FSociety.pt

Infraestrutura Empresarial Segura | Four-Legged Firewall

View on GitHub

šŸŒ DHCP Server - ISC DHCP

ConfiguraĆ§Ć£o do servidor DHCP para atribuiĆ§Ć£o dinĆ¢mica de IPs na rede LAN

šŸ“‹ ƍndice

  1. VisĆ£o Geral
  2. InstalaĆ§Ć£o
  3. ConfiguraĆ§Ć£o Principal
  4. Reservas de IP
  5. IntegraĆ§Ć£o com DNS
  6. Logs e MonitorizaĆ§Ć£o
  7. VerificaĆ§Ć£o e Testes
  8. ReferĆŖncias

šŸ“– VisĆ£o Geral

O que Ć© o ISC DHCP Server?

O ISC DHCP (Internet Systems Consortium DHCP) Ć© a implementaĆ§Ć£o de referĆŖncia do protocolo DHCP (Dynamic Host Configuration Protocol). Permite:

InformaĆ§Ć£o da Rede

ParĆ¢metro Valor
Subnet 192.168.1.0/24
Range DHCP 192.168.1.100 - 192.168.1.200
Gateway 192.168.1.1
DNS PrimƔrio 192.168.1.10 (DC)
DNS SecundƔrio 192.168.1.1 (pfSense)
DomĆ­nio fsociety.pt

šŸ“¦ InstalaĆ§Ć£o

Instalar ISC DHCP Server

# Instalar pacote
sudo apt install -y isc-dhcp-server

# Verificar versĆ£o
dhcpd --version

Configurar Interface

Ficheiro: /etc/default/isc-dhcp-server

# Configurar interface de escuta
sudo nano /etc/default/isc-dhcp-server

ConteĆŗdo:

# Defaults for isc-dhcp-server (sourced by /etc/init.d/isc-dhcp-server)

# Path to dhcpd's config file (default: /etc/dhcp/dhcpd.conf).
DHCPDv4_CONF=/etc/dhcp/dhcpd.conf

# Path to dhcpd's PID file (default: /var/run/dhcpd.pid).
DHCPDv4_PID=/var/run/dhcpd.pid

# On what interfaces should the DHCP server (dhcpd) serve DHCP requests?
# Separate multiple interfaces with spaces, e.g. "eth0 eth1".
INTERFACESv4="ens18"
INTERFACESv6=""

āš™ļø ConfiguraĆ§Ć£o Principal

Ficheiro dhcpd.conf

LocalizaĆ§Ć£o: /etc/dhcp/dhcpd.conf

sudo nano /etc/dhcp/dhcpd.conf

ConteĆŗdo Completo:

# ISC DHCP Server Configuration
# Domain: fsociety.pt
# Server: dc.fsociety.pt
# Network: LAN (192.168.1.0/24)

#------------------------------------------------------------
# ConfiguraƧƵes Globais
#------------------------------------------------------------

# DomĆ­nio e servidores DNS
option domain-name "fsociety.pt";
option domain-name-servers 192.168.1.10, 192.168.1.1;

# Tempos de lease
default-lease-time 86400;      # 24 horas
max-lease-time 604800;         # 7 dias
min-lease-time 3600;           # 1 hora (mĆ­nimo)

# Autoritative para esta subnet
authoritative;

# Logging
log-facility local7;

# OpƧƵes de seguranƧa
deny declines;
deny bootp;

#------------------------------------------------------------
# Subnet LAN - 192.168.1.0/24
#------------------------------------------------------------

subnet 192.168.1.0 netmask 255.255.255.0 {
    # Range de IPs dinĆ¢micos
    range 192.168.1.100 192.168.1.200;
    
    # Gateway padrĆ£o
    option routers 192.168.1.1;
    
    # Servidores DNS
    option domain-name-servers 192.168.1.10, 192.168.1.1;
    
    # DomĆ­nio de pesquisa
    option domain-name "fsociety.pt";
    option domain-search "fsociety.pt";
    
    # Broadcast
    option broadcast-address 192.168.1.255;
    
    # MƔscara de rede
    option subnet-mask 255.255.255.0;
    
    # Servidor NTP
    option ntp-servers 192.168.1.10;
    
    # Servidor WINS/NetBIOS (Samba)
    option netbios-name-servers 192.168.1.10;
    option netbios-node-type 8;  # Hybrid node
    
    # Lease times
    default-lease-time 86400;
    max-lease-time 604800;
}

#------------------------------------------------------------
# Reservas de IP (Hosts Fixos)
#------------------------------------------------------------

