Droms R. The DHCP handbook

Подождите немного. Документ загружается.

• If the server is dumping core, a stack trace the debugger. For example, if your

debugger is

gdb, perform the following:

gdb dhcpd dhcpd.core

(gdb) where

[...]

(gdb) quit

This assumes that you’re debugging the DHCP server and that the core file is in

dhcpd.core.

• If you can get one, a trace file. Trace files do not work with failover, but they

do work without it. A trace file contains a complete replay log of the DHCP

server’s transactions, and often, the trace file can be used to precisely reproduce

a problem. You should play the trace file back yourself before you send it in, to

make sure it does reproduce your problem, and if the file is large, ask before

sending it. Also, bear in mind that the file contains your complete server

configuration, so if there is information in your configuration that you do not

want to share with other participants on the ISC mailing lists, you should wait

until someone from the ISC asks you for the trace file, and send it just to that

person.

• Finally, when you ask for help with the ISC DHCP server, remember that you

are asking for a favor from people who may not have time to help you. It is

somewhat discouraging to have to say this, but frequently people are very

upset when nobody will help them with their ISC DHCP problems. This is free

software, and at least at the time of this writing, there is nobody who is being

paid to work on it. If you don’t get an answer, you have to figure out the

problem for yourself. Don’t spam the mailing list with repeated copies of the

same message, and don’t send flaming diatribes about the poor service. If you

want good service, you can purchase one of a number of DHCP servers.

Installing the ISC DHCP Distribution

To use the ISC DHCP distribution, you must unpack the distribution, configure it for

your system, build it, and install it.

Unpacking the Distribution

To unpack the ISC DHCP distribution, you must connect to a directory on a filesys-

tem that has about 12MB of free space. Then you must use the

gunzip command to

uncompress the tar file and use the

tar command to extract its contents, as shown

in Example 14.1.

CHAPTER 14 The ISC DHCP Server226

018 3273 CH14 10/3/02 5:02 PM Page 226

Example 14.1

% gunzip <dhcp-3.0.1.tar.gz |tar xf -

The tar command extracts the distribution into a directory with the name of the

distribution you are building. In the preceding example, this is

dhcp-3.0.1.

Configuring the Distribution

To configure the distribution, you need to connect to the directory that the

tar

command extracted. Use the configure command to configure the distribution, as

shown in Example 14.2.

Example 14.2

% cd dhcp-3.0.1

% ./configure

System Type: netbsd

If the configure command indicates that it is unfamiliar with the system you are

using, you must configure the DHCP distribution yourself or ask for help on the ISC

DHCP server mailing list.

Building the Distribution

After you unpack the distribution, you must build it. To build it, simply type

make, as

shown in Example 14.3. In this example, many lines of output were deleted and

replaced with ellipses to save space. However, the example does show part of the

output of the

make command, to give you an idea of what to expect.

Example 14.3

% make

Making all in common

cc -g -I.. -I../includes -Wall -Wstrict-prototypes -Wno-unused -Wno-implicit -

Wno-comment -Wno-uninitialized -Werror -Wno-switch -pipe -c raw.c

[...]

rm -f libdhcp.a

ar cruv libdhcp.a raw.o parse.o nit.o icmp.o dispatch.o conflex.o upf.o bpf.o s

ocket.o lpf.o dlpi.o packet.o memory.o print.o options.o inet.o convert.o tre

e.o tables.o hash.o alloc.o errwarn.o inet_addr.o dns.o resolv.o execute.o dis

cover.o auth.o

Obtaining the ISC DHCP Server 227

018 3273 CH14 10/3/02 5:02 PM Page 227

[...]

ranlib libdhcp.a

Making all in server

cc -g -I.. -I../includes -Wall -Wstrict-prototypes -Wno-unused -Wno-implicit -

Wno-comment -Wno-uninitialized -Werror -Wno-switch -pipe -c dhcpd.c

[...]

