% 5% 8% 12% 12% 12% 12% 12% >| | |< 100% 5% 8% 12% 12% 12% 12% 12% >| | ||
| - | ^ Subnetz \\ (ID) ^ Subnetz \\ (Use) ^ Subnetz Prefix\\ (global Unicast) | + | ^ Subnetz \\ (ID) ^ Subnetz \\ (Use) ^ Subnetz Prefix\\ (global Unicast) |
| - | | **7** | Intra | 2003:a:e0d:760**7**::/ | + | | **7** | Intra | 2003:a:bcd:123**4**::/ |
| - | | | + | | |
| - | | | + | | |
| - | | | + | | |
| Zeile 1152: | Zeile 1152: | ||
| ==== Grund-Konfiguration ==== | ==== Grund-Konfiguration ==== | ||
| === Firewall/ | === Firewall/ | ||
| - | Bevor wir nun unseren **Kea-DHCP-Daemon** | + | Bevor wir nun unseren **Kea-DHCP-Daemon** |
| Wie auch schon früher bei **CentOS** ab Release **7** bzw. den nachfolgenden Relaese-Kandidaten **Stream von RHEL** nutzen wir auch unter **Arch Linux** den dynamischen **[[https:// | Wie auch schon früher bei **CentOS** ab Release **7** bzw. den nachfolgenden Relaese-Kandidaten **Stream von RHEL** nutzen wir auch unter **Arch Linux** den dynamischen **[[https:// | ||
| Zeile 1180: | Zeile 1180: | ||
| Werfen wir noch kurz einen Blick in die Zone **'' | Werfen wir noch kurz einen Blick in die Zone **'' | ||
| - | # firewall-cmd --zone=intra --list-services | + | < |
| dhcp dhcpv6 | dhcp dhcpv6 | ||
| Zeile 2192: | Zeile 2192: | ||
| === Konfigurationsoptionen für unseren DHCPv6-Daemon === | === Konfigurationsoptionen für unseren DHCPv6-Daemon === | ||
| In unserer Betriebsumgebung haben wir folgende Rahmenbedingungen für unseren DHCPv6-Server: | In unserer Betriebsumgebung haben wir folgende Rahmenbedingungen für unseren DHCPv6-Server: | ||
| - | * **[[https:// | + | * **[[https:// |
| * **[[https:// | * **[[https:// | ||
| - | * **[[https:// | + | * **[[https:// |
| - | + | ||
| * **[[https:// | * **[[https:// | ||
| * **[[https:// | * **[[https:// | ||
| * **[[https:// | * **[[https:// | ||
| - | * **Name-Server** : \\ Der interne DNS-Daemon ist unter der IP-Adresse **'' | + | * **Name-Server** : \\ Der interne DNS-Daemon ist unter der IP-Adresse **'' |
| * **Domain-Name** : \\ Der Name unserer Domain lautet **'' | * **Domain-Name** : \\ Der Name unserer Domain lautet **'' | ||
| * **Domain-Search-Liste** : \\ Auf Domain-Search-Listen wird bewusst verzichtet, da diese ein [[https:// | * **Domain-Search-Liste** : \\ Auf Domain-Search-Listen wird bewusst verzichtet, da diese ein [[https:// | ||
| - | * **Time-Server** : \\ Der interne Time-Server ist unter der IP-Adresse **'' | + | * **Time-Server** : \\ Der interne Time-Server ist unter der IP-Adresse **'' |
| - | * **Subnetz** : \\ Der DHCPv4-Server ist verantwortlich für das Sub-Netz **'' | + | * **Subnetz** : \\ Der DHCPv6-Server ist verantwortlich für das Sub-Netz **'' |
| - | * **Router** : \\ Der Default-Router ist für dieses Subnetz unter der IP-Adresse **'' | + | * **Time-Server** : \\ Der interne Time-Server ist bei diesem Subnetz unter der IP-Adresse **'' |
| - | * **Time-Server** : \\ Der interne Time-Server ist bei diesem Subnetz unter der IP-Adresse **'' | + | * **Name-Server** : \\ Der interne DNS-Daemon ist unter der IP-Adresse **'' |
| - | * **Name-Server** : \\ Der interne DNS-Daemon ist unter der IP-Adresse **'' | + | * **Pool (dynamischer Adress-Bereich)** : \\ Dynamische IP-Adressen sollen aus dem Bereich von **'' |
| - | * **Pool (dynamischer Adress-Bereich)** : \\ Dynamische IP-Adressen sollen aus dem Bereich von **'' | + | * **Reservierungen** : \\ Einige Hosts bekommen eine feste IP-Adresse, die der DHCP-Server an Hand der übermittelten |
| - | * **Reservierungen** : \\ Einige Hosts bekommen eine feste IP-Adresse, die der DHCP-Server an Hand der übermittelten | + | |
| - | * **Subnetz** : \\ Der DHCPv4-Server | + | === Konfigurationsdatei / |
| - | * **Router** : \\ Der Default-Router ist für dieses Subnetz unter der IP-Adresse **'' | + | Bei der Installation unseres Kea-Servers wurde uns eine entsprechende Musterkonfigurations-Datei bereits mitgeliefert. |
| - | | + | # less / |
| - | * **Name-Server** : \\ Der interne DNS-Daemon ist unter der IP-Adresse | + | |
| - | * **Pool (dynamischer Adress-Bereich)** : \\ Da die IPv4-Adressen in der Zone **idmz** ausschließlich per **[[|Ansible]]** | + | ++++ / |
| - | * **Reservierungen** : \\ Einige Hosts bekommen | + | <file java / |
| + | // are mostly commented out and no interfaces are listed. Therefore, the servers | ||
| + | // will not listen or respond to any queries. | ||
| + | // The basic configuration must be extended to specify interfaces on which | ||
| + | // the servers should listen. There are a number of example options defined. | ||
| + | // These probably don't make any sense in your network. Make sure you at least | ||
| + | // update the following, before running this example in your network: | ||
| + | // - change the network interface names | ||
| + | // - change the subnets to match your actual network | ||
