The kea package has moved all services to run as a dedicated kea user (instead of root) for improved security. This change requires permission updates to the runtime files created by the kea services.

Users upgrading from an existing kea installation should therefore run the following commands after the upgrade:

chown kea: /var/lib/kea/* /var/log/kea/* /run/lock/kea/logger_lockfile

systemctl try-restart kea-ctrl-agent.service kea-dhcp{4,6,-ddns}.service

Accounts that need to interact with kea services files (e.g. lease files under /var/lib/kea, log files under /var/log/kea or configuration files under /etc/kea) should be added to the kea group.