cc -o dhcpd dhcpd.o dhcp.o bootp.o confpars.o db.o class.o failover.o ../commo

n/libdhcp.a

Making all in client

cc -g -I.. -I../includes -Wall -Wstrict-prototypes -Wno-unused -Wno-implicit -

Wno-comment -Wno-uninitialized -Werror -Wno-switch -pipe -c dhclient.c

cc -o dhclient dhclient.o clparse.o ../common/libdhcp.a

Making all in relay

cc -g -I.. -I../includes -Wall -Wstrict-prototypes -Wno-unused -Wno-implicit -

Wno-comment -Wno-uninitialized -Werror -Wno-switch -pipe -c dhcrelay.c

cc -o dhcrelay dhcrelay.o ../common/libdhcp.a

NOTE

The make command should complete without errors, but some operating systems might give

warning messages. This might occur because of differences between the vendor’s C library

and the POSIX and ANSI standards, or, more likely, because of differences in areas not covered

by the standards. For operating systems that the ISC DHCP distribution currently supports,

warnings you might see generally do not represent actual problems about which you should

be concerned. If you have concerns, you can raise them on the ISC mailing list. The ISC’s goal

is for warnings to be eliminated in all compiles on all architectures.

If the make command fails with an error, it could be because the version of the DHCP

distribution you are using wasn’t tested on the architecture on which you are

compiling, or it could be because you have a nonstandard compiler setup. Make sure

the problem is not with your installation before you ask for help on the mailing list.

You should also make sure you are using the most recent distribution of the release

cycle you’re trying to build. For example, don’t ask for help compiling 2.0b1pl27 (a

beta test snapshot) when 2.0pl2 (that is, two patchlevels after the end of the beta

test) is available. However, if you are sure you are using the most recent distribution

and you can’t get it to compile, you are encouraged to ask for help.

CHAPTER 14 The ISC DHCP Server228

Example 14.3 Continued

018 3273 CH14 10/3/02 5:02 PM Page 228

Installing the Distribution

After you build the distribution, you can install it on your system by using the

make

install command. This installs the entire distribution: the client, the server, and the

relay agent, as well as all the documentation. If you want to install only the server,

or if you want to install in a special location, you can locate the executables within

the build tree and copy them to the correct places yourself. Example 14.4 shows a

sample installation.

Example 14.4

% su

Password:

# make install

Installing in common

for dir in /usr/share/man/cat5; do foo=””; for bar in `echo ${dir} |tr / ‘ ‘`;

do foo=${foo}/$bar; if [ ! -d $foo ]; then mkdir $foo; chmod 755 $foo; fi

; done; done

install -c dhcp-options.cat5 /usr/share/man/cat5/dhcp-options.0

install -c dhcp-eval.cat5 /usr/share/man/cat5/dhcp-eval.0

install -c dhcp-contrib.cat5 /usr/share/man/cat5/dhcp-contrib.0

Installing in server

for dir in /usr/sbin /usr/share/man/cat8 /usr/share/man/cat5 /var/db; do foo=”

“; for bar in `echo ${dir} |tr / ‘ ‘`; do foo=${foo}/$bar; if [ ! -d $foo ];

