---
title: "Kea Security"
slug: "kea-security"
description: "This article aims to be a central resource for all things related to securing your Kea DHCP installation."
updated: 2026-06-17T22:14:21Z
published: 2026-06-17T22:14:21Z
canonical: "kb.isc.org/kea-security"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.isc.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Kea Security

## Introduction

This article aims to be a central resource for all things related to Kea security.

Security stance necessarily varies with the needs of the operator and the environment.  A dedicated server which only runs Kea will have different security needs than a multi-purpose server hosting many services and users.  Larger organizations with more people typically have tighter security requirements.  As such, this article can only provide guidelines for typical scenarios.  Kea administrators will have to tailor these guidelines for their particular policies and environment.

By default, the Kea packages provided by ISC implement protections suitable for most installations.

## General

* All [best practices for servers](/docs/server-best-practices) apply
  * In particular: Keep current with updates to new versions for security and stability
* Monitor the [``kea-announce`` mailing list](https://lists.isc.org/mailman/listinfo/kea-announce) for new releases and advisories
* Be aware of important information resources:
  * [Kea Security Advisories](all-kea-advisories)
  * [Kea Known Issues List](https://gitlab.isc.org/isc-projects/kea/-/wikis/Known-Issues-List)
  * [Kea Release Notes](https://gitlab.isc.org/isc-projects/kea/-/wikis/Release-Notes)
* Run Kea daemons as an unprivileged user (***not*** ``root``)
  * [Limiting application permissions](https://kea.readthedocs.io/en/stable/arm/security.html#limiting-application-permissions)
  * [Running Kea From a Non-root Account on Linux](https://kea.readthedocs.io/en/stable/arm/install.html#running-kea-from-a-non-root-account-on-linux)

## Files and permissions

A detailed discussion of directories, files, and protections can be found in [Kea files and directories](kea-files).  A quick summary is:

:::(Internal) (Reminder)
If you change this table, update the table in [kea-files](kea-files) as well.
:::

| File type     | Typical path       | Kea       | Admins    | Others    |
|---------------|--------------------|-----------|-----------|-----------|
| Executables   | ``/usr/sbin``      | Read-only | Read-only | Read-only |
| Libraries     | ``/usr/lib/kea``   | Read-only | Read-only | Read-only |
| Scripts       | ``/usr/share/kea`` | Read-only | Read-only | Read-only |
| Configuration | ``/etc/kea``       | Varies    | Writable  | None      |
| System Logs   | ``/var/log``       | None      | Read-only | None      |
| Kea Logs      | ``/var/log/kea``   | Writable  | Read-only | None      |
| Data          | ``/var/lib/kea``   | Writable  | None      | None      |
| Transients    | ``/var/run/kea``   | Writable  | None      | None      |

Again, see [Kea files and directories](kea-files) for details.

## Securing the API

As noted in [Kea Sockets](/docs/kea-api-sockets#the-api-is-powerful), the Kea API is very powerful.  Depending on how Kea is configured to run, access to the Kea API can potentially be used to take over or corrupt the entire host server.  Due to this power, operators are very strongly encouraged to take steps to protect the API from abuse.  These steps might include some subset of the following:

* If you do not use the API, do not configure any control sockets at all
* [Restrict the directories containing Unix domain sockets](/docs/kea-files#transients)
* Bind HTTP listeners to loopback (``127.0.0.1`` and/or ``::1``)
* [Bind HTTP listeners to privileged ports](/docs/kea-ports#privileged-ports)
* Use a firewall to restrict access to HTTP listeners
* [Require HTTP authentication (password)](https://kea.readthedocs.io/en/stable/arm/security.html#authentication-for-kea-s-restful-api)
* [Use HTTPS/TLS encryption](https://kea.readthedocs.io/en/stable/arm/hooks.html#https-support)
* Require HTTPS/TLS client certificates (mutual authentication)
* [Restrict HA listeners to HA-related commands](/docs/kea-api-sockets#restrict-ha-listener-commands)

:::(Internal) (FIXME)
should have a section "## Database security" here
:::

## See also

* [List of Kea security advisories](all-kea-advisories)
* [Security in the Kea Administrator's Reference Manual](https://kea.readthedocs.io/en/stable/arm/security.html)