| + | // - change the option values to match your network | ||
| + | // | ||
| + | // This is just a very basic configuration. Kea comes with large suite (over 30) | ||
| + | // of configuration examples and extensive Kea User's Guide. Please refer to | ||
| + | // those materials to get better understanding of what this software is able to | ||
| + | // do. Comments in this configuration file sometimes refer to sections for more | ||
| + | // details. These are section numbers in Kea User's Guide. The version matching | ||
| + | // your software should come with your Kea package, but it is also available | ||
| + | // in ISC's Knowledgebase (https:// | ||
| + | // the stable version is https:// | ||
| + | // | ||
| + | // This configuration file contains only DHCPv6 server' | ||
| + | // If configurations for other Kea services are also included in this file they | ||
| + | // are ignored by the DHCPv6 server. | ||
| + | { | ||
| + | |||
| + | // DHCPv6 configuration starts here. This section will be read by DHCPv6 server | ||
| + | // and will be ignored by other components. | ||
| + | " | ||
| + | // Add names of your network interfaces to listen on. | ||
| + | " | ||
| + | // You typically want to put specific interface names here, e.g. eth0 | ||
| + | // but you can also specify unicast addresses (e.g. eth0/ | ||
| + | // you want your server to handle unicast traffic in addition to | ||
| + | // multicast. (DHCPv6 is a multicast based protocol). | ||
| + | " | ||
| + | }, | ||
| + | |||
| + | // Kea supports control channel, which is a way to receive management commands | ||
| + | // while the server is running. This is a Unix domain socket that receives | ||
| + | // commands formatted in JSON, e.g. config-set (which sets new configuration), | ||
| + | // config-reload (which tells Kea to reload its configuration from file), | ||
| + | // statistic-get (to retrieve statistics) and many more. For detailed | ||
| + | // description, | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | |||
| + | // Use Memfile lease database backend to store leases in a CSV file. | ||
| + | // Depending on how Kea was compiled, it may also support SQL databases | ||
| + | // (MySQL and/or PostgreSQL). Those database backends require more | ||
| + | // parameters, like name, host and possibly user and password. | ||
| + | // There are dedicated examples for each backend. See Section 8.2.2 " | ||
| + | // Storage" | ||
| + | " | ||
| + | // Memfile is the simplest and easiest backend to use. It's an in-memory | ||
| + | // C++ database that stores its state in CSV file. | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | |||
| + | // Kea allows storing host reservations in a database. If your network is | ||
| + | // small or you have few reservations, | ||
| + | // in the configuration file. If your network is large, it's usually better | ||
| + | // to use database for it. To enable it, uncomment the following: | ||
| + | // " | ||
| + | // " | ||
| + | // " | ||
| + | // " | ||
| + | // " | ||
| + | // " | ||
| + | // " | ||
| + | // }, | ||
| + | // See Section 8.2.3 "Hosts storage" | ||
| + | |||
| + | // Setup reclamation of the expired leases and leases affinity. | ||
| + | // Expired leases will be reclaimed every 10 seconds. Every 25 | ||
| + | // seconds reclaimed leases, which have expired more than 3600 | ||
| + | // seconds ago, will be removed. The limits for leases reclamation | ||
| + | // are 100 leases or 250 ms for a single cycle. A warning message | ||
| + | // will be logged if there are still expired leases in the | ||
| + | // database after 5 consecutive reclamation cycles. | ||
| + | // If both " | ||
| + | // not 0, when the client sends a release message the lease is expired | ||
| + | // instead of being deleted from the lease storage. | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | |||
| + | // These parameters govern global timers. Addresses will be assigned with | ||
| + | // preferred and valid lifetimes being 3000 and 4000, respectively. Client | ||
| + | // is told to start renewing after 1000 seconds. If the server does not | ||
| + | // respond after 2000 seconds since the lease was granted, a client is | ||
| + | // supposed to start REBIND procedure (emergency renewal that allows | ||
| + | // switching to a different server). | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | |||
| + | // These are global options. They are going to be sent when a client requests | ||
| + | // them, unless overwritten with values in more specific scopes. The scope | ||
| + | // hierarchy is: | ||
| + | // - global | ||
| + | // - subnet | ||
| + | // - class | ||
| + | // - host | ||
| + | // | ||
| + | // Not all of those options make sense. Please configure only those that | ||
| + | // are actually useful in your network. | ||
| + | // | ||