then mkdir $foo; chmod 755 $foo; fi; done; done

install -c -m 444 dhcpd /usr/sbin

chmod 755 /usr/sbin/dhcpd

install -c dhcpd.cat8 /usr/share/man/cat8/dhcpd.0

install -c dhcpd.conf.cat5 /usr/share/man/cat5/dhcpd.conf.0

install -c dhcpd.leases.cat5 /usr/share/man/cat5/dhcpd.leases.0

Installing in client

nroff -man dhclient.man8 >dhclient.man8

for dir in /sbin /etc /usr/share/man/cat5 /usr/share/man/cat8 /var/db; do foo

=””; for bar in `echo ${dir} |tr / ‘ ‘`; do foo=${foo}/$bar; if [ ! -d $foo

]; then mkdir $foo; chmod 755 $foo; fi; done; done

install -c -m 444 dhclient /sbin

chmod 755 /sbin/dhclient

if [ xnetbsd = xnone ]; then echo “No client script available.”; else instal

l -c -m 444 scripts/netbsd /etc/dhclient-script; chmod 700 /etc/dhclient-scri

pt; fi

install -c dhclient.cat8 /usr/share/man/cat8/dhclient.0

install -c dhclient-script.cat8 /usr/share/man/cat8/dhclient-script.0

install -c dhclient.conf.cat5 /usr/share/man/cat5/dhclient.conf.0

install -c dhclient.leases.cat5 /usr/share/man/cat5/dhclient.leases.0

Obtaining the ISC DHCP Server 229

018 3273 CH14 10/3/02 5:02 PM Page 229

Installing in relay

for dir in /usr/sbin /usr/share/man/cat8; do foo=””; for bar in `echo ${dir}

| tr / ‘ ‘`; do foo=${foo}/$bar; if [ ! -d $foo ]; then mkdir $foo; chmod 7

55 $foo; fi; done; done

install -c -m 444 dhcrelay /usr/sbin

chmod 755 /usr/sbin/dhcrelay

install -c dhcrelay.cat8 /usr/share/man/cat8/dhcrelay.0

# exit

Vendor-Supplied Versions of the ISC DHCP Distribution

Your operating system vendor might supply a version of the ISC DHCP server in its

distribution. It would be nice if you could use this version because then you would

not have to go through the steps described previously. Unfortunately, even vendors

that do include the ISC DHCP distribution with their operating systems typically do

not include the most recent version, for the simple reason that the most recent

stable version that was available when they released their operating system distribu-

tion has since been superseded by a new version. Before you use a vendor’s version

of the DHCP server, it’s best to go straight to the ISC and see that the version the

vendor is shipping doesn’t have known bugs. The ISC Web page for any given

version of the DHCP distribution includes a complete history of the changes that

were made. You can follow that history back to the version you have from your

operating system vendor and see whether any significant changes were made. The

ISC also provides pointers to RPMs that are available for popular versions of Linux;

these RPMs help you easily install the most up-to-date software.

Example 14.5 shows how you can tell what version of the DHCP server you currently

have installed. The version number is printed at the end of the first line of output.

(If you don’t have a configuration file yet, this command prints an error message

after it gives you the release information, but you can ignore the error message for

now.)

Example 14.5

% dhcpd -t

Internet Software Consortium DHCP Server V3.0-alpha 980424

CHAPTER 14 The ISC DHCP Server230

Example 14.4 Continued

018 3273 CH14 10/3/02 5:02 PM Page 230

Configuring System Logging for the ISC DHCP Distribution

The DHCP server logs status information and errors by using the syslog application

programming interface (API). The syslog API provides a way for Unix server programs

running as daemons to log events to a centralized event logging daemon,

syslogd.

You configure this daemon through the

/etc/syslog.conf file. The syslog API

enables each information provider to specify a facility code, indicating a rough cate-

gory into which it falls. The ISC DHCP server normally classifies itself in the daemon

category, as do such other daemons as the name server and the Network Time

Protocol (NTP) server.

Some sites prefer to keep the DHCP logs separate. If you want to do this, you can

change the facility that the DHCP server reports using the

log-facility statement

in the

dhcpd.conf file. For example, to log on to the local1 log facility, you would

add the following to your

dhcpd.conf file:

log-facility local1;

In addition, you would need to add the following to your /etc/syslog.conf file:

local1.info /var/log/dhcp.log;

In this case, local1 is the log facility, and info is the log level. A log level of info

indicates that the server should log details of each DHCP transaction. This might be

more information than you need. To limit logging to only messages that describe

errors that have occurred, use the

error log level instead. The syslog daemon does

not create a log file for you; you must create the file yourself and then restart

syslogd. syslogd then begins to write log messages to the log file.

Prerequisites to Operation of the ISC DHCP Server

The DHCP server is implemented so that if it detects something inconsistent about

its configuration, it refuses to operate. This is because a misconfigured DHCP server

can potentially cause more harm to a network than simply having no DHCP server

at all. Version 3 of the server requires that you explicitly enable any features that

can potentially cause problems. This prevents these features from being enabled

accidentally.

