1.. _installation: 2 3************ 4Installation 5************ 6 7Packages 8======== 9 10ISC publishes native RPM, deb, and APK packages, along with the tarballs 11with the source code. The packages are available on 12`Cloudsmith <https://cloudsmith.io/~isc/repos/>`_ at 13https://cloudsmith.io/~isc/repos. The native packages can be downloaded 14and installed using the system available in a specific distribution (such 15as dpkg or rpm). The Kea repository can also be added to the system, 16making it easier to install updates. For details, please 17go to https://cloudsmith.io/~isc/repos, choose the repository of 18interest, and then click the ``Set Me Up`` button for detailed 19instructions. 20 21.. _install-hierarchy: 22 23Installation Hierarchy 24====================== 25 26The following is the directory layout of the complete Kea installation. 27(All directory paths are relative to the installation directory.) 28 29- ``etc/kea/`` — configuration files. 30 31- ``include/`` — C++ development header files. 32 33- ``lib/`` — libraries. 34 35- ``lib/kea/hooks`` — additional hooks libraries. 36 37- ``sbin/`` — server software and commands used by the system administrator. 38 39- ``share/doc/kea/`` — this guide, other supplementary documentation, and examples. 40 41- ``share/kea/`` — API command examples and database schema scripts. 42 43- ``share/man/`` — manual pages (online documentation). 44 45- ``var/lib/kea/`` — server identification and lease database files. 46 47- ``var/log/`` - log files. 48 49- ``var/run/kea`` - PID file and logger lock file. 50 51.. _build-requirements: 52 53Build Requirements 54================== 55 56In addition to the run-time requirements (listed in 57:ref:`required-software`), building Kea from source code requires 58various development include headers and program development tools. 59 60.. note:: 61 62 Some operating systems have split their distribution packages into a 63 run-time and a development package. The 64 development package versions, which include header files and 65 libraries, must be installed to build Kea from the source code. 66 67Building from source code requires the following software installed on 68the system: 69 70- Boost C++ libraries (https://www.boost.org/). The oldest Boost version 71 used for testing is 1.57 (although Kea may also work with older 72 versions). The Boost system library must also be installed. 73 Installing a header-only version of Boost is not recommended. 74 75- OpenSSL (at least version 1.0.2) or Botan (at least version 2). 76 OpenSSL version 1.1.1 or later is strongly recommended. 77 78- log4cplus (at least version 1.0.3) development include headers. 79 80- A C++ compiler (with C++11 support) and standard development headers. 81 The Kea build has been checked with GCC g++ 4.8.5 and some later versions, 82 and Clang 800.0.38 and some later versions. 83 84- The development tools automake, libtool, and pkg-config. 85 86- The MySQL client and the client development libraries, when using the 87 ``--with-mysql`` configuration flag to build the Kea MySQL database 88 backend. In this case, an instance of the MySQL server running locally 89 or on a machine reachable over a network is required. Note that running 90 the unit tests requires a local MySQL server. 91 92- The PostgreSQL client and the client development libraries, when using the 93 ``--with-pgsql`` configuration flag to build the Kea PostgreSQL database 94 backend. In this case an instance of the PostgreSQL server running locally 95 or on a machine reachable over a network is required. Note that running 96 the unit tests requires a local PostgreSQL server. 97 98- The cpp-driver from DataStax is needed when using the ``--with-cql`` 99 configuration flag to build Kea with the Cassandra database backend. 100 In this case, an instance of the Cassandra server running locally 101 or on a machine reachable over a network is required. Note that running 102 the unit tests requires a local Cassandra server. 103 104- The FreeRADIUS client library is required to connect to a RADIUS server. 105 This is specified using the ``--with-freeradius`` configuration switch. 