| + | // For a complete list of options currently supported by Kea, see | ||
| + | // Section 8.2.9 " | ||
| + | // vendor options (see Section 7.2.10) and allows users to define their | ||
| + | // own custom options (see Section 7.2.9). | ||
| + | " | ||
| + | // When specifying options, you typically need to specify | ||
| + | // one of (name or code) and data. The full option specification | ||
| + | // covers name, code, space, csv-format and data. | ||
| + | // space defaults to " | ||
| + | // use encapsulate options. csv-format defaults to " | ||
| + | // this is also correct, unless you want to specify the whole | ||
| + | // option value as long hex string. For example, to specify | ||
| + | // domain-name-servers you could do this: | ||
| + | // { | ||
| + | // " | ||
| + | // " | ||
| + | // " | ||
| + | // " | ||
| + | // " | ||
| + | // } | ||
| + | // but it's a lot of writing, so it's easier to do this instead: | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | |||
| + | // Typically people prefer to refer to options by their names, so they | ||
| + | // don't need to remember the code names. However, some people like | ||
| + | // to use numerical values. For example, DHCPv6 can optionally use | ||
| + | // server unicast communication, | ||
| + | // " | ||
| + | // by " | ||
| + | // you really should also tell the server to listen on that address | ||
| + | // (see interfaces-config/ | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | |||
| + | // String options that have a comma in their values need to have | ||
| + | // it escaped (i.e. each comma is preceded by two backslashes). | ||
| + | // That's because commas are reserved for separating fields in | ||
| + | // compound options. At the same time, we need to be conformant | ||
| + | // with JSON spec, that does not allow " | ||
| + | // slightly uncommon double backslashes notation is needed. | ||
| + | |||
| + | // Legal JSON escapes are \ followed by " | ||
| + | // or \u followed by 4 hexadecimal numbers (currently Kea | ||
| + | // supports only \u0000 to \u00ff code points). | ||
| + | // CSV processing translates ' | ||
| + | // only so for instance ' | ||
| + | // as it works on a JSON string value each of these ' | ||
| + | // characters must be doubled on JSON input. | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | |||
| + | // Options that take integer values can either be specified in | ||
| + | // dec or hex format. Hex format could be either plain (e.g. abcd) | ||
| + | // or prefixed with 0x (e.g. 0xabcd). | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | |||
| + | // A few options are encoded in (length, string) tuples | ||
| + | // which can be defined using only strings as the CSV | ||
| + | // processing computes lengths. | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | ], | ||
| + | |||
| + | // Another thing possible here are hooks. Kea supports a powerful mechanism | ||
| + | // that allows loading external libraries that can extract information and | ||
| + | // even influence how the server processes packets. Those libraries include | ||
| + | // additional forensic logging capabilities, | ||
| + | // more flexible ways, and even add extra commands. For a list of available | ||
| + | // hook libraries, see https:// | ||
| + | // " | ||
| + | // { | ||
| + | // // Forensic Logging library generates forensic type of audit trail | ||
| + | // // of all devices serviced by Kea, including their identifiers | ||
| + | // // (like MAC address), their location in the network, times | ||
| + | // // when they were active etc. | ||
| + | // " | ||
| + | // " | ||
| + | // " | ||
| + | // " | ||
| + | // } | ||
| + | // }, | ||
| + | // { | ||
| + | // // Flexible identifier (flex-id). Kea software provides a way to | ||
| + | // // handle host reservations that include addresses, prefixes, | ||
| + | // // options, client classes and other features. The reservation can | ||
| + | // // be based on hardware address, DUID, circuit-id or client-id in | ||
| + | // // DHCPv4 and using hardware address or DUID in DHCPv6. However, | ||
| + | // // there are sometimes scenario where the reservation is more | ||
| + | // // complex, e.g. uses other options that mentioned above, uses part | ||
| + | // // of specific options or perhaps even a combination of several | ||
| + | // // options and fields to uniquely identify a client. Those scenarios | ||
| + | // // are addressed by the Flexible Identifiers hook application. | ||
| + | // " | ||
| + | // " | ||
| + | // " | ||
| + | // } | ||
| + | // } | ||
| + | // ], | ||
| + | |||
| + | // Below an example of a simple IPv6 subnet declaration. Uncomment to enable | ||
| + | // it. This is a list, denoted with [ ], of structures, each denoted with | ||
| + | // { }. Each structure describes a single subnet and may have several | ||
