diff --git a/python/vyos/kea.py b/python/vyos/kea.py
index cb341e0f2..4a517da5f 100644
--- a/python/vyos/kea.py
+++ b/python/vyos/kea.py
@@ -1,319 +1,328 @@
 # Copyright 2023 VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
 # License as published by the Free Software Foundation; either
 # version 2.1 of the License, or (at your option) any later version.
 #
 # This library is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 # Lesser General Public License for more details.
 #
 # You should have received a copy of the GNU Lesser General Public
 # License along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 import json
 import os
 import socket
 
 from datetime import datetime
 
 from vyos.template import is_ipv6
 from vyos.template import isc_static_route
 from vyos.template import netmask_from_cidr
 from vyos.utils.dict import dict_search_args
+from vyos.utils.file import file_permissions
 from vyos.utils.file import read_file
+from vyos.utils.process import cmd
 
 kea4_options = {
     'name_server': 'domain-name-servers',
     'domain_name': 'domain-name',
     'domain_search': 'domain-search',
     'ntp_server': 'ntp-servers',
     'pop_server': 'pop-server',
     'smtp_server': 'smtp-server',
     'time_server': 'time-servers',
     'wins_server': 'netbios-name-servers',
     'default_router': 'routers',
     'server_identifier': 'dhcp-server-identifier',
     'tftp_server_name': 'tftp-server-name',
     'bootfile_size': 'boot-size',
     'time_offset': 'time-offset',
     'wpad_url': 'wpad-url',
     'ipv6_only_preferred': 'v6-only-preferred',
     'captive_portal': 'v4-captive-portal'
 }
 
 kea6_options = {
     'info_refresh_time': 'information-refresh-time',
     'name_server': 'dns-servers',
     'domain_search': 'domain-search',
     'nis_domain': 'nis-domain-name',
     'nis_server': 'nis-servers',
     'nisplus_domain': 'nisp-domain-name',
     'nisplus_server': 'nisp-servers',
     'sntp_server': 'sntp-servers',
     'captive_portal': 'v6-captive-portal'
 }
 
 def kea_parse_options(config):
     options = []
 
     for node, option_name in kea4_options.items():
         if node not in config:
             continue
 
         value = ", ".join(config[node]) if isinstance(config[node], list) else config[node]
         options.append({'name': option_name, 'data': value})
 
     if 'client_prefix_length' in config:
         options.append({'name': 'subnet-mask', 'data': netmask_from_cidr('0.0.0.0/' + config['client_prefix_length'])})
 
     if 'ip_forwarding' in config:
         options.append({'name': 'ip-forwarding', 'data': "true"})
 
     if 'static_route' in config:
         default_route = ''
 
         if 'default_router' in config:
             default_route = isc_static_route('0.0.0.0/0', config['default_router'])
 
         routes = [isc_static_route(route, route_options['next_hop']) for route, route_options in config['static_route'].items()]
 
         options.append({'name': 'rfc3442-static-route', 'data': ", ".join(routes if not default_route else routes + [default_route])})
         options.append({'name': 'windows-static-route', 'data': ", ".join(routes)})
 
     if 'time_zone' in config:
         with open("/usr/share/zoneinfo/" + config['time_zone'], "rb") as f:
             tz_string = f.read().split(b"\n")[-2].decode("utf-8")
 
         options.append({'name': 'pcode', 'data': tz_string})
         options.append({'name': 'tcode', 'data': config['time_zone']})
 
     return options
 
 def kea_parse_subnet(subnet, config):
     out = {'subnet': subnet}
     options = kea_parse_options(config)
 
     if 'bootfile_name' in config:
         out['boot-file-name'] = config['bootfile_name']
 
     if 'bootfile_server' in config:
         out['next-server'] = config['bootfile_server']
 
     if 'lease' in config:
         out['valid-lifetime'] = int(config['lease'])
         out['max-valid-lifetime'] = int(config['lease'])
 
     if 'range' in config:
         pools = []
         for num, range_config in config['range'].items():
             start, stop = range_config['start'], range_config['stop']
             pools.append({'pool': f'{start} - {stop}'})
         out['pools'] = pools
 
     if 'static_mapping' in config:
         reservations = []
         for host, host_config in config['static_mapping'].items():
             if 'disable' in host_config:
                 continue
 