106 107- Sysrepo v1.4.140 and libyang v1.0.240 are needed to connect to a Sysrepo 108 datastore. Earlier versions are no longer supported. When compiling from 109 sources, the configure switches that can be used are ``--with-libyang`` and 110 ``--with-sysrepo`` without any parameters. If these dependencies were 111 installed in custom paths, point the switches to them. 112 113- The MIT Kerberos 5 or Heimdal libraries are needed by Kea DDNS server to sign 114 and verify DNS updates using GSS-TSIG. The configuration switch which enables 115 this functionality is ``--with-gssapi`` without any parameters. If these 116 dependencies were installed in custom paths, point the switch to them. 117 118- googletest (version 1.8 or later) is required when using the ``--with-gtest`` 119 configuration option to build the unit tests. 120 121- The documentation generation tools `Sphinx <https://www.sphinx-doc.org/>`_, 122 texlive with its extensions, and Doxygen, if using the ``--enable-generate-docs`` 123 configuration option to create the documentation. Specifically, 124 with Fedora, python3-sphinx, texlive, and texlive-collection-latexextra are necessary; 125 with Ubuntu, python3-sphinx, python3-sphinx-rtd-theme, and texlive-binaries 126 are needed. If LaTeX packages are missing, Kea skips PDF generation and produces 127 only HTML documents. 128 129Visit ISC's Knowledgebase at https://kb.isc.org/docs/installing-kea for 130system-specific installation tips. 131 132.. _install: 133 134Installation From Source 135======================== 136 137Although Kea may be available in pre-compiled, ready-to-use packages 138from operating system vendors, it is open source software written in 139C++. As such, it is freely available in source code form from ISC as a 140downloadable tar file. The source code can also be obtained from the Kea 141GitLab repository at https://gitlab.isc.org/isc-projects/kea. This 142section describes how to build Kea from the source code. 143 144Download Tar File 145----------------- 146 147The Kea release tarballs may be downloaded from: 148https://downloads.isc.org/isc/kea/. 149 150Retrieve From Git 151----------------- 152 153The latest development code is available on GitLab (see 154https://gitlab.isc.org/isc-projects/kea). The Kea source is public and 155development is done in the “master” branch. 156 157Downloading this "bleeding edge" code is recommended only for developers 158or advanced users. Using development code in a production environment is 159not recommended. 160 161.. note:: 162 163 When building from source code retrieved via git, additional software 164 is required: automake (v1.11 or later), libtoolize, and autoconf 165 (v2.69 or later). These may need to be installed. 166 167The code can be checked out from 168``https://gitlab.isc.org/isc-projects/kea.git``: 169 170.. code-block:: console 171 172 $ git clone https://gitlab.isc.org/isc-projects/kea.git 173 174The code checked out from the git repository does not include the 175generated configure script or the Makefile.in files, nor their related build 176files. They can be created by running ``autoreconf`` with the 177``--install`` switch. This will run ``autoconf``, ``aclocal``, 178``libtoolize``, ``autoheader``, ``automake``, and related commands. 179 180Write access to the Kea repository is only granted to ISC staff. 181Developers planning to contribute to Kea should check our 182`Contributor's 183Guide <https://gitlab.isc.org/isc-projects/kea/blob/master/contributors-guide.md>`__. 184The `Kea Developer's 185Guide <https://reports.kea.isc.org/dev_guide/>`__ contains more 186information about the process, and describes the requirements for 187contributed code to be accepted by ISC. 188 189.. _configure: 190 191Configure Before the Build 192-------------------------- 193 194Kea uses the GNU Build System to discover build environment details. To 195generate the makefiles using the defaults, simply run: 196 197.. code-block:: console 198 199 $ ./configure 200 201Run ``./configure`` with the ``--help`` switch to view the different 202options. Some commonly used options are: 203 204 - ``--prefix`` 205 Define the installation location (the default is ``/usr/local``). 206 207 - ``--with-mysql`` 208 Build Kea with code to allow it to store leases and host reservations 209 in a MySQL database. 210 211 - ``--with-pgsql`` 212 Build Kea with code to allow it to store leases and host reservations 213 in a PostgreSQL database. 214 215 - ``--with-cql`` 216 Build Kea with code to allow it to store leases and host reservations 217 in a Cassandra (CQL) database. Support for Cassandra is now deprecated. 218 219 - ``--with-log4cplus`` 220 Define the path to find the Log4cplus headers and libraries. Normally 221 this is not necessary. 