# Grupo: Servidores
group {
    # Domain Controller
    host dc {
        hardware ethernet AA:BB:CC:DD:EE:01;
        fixed-address 192.168.1.10;
        option host-name "dc";
    }
    
    # Nextcloud / Files Server
    host files {
        hardware ethernet AA:BB:CC:DD:EE:02;
        fixed-address 192.168.1.40;
        option host-name "files";
    }
    
    # Backup Server
    host backup {
        hardware ethernet AA:BB:CC:DD:EE:03;
        fixed-address 192.168.1.50;
        option host-name "backup";
    }
}

# Grupo: Workstations (Exemplo)
group {
    # EstaĆ§Ć£o de trabalho TI
    host ws-ti-001 {
        hardware ethernet AA:BB:CC:DD:EE:10;
        fixed-address 192.168.1.30;
        option host-name "ws-ti-001";
    }
}

ParĆ¢metros Explicados

ParĆ¢metro Valor DescriĆ§Ć£o
default-lease-time 86400 Tempo padrĆ£o de lease (24h)
max-lease-time 604800 Tempo mƔximo de lease (7 dias)
authoritative - Servidor DHCP autoritativo para a rede
deny declines - Rejeitar pedidos de decline
deny bootp - NĆ£o responder a pedidos BOOTP

šŸ“Œ Reservas de IP

Plano de EndereƧamento

Range UtilizaĆ§Ć£o
192.168.1.1 - 192.168.1.9 Infraestrutura de rede
192.168.1.10 - 192.168.1.29 Servidores
192.168.1.30 - 192.168.1.49 EstaƧƵes de trabalho fixas
192.168.1.50 - 192.168.1.99 Reservado
192.168.1.100 - 192.168.1.200 DHCP Pool
192.168.1.201 - 192.168.1.254 Reservado

Reservas Atuais

Hostname IP MAC DescriĆ§Ć£o
pfSense 192.168.1.1 - Gateway/Firewall
dc 192.168.1.10 AA:BB:CC:DD:EE:01 Domain Controller
files 192.168.1.40 AA:BB:CC:DD:EE:02 Nextcloud
backup 192.168.1.50 AA:BB:CC:DD:EE:03 Proxmox Backup

Adicionar Nova Reserva

# Editar configuraĆ§Ć£o
sudo nano /etc/dhcp/dhcpd.conf

# Adicionar dentro do grupo apropriado:
host novo-servidor {
    hardware ethernet XX:XX:XX:XX:XX:XX;
    fixed-address 192.168.1.XX;
    option host-name "novo-servidor";
}

# Reiniciar serviƧo
sudo systemctl restart isc-dhcp-server

šŸ”— IntegraĆ§Ć£o com DNS

Dynamic DNS Updates (DDNS)

Para integraĆ§Ć£o com o DNS do Samba AD, adicionar ao dhcpd.conf:

#------------------------------------------------------------
# Dynamic DNS Updates
#------------------------------------------------------------

# MĆ©todo de atualizaĆ§Ć£o
ddns-updates on;
ddns-update-style interim;
update-static-leases on;

# Chave TSIG para atualizaƧƵes (gerar com dnssec-keygen)
key "DHCP_UPDATER" {
    algorithm hmac-md5;
    secret "CHAVE_SECRETA_BASE64";
};

# Zona forward
zone fsociety.pt. {
    primary 192.168.1.10;
    key DHCP_UPDATER;
}

# Zona reverse
zone 1.168.192.in-addr.arpa. {
    primary 192.168.1.10;
    key DHCP_UPDATER;
}

Gerar Chave TSIG

# Gerar chave
dnssec-keygen -a HMAC-MD5 -b 128 -n HOST DHCP_UPDATER

# Ver chave gerada
cat Kdhcp_updater.+157+xxxxx.key

Nota: A integraĆ§Ć£o DDNS com Samba AD pode requerer configuraĆ§Ć£o adicional do lado do Samba.

