Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kea 3.0, our first LTS version

isc.org

Post reply on HN
Print view View original

41–50 of 50 posts

Re: Kea 3.0, our first LTS version

#41

Post by vlowther »

bc569a80a344f9c wrote: post #33
gertrunde wrote: post #8

Earlier quoted context omitted.

As others have said, Kea is a DHCP server. More than that, it is an ISC project, is the successor to ISC DHCP (now end-of-life & unsupported for a few years), and weirdly started out as part of BIND 10. Ref: https://www.isc.org/dhcphistory/#the-kea-dhcp-server (And I vaguely recall it's used as the DHCP component in a few other things, like maybe Infoblox).

Would be nice if Infoblox used Kea instead of dhcpd, that way you could change DHCP reservations without having to restart the services to have it take effect.

That sort of thing is why I wrote my own DHCPv4 server that is directly integrated with the core product at $DAYJOB. 10 years ago. Having the DHCP server determine how to handle PXE requests straight from the machine database made my life so much simpler.

Re: Kea 3.0, our first LTS version

#42

Post by tok1 »

JdeBP wrote: post #32
kjellsbells wrote: post #17

Earlier quoted context omitted.

I remember Dan Bernstein (djb) being scathing about BIND. To the extent of writing his own DNS suite. Is that all ancient history now?

No. Kea is making several of the same mistakes all over again, despite being in a good position to have learned from them. It yet again runs as the superuser serving requests from potentially hostile clients. In fairness, a lot of DHCP servers do this; but Kea development was in a position to have learned the ideas about using unprivileged dæmons, having started years later than them. Instead, its documented approach…

> Instead, its documented approach to running as some other account is to add some of the superuser's privileges to Kea [...]

Not disagreeing, just want to mention that Kea can run fine without privileges, which is also documented at the link provided. Key is to use DHCP relaying, a technique which becomes relevant quickly in larger setups anyways because you cannot (or don't want to) give the DHCP server access to all subnets: Instead of the DHCP server(s) processing local requests, DHCP relaying agents encapsulate and unicast-forward the whole DHCP request-response traffic to centralized DHCP instance(s). Those relaying agents (on switches/routers) do require privileges but potentially posing a smaller attack surface due to being much simpler. Sadly, ISC has not made a successor dhcprelay as part of Kea, but luckily systemd-networkd implements the RelayTarget parameter, adding this capability (at least for IPv4).

Re: Kea 3.0, our first LTS version

#43

Post by sjm-lbm »

Helmut10001 wrote: post #24
kayson wrote: post #11

I wonder when this will make it into pfsense... The transition to kea has been a bit of a mess with tons of bugs. Thankfully it's controlled by an option, and it seems like 2.8.0 knocked out quite a few of them

I have been using Kea on pfSense CE for a long time — I think it was version 23.0.x. Or you mean 3.0 in particular? I also have OPNsense and I am not completely convinced of their aggressive update strategy yet. For a firewall, I prefer stability over features. Jumping to the newest releases every month can have tradeoffs. Note: in general, both OPNsense and pfSense are excellent. I have never had any problems with e…

I use pfSense CE, and rely on DNS entries to be automatically created for DHCP addresses. That worked fine for more than a decade, until they made Kea the default a couple of years ago (or did they just put a bunch of notices in the interface that old DHCPd was deprecated? It's been long enough that I don't remember).

Anyway, at the time Kea (at least in pfSense) wasn't able to do that, which caused things to break for me for a bit. It's a small thing (and, I mean, totally fair with free software) but the fact that they pushed an update to Kea before Kea (again, at least in pfSense) was at feature parity rubbed me the wrong way and has kept me from using it since then.

(edit: on the off chance anyone cares, I decided to check and it looks like this issue has been fixed as of pfSense CE 2.8.)

Re: Kea 3.0, our first LTS version

#45

Post by hu3 »

righthand wrote: post #40
rapnie wrote: post #35

I observe how so many of these kinds of release announcements do not start the text with a brief line introducing the project. I had never heard of Kea and clicked through out of curiosity, but that info is yet another click away: Kea is a "Modern, open source DHCPv4 & DHCPv6 server".

Copy paste that phrase on every piece of content to save you a click? Why would you describe a project on a > v1 release announcement? After v1 the project has been introduced, no reason to continuously reintroduce it because someone might eventually add it to their zeitgeist.

> Copy paste that phrase on every piece of content to save you a click?

Yes please.

Re: Kea 3.0, our first LTS version

#46

Post by cmeacham98 »

joh6nn wrote: post #36
rapnie wrote: post #35

I observe how so many of these kinds of release announcements do not start the text with a brief line introducing the project. I had never heard of Kea and clicked through out of curiosity, but that info is yet another click away: Kea is a "Modern, open source DHCPv4 & DHCPv6 server".

Right? I find submissions titles like this so frustrating: it's simply not possible to be aware of every project out there. Please, please provide me some context in the title. This would be way better with a title something like "ISC releases KEA DHCP server 3.0 as LTS"

The HN guidelines state to use the original title "unless it is misleading or clickbait", which is why this happens.

Re: Kea 3.0, our first LTS version

#47

Post by blamazon »

kayson wrote: post #11

I wonder when this will make it into pfsense... The transition to kea has been a bit of a mess with tons of bugs. Thankfully it's controlled by an option, and it seems like 2.8.0 knocked out quite a few of them

I've tried a few times to switch to Kea in PFsense but it crashes my network fiercely.

Re: Kea 3.0, our first LTS version

#50

Post by [deleted] »

latchkey wrote: post #28
kaladin-jasnah wrote: post #16

Earlier quoted context omitted.

Wow, I didn't know the BC250s were used at such scale. I bought two to play with for dirt cheap, but haven't gotten around to it yet. Are they primarily used for mining?

We used them for mining ethereum, but no longer. There is a good fairly easily discovered discord out there for enthusiasts.

[deleted]
Post reply on HN