222 223 - ``--with-boost-include`` 224 Define the path to find the Boost headers. Normally this is not 225 necessary. 226 227 - ``--with-botan-config`` 228 Specify the path to the botan-config script to build with Botan for 229 cryptographic functions. It is preferable to use OpenSSL (see below). 230 231 - ``--with-openssl`` 232 Use the OpenSSL cryptographic library instead of Botan. By default 233 ``configure`` searches for a valid Botan installation; if one is not 234 found, Kea searches for OpenSSL. Normally this is not necessary. 235 236 - ``--enable-shell`` 237 Build the optional ``kea-shell`` tool (more in :ref:`kea-shell`). 238 The default is to not build it. 239 240 - ``--with-site-packages`` 241 Only useful when ``kea-shell`` is enabled, this switch causes the kea-shell 242 Python packages to be installed in the specified directory. This is 243 mostly useful for Debian-related distributions. While most systems store 244 Python packages in ``${prefix}/usr/lib/pythonX/site-packages``, Debian 245 introduced a separate directory for packages installed from DEB. Such 246 Python packages are expected to be installed in 247 ``/usr/lib/python3/dist-packages``. 248 249 - ``--enable-perfdhcp`` 250 Build the optional ``perfdhcp`` DHCP benchmarking tool. The default 251 is to not build it. 252 253 - ``--with-freeradius`` 254 Build the optional ``RADIUS`` hook. This option specifies the path to the 255 patched version of the FreeRADIUS client. This feature is available in 256 the subscriber-only version of Kea, and requires the subscription-only RADIUS hook. 257 258 - ``--with-freeradius-dictionary`` 259 Specify a non-standard location for a FreeRADIUS dictionary file, which 260 contains a list of supported RADIUS attributes. This feature is available in 261 the subscriber-only version of Kea, and requires the subscription-only RADIUS hook. 262 263If the RADIUS options are not available, ensure that the RADIUS hook sources are in 264the ``premium`` directory and rerun ``autoreconf -i``. 265 266.. note:: 267 268 For instructions concerning the installation and configuration of 269 database backends for Kea, see :ref:`dhcp-install-configure`. 270 271There are many options that are typically not necessary for 272regular users. However, they may be useful for package maintainers, 273developers, or people who want to extend Kea code or send patches: 274 275 - ``--with-gtest``, ``--with-gtest-source`` 276 Enable the building of C++ unit tests using the Google Test 277 framework. This option specifies the path to the gtest source. (If 278 the framework is not installed on the system, it can be downloaded 279 from https://github.com/google/googletest.) 280 281 - ``--enable-generate-docs`` 282 Enable the rebuilding of Kea documentation. ISC publishes Kea 283 documentation for each release; however, in some cases it may be 284 desirable to rebuild it: for example, to change something in the 285 docs, or to generate new ones from git sources that are not yet 286 released. 287 288 - ``--enable-generate-parser`` 289 Enable the generation of parsers using flex or bison. Kea sources include 290 .cc and .h parser files, pre-generated for users' convenience. By 291 default Kea does not use flex or bison, to avoid 292 requiring installation of unnecessary dependencies for users. 293 However, if anything in the parsers is changed (such as adding a new 294 parameter), flex and bison are required to regenerate 295 parsers. This option permits that. 296 297 - ``--enable-generate-messages`` 298 Enable the regeneration of messages files from their messages source 299 files, e.g. regenerate xxx_messages.h and xxx_messages.cc from 300 xxx_messages.mes using the Kea message compiler. By default Kea is 301 built using these .h and .cc files from the distribution. However, if 302 anything in a .mes file is changed (such as adding a new message), 303 the Kea message compiler needs to be built and used. This option 304 permits that. 305 306 - ``--with-benchmark``, ``--with-benchmark-source`` 307 Enable the building of the database backend benchmarks using the 308 Google Benchmark framework. This option specifies the path to the 309 gtest source. (If the framework is not installed on the system, it 310 can be downloaded from https://github.com/google/benchmark.) 311 This support is experimental. 