April 2004 - db-wg - mailman.ripe.net

<auto-dbm@ripe.net> is slow this afternoon.
by RIPE Database Administration 16 May '18

16 May '18

Dear Colleagues, Because of a very high level of use this afternoon, the response time of <auto-dbm(a)ripe.net> is longer than normal. I have made contact with those who are responsible and I expect the situation to improve as the machine works through the queue. Please be patient. Obviously we at the RIPE NCC Database Group are continuously working to make the performance of the database as good as possible. However, we cannot make improvements in zero time. We thank you for your co-operation up to now and we ask for your continued co-operation so that everyone receives the best possible service. If you have anymore questions, please contact <ripe-dbm(a)ripe.net>. Regards, Ambrose Magee ____________________________ RIPE Database Administration.

2 2

Deprecation of the NONE Authentication Scheme
by Ziya Suzen 07 Nov '05

07 Nov '05

Dear Colleagues, As announced at RIPE 47 the NONE authentication scheme will be deprecated. After 26 April 2004 the RIPE Whois Database will not accept updates using the NONE authentication scheme. If you have objects protected by a MNTNER object which has the NONE authentication scheme, please assign another authentication scheme or create another MNTNER object to protect these objects. If you are a RIPE NCC member you can create new MNTNER objects through the LIR Portal or send your update to <auto-dbm(a)ripe.net>. History and details: -------------------- 1. Motivation The RIPE Database protects data from unauthorised modification through the use of references to maintainer objects. The maintainer objects contain an "auth:" attribute which specifiy how a user is authenticated during updates to the database. One of the allowed authentication schemes is "NONE", which is actually not an authentication at all, but rather specifies that no authentication is necessary. NONE is intended to be used consciously, as a notification facility or as a means to tag objects. In April 2003, a proposal was sent to the Database Working Group by Hank Nussbacher: It has come lately to the attention in the Internet security realm that spammers as well as crackers are hijacking IP address space. One easy way to "steal" IP address space is via those that have auth=NONE on their objects. It is likely that in many cases NONE is used simply because it is easy. Currently approximately 500 maintainers use NONE - about 5% of all maintainers. 2. Plan Normally with a database cleanup effort, an announcement is sent to the appropriate mailing lists, posted to the RIPE web page, and also sent to the specific users affected. A period of time for cleanup is given. Finally, if the users have not fixed the data then it is modified. However, for the NONE deprecation, it is inadvisable to do this as it means announcing what is in effect a security vulnerability. Also, our operational experience with past cleanups shows that most users do not really participate through the phases of the effort. Therefore, the plan for MNTNER objects with the NONE authentication scheme is: o Announcement only to db-wg mailing list. (This announcement) o Remove "auth: NONE" attributes from all MNTNER objects, by changing them to a "remarks:" attribute with a URL explaining the change. o If that is the only authentication scheme, update the mntner objects, adding MD5-PW with a generated password. o E-mail the "admin-c:" and "tech-c:" of the objects, and the e-mail addresses listed in the "upd-to:" and "mnt-nfy:" attributes of the objects, explaining the change and including the new password if one is added. o Passwords can be requested via an e-mail to <ripe-dbm(a)ripe.net>. The reply with the password will be sent to the same contacts. After a certain period of time the service will be discontinued. Users wishing to use these maintainers may contact <ripe-dbm(a)ripe.net> for assistance. 3. RIPE-NCC-NONE-MNT A maintainer with NONE authentication, RIPE-NCC-NONE-MNT, was added to objects without any maintainer when the database was converted from RIPE-181 format to RPSL format in April 2001. There is a remark in these objects which includes the following: remarks: The RIPE NCC will never use this maintainer object to remarks: enforce any sort of control over user's objects. It is possible this could have been interpreted to mean that no restriction would ever be added to the object. One use of the RIPE-NCC-NONE-MNT has been to allow the creation of objects representing routing policy for resources not allocated or assigned by the RIPE NCC. This is done by using "mnt-routes: RIPE-NCC-NONE-MNT" or "mnt-lower: RIPE-NCC-NONE-MNT" as appropriate. A new maintainer object will be created for these cases, with a well- known password, published in the object: mntner: RIPE-NCC-RPSL-MNT descr: This maintainer may be used to create objects to represent descr: routing policy in the RIPE Database for number resources not descr: allocated or assigned from the RIPE NCC. admin-c: RD132-RIPE upd-to: ripe-dbm-notify(a)ripe.net auth: MD5-PW $1$GUExyzzy$XQtbZHGVqy9GW8BiAckBV1 remarks: ******************************************************* remarks: * The password for this object is 'RPSL', without the * remarks: * quotes. * remarks: ******************************************************* mnt-by: RIPE-DBM-MNT referral-by: RIPE-DBM-MNT changed: ripe-dbm(a)ripe.net 20040301 source: RIPE The main use of this maintainer is for INETNUM objects. There are approximately 60000 such objects - about 6% of the inetnums. Updates for objects with RIPE-NCC-NONE-MNT are rare, less than 2% of all updates. For objects using RIPE-NCC-NONE-MNT: o If there are other "mnt-by:" attributes it will be changed to a "remarks:" attribute. o Otherwise, the "mnt-by:" will be changed to RIPE-NCC-LOCKED-MNT, which has a locked password (or PGP key). o A "remarks:" attribute will be added explaining how to generate a maintainer. o An e-mail will be sent to the "admin-c:" and "tech-c:" of the objects, and the e-mail addresses listed in the "notify:" attributes of the objects, explaining the change and giving a URL which will help to generate a new maintainer or assign another existing maintainer. o At the URL, the object will be automatically updated to have a new maintainer. o After a certain period of time the service will be discontinued. Users wishing to use these maintainers may contact ripe-dbm(a)ripe.net for assistance. 4. Other maintainers with "auth: NONE" The RIPE-NCC-PN-NONE-MNT was used to mark PERSON objects not to be deleted in the 2001 person cleanup. It can be removed and the maintainer deleted. The LIM-MNT is used for limericks. It will have a well-known password similar to the RPSL maintainer. It will also be maintained by another maintainer (not itself, as currently). -- Ziya Suzen RIPE NCC