-            reservations.append({
-                'hw-address': host_config['mac_address'],
-                'ip-address': host_config['ip_address']
-            })
+            obj = {
+                'hw-address': host_config['mac_address']
+            }
+
+            if 'ip_address' in host_config:
+                obj['ip-address'] = host_config['ip_address']
+
+            reservations.append(obj)
         out['reservations'] = reservations
 
     unifi_controller = dict_search_args(config, 'vendor_option', 'ubiquiti', 'unifi_controller')
     if unifi_controller:
         options.append({
             'name': 'unifi-controller',
             'data': unifi_controller,
             'space': 'ubnt'
         })
 
     if options:
         out['option-data'] = options
 
     return out
 
 def kea6_parse_options(config):
     options = []
 
     if 'common_options' in config:
         common_opt = config['common_options']
 
         for node, option_name in kea6_options.items():
             if node not in common_opt:
                 continue
 
             value = ", ".join(common_opt[node]) if isinstance(common_opt[node], list) else common_opt[node]
             options.append({'name': option_name, 'data': value})
 
     for node, option_name in kea6_options.items():
         if node not in config:
             continue
 
         value = ", ".join(config[node]) if isinstance(config[node], list) else config[node]
         options.append({'name': option_name, 'data': value})
 
     if 'sip_server' in config:
         sip_servers = config['sip_server']
 
         addrs = []
         hosts = []
 
         for server in sip_servers:
             if is_ipv6(server):
                 addrs.append(server)
             else:
                 hosts.append(server)
 
         if addrs:
             options.append({'name': 'sip-server-addr', 'data': ", ".join(addrs)})
         
         if hosts:
             options.append({'name': 'sip-server-dns', 'data': ", ".join(hosts)})
 
     cisco_tftp = dict_search_args(config, 'vendor_option', 'cisco', 'tftp-server')
     if cisco_tftp:
         options.append({'name': 'tftp-servers', 'code': 2, 'space': 'cisco', 'data': cisco_tftp})
 
     return options
 
 def kea6_parse_subnet(subnet, config):
     out = {'subnet': subnet}
     options = kea6_parse_options(config)
 
     if 'address_range' in config:
         addr_range = config['address_range']
         pools = []
 
         if 'prefix' in addr_range:
             for prefix in addr_range['prefix']:
                 pools.append({'pool': prefix})
 
         if 'start' in addr_range:
             for start, range_conf in addr_range['start'].items():
                 stop = range_conf['stop']
                 pools.append({'pool': f'{start} - {stop}'})
 
         out['pools'] = pools
 
     if 'prefix_delegation' in config:
         pd_pools = []
 
         if 'prefix' in config['prefix_delegation']:
             for prefix, pd_conf in config['prefix_delegation']['prefix'].items():
                 pd_pools.append({
                     'prefix': prefix,
                     'prefix-len': int(pd_conf['prefix_length']),
                     'delegated-len': int(pd_conf['delegated_length'])
                 })
 
         out['pd-pools'] = pd_pools
 
     if 'lease_time' in config:
         if 'default' in config['lease_time']:
             out['valid-lifetime'] = int(config['lease_time']['default'])
         if 'maximum' in config['lease_time']:
             out['max-valid-lifetime'] = int(config['lease_time']['maximum'])
         if 'minimum' in config['lease_time']:
             out['min-valid-lifetime'] = int(config['lease_time']['minimum'])
 
     if 'static_mapping' in config:
         reservations = []
         for host, host_config in config['static_mapping'].items():
             if 'disable' in host_config:
                 continue
 
             reservation = {}
 
             if 'identifier' in host_config:
                 reservation['duid'] = host_config['identifier']
 
             if 'ipv6_address' in host_config:
                 reservation['ip-addresses'] = [ host_config['ipv6_address'] ]
 
             if 'ipv6_prefix' in host_config:
                 reservation['prefixes'] = [ host_config['ipv6_prefix'] ]
 
             reservations.append(reservation)
 
         out['reservations'] = reservations
 
     if options:
         out['option-data'] = options
 
     return out
 
 def kea_parse_leases(lease_path):
     contents = read_file(lease_path)
     lines = contents.split("\n")
     output = []
 
     if len(lines) < 2:
         return output
 
     headers = lines[0].split(",")
 
     for line in lines[1:]:
         line_out = dict(zip(headers, line.split(",")))
 
         lifetime = int(line_out['valid_lifetime'])
         expiry = int(line_out['expire'])
 
         line_out['start_timestamp'] = datetime.utcfromtimestamp(expiry - lifetime)
         line_out['expire_timestamp'] = datetime.utcfromtimestamp(expiry) if expiry else None
 
         output.append(line_out)
 
     return output
 
 def _ctrl_socket_command(path, command, args=None):
     if not os.path.exists(path):
         return None
 
+    if file_permissions(path) != '0775':
+        cmd(f'sudo chmod 775 {path}')
+
     with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as sock:
         sock.connect(path)
 
         payload = {'command': command}
         if args:
             payload['arguments'] = args
 
         sock.send(bytes(json.dumps(payload), 'utf-8'))
         result = b''
         while True:
             data = sock.recv(4096)
             result += data
             if len(data) < 4096:
                 break
 
         return json.loads(result.decode('utf-8'))
 
 def kea_get_active_config(inet):
     ctrl_socket = f'/run/kea/dhcp{inet}-ctrl-socket'
 
     config = _ctrl_socket_command(ctrl_socket, 'config-get')
     
     if not config or 'result' not in config or config['result'] != 0:
         return None
 
     return config
 
 def kea_get_pool_from_subnet_id(config, inet, subnet_id):
     shared_networks = dict_search_args(config, 'arguments', f'Dhcp{inet}', 'shared-networks')
 