312 313As an example, the following command configures Kea to find the Boost 314headers in /usr/pkg/include, specifies that PostgreSQL support should be 315enabled, and sets the installation location to /opt/kea: 316 317.. code-block:: console 318 319 $ ./configure \ 320 --with-boost-include=/usr/pkg/include \ 321 --with-pgsql=/usr/local/bin/pg_config \ 322 --prefix=/opt/kea 323 324Users who have any problems with building Kea using the header-only Boost 325code, or who would like to use the Boost system library (assumed for the 326sake of this example to be located in /usr/pkg/lib), should issue these 327commands: 328 329.. code-block:: console 330 331 $ ./configure \ 332 --with-boost-libs=-lboost_system \ 333 --with-boost-lib-dir=/usr/pkg/lib 334 335If ``configure`` fails, it may be due to missing or old dependencies. 336 337When ``configure`` succeeds, it displays a report with the parameters used 338to build the code. This report is saved into the file ``config.report`` 339and is also embedded into the executable binaries, e.g., ``kea-dhcp4``. 340 341Build 342----- 343 344After the configure step is complete, build the executables from the C++ 345code and prepare the Python scripts by running the command: 346 347.. code-block:: console 348 349 $ make 350 351Install 352------- 353 354To install the Kea executables, support files, and documentation, issue 355the command: 356 357.. code-block:: console 358 359 $ make install 360 361Do not use any form of parallel or job server options (such as GNU 362make's ``-j`` option) when performing this step; doing so may cause 363errors. 364 365.. note:: 366 367 The install step may require superuser privileges. 368 369If required, run ``ldconfig`` as root with ``/usr/local/lib`` (or with 370prefix/lib if configured with ``--prefix``) in ``/etc/ld.so.conf`` (or the 371relevant linker cache configuration file for the OS): 372 373.. code-block:: console 374 375 $ ldconfig 376 377.. 378 379.. note:: 380 381 If ``ldconfig`` is not run where required, users may see 382 errors like the following: 383 384 :: 385 386 program: error while loading shared libraries: libkea-something.so.1: 387 cannot open shared object file: No such file or directory 388 389 390Cross-Building 391-------------- 392 393It is possible to cross-build Kea, i.e. to create binaries in a separate 394system (the ``build`` system) from the one where Kea runs 395(the ``host`` system). 396 397It is outside of the scope of common administrator operations and requires 398some developer skills, but the Developer Guide explains how to do that 399using an x86_64 Linux system to build Kea for a Raspberry Pi box running 400Raspbian: `Kea Cross-Compiling Example 401<https://reports.kea.isc.org/dev_guide/de/d9a/crossCompile.html>`__. 402 403.. _dhcp-install-configure: 404 405DHCP Database Installation and Configuration 406============================================ 407 408Kea stores its leases in a lease database. The software has been written 409in a way that makes it possible to choose which database product should 410be used to store the lease information. Kea supports four 411database backends: MySQL, PostgreSQL, Cassandra[1], and memfile. To limit 412external dependencies, MySQL, PostgreSQL, and Cassandra support are 413disabled by default and only memfile is available. Support for the 414optional external database backend must be explicitly included when Kea 415is built. This section covers the building of Kea with one of the 416optional backends and the creation of the lease database. 417 418[1] As of Kea 1.9.9, support for Cassandra is deprecated. 419 420.. note:: 421 422 When unit tests are built with Kea (i.e. the ``--with-gtest`` configuration 423 option is specified), the databases must be manually pre-configured 424 for the unit tests to run. The details of this configuration can be 425 found in the `Kea Developer's 426 Guide <https://reports.kea.isc.org/dev_guide/>`__. 427 428Building with MySQL Support 429--------------------------- 430 431Install MySQL according to the instructions for the system. The client 432development libraries must be installed. 433 434Build and install Kea as described in :ref:`installation`, 435with the following modification. To enable the MySQL database code, at the 436"configure" step (see :ref:`configure`), the ``--with-mysql`` switch should be 437specified: 438 439.. code-block:: console 440 441 $ ./configure [other-options] --with-mysql 442 443If MySQL was not installed in the default location, the location of the 444MySQL configuration program "mysql_config" should be included with the 445switch: 446 447.. code-block:: console 448 449 $ ./configure [other-options] --with-mysql=path-to-mysql_config 450 451See :ref:`mysql-database-create` for details regarding MySQL 452database configuration. 