šŸ“Š Logs e MonitorizaĆ§Ć£o

Configurar Logging

# Editar rsyslog para DHCP
sudo nano /etc/rsyslog.d/50-isc-dhcp-server.conf

ConteĆŗdo:

# Log do DHCP Server
local7.* /var/log/dhcpd.log

# Reiniciar rsyslog
sudo systemctl restart rsyslog

Ver Logs

# Logs em tempo real
sudo tail -f /var/log/dhcpd.log

# Ou via journalctl
sudo journalctl -u isc-dhcp-server -f

Ver Leases Ativos

# Ficheiro de leases
sudo cat /var/lib/dhcp/dhcpd.leases

# Filtrar leases ativos
sudo dhcp-lease-list --lease /var/lib/dhcp/dhcpd.leases

Formato do Lease

lease 192.168.1.105 {
  starts 1 2024/12/02 10:30:00;
  ends 2 2024/12/03 10:30:00;
  cltt 1 2024/12/02 10:30:00;
  binding state active;
  next binding state free;
  hardware ethernet aa:bb:cc:dd:ee:ff;
  client-hostname "workstation1";
}

āœ… VerificaĆ§Ć£o e Testes

Verificar Sintaxe

# Verificar configuraĆ§Ć£o
sudo dhcpd -t -cf /etc/dhcp/dhcpd.conf

Iniciar ServiƧo

# Iniciar DHCP
sudo systemctl start isc-dhcp-server

# Ativar no boot
sudo systemctl enable isc-dhcp-server

# Verificar estado
sudo systemctl status isc-dhcp-server

Testar DHCP

# Numa mƔquina cliente:
# 1. Libertar IP atual
sudo dhclient -r ens18

# 2. Solicitar novo IP
sudo dhclient ens18

# 3. Verificar IP obtido
ip addr show ens18

Verificar Portas

# DHCP escuta nas portas 67 (servidor) e 68 (cliente)
sudo ss -ulnp | grep dhcpd

# Esperado:
# udp  UNCONN  0  0  *:67  *:*  users:(("dhcpd",pid=xxxx,fd=x))

Script de DiagnĆ³stico

#!/bin/bash
# DiagnĆ³stico DHCP

echo "=== ISC DHCP Server Status ==="
systemctl status isc-dhcp-server --no-pager

echo -e "\n=== Listening Ports ==="
ss -ulnp | grep dhcp

echo -e "\n=== Active Leases ==="
cat /var/lib/dhcp/dhcpd.leases | grep -A 5 "binding state active"

echo -e "\n=== Recent Logs ==="
journalctl -u isc-dhcp-server --since "1 hour ago" --no-pager | tail -20

šŸ”§ Troubleshooting

Problemas Comuns

Problema Causa SoluĆ§Ć£o
ServiƧo nĆ£o inicia Erro de sintaxe dhcpd -t -cf /etc/dhcp/dhcpd.conf
Clientes nĆ£o recebem IP Interface incorreta Verificar /etc/default/isc-dhcp-server
IP duplicado Lease stale Limpar /var/lib/dhcp/dhcpd.leases
DNS errado ConfiguraĆ§Ć£o Verificar option domain-name-servers

Limpar Leases

# Parar serviƧo
sudo systemctl stop isc-dhcp-server

# Limpar ficheiro de leases
sudo rm /var/lib/dhcp/dhcpd.leases
sudo touch /var/lib/dhcp/dhcpd.leases

# Iniciar serviƧo
sudo systemctl start isc-dhcp-server

Debug Mode

# Executar em modo debug
sudo dhcpd -d -f -cf /etc/dhcp/dhcpd.conf ens18

šŸ“š ReferĆŖncias

DocumentaĆ§Ć£o Oficial

Recurso URL
ISC DHCP Documentation https://kb.isc.org/docs/aa-00333
dhcpd.conf Manual https://linux.die.net/man/5/dhcpd.conf
Ubuntu DHCP Server https://ubuntu.com/server/docs/network-dhcp

RFCs

RFC DescriĆ§Ć£o
RFC 2131 Dynamic Host Configuration Protocol
RFC 2132 DHCP Options and BOOTP Vendor Extensions
RFC 4702 DNS Dynamic Updates

šŸŽ“ InformaĆ§Ć£o AcadĆ©mica

Campo InformaĆ§Ć£o
InstituiĆ§Ć£o ESTG - Instituto PolitĆ©cnico do Porto
Unidade Curricular AdministraĆ§Ć£o de Sistemas II
Ano Letivo 2025/2026
Autores Ryan Barbosa, Hugo Correia, Igor AraĆŗjo

šŸ”— NavegaĆ§Ć£o

Anterior ƍndice PrĆ³ximo
ā† DNS Integrado šŸ“š ƍndice Kerberos ā†’
**[ā¬†ļø Voltar ao Topo](#-dhcp-server---isc-dhcp)** --- *ƚltima atualizaĆ§Ć£o: Dezembro 2025*