     if not shared_networks:
         return None
 
     for network in shared_networks:
         if f'subnet{inet}' not in network:
             continue
 
         for subnet in network[f'subnet{inet}']:
             if 'id' in subnet and int(subnet['id']) == int(subnet_id):
                 return network['name']
 
     return None
diff --git a/python/vyos/utils/file.py b/python/vyos/utils/file.py
index 2af87a0ca..70ac1753b 100644
--- a/python/vyos/utils/file.py
+++ b/python/vyos/utils/file.py
@@ -1,197 +1,201 @@
 # Copyright 2023 VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
 # License as published by the Free Software Foundation; either
 # version 2.1 of the License, or (at your option) any later version.
 #
 # This library is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 # Lesser General Public License for more details.
 #
 # You should have received a copy of the GNU Lesser General Public
 # License along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 import os
 from vyos.utils.permission import chown
 
 def makedir(path, user=None, group=None):
     if os.path.exists(path):
         return
     os.makedirs(path, mode=0o755)
     chown(path, user, group)
 
 def file_is_persistent(path):
     import re
     location = r'^(/config|/opt/vyatta/etc/config)'
     absolute = os.path.abspath(os.path.dirname(path))
     return re.match(location,absolute)
 
 def read_file(fname, defaultonfailure=None):
     """
     read the content of a file, stripping any end characters (space, newlines)
     should defaultonfailure be not None, it is returned on failure to read
     """
     try:
         """ Read a file to string """
         with open(fname, 'r') as f:
             data = f.read().strip()
         return data
     except Exception as e:
         if defaultonfailure is not None:
             return defaultonfailure
         raise e
 
 def write_file(fname, data, defaultonfailure=None, user=None, group=None, mode=None, append=False):
     """
     Write content of data to given fname, should defaultonfailure be not None,
     it is returned on failure to read.
 
     If directory of file is not present, it is auto-created.
     """
     dirname = os.path.dirname(fname)
     if not os.path.isdir(dirname):
         os.makedirs(dirname, mode=0o755, exist_ok=False)
         chown(dirname, user, group)
 
     try:
         """ Write a file to string """
         bytes = 0
         with open(fname, 'w' if not append else 'a') as f:
             bytes = f.write(data)
         chown(fname, user, group)
         chmod(fname, mode)
         return bytes
     except Exception as e:
         if defaultonfailure is not None:
             return defaultonfailure
         raise e
 
 def read_json(fname, defaultonfailure=None):
     """
     read and json decode the content of a file
     should defaultonfailure be not None, it is returned on failure to read
     """
     import json
     try:
         with open(fname, 'r') as f:
             data = json.load(f)
         return data
     except Exception as e:
         if defaultonfailure is not None:
             return defaultonfailure
         raise e
 
 def chown(path, user, group):
     """ change file/directory owner """
     from pwd import getpwnam
     from grp import getgrnam
 
     if user is None or group is None:
         return False
 
     # path may also be an open file descriptor
     if not isinstance(path, int) and not os.path.exists(path):
         return False
 
     uid = getpwnam(user).pw_uid
     gid = getgrnam(group).gr_gid
     os.chown(path, uid, gid)
     return True
 
 
 def chmod(path, bitmask):
     # path may also be an open file descriptor
     if not isinstance(path, int) and not os.path.exists(path):
         return
     if bitmask is None:
         return
     os.chmod(path, bitmask)
 
 
 def chmod_600(path):
     """ Make file only read/writable by owner """
     from stat import S_IRUSR, S_IWUSR
 
     bitmask = S_IRUSR | S_IWUSR
     chmod(path, bitmask)
 
 
 def chmod_750(path):
     """ Make file/directory only executable to user and group """
     from stat import S_IRUSR, S_IWUSR, S_IXUSR, S_IRGRP, S_IXGRP
 
     bitmask = S_IRUSR | S_IWUSR | S_IXUSR | S_IRGRP | S_IXGRP
     chmod(path, bitmask)
 
 
 def chmod_755(path):
     """ Make file executable by all """
     from stat import S_IRUSR, S_IWUSR, S_IXUSR, S_IRGRP, S_IXGRP, S_IROTH, S_IXOTH
 
     bitmask = S_IRUSR | S_IWUSR | S_IXUSR | S_IRGRP | S_IXGRP | \
               S_IROTH | S_IXOTH
     chmod(path, bitmask)
 
 def chmod_2775(path):
     """ user/group permissions with set-group-id bit set """
     from stat import S_ISGID, S_IRWXU, S_IRWXG, S_IROTH, S_IXOTH
 
     bitmask = S_ISGID | S_IRWXU | S_IRWXG | S_IROTH | S_IXOTH
     chmod(path, bitmask)
 
 def chmod_775(path):
     """ Make file executable by all """
     from stat import S_IRUSR, S_IWUSR, S_IXUSR, S_IRGRP, S_IWGRP, S_IXGRP, S_IROTH, S_IXOTH
 
     bitmask = S_IRUSR | S_IWUSR | S_IXUSR | S_IRGRP | S_IWGRP | S_IXGRP | \
               S_IROTH | S_IXOTH
     chmod(path, bitmask)
 