453 454Building with PostgreSQL support 455-------------------------------- 456 457Install PostgreSQL according to the instructions for the system. The 458client development libraries must be installed. Client development 459libraries are often packaged as "libpq". 460 461Build and install Kea as described in :ref:`installation`, 462with the following modification. To enable the PostgreSQL database code, at the 463"configure" step (see :ref:`configure`), the ``--with-pgsql`` switch should be 464specified: 465 466.. code-block:: console 467 468 $ ./configure [other-options] --with-pgsql 469 470If PostgreSQL was not installed in the default location, the location of 471the PostgreSQL configuration program "pg_config" should be included with 472the switch: 473 474.. code-block:: console 475 476 $ ./configure [other-options] --with-pgsql=path-to-pg_config 477 478See :ref:`pgsql-database-create` for details regarding PostgreSQL 479database configuration. 480 481Building with CQL (Cassandra) Support 482------------------------------------- 483 484As of Kea 1.9.9, support for Cassandra is deprecated. It is still 485available in current versions, but the support will be removed in a future 486version; new users are encouraged to choose an alternative. 487 488Install Cassandra according to the instructions for the system. The 489Cassandra project website contains useful pointers: 490https://cassandra.apache.org. 491 492If a cpp-driver package is available as binary or as source, 493simply install or build and install the package. Then build and install 494Kea as described in :ref:`installation`. To enable the 495Cassandra (CQL) database code, at the "configure" step (see :ref:`configure`), enter: 496 497.. code-block:: console 498 499 $ ./configure [other-options] --with-cql=path-to-pkg-config 500 501If ``pkg-config`` is at its standard location (and thus in the 502shell path), the path does not need to be specified. If it does not work 503(e.g. no pkg-config, package not available in pkg-config with the 504cassandra name), the ``cql_config`` script in the tools/ directory 505can still be used as described below. 506 507Download and compile cpp-driver from DataStax. For details regarding 508dependencies for building cpp-driver, see the project homepage 509https://github.com/datastax/cpp-driver. 510 511.. code-block:: console 512 513 $ git clone https://github.com/datastax/cpp-driver.git 514 $ cd cpp-driver 515 $ mkdir build 516 $ cd build 517 $ cmake .. 518 $ make 519 520Kea's cpp-driver does not include the cql_config script. A 521cql_config script is present in the tools/ directory of the Kea sources. 522Before using it, please create a cql_config_defines.sh file in the same 523directory (there is an example available in cql_config_define.sh.sample; 524copy it over to cql_config_defines.sh and edit the path 525specified in it) and change the environment variable CPP_DRIVER_PATH to 526point to the directory where the cpp-driver sources are located. Make 527sure that appropriate access rights are set on this file; it should be 528executable by the system user building Kea. 529 530Build and install Kea as described in :ref:`installation`, 531with the following modification. To enable the Cassandra (CQL) database 532code, at the "configure" step (see :ref:`configure`), enter: 533 534.. code-block:: console 535 536 $ ./configure [other-options] --with-cql=path-to-cql_config 537 538 539 540.. include:: hammer.rst 541 542.. _non-root: 543 544Running Kea From a Non-root Account on Linux 545============================================ 546 547Both Kea DHCPv4 and DHCPv6 servers perform operations that in general require root access 548privileges. In particular, DHCPv4 opens raw sockets and both DHCPv4 and DHCPv6 open UDP sockets on 549privileged ports. However, with some extra system configuration, it is possible to run Kea from 550non-root accounts. 