| + | // parameters. One of those parameters is " | ||
| + | // structures. | ||
| + | " | ||
| + | { | ||
| + | // This defines the whole subnet. Kea will use this information to | ||
| + | // determine where the clients are connected. This is the whole | ||
| + | // subnet in your network. | ||
| + | |||
| + | // Subnet identifier should be unique for each subnet. | ||
| + | " | ||
| + | |||
| + | // This is mandatory parameter for each subnet. | ||
| + | " | ||
| + | |||
| + | // Pools define the actual part of your subnet that is governed | ||
| + | // by Kea. Technically this is optional parameter, but it's | ||
| + | // almost always needed for DHCP to do its job. If you omit it, | ||
| + | // clients won't be able to get addresses, unless there are | ||
| + | // host reservations defined for them. | ||
| + | " | ||
| + | |||
| + | // Kea supports prefix delegation (PD). This mechanism delegates | ||
| + | // whole prefixes, instead of single addresses. You need to specify | ||
| + | // a prefix and then size of the delegated prefixes that it will | ||
| + | // be split into. This example below tells Kea to use | ||
| + | // 2001: | ||
| + | // This will give you 256 (2^(64-56)) prefixes. | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | |||
| + | // Kea also supports excluded prefixes. This advanced option | ||
| + | // is explained in Section 9.2.9. Please make sure your | ||
| + | // excluded prefix matches the pool it is defined in. | ||
| + | // " | ||
| + | // " | ||
| + | } | ||
| + | ], | ||
| + | " | ||
| + | // You can specify additional options here that are subnet | ||
| + | // specific. Also, you can override global options here. | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | ], | ||
| + | |||
| + | // Host reservations can be defined for each subnet. | ||
| + | // | ||
| + | // Note that reservations are subnet-specific in Kea. This is | ||
| + | // different than ISC DHCP. Keep that in mind when migrating | ||
| + | // your configurations. | ||
| + | " | ||
| + | // This is a simple host reservation. The host with DUID matching | ||
| + | // the specified value will get an address of 2001: | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | |||
| + | // This is similar to the previous one, but this time the | ||
| + | // reservation is done based on hardware/ | ||
| + | // will do its best to extract the hardware/ | ||
| + | // received packets (see ' | ||
| + | // details). This particular reservation also specifies two | ||
| + | // extra options to be available for this client. If there are | ||
| + | // options with the same code specified in a global, subnet or | ||
| + | // class scope, the values defined at host level take | ||
| + | // precedence. | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | }], | ||
| + | |||
| + | // This client will be automatically added to certain | ||
| + | // classes. | ||
| + | " | ||
| + | }, | ||
| + | |||
| + | // This is a bit more advanced reservation. The client with the | ||
| + | // specified DUID will get a reserved address, a reserved prefix | ||
| + | // and a hostname. | ||
| + | // not within the dynamic pool. Finally, this reservation | ||
| + | // features vendor specific options for CableLabs, which happen | ||
| + | // to use enterprise-id 4491. Those particular values will be | ||
| + | // returned only to the client that has a DUID matching this | ||
| + | // reservation. | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | ] | ||
| + | }, | ||
| + | |||
| + | // This reservation is using flexible identifier. Instead of | ||
| + | // relying on specific field, sysadmin can define an expression | ||
| + | // similar to what is used for client classification, | ||
| + | // e.g. substring(relay[0].option[17], | ||
| + | // value of that expression for incoming packet, the reservation | ||
| + | // is matched. | ||
| + | // plain text using single quotes. | ||
| + | |||
| + | // Note: flexible identifier requires flex_id hook library to be | ||
| + | // loaded to work. | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | // More subnets can be defined here. | ||
| + | // { | ||
| + | // " | ||
| + | // " | ||
| + | // }, | ||
| + | // { | ||
| + | // " | ||
| + | // " | ||
| + | // }, | ||
| + | // { | ||
| + | // " | ||
| + | // " | ||
| + | // } | ||
| + | ], | ||
| + | |||
| + | // Client-classes can be defined here. See " | ||
| + | // an example. | ||
| + | |||
| + | // DDNS information (how the DHCPv6 component can reach a DDNS daemon) | ||
| + | |||
| + | // Logging configuration starts here. Kea uses different loggers to log various | ||
| + | // activities. For details (e.g. names of loggers), see Chapter 18. | ||
| + | " | ||
| + | { | ||
| + | // This specifies the logging for kea-dhcp6 logger, i.e. all logs | ||