+def file_permissions(path):
+    """ Return file permissions in string format, e.g '0755' """
+    return oct(os.stat(path).st_mode)[4:]
+
 def makedir(path, user=None, group=None):
     if os.path.exists(path):
         return
     os.makedirs(path, mode=0o755)
     chown(path, user, group)
 
 def wait_for_inotify(file_path, pre_hook=None, event_type=None, timeout=None, sleep_interval=0.1):
     """ Waits for an inotify event to occur """
     if not os.path.dirname(file_path):
         raise ValueError(
           "File path {} does not have a directory part (required for inotify watching)".format(file_path))
     if not os.path.basename(file_path):
         raise ValueError(
           "File path {} does not have a file part, do not know what to watch for".format(file_path))
 
     from inotify.adapters import Inotify
     from time import time
     from time import sleep
 
     time_start = time()
 
     i = Inotify()
     i.add_watch(os.path.dirname(file_path))
 
     if pre_hook:
         pre_hook()
 
     for event in i.event_gen(yield_nones=True):
         if (timeout is not None) and ((time() - time_start) > timeout):
             # If the function didn't return until this point,
             # the file failed to have been written to and closed within the timeout
             raise OSError("Waiting for file {} to be written has failed".format(file_path))
 
         # Most such events don't take much time, so it's better to check right away
         # and sleep later.
         if event is not None:
             (_, type_names, path, filename) = event
             if filename == os.path.basename(file_path):
                 if event_type in type_names:
                     return
         sleep(sleep_interval)
 
 def wait_for_file_write_complete(file_path, pre_hook=None, timeout=None, sleep_interval=0.1):
     """ Waits for a process to close a file after opening it in write mode. """
     wait_for_inotify(file_path,
       event_type='IN_CLOSE_WRITE', pre_hook=pre_hook, timeout=timeout, sleep_interval=sleep_interval)
diff --git a/src/conf_mode/dhcp_server.py b/src/conf_mode/dhcp_server.py
index 66f7c8057..958e90014 100755
--- a/src/conf_mode/dhcp_server.py
+++ b/src/conf_mode/dhcp_server.py
@@ -1,384 +1,373 @@
 #!/usr/bin/env python3
 #
 # Copyright (C) 2018-2023 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
 # published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import os
 
 from ipaddress import ip_address
 from ipaddress import ip_network
 from netaddr import IPAddress
 from netaddr import IPRange
 from sys import exit
-from time import sleep
 
 from vyos.config import Config
 from vyos.pki import wrap_certificate
 from vyos.pki import wrap_private_key
 from vyos.template import render
 from vyos.utils.dict import dict_search
 from vyos.utils.dict import dict_search_args
-from vyos.utils.file import chmod_775
 from vyos.utils.file import write_file
 from vyos.utils.process import call
 from vyos.utils.process import run
 from vyos.utils.network import is_subnet_connected
 from vyos.utils.network import is_addr_assigned
 from vyos import ConfigError
 from vyos import airbag
 airbag.enable()
 
 ctrl_config_file = '/run/kea/kea-ctrl-agent.conf'
 ctrl_socket = '/run/kea/dhcp4-ctrl-socket'
 config_file = '/run/kea/kea-dhcp4.conf'
 lease_file = '/config/dhcp4.leases'
 
 ca_cert_file = '/run/kea/kea-failover-ca.pem'
 cert_file = '/run/kea/kea-failover.pem'
 cert_key_file = '/run/kea/kea-failover-key.pem'
 
 def dhcp_slice_range(exclude_list, range_dict):
     """
     This function is intended to slice a DHCP range. What does it mean?
 
     Lets assume we have a DHCP range from '192.0.2.1' to '192.0.2.100'
     but want to exclude address '192.0.2.74' and '192.0.2.75'. We will
     pass an input 'range_dict' in the format:
       {'start' : '192.0.2.1', 'stop' : '192.0.2.100' }
     and we will receive an output list of:
       [{'start' : '192.0.2.1' , 'stop' : '192.0.2.73'  },
        {'start' : '192.0.2.76', 'stop' : '192.0.2.100' }]
     The resulting list can then be used in turn to build the proper dhcpd
     configuration file.
     """
     output = []
     # exclude list must be sorted for this to work
     exclude_list = sorted(exclude_list)
     range_start = range_dict['start']
     range_stop = range_dict['stop']
     range_last_exclude = ''
 
     for e in exclude_list:
         if (ip_address(e) >= ip_address(range_start)) and \
            (ip_address(e) <= ip_address(range_stop)):
             range_last_exclude = e
 
     for e in exclude_list:
         if (ip_address(e) >= ip_address(range_start)) and \
            (ip_address(e) <= ip_address(range_stop)):
 
