August 2005 - db-wg - mailman.ripe.net

<auto-dbm@ripe.net> is slow this afternoon.
by RIPE Database Administration 17 May '18

17 May '18

Dear Colleagues, Because of a very high level of use this afternoon, the response time of <auto-dbm(a)ripe.net> is longer than normal. I have made contact with those who are responsible and I expect the situation to improve as the machine works through the queue. Please be patient. Obviously we at the RIPE NCC Database Group are continuously working to make the performance of the database as good as possible. However, we cannot make improvements in zero time. We thank you for your co-operation up to now and we ask for your continued co-operation so that everyone receives the best possible service. If you have anymore questions, please contact <ripe-dbm(a)ripe.net>. Regards, Ambrose Magee ____________________________ RIPE Database Administration.

2 2

Deprecation of the NONE Authentication Scheme
by Ziya Suzen 08 Nov '05

08 Nov '05

Dear Colleagues, As announced at RIPE 47 the NONE authentication scheme will be deprecated. After 26 April 2004 the RIPE Whois Database will not accept updates using the NONE authentication scheme. If you have objects protected by a MNTNER object which has the NONE authentication scheme, please assign another authentication scheme or create another MNTNER object to protect these objects. If you are a RIPE NCC member you can create new MNTNER objects through the LIR Portal or send your update to <auto-dbm(a)ripe.net>. History and details: -------------------- 1. Motivation The RIPE Database protects data from unauthorised modification through the use of references to maintainer objects. The maintainer objects contain an "auth:" attribute which specifiy how a user is authenticated during updates to the database. One of the allowed authentication schemes is "NONE", which is actually not an authentication at all, but rather specifies that no authentication is necessary. NONE is intended to be used consciously, as a notification facility or as a means to tag objects. In April 2003, a proposal was sent to the Database Working Group by Hank Nussbacher: It has come lately to the attention in the Internet security realm that spammers as well as crackers are hijacking IP address space. One easy way to "steal" IP address space is via those that have auth=NONE on their objects. It is likely that in many cases NONE is used simply because it is easy. Currently approximately 500 maintainers use NONE - about 5% of all maintainers. 2. Plan Normally with a database cleanup effort, an announcement is sent to the appropriate mailing lists, posted to the RIPE web page, and also sent to the specific users affected. A period of time for cleanup is given. Finally, if the users have not fixed the data then it is modified. However, for the NONE deprecation, it is inadvisable to do this as it means announcing what is in effect a security vulnerability. Also, our operational experience with past cleanups shows that most users do not really participate through the phases of the effort. Therefore, the plan for MNTNER objects with the NONE authentication scheme is: o Announcement only to db-wg mailing list. (This announcement) o Remove "auth: NONE" attributes from all MNTNER objects, by changing them to a "remarks:" attribute with a URL explaining the change. o If that is the only authentication scheme, update the mntner objects, adding MD5-PW with a generated password. o E-mail the "admin-c:" and "tech-c:" of the objects, and the e-mail addresses listed in the "upd-to:" and "mnt-nfy:" attributes of the objects, explaining the change and including the new password if one is added. o Passwords can be requested via an e-mail to <ripe-dbm(a)ripe.net>. The reply with the password will be sent to the same contacts. After a certain period of time the service will be discontinued. Users wishing to use these maintainers may contact <ripe-dbm(a)ripe.net> for assistance. 3. RIPE-NCC-NONE-MNT A maintainer with NONE authentication, RIPE-NCC-NONE-MNT, was added to objects without any maintainer when the database was converted from RIPE-181 format to RPSL format in April 2001. There is a remark in these objects which includes the following: remarks: The RIPE NCC will never use this maintainer object to remarks: enforce any sort of control over user's objects. It is possible this could have been interpreted to mean that no restriction would ever be added to the object. One use of the RIPE-NCC-NONE-MNT has been to allow the creation of objects representing routing policy for resources not allocated or assigned by the RIPE NCC. This is done by using "mnt-routes: RIPE-NCC-NONE-MNT" or "mnt-lower: RIPE-NCC-NONE-MNT" as appropriate. A new maintainer object will be created for these cases, with a well- known password, published in the object: mntner: RIPE-NCC-RPSL-MNT descr: This maintainer may be used to create objects to represent descr: routing policy in the RIPE Database for number resources not descr: allocated or assigned from the RIPE NCC. admin-c: RD132-RIPE upd-to: ripe-dbm-notify(a)ripe.net auth: MD5-PW $1$GUExyzzy$XQtbZHGVqy9GW8BiAckBV1 remarks: ******************************************************* remarks: * The password for this object is 'RPSL', without the * remarks: * quotes. * remarks: ******************************************************* mnt-by: RIPE-DBM-MNT referral-by: RIPE-DBM-MNT changed: ripe-dbm(a)ripe.net 20040301 source: RIPE The main use of this maintainer is for INETNUM objects. There are approximately 60000 such objects - about 6% of the inetnums. Updates for objects with RIPE-NCC-NONE-MNT are rare, less than 2% of all updates. For objects using RIPE-NCC-NONE-MNT: o If there are other "mnt-by:" attributes it will be changed to a "remarks:" attribute. o Otherwise, the "mnt-by:" will be changed to RIPE-NCC-LOCKED-MNT, which has a locked password (or PGP key). o A "remarks:" attribute will be added explaining how to generate a maintainer. o An e-mail will be sent to the "admin-c:" and "tech-c:" of the objects, and the e-mail addresses listed in the "notify:" attributes of the objects, explaining the change and giving a URL which will help to generate a new maintainer or assign another existing maintainer. o At the URL, the object will be automatically updated to have a new maintainer. o After a certain period of time the service will be discontinued. Users wishing to use these maintainers may contact ripe-dbm(a)ripe.net for assistance. 4. Other maintainers with "auth: NONE" The RIPE-NCC-PN-NONE-MNT was used to mark PERSON objects not to be deleted in the 2001 person cleanup. It can be removed and the maintainer deleted. The LIM-MNT is used for limericks. It will have a well-known password similar to the RPSL maintainer. It will also be maintained by another maintainer (not itself, as currently). -- Ziya Suzen RIPE NCC

