dhcpd.conf overwritten. Can it be recovered?

dmellem · 01-26-2006, 02:54 PM

Hi,

Someone accidentally overwrote our dhcpd.conf file so it's now 0 bytes long. The server is still running and DHCPD is still serving addresses. Is there any way to either recover the lost file from disk, or to dump the configuration from memory? It's running FC3.

Thanks a lot,

-Dan

introuble · 01-26-2006, 04:01 PM

Why go through all that trouble ? Is it so hard to rewrite dchpd.conf ?

Tinkster · 01-26-2006, 04:12 PM

Quote:

Originally Posted by dmellem

Hi,

Someone accidentally overwrote our dhcpd.conf file so it's now 0 bytes long. The server is still running and DHCPD is still serving addresses. Is there any way to either recover the lost file from disk, or to dump the configuration from memory? It's running FC3.

Thanks a lot,

-Dan

No, you can't do either. Just restore from a recent backup.

Cheers,
Tink

dmellem · 01-26-2006, 04:25 PM

We have a backup, but we've been making a lot of changes and backups have failed for a couple of weeks on this machine.

Quote:

Originally Posted by introuble

Why go through all that trouble ? Is it so hard to rewrite dchpd.conf ?

We have 10,000 nodes at 43 sites. There's quite a few printers and client machines with reserved addresses as well, plus we have special scopes for some of our VLANs.

-Dan

Tinkster · 01-26-2006, 04:56 PM

You should be able to extract data from the leases-file,
/var/state/dhcp/dhcpd.leases

Just be aware that there could be multiple entries for the
same MAC address, the closest to bottom one will be valid.

Good luck!

Cheers,
Tink

dmellem · 01-26-2006, 05:25 PM

Thanks, Tink. Unfortunately, the leases file doesn't keep track of reserved addresses, only those from the pools.

-Dan

homey · 01-26-2006, 05:31 PM

Quote:

backups have failed for a couple of weeks on this machine.

I'd say off hand that you have some real problems in the making. Looks like you will need to make the file over unless you can restore from backup.
How did someone accidently delete that anyhow?

dmellem · 01-26-2006, 05:43 PM

Quote:

Originally Posted by homey

How did someone accidently delete that anyhow?

They were trying to copy the file off the machine and confused source and destination. (!)

One thing we're going to try, besides going back through our work logs, is to search the dhcpd log file for ACKs and then filtering out everything out of the pools. We'll then combine this with our old backup to find any reserved addresses that got lost. It's not perfect (we won't get the ones that haven't been on the network yet and we'll lose the comments) but should fill out anything else we've missed from the work requests.

Thanks,
-Dan

Tinkster · 01-26-2006, 06:07 PM

Another way of adding stuff with fixed-IPs (I've done that in
the past) is to resolve all hosts and filter out static ones
via script, then ping and arp to get their MAC addresses. I'm
quite anal about security, and only devices with known MACs got
a lease on that LAN. To create sections of a dhcpd.conf file from
the arp requests I used this:

Code:

less arp2dhcpd.awk 
#!/usr/bin/awk -f
{
  split( $1, chunks, ".")
  print "host " chunks[1] " {"
  print "       hardware ethernet " $3 " ;"
  print "       fixed-address " $1 " ;"
  print "}\n"

}

You get the idea ;}

Cheers,
Tink

dmellem · 01-26-2006, 06:27 PM

I like it. Thanks!

-Dan