The Lease Database

Before invoking the DHCP server, you must create an empty lease database file for it.

On a Unix or Unix-like machine, you can do this by typing

touch file, in which

file is the full path and name of the lease database file.

Prerequisites to Operation of the ISC DHCP Server 231

018 3273 CH14 10/3/02 5:02 PM Page 231

The DHCP server stores its lease database as an ASCII text file, much like its configu-

ration file. The lease database file contains the DHCP server’s entire knowledge of

what it promised to its clients, and thus is very important. The DHCP server does not

operate if it detects conditions that suggest that by doing so it will lose information

from the lease file.

When the DHCP server rewrites the lease database to remove obsolete entries, it does

so by creating a temporary file called

dhcpd.leases.pid (where pid is the process ID

of the DHCP server when it creates the new lease file), writing a complete lease data-

base into that file, renaming the old lease file with the backup filename

dhcpd.leases~, and renaming the new database with the old name.

If the system crashes just as this renaming operation occurs, some of the filesystem

directory information might update prior to the crash, but some might not. This can

result in there being a new copy of the lease database in

dhcpd.leases.pid and an

old database in

dhcpd.leases~, but no lease file called dhcpd.leases.

This scenario should not ever happen on a POSIX-compliant Unix system because

the DHCP server uses the

rename system call to perform an atomic operation, renam-

ing the lease file, but because the lease file is so important, the DHCP server doesn’t

make the assumption that the rename system call is POSIX compliant (it is better to

confuse someone who is trying to get the DHCP server working for the first time

than it is to accidentally delete the contents of the lease database, even though this

is an extremely unlikely occurrence).

To the DHCP server, this condition can’t be safely distinguished from the situation in

which you have just installed the DHCP server and do not yet have a lease. As a

result, the DHCP server never creates a lease database file on its own. It always insists

that you do it. If you try to start the server without first creating a lease database file,

it displays an error message similar to the one shown in Example 14.6.

Example 14.6

Can’t open lease database /tmp/dhcpd.leases: No such file or directory

Check for failed database rewrite attempt!

Please read the dhcpd.leases man page if you don’t know what to do about this.

Only leases for clients whose IP addresses have been dynamically allocated are

recorded in the

dhcpd.leases file. A client whose IP address comes from a fixed-

address declaration will never appear in the lease database. So if your DHCP server

does only static allocation, the lease file will always be empty.

CHAPTER 14 The ISC DHCP Server232

018 3273 CH14 10/3/02 5:02 PM Page 232

The Configuration File

The DHCP configuration file is described in this chapter and previous chapters. You

must include the following in the DHCP server’s configuration file, or the server will

not operate:

• Complete subnet declarations for all network segments on which the server

provides service

• IP addresses for all clients for which the server provides service

• Complete subnet declarations for all network segments to which the server

computer’s network interfaces are connected

• Statements about whether the server is authoritative for any given subnet

•A

ddns-update-style statement

You must declare every network segment to which clients served by the DHCP server

are attached. Even if every client you are serving has a

fixed-address statement, the

server still needs to know the configuration of the network segments: the subnet

number of each segment and each segment’s subnet mask. If more than one subnet

exists on a given network segment, every subnet on that network segment must be

explicitly declared—not just the subnet or subnets the DHCP server serves. All

subnets on a given network segment should be enclosed within a

shared-network

statement. This is explained in greater detail in Chapter 15.

IP Addresses

You must provide IP addresses for the server to assign for all clients you want to

serve. If you are providing static IP address assignments, you must have a

host decla-

ration for every client on every network segment to which the client might ever be

connected. Static assignments are described in detail in Chapter 16, “Client

Identification and Fixed-Address Allocation.”

If you are providing pools of addresses from which the server dynamically allocates

addresses to clients, you must declare these pools by using

pool declarations. These

pool declarations must appear within subnet or shared-network declarations. Each

pool

declaration must contain at least one range statement, listing a range of one or

more addresses that the server can allocate from the pool. Dynamic allocation is

covered in Chapter 15. Address pools are covered in Chapter 20, “Conditional

Behavior.”