4 5

call for items for the DB-WG meeting, RIPE51, Amsterdam
by Wilfried Woeber, UniVie/ACOnet 01 Sep '05

01 Sep '05

The next RIPE meeting ( http://www.ripe.net/ripe/meetings/ripe-51/ ) is coming closer, and I have already collected a couple of suggestions for the DB-WG Meeting [1]. So this is a call for suggestions of items for the draft agenda. As I am going to be off the net for the next 2 weeks, please cc: Nigel Titley in case you want to reply to me individually, or to the list. Thanks, and see you in Amsterdam! Wilfried. [1] . impact of the new PDP ("policy" development process) . secureDNS requirements for the DB . whois functionality/service - follow-up (tbc)

2 2

Database Loading Error
by Peter Schroeder 31 Aug '05

31 Aug '05

Hello, I have been trying to set up a local snapshot of the RIPE database. I have been receiving this error after several hours of loading data: query not defined for this type of attribute[74] died: +781 modules/ud/ud_core.c ./load_all.sh: line 1: 29427 Broken pipe cat ./load_all.sh: line 72: 29425 Broken pipe ${UNZIP1} ${object_file} 29426 Exit 141 | eval ${FILTER} 29428 Segmentation fault | $LOADER -L $1 -p ${PROPERTIES} -s ${SOURCE} I am using ripe.db.gz from a few days ago. Does anyone know why I would be getting this error? Pete

1 0

To post to this list
by contact＠internetprogress.org 12 Aug '05

12 Aug '05

To post to this list, my emailadress : contact(a)internetprogress.org Sincerely, Guy Lombart

1 0

Database updates not visible
by Shane Kerr 11 Aug '05

11 Aug '05

Dear Colleagues Our query servers are not synchronising with our update server. A large update is taking place. You may have received an acknowledgement to your update, but do not see your changes when you query the database. Do not worry, the changes have been made, and will be visible as soon as we can update our query servers. If you have not received an acknowledgement to your update, please be patient. The server will process your update as soon as possible. Apologies for any inconvience. -- Shane Kerr Software Engineering Department Manager RIPE NCC

1 1

Anything wrong with RIPE DB?
by Marcus.Ruchti＠colt.net 11 Aug '05

11 Aug '05

Hi all, Do you know if anything happened with the RIPE DB last evening or even this morning? Our RIPE robot, reading out AS-sets and route objects, deleted a lot of prefixes. Started just a few minutes ago again without any changes to the Robot we got many prefixes back. This was of course service affecting for single-homed PI customers :-( Now I wonder if RIPE is doing something with the DB. I've seen the output has been changed (reduced mainly) but this does not affect my script. So any hints from your side are appreciated. Thanks Marcus Ruchti COLT Telecom, Frankfurt ************************************************************************************* The message is intended for the named addressee only and may not be disclosed to or used by anyone else, nor may it be copied in any way. The contents of this message and its attachments are confidential and may also be subject to legal privilege. If you are not the named addressee and/or have received this message in error, please advise us by e-mailing security(a)colt.net and delete the message and any attachments without retaining any copies. Internet communications are not secure and COLT does not accept responsibility for this message, its contents nor responsibility for any viruses. No contracts can be created or varied on behalf of COLT Telecommunications, its subsidiaries or affiliates ("COLT") and any other party by email Communications unless expressly agreed in writing with such other party. Please note that incoming emails will be automatically scanned to eliminate potential viruses and unsolicited promotional emails. For more information refer to www.colt.net or contact us on +44(0)20 7390 3900.

2 1

RIPE DB question
by Dmitry Kiselev 05 Aug '05

05 Aug '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi! Can I delete aut-num object from RIPE DB if it registered by me (as LIR) for one of our customers and I have NO auth info refered by object's mnt-by field? In different way question may sound like: how can I return registered resources (PI/ASN) if my customer gone? What is BCP within LIRs for this case? Thanks for advices! P.S. If I choise wrong WG, don't hit me too much ;) :) - -- Dmitry Kiselev -----BEGIN PGP SIGNATURE----- iD8DBQFC8csaZaocAwQhSAQRAhg7AKChkv2sTl4qBoRcnFxAMqYGEQ5kCACbBacj KvojUT8PbYFXR/emNFga9EM= =IFJU -----END PGP SIGNATURE-----

8 13

mntner creation
by Ulf Kieber 01 Aug '05

01 Aug '05

Hi all, did I miss something or since when does the RIPE DB permit creation of mntner objects by direct mail. Several of our customers have started creating mntners ad libitum and the mntner creation feature on lirportal.ripe.net has become pretty superfluous. -- Ulf Kieber email: ukieber(a)cogentco.com Sr. Network Engineer voice: +49-69-299896-21 C.C.D. Cogent Communications Deutschland GmbH fax : +49-69-299896-40 Optical Internet www : www.cogentco.com Brilliantly Fast. Elegantly Simple. AIM : ulfkieber

2 1