             # Build new address range ending one address before exclude address
             r = {
                 'start' : range_start,
                 'stop' : str(ip_address(e) -1)
             }
             # On the next run our address range will start one address after
             # the exclude address
             range_start = str(ip_address(e) + 1)
 
             # on subsequent exclude addresses we can not
             # append them to our output
             if not (ip_address(r['start']) > ip_address(r['stop'])):
                 # Everything is fine, add range to result
                 output.append(r)
 
             # Take care of last IP address range spanning from the last exclude
             # address (+1) to the end of the initial configured range
             if ip_address(e) == ip_address(range_last_exclude):
                 r = {
                   'start': str(ip_address(e) + 1),
                   'stop': str(range_stop)
                 }
                 if not (ip_address(r['start']) > ip_address(r['stop'])):
                     output.append(r)
         else:
           # if the excluded address was not part of the range, we simply return
           # the entire ranga again
           if not range_last_exclude:
               if range_dict not in output:
                   output.append(range_dict)
 
     return output
 
 def get_config(config=None):
     if config:
         conf = config
     else:
         conf = Config()
     base = ['service', 'dhcp-server']
     if not conf.exists(base):
         return None
 
     dhcp = conf.get_config_dict(base, key_mangling=('-', '_'),
                                 no_tag_node_value_mangle=True,
                                 get_first_key=True,
                                 with_recursive_defaults=True)
 
     if 'shared_network_name' in dhcp:
         for network, network_config in dhcp['shared_network_name'].items():
             if 'subnet' in network_config:
                 for subnet, subnet_config in network_config['subnet'].items():
                     # If exclude IP addresses are defined we need to slice them out of
                     # the defined ranges
                     if {'exclude', 'range'} <= set(subnet_config):
                         new_range_id = 0
                         new_range_dict = {}
                         for r, r_config in subnet_config['range'].items():
                             for slice in dhcp_slice_range(subnet_config['exclude'], r_config):
                                 new_range_dict.update({new_range_id : slice})
                                 new_range_id +=1
 
                         dhcp['shared_network_name'][network]['subnet'][subnet].update(
                                 {'range' : new_range_dict})
 
     if dict_search('failover.certificate', dhcp):
         dhcp['pki'] = conf.get_config_dict(['pki'], key_mangling=('-', '_'), get_first_key=True, no_tag_node_value_mangle=True) 
 
     return dhcp
 
 def verify(dhcp):
     # bail out early - looks like removal from running config
     if not dhcp or 'disable' in dhcp:
         return None
 
     # If DHCP is enabled we need one share-network
     if 'shared_network_name' not in dhcp:
         raise ConfigError('No DHCP shared networks configured.\n' \
                           'At least one DHCP shared network must be configured.')
 
     # Inspect shared-network/subnet
     listen_ok = False
     subnets = []
     failover_ok = False
     shared_networks =  len(dhcp['shared_network_name'])
     disabled_shared_networks = 0
 
 
     # A shared-network requires a subnet definition
     for network, network_config in dhcp['shared_network_name'].items():
         if 'disable' in network_config:
             disabled_shared_networks += 1
 
         if 'subnet' not in network_config:
             raise ConfigError(f'No subnets defined for {network}. At least one\n' \
                               'lease subnet must be configured.')
 
         for subnet, subnet_config in network_config['subnet'].items():
             # All delivered static routes require a next-hop to be set
             if 'static_route' in subnet_config:
                 for route, route_option in subnet_config['static_route'].items():
                     if 'next_hop' not in route_option:
                         raise ConfigError(f'DHCP static-route "{route}" requires router to be defined!')
 
             # Check if DHCP address range is inside configured subnet declaration
             if 'range' in subnet_config:
                 networks = []
                 for range, range_config in subnet_config['range'].items():
                     if not {'start', 'stop'} <= set(range_config):
                         raise ConfigError(f'DHCP range "{range}" start and stop address must be defined!')
 
                     # Start/Stop address must be inside network
                     for key in ['start', 'stop']:
                         if ip_address(range_config[key]) not in ip_network(subnet):
                             raise ConfigError(f'DHCP range "{range}" {key} address not within shared-network "{network}, {subnet}"!')
 
                     # Stop address must be greater or equal to start address
                     if ip_address(range_config['stop']) < ip_address(range_config['start']):
                         raise ConfigError(f'DHCP range "{range}" stop address must be greater or equal\n' \
                                           'to the ranges start address!')
 
                     for network in networks:
                         start = range_config['start']
                         stop = range_config['stop']
                         if start in network:
                             raise ConfigError(f'Range "{range}" start address "{start}" already part of another range!')
                         if stop in network:
                             raise ConfigError(f'Range "{range}" stop address "{stop}" already part of another range!')
 
                     tmp = IPRange(range_config['start'], range_config['stop'])
                     networks.append(tmp)
 
             # Exclude addresses must be in bound
             if 'exclude' in subnet_config:
                 for exclude in subnet_config['exclude']:
                     if ip_address(exclude) not in ip_network(subnet):
                         raise ConfigError(f'Excluded IP address "{exclude}" not within shared-network "{network}, {subnet}"!')
 