4 5

draft agenda (V2) for DB-WG meeting, RIPE 48, Amsterdam, NL
by Wilfried Woeber, UniVie/ACOnet 30 Apr '04

30 Apr '04

Dear DB-WG community, below please find Version *2* of the draft agenda for the DB-WG meeting at RIPE48 in Amsterdam, NL. Changes: - the CRISP item was confirmed by Andrew Norton, as well as the follow-up by the RIPE NCC - proposal to better support works of art in the DataBase poetry or just haiku? text-only (IDN-style??) or multi-media? - a sub-item added in A. to find out if coordination is needed for "remote participation" and maybe the Wiki stuff. Looking forward to see many of you again in Amsterdam! Wilfried. ++++++++ [ slot Nr.1 ] A. Administrative Matters - scribe - list of participants - agenda - minutes - "remote participation" coordination (if needed) B. DB Operational Update (Shane K., RIPE NCC) [~20 min] C. ERX Phase 3 (Leo V., RIPE NCC) [~15 min] D. Value "ZZ" for country: attribute (Engin G., RIPE NCC) [~10 min] E. CRISP/Joint-Whois status [~30 min] . report by Andrew Newton, VeriSign . follow-up by RIPE NCC [ slot Nr.2 ] F. support for works of art (Nigel T., FLAG TC [~10 min] . poetry | haiku | ??? G. irt: / abuse: [60+ min] . proposal by Niall O'R. & Randy B. . statistics by Marco H. Y. Input from other WGs Z. AOB -------------------------------------------------------------------------------- 30-APR-2004 09:40:06 UTC --------------------------------------------------------------------------------

1 0

Re: [db-wg] Action item 47.2: Proposal for Adding Abuse Contact
by Wilfried Woeber, UniVie/ACOnet 26 Apr '04

26 Apr '04

>As a starting point, let's take (approximations to) MarcoH's RIPE-47 >statistics. > >Number of inet[6]num objects: > 10**6 >Number of inet[6]num objects with IRT: > 10**3 (not significant) This simple counting approach is potentially VERY misleading, as it is not the sheer _number_ of individual entries which should be counted, but the _size_ of the address blocks covered in this hierarchy. On top of that, there's the possibiltiy to use the hierarchy to e.g. provide a "1st-line" contact for an individual address block AND a fallback or upstream for the encompassing block. Marco, would it be reasonably easy for you to extract this additional piece of statistics data? Wilfried.