| + | // generated by Kea DHCPv6 server. | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | // Specifies the output file. There are several special values | ||
| + | // supported: | ||
| + | // - stdout (prints on standard output) | ||
| + | // - stderr (prints on standard error) | ||
| + | // - syslog (logs to syslog) | ||
| + | // - syslog:name (logs to syslog using specified name) | ||
| + | // Any other value is considered a name of the file | ||
| + | " | ||
| + | |||
| + | // Shorter log pattern suitable for use with systemd, | ||
| + | // avoids redundant information | ||
| + | // " | ||
| + | |||
| + | // This governs whether the log output is flushed to disk after | ||
| + | // every write. | ||
| + | // " | ||
| + | |||
| + | // This specifies the maximum size of the file before it is | ||
| + | // rotated. | ||
| + | // " | ||
| + | |||
| + | // This specifies the maximum number of rotated files to keep. | ||
| + | // " | ||
| + | } | ||
| + | ], | ||
| + | // This specifies the severity of log messages to keep. Supported values | ||
| + | // are: FATAL, ERROR, WARN, INFO, DEBUG | ||
| + | " | ||
| + | |||
| + | // If DEBUG level is specified, this value is used. 0 is least verbose, | ||
| + | // 99 is most verbose. Be cautious, Kea can generate lots and lots | ||
| + | // of logs if told to do so. | ||
| + | " | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | }</ | ||
| + | ++++ | ||
| + | |||
| + | Bevor wir nun aber unseren Kea-DHCPv6-Daemon individuell nach unseren Bedürfnissen hin anpassen, werden wir zunächst die im Paket mitgelieferte Original-Konfigurationsdatei | ||
| + | # cp -a / | ||
| + | |||
| + | So können wir später bei etwaigen Bedarf Vergleiche zur originalen Konfigurationsdatei mit einer neuen Version bei einem Update des KEA-Paketes anstreben, wie in diesem Beispiel hier: | ||
| + | # vimdiff / | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | Aus den oben genannten Konfigurationsparametern erstellen wir uns nun eine entsprechende Konfigurationsdatei | ||
| + | # vim / | ||
| + | |||
| + | <file java / | ||
| + | // 9.2 DHCPv6 Server Configuration for detailed informations. the direct link | ||
| + | // for the stable version is https:// | ||
| + | // | ||
| + | // This configuration file contains only DHCPv6 server' | ||
| + | // If configurations for other Kea services are also included in this file they | ||
| + | // are ignored by the DHCPv6 server. | ||
| + | // | ||
| + | // DHCPv6 configuration starts here. This section will be read by DHCPv6 server | ||
| + | // and will be ignored by other components. | ||
| + | { | ||
| + | " | ||
| + | // See section 9.2.4 Interface Configuration for more details: | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | |||
| + | // Kea supports control channel, which is a way to receive management | ||
| + | // commands while the server is running. For detailed description, | ||
| + | // see Sections 9.14. | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | // Use Memfile lease database backend to store leases in a CSV file. | ||
| + | // See Section 9.2.2.1 Memfile - Basic Storage for Leases | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | |||
| + | // Setup reclamation of the expired leases and leases affinity. | ||
| + | // See section 11. Lease Expiration for more and detailed informations. | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | |||
| + | // Global timers specified here apply to all subnets, unless there are | ||
| + | // subnet specific values defined in particular subnets. See section | ||
| + | // 9.2.1. Introduction. | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | |||
| + | // Many additional parameters can be specified here. Alle datails will be | ||
| + | // found in following sections: | ||
| + | // - 9.2.11. Standard DHCPv6 Options | ||
| + | // - 9.2.14. Custom | ||
| + | // - 9.2.15. DHCPv6 Vendor-Specific Options | ||
| + | // - 9.2.16. Nested DHCPv6 Options (Custom Option Spaces) | ||
| + | // - 9.2.17. Unspecified Parameters for DHCPv6 Option Configuration | ||
| + | // | ||
| + | // For a complete list of options currently supported by Kea, see | ||
| + | // Section 9.2.11 " | ||
| + | // vendor options (see Section 7.2.10) and allows users to define their | ||
| + | // own custom options (see Section 7.2.9). | ||
| + | " | ||
| + | // Domain-Name-Server: | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | |||
| + | // Domain-Search-Liste: | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | ], | ||
| + | |||
| + | // Finally, we list the subnets from which we will be leasing addresses. | ||
| + | // See section 9.2.5 IPv6 Subnet Identifier and the following sections | ||
| + | // for more details. | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | |||
| + | // This defines the whole subnet. Kea will use this information to | ||
