<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Stefan,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Make sure that when you change the password, you also change it in Stork and in the HA hook config on each daemon of each server.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted1">
I am not aware of documentation from ISC for generating certificates, but here is an article I found that should get you started: <a href="https://node-security.com/posts/openssl-creating-a-ca/" id="LPlnk184504">https://node-security.com/posts/openssl-creating-a-ca/</a></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted1 ContentPasted2">
You will want to make a CA in this case, and not just self-signed certificates. Make sure if you make the certificates for IP and not hostname, that you add the IP to the SAN field of the certificates. Here's an article from Red Hat about trusting the CA on
each host: <a href="https://www.redhat.com/sysadmin/ca-certificates-cli" id="LPNoLPOWALinkPreview">https://www.redhat.com/sysadmin/ca-certificates-cli</a> Even if you're not in Red Hat-land, it'll get you started.</div>
<div class="_Entity _EType_OWALinkPreview _EId_OWALinkPreview _EReadonly_1"></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<b>Eric Graham</b></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<i>DevOps Specialist</i></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-size: 8pt;">Direct: 605.990.1859</span><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 8pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"></span><i><br>
</i></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<i><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 8pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"></span></i><a href="mailto:eric.graham@vantagepnt.com" title="mailto:eric.graham@vantagepnt.com" data-loopstyle="linkonly"><span style="font-size: 8pt;">Eric.Graham@vantagepnt.com</span></a><i><br>
</i></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<i><img style="max-width:100%" class="ContentPasted0" id="imageSelected0" data-outlook-trace="F:1|T:1" src="cid:2e6a83d9-9c45-41bc-86d4-fdd91ce6a9f1"><br>
</i></div>
</div>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Stefan G. Weichinger <lists@xunil.at><br>
<b>Sent:</b> Tuesday, June 27, 2023 2:57 AM<br>
<b>To:</b> Eric Graham <eric.graham@vantagepnt.com>; kea-users@lists.isc.org <kea-users@lists.isc.org><br>
<b>Cc:</b> Darren Ankney <darren.ankney@gmail.com><br>
<b>Subject:</b> Re: [Kea-users] kea-2.2.0 - HA cluster - communication between stork and dhcp4 gets lost</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">CAUTION: This email originated outside the organization. Do not click any links or attachments unless you have verified the sender.<br>
<br>
Am 23.06.23 um 17:34 schrieb Eric Graham:<br>
> Stefan,<br>
><br>
> Please be aware that you posted a password in your control agent config.<br>
> I strongly recommend replacing it.<br>
><br>
> You may prefer to put the socket in /var. Cleaning of /tmp is<br>
> distro-dependent behavior. You'll need to make that change (to the<br>
> socket path) in the control agent and DHCP configs on both servers.<br>
> Stork will pick up the change automatically (without any config<br>
> changes), but the agent may need a restart, as well as all Kea services.<br>
<br>
Changed the socket path, we'll see if that improves stability.<br>
<br>
Changing the password didn't work yet, I had to roll back. I'll try that<br>
again later.<br>
<br>
I have basic-auth in place, but no TLS enabled yet. This might be the<br>
time to add this also, although the 2 machines run in a rather protected<br>
environment. It's just better, and state of the art, to use TLS ...<br>
<br>
Any pointers to the kea-docs how to generate working certs? I assume<br>
they could be rather dummy style ...<br>
<br>
thanks, regards, Stefan<br>
<br>
<br>
</div>
</span></font></div>
</body>
</html>