3 3

Announcement Routing Registry Training Courses
by RIPE NCC Training 22 Apr '04

22 Apr '04

------- Dear Colleagues, [apologies for duplicate postings] As a service to its members the RIPE NCC offers the "Routing Registry Training Course". The main objective of the "Routing Registry Training Course" is to familiarise the LIRs with the features of the Routing Registry, while introducing the relevant tools and services of the RIPE NCC. The course also offers practical exercises. OVERVIEW OF TOPICS COVERED IN THE COURSE: - Routing Registry as a part of the RIPE Whois Database and the Internet Routing Registry (IRR) - Specifying routing policies using (RPSL) Routing Policy Specification Language and the RtConfig tool - IRRToolSet - Routing Information Service (RIS) - Routing Registry Consistency Check Project Please note that this is an advanced course. It will: - NOT teach the basics of routing - NOT teach the basics of RIPE Database operations, - NOT describe how to receive Internet resources from the RIPE NCC - NOT describe how to operate a Local Internet Registry (LIR) The target audience of the course are technical staff of LIRs: e.g. network operators, engineers etc. This course is not intended for administrative or management staff (e.g. Hostmasters) . It is assumed that all attendees will be familiar with Border Gateway Protocol routing and with the RIPE Database (i.e. creating/modifying objects). This course is based on interactive exercises in a local network set-up. Please bring your laptops equipped with the following: - A working Ethernet card, - Three meters of Ethernet cable, - A secure connection client, - A web browser. Please be prepared to share your laptop (or at least allow another attendee to "look over your shoulder") if necessary. The Routing Registry Training Course is conducted in the English language and is free of charge, since it is covered by the membership fee. More information about the Routing Registry Training Course can be found at: http://www.ripe.net/training/rr/ REGISTRATION: You can register for a Routing Registry Training Course at the follow ing URL: http://www.ripe.net/cgi-bin/trainingform.pl.cgi Or by completing the registration form at the end of this e-mail and replying to <training(a)ripe.net> . In order to register for a Routing Registry Training Course you must be an employee of an LIR and either: - be an LIR contact - be confirmed by an LIR contact LIR contacts are those employees of an LIR who are registered with RIPE NCC as authoritative contact persons. It is expected that most of those interested in the Routing Registry Training Course will not be an authoritative contact person for their LIR, and therefore will be, refused by the course registration "robot". In order to be admitted to the course, a confirmation e-mail must be sent to <training(a)ripe.net>. Please approach the LIR contacts from your organisation personally, since the identity of LIR contacts is confidential, and the RIPE NCC is unable to divulge contact persons for any given LIR. Kind Regards, Training Team RIPE NCC ************************************************************************ COURSE DATES AND VENUES ======================== Date: Thursday 24 June 2004 Time: 0900 - 1700 Location: Stockholm, Sweden AND: Date: Friday 9 July 2004 Time: 0900 - 1700 Location: London, United Kingdom AND: Date: Friday 6 August 2004 Time: 0900 - 1700 Location: Amsterdam,the Netherlands AND: Date: Tuesday 10 August 2004 Time: 0900 - 1700 Location: Tehran, Iran ********************************************************************* REGISTRATION FORM ================= %START PART 1 - Registration 1) Your name Enter First name, Last name in full e.g. John Doe Mary-Beth Walton # NAME [ ] 2) Your Registry ID (format: country-code.<name of registry>) # REG [ ] 3) Your e-mail address # EMAIL [ ] 4) Your NIC handle (optional) # NICHANDLE [ ] 5) The course you plan to attend (date and location) # COURSE [ ] %END

1 0

draft agenda (V1) for DB-WG meeting, RIPE 48, Amsterdam, NL
by Wilfried Woeber, UniVie/ACOnet 21 Apr '04

21 Apr '04

Dear DB-WG community, below please find Version 1 of the draft agenda for the DB-WG meeting at RIPE48 in Amsterdam, NL. In order to refine this 1st draft, I'd like to ask - Andrew Newton to confirm - or cancel - the CRISP item (I was told about that indirectly by NCC staff), and tell us a bit about time-slot length and content, - Niall and Randy: who's going to present the abuse proposal, - every individual or group mentioned in the list of topics to please check the lengh of the timeslot allocated and/or reply _to me privately, pls._ with information missing or any change requests. Pls. let me know asap if I missed any of the topic proposals and/or requests. If so, it was not done on purpose!! Looking forward to see many of you again in Amsterdam! Wilfried. ++++++++ A. Administrative Matters - scribe - list of participants - agenda - minutes B. DB Operational Update (Shane K., RIPE NCC) [~20 min] C. ERX Phase 3 (Leo V., RIPE NCC) [~15 min] D. Value "ZZ" for country: attribute (Engin G., RIPE NCC) [~10 min] E. CRISP/Joint-Whois status [??? min] . report by Andrew Newton, VeriSign [t.b.c.] . follow-up by RIPE NCC [t.b.c.] F. irt: / abuse: [60+ min] . proposal by Niall O'R. & Randy B. . statistics by Marco H. Y. Input from other WGs Z. AOB -------------------------------------------------------------------------------- 21-APR-2004 12:56:30 UTC