| + | // determine where the clients are connected. This is the whole | ||
| + | // subnet in your network. | ||
| + | |||
| + | // Subnet identifier should be unique for each subnet. | ||
| + | // Subnet identifier for zone intra | ||
| + | " | ||
| + | |||
| + | // This is mandatory parameter for each subnet. | ||
| + | " | ||
| + | |||
| + | // Pools define the actual part of your subnet that is governed | ||
| + | // by Kea. | ||
| + | " | ||
| + | |||
| + | " | ||
| + | // You can specify additional options here that are subnet | ||
| + | // specific. Also, you can override global options here. | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | |||
| + | ], | ||
| + | |||
| + | // Host reservations can be defined for each subnet. | ||
| + | // Note that reservations are subnet-specific in Kea. This is | ||
| + | // different than ISC DHCP. Keep that in mind when migrating | ||
| + | // your configurations. | ||
| + | " | ||
| + | |||
| + | // This are the reservations for specific DUID matchings. | ||
| + | // "MNSS (C7)" | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | |||
| + | // "WLAN Router Trendnet TEW-826DAP" | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | |||
| + | // " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | |||
| + | // " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | |||
| + | // " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | |||
| + | // "MNSS (ArchLinux)" | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | |||
| + | // " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | ], | ||
| + | |||
| + | // Logging configuration starts here. Kea uses different loggers to log various | ||
| + | //# activities. For details (e.g. names of loggers), see Chapter 19. | ||
| + | " | ||
| + | { | ||
| + | // This specifies the logging for kea-dhcp6 logger, i.e. all logs | ||
| + | // generated by Kea DHCPv6 server. | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | // Specifies the output file. There are several special values | ||
| + | // supported: | ||
| + | // - stdout (prints on standard output) | ||
| + | // - stderr (prints on standard error) | ||
| + | // - syslog (logs to syslog) | ||
| + | // - syslog:name (logs to syslog using specified name) | ||
| + | // Any other value is considered a name of the file | ||
| + | " | ||
| + | } | ||
| + | ], | ||
| + | |||
| + | // This specifies the severity of log messages to keep. Supported values | ||
| + | // are: FATAL, ERROR, WARN, INFO, DEBUG | ||
| + | " | ||
| + | |||
| + | // If DEBUG level is specified, this value is used. 0 is least verbose, | ||
| + | // 99 is most verbose. Be cautious, Kea can generate lots and lots | ||
| + | // of logs if told to do so. | ||
| + | " | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | }</ | ||
| + | |||
| + | Wollen wir die Kondfigurationsdate ohne die Kommentare sehen, grep' | ||
| + | # grep -Ev '(^.*// | ||
| + | |||
| + | ++++ Beispielkonfigurationsdatei ohne Kommentare | | ||
| + | <file java / | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | |||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | |||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | |||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | |||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | |||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | ], | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | |||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | ], | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | ], | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | } | ||
| + | ], | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | }</ | ||
| + | ++++ | ||
| + | |||
| + | |||
| + | |||
| + | Bevor wir nun unseren | ||
| + | # kea-dhcp6 -t / | ||
| + | < | ||
| + | 2024-10-19 11: | ||
| + | 2024-10-19 11: | ||
| + | 2024-10-19 11: | ||
| + | 2024-10-19 11: | ||
| + | 2024-10-19 11: | ||
| + | |||
| + | === Start des kea-dhcp6 === | ||
| + | Nun können wir beruhigt und guten Mutes unseren **kea-dhcp6** Daemon starten. | ||
| + | # systemctl start kea-dhcp6.service | ||
| + | |||
| + | Im **Journal** wir der Start entsprechend dokumentiert. | ||
| + | |||
| + | < | ||
| + | Oct 19 11:49:49 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:49:49 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:49:49 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:49:49 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:49:49 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:49:49 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:49:49 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:49:49 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:49:49 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:49:49 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:49:49 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:49:49 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:49:49 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:49:49 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:49:49 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:49:49 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:49:49 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:49:49 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:49:49 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:49:49 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:49:49 vml000110 kea-dhcp6[13092]: | ||