             # At least one DHCP address range or static-mapping required
             if 'range' not in subnet_config and 'static_mapping' not in subnet_config:
                 raise ConfigError(f'No DHCP address range or active static-mapping configured\n' \
                                   f'within shared-network "{network}, {subnet}"!')
 
             if 'static_mapping' in subnet_config:
                 # Static mappings require just a MAC address (will use an IP from the dynamic pool if IP is not set)
                 for mapping, mapping_config in subnet_config['static_mapping'].items():
                     if 'ip_address' in mapping_config:
                         if ip_address(mapping_config['ip_address']) not in ip_network(subnet):
                             raise ConfigError(f'Configured static lease address for mapping "{mapping}" is\n' \
                                               f'not within shared-network "{network}, {subnet}"!')
 
                         if 'mac_address' not in mapping_config:
                             raise ConfigError(f'MAC address required for static mapping "{mapping}"\n' \
                                               f'within shared-network "{network}, {subnet}"!')
 
             # There must be one subnet connected to a listen interface.
             # This only counts if the network itself is not disabled!
             if 'disable' not in network_config:
                 if is_subnet_connected(subnet, primary=False):
                     listen_ok = True
 
             # Subnets must be non overlapping
             if subnet in subnets:
                 raise ConfigError(f'Configured subnets must be unique! Subnet "{subnet}"\n'
                                    'defined multiple times!')
             subnets.append(subnet)
 
             # Check for overlapping subnets
             net = ip_network(subnet)
             for n in subnets:
                 net2 = ip_network(n)
                 if (net != net2):
                     if net.overlaps(net2):
                         raise ConfigError(f'Conflicting subnet ranges: "{net}" overlaps "{net2}"!')
 
     # Prevent 'disable' for shared-network if only one network is configured
     if (shared_networks - disabled_shared_networks) < 1:
         raise ConfigError(f'At least one shared network must be active!')
 
     if 'failover' in dhcp:
         for key in ['name', 'remote', 'source_address', 'status']:
             if key not in dhcp['failover']:
                 tmp = key.replace('_', '-')
                 raise ConfigError(f'DHCP failover requires "{tmp}" to be specified!')
 
         if len({'certificate', 'ca_certificate'} & set(dhcp['failover'])) == 1:
             raise ConfigError(f'DHCP secured failover requires both certificate and CA certificate')
 
         if 'certificate' in dhcp['failover']:
             cert_name = dhcp['failover']['certificate']
 
             if cert_name not in dhcp['pki']['certificate']:
                 raise ConfigError(f'Invalid certificate specified for DHCP failover')
 
             if not dict_search_args(dhcp['pki']['certificate'], cert_name, 'certificate'):
                 raise ConfigError(f'Invalid certificate specified for DHCP failover')
 
             if not dict_search_args(dhcp['pki']['certificate'], cert_name, 'private', 'key'):
                 raise ConfigError(f'Missing private key on certificate specified for DHCP failover')
 
         if 'ca_certificate' in dhcp['failover']:
             ca_cert_name = dhcp['failover']['ca_certificate']
             if ca_cert_name not in dhcp['pki']['ca']:
                 raise ConfigError(f'Invalid CA certificate specified for DHCP failover')
 
             if not dict_search_args(dhcp['pki']['ca'], ca_cert_name, 'certificate'):
                 raise ConfigError(f'Invalid CA certificate specified for DHCP failover')
 
     for address in (dict_search('listen_address', dhcp) or []):
         if is_addr_assigned(address):
             listen_ok = True
             # no need to probe further networks, we have one that is valid
             continue
         else:
             raise ConfigError(f'listen-address "{address}" not configured on any interface')
 
 
     if not listen_ok:
         raise ConfigError('None of the configured subnets have an appropriate primary IP address on any\n'
                           'broadcast interface configured, nor was there an explicit listen-address\n'
                           'configured for serving DHCP relay packets!')
 
     return None
 
 def generate(dhcp):
     # bail out early - looks like removal from running config
     if not dhcp or 'disable' in dhcp:
         return None
 
     dhcp['lease_file'] = lease_file
     dhcp['machine'] = os.uname().machine
 
     if not os.path.exists(lease_file):
         write_file(lease_file, '', user='_kea', group='vyattacfg', mode=0o755)
 
     for f in [cert_file, cert_key_file, ca_cert_file]:
         if os.path.exists(f):
             os.unlink(f)
 
     if 'failover' in dhcp:
         if 'certificate' in dhcp['failover']:
             cert_name = dhcp['failover']['certificate']
             cert_data = dhcp['pki']['certificate'][cert_name]['certificate']
             key_data = dhcp['pki']['certificate'][cert_name]['private']['key']
             write_file(cert_file, wrap_certificate(cert_data), user='_kea', mode=0o600)
             write_file(cert_key_file, wrap_private_key(key_data), user='_kea', mode=0o600)
 
             dhcp['failover']['cert_file'] = cert_file
             dhcp['failover']['cert_key_file'] = cert_key_file
 