551 552First, a regular user account must be created: 553 554.. code-block:: console 555 556 useradd admin 557 558Then, change the binaries' ownership and group to the new user. Note that 559the specific path may be different. Please refer to the ``--prefix`` 560parameter passed to the configure script: 561 562.. code-block:: console 563 564 chown -R admin /opt/kea 565 chgrp -R admin /opt/kea 566 chown -R admin /var/log/kea-dhcp4.log 567 chgrp -R admin /var/log/kea-dhcp4.log 568 chown -R admin /var/log/kea-dhcp6.log 569 chgrp -R admin /var/log/kea-dhcp6.log 570 571If using systemd, modify its service file 572(e.g. /etc/systemd/system/kea-dhcp6.service): 573 574.. code-block:: console 575 576 User=admin 577 Group=admin 578 579The most important step is to set the capabilities of the binaries. Refer to `man capabilities` to get 580more information. 581 582.. code-block:: console 583 584 setcap 'cap_net_bind_service,cap_net_raw=+ep' /opt/kea/sbin/kea-dhcp4 585 setcap 'cap_net_bind_service=+ep' /opt/kea/sbin/kea-dhcp6 586 587If using systemd, also add this to the service file 588(e.g. /etc/systemd/system/kea-dhcp6.service): 589 590.. code-block:: console 591 592 ExecStartPre=setcap 'cap_net_bind_service=+ep' /opt/kea/sbin/kea-dhcp6 593 594After this step is complete, the admin user should be able to run Kea. Note that the DHCPv4 server by 595default opens raw sockets. If the network is only using relayed traffic, Kea can be instructed to 596use regular UDP sockets (refer to ``dhcp-socket-type`` parameter in the 597:ref:`dhcp4-interface-configuration` section) and the ``cap_net_raw`` capability can be skipped. 598 599.. note:: 600 601 It is possible to avoid running Kea with root privileges by instructing Kea to 602 use non-privileged (greater than 1024) ports and redirecting traffic. This, however, only works 603 for relayed traffic. This approach in general is considered experimental and has not been tested 604 for deployment in production environments. Use with caution! 605 606 To use this approach, configure the server to listen on other non-privileged ports (e.g. 1547 607 and 1548) by running the process with the ``-p`` option in ``/etc/systemd/system/kea-dhcp4.service``: 608 609.. code-block:: console 610 611 ExecStart=/opt/kea/sbin/kea-dhcp4 -d -c /etc/kea/kea-dhcp4.conf -p 2067 612 613and ``/etc/systemd/system/kea-dhcp4.service``: 614 615.. code-block:: console 616 617 ExecStart=/opt/kea/sbin/kea-dhcp6 -d -c /etc/kea/kea-dhcp6.conf -p 1547 618 619Then configure port redirection with iptables and ip6tables for new ports (e.g. 1547 620and 1548). Be sure to replace ``ens4`` with the specific interface name. 621 622.. code-block:: console 623 624 iptables -t nat -A PREROUTING -i ens4 -p udp --dport 67 -j REDIRECT --to-port 2067 625 iptables -t nat -A PREROUTING -i ens4 -p udp --dport 2068 -j REDIRECT --to-port 68 626 ip6tables -t nat -A PREROUTING -i ens4 -p udp --dport 547 -j REDIRECT --to-port 1547 627 ip6tables -t nat -A PREROUTING -i ens4 -p udp --dport 1548 -j REDIRECT --to-port 548 628 629.. _deprecated: 630 631Deprecated Features 632=================== 633 634This section lists significant features that have been or will be removed. We try to 635deprecate features before removing them to signal 636to current users to plan a migration. New users should not rely on deprecated features. 637 638Cassandra (CQL) Support 639----------------------- 640 641Cassandra is a non-relational NoSQL database. Kea added support for the CQL lease backend in 642Kea 1.1.0-beta1 and the CQL host backend in 1.4.0-beta1. This feature never gained much 643traction with users, particularly compared to the level of interest in and deployments of 644the alternatives, MySQL and PostgreSQL. 645 646The non-relational nature of Cassandra makes it exceedingly difficult to implement more complex 647DHCP features, such as the configuration backend. Cassandra also introduces performance degradation, 648is complicated to set up, and is an ongoing maintenance burden. 649 650Cassandra support is deprecated as of Kea 1.9.9. The feature will 651function as before in the Kea 2.0.x and 2.1.x series, but will print a warning. The 652feature will be removed entirely in a future release. 653 654Sysrepo 0.x 655----------- 656 657Kea versions 1.9.9 and earlier required Sysrepo 0.7.x to run, when optional support for NETCONF was 658enabled. Kea versions 1.9.10 and later now require Sysrepo 1.4.x and the related libyang 1.x library to 659run. The earlier Sysrepo versions are no longer supported. The latest Sysrepo 2.x version does not 660provide C++ bindings, and as such, is not usable for Kea. 661