1 0

ORGANISATION objects in the RIPE Whois Database
by DB-News 19 Apr '04

19 Apr '04

Dear Colleagues, (apologies for duplicate messages) The RIPE NCC is pleased to announce that as of 17, April 2004, a new type of object, the ORGANISATION object, is available in the RIPE Whois Database. You can find more information about the ORGANISATION object at: http://www.ripe.net/db/organisation.html As part of the transition process, the RIPE NCC has: - created ORGANISATION objects for LIRs (around 4000 ORGANISATION objects) - updated LIR allocation objects to include "org:" attributes pointing to these new ORGANISATION objects (around 6500 INETNUM/INET6NUM objects) LIRs can update parts of their ORGANISATION objects through the ORGANISATION Object Editor available through the LIR Portal: https://lirportal.ripe.net/lirportal/index.html Please contact <ripe-dbm(a)ripe.net> for any questions. Best Regards, -- Engin Gunduz RIPE NCC Software Engineering Department

1 0

ANNOUNCEMENT Maintenance on Whois Server Regarding ORGANISATION Object
by DB-News 15 Apr '04

15 Apr '04

Dear Colleagues, [apologies for duplicate messages] On Saturday April 17, 2004, the RIPE NCC will perform maintenance work on the whois server. The aim of the maintenance is to upgrade the whois server to add support for a new object type, the organisation object. The maintenance is scheduled to start at 8:00 UTC (10:00 Amsterdam time) and expected to last around 10 hours. During the maintenance: - e-mail updates to <auto-dbm(a)ripe.net> will be queued to be processed after the maintenance - webupdates and syncupdates interfaces will NOT be available - whois query service will NOT be interrupted The maintenance work will consist of: - upgrading the whois software - creating ORGANISATION objects for LIRs - updating LIRs' allocation objects to have "org:" attributes pointing to these new ORGANISATION objects. We are sorry for any inconvenience this may cause. Please contact <ripe-dbm(a)ripe.net> for any questions. Best regards, -- Engin Gunduz RIPE NCC Software Engineering Department

1 0

Re: [db-wg] Action item 47.2: Proposal for Adding Abuse Contact
by Wilfried Woeber, UniVie/ACOnet 14 Apr '04

14 Apr '04

>To be sure, last meeting I had the count on the number of inet(6)num >objects having a mnt-irt and the number having a remarks: *abuse* >attribute. > >The request is to extend this on the actual number of IP-addresses covered >by both methods ? Correct, 'cause the single entry you can obtain by asking for > whois -h whois.ripe.net -cr 193.171.2.3 inetnum: 193.170.0.0 - 193.171.255.255 [ ... ] status: ALLOCATED UNSPECIFIED mnt-by: RIPE-NCC-HM-MNT mnt-lower: ACONET-LIR-MNT mnt-irt: IRT-ACOnet-CERT [ ... ] actually covers a /15 range... > I will try to extend my script (grep | wc -l) a bit to >get this info, hopefully during next weekend but at least in time for the >next meeting. thanks! >Grtx, > >MarcoH Wilfried.

1 0

call for agenda items, DB-WG, RIPE48 @AMS
by Wilfried Woeber, UniVie/ACOnet 14 Apr '04

14 Apr '04

Dear DB WG! Our next meeting is scheduled for less than a month from today, so it is time to ask for agenda items for the draft agenda. Support items for the logistics will be provided by Nigel T. and myself, the meet on the bones should be suggested from "your" end:-) Looking forward to meet many of you in Amsterdam! Wilfried ( https://cert.aco.net/ ) _________________________________:_____________________________________ Wilfried Woeber : e-mail: Woeber(a)CC.UniVie.ac.at UniVie Computer Center - ACOnet : Tel: +43 1 4277 - 140 33 Universitaetsstrasse 7 : Fax: +43 1 4277 - 9 140 A-1010 Vienna, Austria, Europe : RIPE-DB: WW144, PGP keyID 0xF0ACB369 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~:~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ...there's no place like 127.0.0.1 (or is it ::1 ?)

9 29