         if 'ca_certificate' in dhcp['failover']:
             ca_cert_name = dhcp['failover']['ca_certificate']
             ca_cert_data = dhcp['pki']['ca'][ca_cert_name]['certificate']
             write_file(ca_cert_file, wrap_certificate(ca_cert_data), user='_kea', mode=0o600)
 
             dhcp['failover']['ca_cert_file'] = ca_cert_file
 
     render(ctrl_config_file, 'dhcp-server/kea-ctrl-agent.conf.j2', dhcp)
     render(config_file, 'dhcp-server/kea-dhcp4.conf.j2', dhcp)
 
     return None
 
 def apply(dhcp):
     services = ['kea-ctrl-agent', 'kea-dhcp4-server', 'kea-dhcp-ddns-server']
 
     if not dhcp or 'disable' in dhcp:
         for service in services:
             call(f'systemctl stop {service}.service')
 
         if os.path.exists(config_file):
             os.unlink(config_file)
 
         return None
 
     for service in services:
         action = 'restart'
 
         if service == 'kea-dhcp-ddns-server' and 'dynamic_dns_update' not in dhcp:
             action = 'stop'
 
         if service == 'kea-ctrl-agent' and 'failover' not in dhcp:
             action = 'stop'
 
         call(f'systemctl {action} {service}.service')
 
-    # op-mode needs ctrl socket permission change
-    i = 0
-    while not os.path.exists(ctrl_socket):
-        if i > 15:
-            break
-        i += 1
-        sleep(1)
-    chmod_775(ctrl_socket)
-
     return None
 
 if __name__ == '__main__':
     try:
         c = get_config()
         verify(c)
         generate(c)
         apply(c)
     except ConfigError as e:
         print(e)
         exit(1)
diff --git a/src/conf_mode/dhcpv6_server.py b/src/conf_mode/dhcpv6_server.py
index 73a708ff5..b01f510e5 100755
--- a/src/conf_mode/dhcpv6_server.py
+++ b/src/conf_mode/dhcpv6_server.py
@@ -1,219 +1,208 @@
 #!/usr/bin/env python3
 #
 # Copyright (C) 2018-2023 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
 # published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import os
 
 from ipaddress import ip_address
 from ipaddress import ip_network
 from sys import exit
-from time import sleep
 
 from vyos.config import Config
 from vyos.template import render
 from vyos.template import is_ipv6
 from vyos.utils.process import call
-from vyos.utils.file import chmod_775
 from vyos.utils.file import write_file
 from vyos.utils.dict import dict_search
 from vyos.utils.network import is_subnet_connected
 from vyos import ConfigError
 from vyos import airbag
 airbag.enable()
 
 config_file = '/run/kea/kea-dhcp6.conf'
 ctrl_socket = '/run/kea/dhcp6-ctrl-socket'
 lease_file = '/config/dhcp6.leases'
 
 def get_config(config=None):
     if config:
         conf = config
     else:
         conf = Config()
     base = ['service', 'dhcpv6-server']
     if not conf.exists(base):
         return None
 
     dhcpv6 = conf.get_config_dict(base, key_mangling=('-', '_'),
                                   get_first_key=True,
                                   no_tag_node_value_mangle=True)
     return dhcpv6
 
 def verify(dhcpv6):
     # bail out early - looks like removal from running config
     if not dhcpv6 or 'disable' in dhcpv6:
         return None
 
     # If DHCP is enabled we need one share-network
     if 'shared_network_name' not in dhcpv6:
         raise ConfigError('No DHCPv6 shared networks configured. At least '\
                           'one DHCPv6 shared network must be configured.')
 
     # Inspect shared-network/subnet
     subnets = []
     listen_ok = False
     for network, network_config in dhcpv6['shared_network_name'].items():
         # A shared-network requires a subnet definition
         if 'subnet' not in network_config:
             raise ConfigError(f'No DHCPv6 lease subnets configured for "{network}". '\
                               'At least one lease subnet must be configured for '\
                               'each shared network!')
 
         for subnet, subnet_config in network_config['subnet'].items():
             if 'address_range' in subnet_config:
                 if 'start' in subnet_config['address_range']:
                     range6_start = []
                     range6_stop = []
                     for start, start_config in subnet_config['address_range']['start'].items():
                         if 'stop' not in start_config:
                             raise ConfigError(f'address-range stop address for start "{start}" is not defined!')
                         stop = start_config['stop']
 
                         # Start address must be inside network
                         if not ip_address(start) in ip_network(subnet):
                             raise ConfigError(f'address-range start address "{start}" is not in subnet "{subnet}"!')
 
                         # Stop address must be inside network
                         if not ip_address(stop) in ip_network(subnet):
                              raise ConfigError(f'address-range stop address "{stop}" is not in subnet "{subnet}"!')
 
                         # Stop address must be greater or equal to start address
                         if not ip_address(stop) >= ip_address(start):
                             raise ConfigError(f'address-range stop address "{stop}" must be greater then or equal ' \
                                               f'to the range start address "{start}"!')
 