| + | </ | ||
| + | |||
| + | Bei Bedarf können wir natürlich auch den Status unseres Daemons jederzeit abfragen. | ||
| + | # systemctl status kea-dhcp6.service | ||
| + | |||
| + | < | ||
| + | <font style=" | ||
| + | | ||
| + | | ||
| + | | ||
| + | Docs: man: | ||
| + | Main PID: 13092 (kea-dhcp6) | ||
| + | Tasks: 9 (limit: 9510) | ||
| + | | ||
| + | CPU: 66ms | ||
| + | | ||
| + | | ||
| + | |||
| + | Oct 19 11:49:49 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:49:49 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:50:00 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:50:00 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:50:00 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:50:00 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:51:52 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:51:52 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:51:52 vml000110 kea-dhcp6[13092]: | ||
| + | Oct 19 11:51:52 vml000110 kea-dhcp6[13092]: | ||
| + | </ | ||
| + | |||
| + | Verbindet sich nun ein uns unbekannter Host und kontaktiert unseren **kea-dhcp6**-Daemon wird der erfolgreiche Handshake im **Journal** protokolliert. | ||
| + | # journalctl -fu kea-dhcp6 | ||
| + | |||
| + | < | ||
| + | Oct 19 12:10:53 vml000110 kea-dhcp6[13178]: | ||
| + | Oct 19 12:10:53 vml000110 kea-dhcp6[13178]: | ||
| + | Oct 19 12:10:53 vml000110 kea-dhcp6[13178]: | ||
| + | </code> | ||
| + | |||
| + | Dem Client wurde also die IP-Adresse **'' | ||
| + | |||
| + | Verbindet sich jedoch nun ein uns bekannter Client, dessen DUID **'' | ||
| + | # journalctl -fu kea-dhcp4 | ||
| + | < | ||
| + | Oct 19 12:11:14 vml000110 kea-dhcp6[13178]: | ||
| + | Oct 19 12:11:14 vml000110 kea-dhcp6[13178]: | ||
| + | Oct 19 12:11:14 vml000110 kea-dhcp6[13178]: | ||
| + | Oct 19 12:11:14 vml000110 kea-dhcp6[13178]: | ||
| + | |||
| + | Der Host hat also seine vordefinierte **feste IPv6-Adresse** **'' | ||
| + | |||
| + | ===== Orchestrierung - Installation und Konfiguration der beiden Kea-Daemon mit Hilfe von Ansible | ||
| + | ==== Aufgabenstellung ==== | ||
| + | Natürlich wird man im Jahr 2024 nicht mehr ernsthaft, manuell | ||
| + | |||
| + | Wir werden uns nun nachfolgend die Server-Installation und -konfiguration genauer betrachten. | ||
| + | |||
| + | ==== Lösung ==== | ||
| + | |||
| + | <WRAP center round tip 80%> | ||
| + | Der ungeduldigen Leser kann auch direkt zur Tat schreiten und das manuelle Anlegen der Inventory-Hülle, des Playbooks und der zugehörigen Rolle überspringen und diese Aufgaben mit folgendem Befehl sozusagen auf einem Rutsch erledigen: | ||
| + | |||
| + | < | ||
| + | -O - | tar -xz --strip-components=1 -C ~/ | ||
| + | |||
| + | Nach Anpassung der Daten im Inventory kann man anschliessend direkt **[[# | ||
| + | </ | ||
| + | |||
| + | === Vorbereitung - (Server-)Daten im Inventory === | ||
| + | Bei unserem Konfigurationsbeispiel hier gehen wir von folgenden Host-Parametern aus: | ||
| + | * **'' | ||
| + | * **'' | ||
| + | |||
| + | Die Konfigurationsdatei unseres **inventory** in unsere, Ansible-Verzeichnis beinhaltet demnach | ||
| + | $ vim inventories/ | ||
| + | ++++ inventories/ | ||
| + | <file bash inventories/ | ||
| + | # | ||
| + | # Hinweise: | ||
| + | # - Kommentare beginnen mit einem '#' | ||
| + | # - leere Zeilen werden ignoriert | ||
| + | # - Host- und Gruppendefinitionen werden mit [] abgegrenzt | ||
| + | # - Hosts können über ihren Hostnamen, FQN oder ihrer IP-Adresse | ||
| + | # - übergeordnete Gruppen werden durch [:children] abgegrenzt | ||
| + | # | ||
| + | # Host-Definitionen | ||
| + | |||
| + | # Hosts ohne Gruppenzuordnung | ||
| + | localhost | ||
| + | |||
| + | [edmz] | ||
| + | vml000210 | ||
| + | |||
| + | [idmz] | ||
| + | vml000110 | ||
| + | |||
| + | [intra] | ||
| + | pnc010007 | ||
| + | vml010110 | ||
| + | |||
| + | |||
| + | # Host-Gruppen-Definitionen | ||
| + | # (zu welcher Gruppe gehören Untergruppen bzw. Hosts) | ||
| + | |||
| + | [linux: | ||
| + | intra | ||
| + | edmz | ||
| + | idmz | ||
| + | </ | ||
| + | ++++ | ||
| + | |||
| + | Die beiden Beispiel-Hosts aus der Gruppe|Zone | ||
| + | * Der Host **'' | ||
| + | * Der Host **'' | ||
| + | |||
