The ISC Consortium has released DHCP server Kea 3.0, which replaces the classic ISC DHCP. Kea 3.0 is marked as the first release that will have a long-term support cycle (LTS) – updates will be issued for three years. New significant stable releases are planned to be formed every six months instead of annually. The source code of the project is distributed under the Mozilla Public License (MPL) 2.0, replacing the previously used ISC License for ISC DHCP.
The Kea DHCP server is based on BIND 10 technologies and built using a modular architecture that divides functionality into different handler processes. The product includes a fully functional server implementation with support for DHCPv4 and DHCPv6 protocols, capable of replacing ISC DHCP. Kea comes equipped with tools for dynamic DNS zone updates and supports discovery mechanisms. servers, address assignment, updates and reconnections, handling informational queries, address reservations for hosts, and PXE booting. The DHCPv6 implementation additionally provides the ability to delegate prefixes.
Information about assigned addresses and client parameters can be stored in various repositories; for instance, backends are provided for storage in CSV files, MySQL databases, Apache Cassandra, and PostgreSQL. Host reservation parameters can be specified in a configuration file in JSON format or as a table in MySQL and PostgreSQL. The package includes the perfdhcp tool for measuring DHCP server performance and components for collecting statistics. A special API is available for interaction with external applications. Configuration updates can be made on the fly without restarting the server.
Key improvements in Kea 3.0:
- Most of the TWELVE libraries for Kea with pluggable handlers (hooks), previously available under commercial license, have been translated into the category of open-source and freely distributed software (only the RBAC and Configuration Backend handlers remain commercial, while the other 12 handlers are open under MPL 2.0). The process for distributing pluggable handlers has changed – installation no longer requires an access token. The open libraries are included in the main archive of Kea source code and are available for installation from ISC's official repositories.
Among the features offered by the open handlers are: manipulation of DHCP client classes without restarting the DHCP server, updating DDNS (Dynamic DNS) linked to clients, flexible assignment of identifiers to clients, maintaining extended logs, using GSS-TSIG for authentication, caching responses from other hosts, isolating host reservation storage in a separate DBMS, limiting request intensity, ping-checking addresses before issuing to clients, integration with RADIUS servers, managing subnet settings without restarting, and supporting DHCPv4/DHCPv6 Leasequery extensions. Open handlers can be used to configure subnets and host reservations through the Stork web interface.
- Additional checks and enhanced security measures have been implemented in response to recently discovered vulnerabilities. After upgrading to Kea 3.0, administrators will need to set new passwords and configure more secure access protections for remote management interfaces.
- Built-in support for HTTP/TLS has been added. Remote access no longer requires the Kea Control Agent (CA), significantly simplifying configuration. Background processes for DHCPv4, DHCPv6, and DHCP-DDNS have integrated support for API calls via HTTP and TLS without the need for a Control Agent. Future releases are planned to remove the Kea Control Agent.
- To simplify migration from ISC DHCP, the classification of clients has been changed. Options can now be added linked to either the client or the subnet. The behavior of option inheritance has been aligned with ISC DHCP.
- A mechanism for address registration (RFC 9686) has been implemented in DHCPv6, allowing for addresses to be generated on the device side instead of being assigned. proxy server The address is generated on the device using SLAAC (Stateless Address Autoconfiguration), after which information about the generated address is transmitted to the DHCPv6 server.
- The build system has been modernized, transitioning from Auto Tools to the Meson toolkit.
- Code for supporting storage backends based on MySQL and PostgreSQL has been moved to separate libraries. These backends are no longer mandatory for installation—if support for MySQL and PostgreSQL is not required, the installation of Kea can proceed without the related DBMS dependencies.
Source: opennet.ru