The Network Segment Declaration

DHCP servers are commonly deployed in such a way that the network segment or

segments to which they are connected do not require DHCP service or receive DHCP

service from other servers. The configurations of these network segments must still

be declared; otherwise, the DHCP server can’t behave correctly.

Prerequisites to Operation of the ISC DHCP Server 233

018 3273 CH14 10/3/02 5:02 PM Page 233

If the network to which the DHCP server is connected is a machine room network

segment on which no DHCP service is needed, it is sufficient to provide complete

declarations for the network segment. If there is only one subnet on this network

segment, a

subnet declaration is sufficient. If there is more than one subnet on this

network segment, you must write a

shared-network declaration that contains empty

subnet declarations for all the subnets that are configured on the network segment.

Statements of Authority

The server configuration file needs to have a statement of authority for each

subnet

or shared-network declaration for which the default authority is incorrect. If the

server’s authority is the same on all configured network segments, it can be stated in

the global scope.

Version 3 of the ISC DHCP server assumes that it does not have complete informa-

tion about the configurations of the subnets it is serving or about other subnets of

which it is aware but on which it is not providing service. This means that if a client

is moved from one network segment to another and sends a

DHCPREQUEST message

for an address on its former subnet, the server does not send a

DHCPNAK message, so

the client continues to use the incorrect address until it can no longer renew its

lease. DHCP servers deployed in production environments should simply state that

they are authoritative in the global scope so that proper

DHCPNAK behavior occurs.

DHCP servers that are authoritative for some network segments and not for others

should state that they are authoritative in those scopes.

If the computer on which the DHCP server is running is connected to a network

segment that is not controlled by the network administrator who operates the DHCP

server, the DHCP server should be configured not to be authoritative for that

network segment. To do this, use

not authoritative; in the subnet or shared-

network declaration for that network segment.

Configuring the ISC DHCP Server

The DHCP server configuration is stored in the /etc/dhcpd.conf file. This file is an

ASCII text file that contains a sequence of declarations and statements. The syntax is

similar to a C or Perl program. A complete reference to the DHCP server’s configura-

tion statements is provided in Appendix B. This section introduces the concepts

involved in writing configuration files and shows some examples.

The configuration file performs six basic functions:

• It sets parameters that control how the DHCP server behaves.

• It defines options and parameters that are sent to clients.

• It determines how the DHCP server will interact with other network servers

and peers (for example DNS servers, OMAPI clients, DHCP failover peers).

CHAPTER 14 The ISC DHCP Server234

018 3273 CH14 10/3/02 5:02 PM Page 234

• It describes the layout of the network being served.

• It defines ways of sending different parameters to different clients, based on

what they send or to what part of the network they are connected.

• It provides IP addresses for DHCP clients.

Server Control Parameters

Server parameters control a number of things:

• The duration of leases the server provides

• The DHCP server’s address assignment policies

• Configurable aspects of the DHCP protocol

Example 14.7 shows a typical set of server parameters.

Example 14.7

default-lease-time 86400;

max-lease-time 86400;

min-lease-time 300;

use-rfc1048 true;

authoritative;

In this example, the default and maximum lease times are set to 86,400 seconds

(that is, one day). The minimum lease time is set to 300 seconds (that is, 5 minutes).

The server is declared to be authoritative for the networks it serves, and it is

instructed to reply with RFC 1048–style options even if it receives a BOOTP request

that does not conform to RFC 1048. The complete meaning of all these parameters is

described in Appendix B.

Client Options and Parameters

The DHCP server sends options to clients. Options are described in greater detail in

other chapters, but essentially they contain information about the network to which

the client is connected or about network services that are available to the client. The

DHCP server can also send three parameters that are not technically options but that

are treated in the same way as options: the

filename, server-name, and next-server

parameters.

Options are specified with the option keyword, followed by the option name,

followed by the option data. Example 14.8 shows a typical option that might be sent

to a client.

Configuring the ISC DHCP Server 235

018 3273 CH14 10/3/02 5:02 PM Page 235