| + | Wir legen uns also nun die Hostdefinitionsdatei für unseren Switch im SOHO an. | ||
| + | $ vim inventories/ | ||
| + | ++++ inventories/ | ||
| + | |||
| + | {{gh> https:// | ||
| + | |||
| + | ++++ | ||
| + | |||
| + | Als nächstes legen wir die Datei für den KVM-Host, auf dem unser Kea-Daemon laufen soll an und definieren darin die zugehörigen Eigenschaften. | ||
| + | $ vim inventories/ | ||
| + | ++++ inventories/ | ||
| + | |||
| + | {{gh> https:// | ||
| + | |||
| + | ++++ | ||
| + | |||
| + | Die für die beiden | ||
| + | $ vim inventories/ | ||
| + | ++++ inventories/ | ||
| + | |||
| + | {{gh> https:// | ||
| + | |||
| + | ++++ | ||
| + | |||
| + | Unser Beispiels-Inventory hat also nunmehr folgenden Aufbau: | ||
| + | < | ||
| + | ├── hosts | ||
| + | └── host_vars | ||
| + | ├── pnc010007 | ||
| + | └── vml010110 | ||
| + | ├── kea | ||
| + | └── kvm_vhost | ||
| + | |||
| + | 3 directories, | ||
| + | |||
| + | === Playbook === | ||
| + | Unser Playbook zum Installieren und Konfigurieren der beiden Kea-Daemon | ||
| + | $ vim playbooks/ | ||
| + | ++++ playbooks/ | ||
| + | |||
| + | {{gh> https:// | ||
| + | |||
| + | ++++ | ||
| + | |||
| + | === Rolle === | ||
| + | Für die Konfiguration | ||
| + | $ cp -avr roles/ | ||
| + | |||
| + | ++++ Ausgabe von cp -avr roles/ | ||
| + | < | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | </ | ||
| + | ++++ | ||
| + | |||
| + | Bei Bedarf können wir uns die Struktur die somit angelegt wurde mit nachfolgendem Befehl anzeigen lassen. | ||
| + | $ tree roles/ | ||
| + | |||
| + | ++++ Ausgabe von tree roles/ | ||
| + | < | ||
| + | ├── defaults | ||
| + | ├── files | ||
| + | ├── handlers | ||
| + | │ └── main.yml | ||
| + | ├── library | ||
| + | ├── lookup_plugins | ||
| + | ├── meta | ||
| + | ├── module_utils | ||
| + | ├── tasks | ||
| + | │ ├── dhcp4.yml | ||
| + | │ ├── dhcp6.yml | ||
| + | │ ├── firewalld.yml | ||
| + | │ ├── main.yml | ||
| + | │ └── vorbereitung.yml | ||
| + | ├── templates | ||
| + | │ ├── dhcp4.j2 | ||
| + | │ └── dhcp6.j2 | ||
| + | └── vars | ||
| + | |||
| + | 11 directories, | ||
| + | </ | ||
| + | ++++ | ||
| + | |||
| + | Wie wir sehen ist die Rolle durchaus überschaubar, | ||
| + | $ vim roles/ | ||
| + | ++++ roles/ | ||
| + | |||
| + | {{gh> https:// | ||
| + | |||
| + | ++++ | ||
| + | |||
| + | Die Installation des Kea DHCP-Servers wird in der ersten Task-Gruppe mit dem tag **'' | ||
| + | $ vim roles/ | ||
| + | ++++ roles/ | ||
| + | |||
| + | {{gh> https:// | ||
| + | |||
| + | ++++ | ||
| + | |||
| + | Für die Konfiguration des Kea-DHCP4-Daemon werden die nötigen Schritte in der Task-Gruppe mit dem tag **'' | ||
| + | $ vim roles/ | ||
| + | ++++ roles/ | ||
| + | |||
| + | {{gh> https:// | ||
| + | |||
| + | ++++ | ||
| + | |||
| + | Der Kea-DHCP4-Daemon wird mit Hilfe der Task-Gruppe mit dem tag **'' | ||
| + | $ vim roles/ | ||
| + | ++++ roles/ | ||
| + | |||
| + | {{gh> https:// | ||
| + | |||
| + | ++++ | ||
| + | |||
| + | Nun brauchen wir noch eine Beschreibung der Aufgaben für die Konfiguration der firewalld-Regeln für beide Kea Daemons. | ||
| + | $ vim roles/ | ||
| + | ++++ roles/ | ||
| + | |||
| + | {{gh> https:// | ||
| + | |||
| + | ++++ | ||
| + | |||
| + | Sollte bei der Abarbeitung des Playbook eine oder beide Konfigurationsdateien | ||
| + | |||
| + | Zu guter Letzt brauchen wir noch eine Konfiguration der Aufgaben die bei einem **'' | ||
| + | $ vim roles/ | ||
| + | ++++ roles/ | ||
| + | |||
| + | {{gh> https:// | ||
| + | |||
| + | ++++ | ||
| + | |||
| + | Für die Erstellung der jeweiligen Konfigurationsdateien | ||
| + | $ vim roles/ | ||
| + | ++++ roles/ | ||
| + | |||
| + | {{gh> https:// | ||
| + | |||
| + | ++++ | ||
| + | |||
| + | $ vim roles/ | ||
| + | ++++ roles/ | ||
| + | |||
| + | {{gh> https:// | ||
| + | |||
| + | ++++ | ||
| + | |||
| + | === Ausführung - Playbooklauf === | ||
| + | Die orchestrierte Variante der Installation und Konfiguration unserer **kea**-Daemon gestaltet sich ab sofort sehr einfach, brauchen wir doch lediglich die Konfigurationswerte im Inventory zu hinterlegen und zu pflegen und letztendlich das Playbook entsprechend aufzurufen, wenn z.B. ein Client im Intranet hinzugefügt, | ||
| + | $ ansible-playbook playbooks/ | ||
| + | |||
| + | < | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | </ | ||
| + | </ | ||
| + | |||
| + | ==== Ergebniskontrolle ==== | ||
| + | Ob die Konfigurationsdateien valide erstellt und auch von den Kea-Daemons erfolgreich geladen worden sind, kontrollieren wir zum Beispiel auf dem Zielhost mit einem Blick in die betreffenden Konfigurationsdateien, | ||
| + | * **kea-dhcp4** < | ||
| + | * **kea-dhcp6** < | ||
| + | |||
| + | ====== Links ====== | ||
| + | * **[[linux: | ||
| + | * **=> [[linux: | ||
| + | * **[[linux: | ||
| + | * **[[wiki: | ||
| + | * **[[http:// | ||
django