                         # DHCPv6 range start address must be unique - two ranges can't
                         # start with the same address - makes no sense
                         if start in range6_start:
                             raise ConfigError(f'Conflicting DHCPv6 lease range: '\
                                               f'Pool start address "{start}" defined multipe times!')
                         range6_start.append(start)
 
                         # DHCPv6 range stop address must be unique - two ranges can't
                         # end with the same address - makes no sense
                         if stop in range6_stop:
                             raise ConfigError(f'Conflicting DHCPv6 lease range: '\
                                               f'Pool stop address "{stop}" defined multipe times!')
                         range6_stop.append(stop)
 
                 if 'prefix' in subnet_config:
                     for prefix in subnet_config['prefix']:
                         if ip_network(prefix) not in ip_network(subnet):
                             raise ConfigError(f'address-range prefix "{prefix}" is not in subnet "{subnet}""')
 
             # Prefix delegation sanity checks
             if 'prefix_delegation' in subnet_config:
                 if 'prefix' not in subnet_config['prefix_delegation']:
                     raise ConfigError('prefix-delegation prefix not defined!')
 
                 for prefix, prefix_config in subnet_config['prefix_delegation']['prefix'].items():
                     if 'delegated_length' not in prefix_config:
                         raise ConfigError(f'Delegated IPv6 prefix length for "{prefix}" '\
                                           f'must be configured')
 
                     if 'prefix_length' not in prefix_config:
                         raise ConfigError('Length of delegated IPv6 prefix must be configured')
 
                     if prefix_config['prefix_length'] > prefix_config['delegated_length']:
                         raise ConfigError('Length of delegated IPv6 prefix must be within parent prefix')
 
             # Static mappings don't require anything (but check if IP is in subnet if it's set)
             if 'static_mapping' in subnet_config:
                 for mapping, mapping_config in subnet_config['static_mapping'].items():
                     if 'ipv6_address' in mapping_config:
                         # Static address must be in subnet
                         if ip_address(mapping_config['ipv6_address']) not in ip_network(subnet):
                             raise ConfigError(f'static-mapping address for mapping "{mapping}" is not in subnet "{subnet}"!')
 
             if 'vendor_option' in subnet_config:
                 if len(dict_search('vendor_option.cisco.tftp_server', subnet_config)) > 2:
                     raise ConfigError(f'No more then two Cisco tftp-servers should be defined for subnet "{subnet}"!')
 
             # Subnets must be unique
             if subnet in subnets:
                 raise ConfigError(f'DHCPv6 subnets must be unique! Subnet {subnet} defined multiple times!')
             subnets.append(subnet)
 
         # DHCPv6 requires at least one configured address range or one static mapping
         # (FIXME: is not actually checked right now?)
 
         # There must be one subnet connected to a listen interface if network is not disabled.
         if 'disable' not in network_config:
             if is_subnet_connected(subnet):
                 listen_ok = True
 
             # DHCPv6 subnet must not overlap. ISC DHCP also complains about overlapping
             # subnets: "Warning: subnet 2001:db8::/32 overlaps subnet 2001:db8:1::/32"
             net = ip_network(subnet)
             for n in subnets:
                 net2 = ip_network(n)
                 if (net != net2):
                     if net.overlaps(net2):
                         raise ConfigError('DHCPv6 conflicting subnet ranges: {0} overlaps {1}'.format(net, net2))
 
     if not listen_ok:
         raise ConfigError('None of the DHCPv6 subnets are connected to a subnet6 on '\
                           'this machine. At least one subnet6 must be connected such that '\
                           'DHCPv6 listens on an interface!')
 
 
     return None
 
 def generate(dhcpv6):
     # bail out early - looks like removal from running config
     if not dhcpv6 or 'disable' in dhcpv6:
         return None
 
     dhcpv6['lease_file'] = lease_file
     dhcpv6['machine'] = os.uname().machine
 
     if not os.path.exists(lease_file):
         write_file(lease_file, '', user='_kea', group='vyattacfg', mode=0o755)
 
     render(config_file, 'dhcp-server/kea-dhcp6.conf.j2', dhcpv6)
     return None
 
 def apply(dhcpv6):
     # bail out early - looks like removal from running config
     service_name = 'kea-dhcp6-server.service'
     if not dhcpv6 or 'disable' in dhcpv6:
         # DHCP server is removed in the commit
         call(f'systemctl stop {service_name}')
         if os.path.exists(config_file):
             os.unlink(config_file)
         return None
 
     call(f'systemctl restart {service_name}')
 
-    # op-mode needs ctrl socket permission change
-    i = 0
-    while not os.path.exists(ctrl_socket):
-        if i > 15:
-            break
-        i += 1
-        sleep(1)
-    chmod_775(ctrl_socket)
-
     return None
 
 if __name__ == '__main__':
     try:
         c = get_config()
         verify(c)
         generate(c)
         apply(c)
     except ConfigError as e:
         print(e)
         exit(1)