Description: Set kea-ctrl-agent up to require a password.
Author: Andreas Hasenack <andreas.hasenack@canonical.com>
Forwarded: not-needed
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033367
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/isc-kea/+bug/2007312
Last-Update: 2023-03-17

diff --git a/src/bin/keactrl/kea-ctrl-agent.conf.pre b/src/bin/keactrl/kea-ctrl-agent.conf.pre
index e6ae8b8a..f7e3fed2 100644
--- a/src/bin/keactrl/kea-ctrl-agent.conf.pre
+++ b/src/bin/keactrl/kea-ctrl-agent.conf.pre
@@ -26,6 +26,18 @@
     // is specifically for HA updates only.
     "http-port": 8000,
 
+    "authentication": {
+        "type": "basic",
+        "realm": "Kea Control Agent",
+        "directory": "/etc/kea",
+        "clients": [
+            {
+                "user": "kea-api",
+                "password-file": "kea-api-password"
+            }
+        ]
+    },
+
     // Specify location of the files to which the Control Agent
     // should connect to forward commands to the DHCPv4, DHCPv6
     // and D2 servers via unix domain sockets.