June 2015 - db-wg - mailman.ripe.net

Personalised authorisation
by Sascha Luck [ml] 19 Jun '15

19 Jun '15

Hi Alex, > Our current proposal allows authorisation on person objects for > those who want it, through maintainer objects Does this mean that calling a maintained object will spit out a reference to a mntner: object which will spit out a ton of references to person: objects which are authorised to make changes on the original object? rgds, Sascha Luck

2 2

[training] RIPE NCC Webinars - new dates
by Training Services 18 Jun '15

18 Jun '15

Dear colleagues, We are pleased to announce the dates for the RIPE NCC Webinars for the coming quarter. These interactive on-line learning sessions take about one hour, and give you the opportunity to learn and interact with our trainers without leaving your desk. In the next 3 months you can participate in the following Webinars: - Advanced RIPE Atlas Usage (NEW!) - Introduction to the RIPE Database - RIPE Database - Advanced Topics - IPv6 in the RIPE Database - IPv6 Addressing Plan - Webinar for New LIRs - Resource Certification (RPKI) Register now at https://www.ripe.net/support/training/learn-online/webinars Participation is limited to 20 people, so don't hesitate if you want to take part! If you have any questions, please email <training(a)ripe.net>. We look forward to seeing you online. Kind regards, RIPE NCC Training Services

1 0

MD5s of the RIPE database, Deprecation of MD5 and safe authentication methods
by Sascha Luck [ml] 17 Jun '15

17 Jun '15

Sorry for breaking the thread already, wasn't subscribed to this before. IMO there is a lot of work to be done before deprecating passwords. Right now this seems more than a little half-baked: 1) There should most definitely be SSO support for syncupdates. Webupdates, I'm sure, is fine for some but to me it's the most awkward and time-consuming way to make any db change. As far as email is concerned, deprecate that for all I care. I have never used that method in 15 years. 2) There are many issues with using PGP. As someone who makes DB changes for up to 5 LIRs at a time and who does not have a desk with a PC from which all work is done, what am I supposed to do? (On a side note, SSO has made that job so very much easier. If it can be used to authenticate mntners, by all means, please make that possible!) -Use the same privkey for all mntners? Hardly. -put all the privkeys on a USB stick? What if that is lost or stolen? All mntners are now compromised and have to be changed. Hopefully there is a copy of each privkey in some secure location... So, I wouldn't deprecate passwords until there is another option that is as flexible as a simple password. rgds, Sascha Luck

1 0

Re: [db-wg] Publishing Deleted Objects - Legal Analysis
by Athina Fragkouli 12 Jun '15

12 Jun '15

Dear Bengt and all, The purpose of the RIPE Database is defined in Article 3 of the RIPE Database Terms and Conditions: ------------------ Article 3 - Purpose of the RIPE Database The RIPE Database contains information for the following purposes: - Ensuring the uniqueness of Internet number resource usage through registration of information related to the resources and Registrants - Publishing routing policies by network operators (IRR) - Facilitating coordination between network operators (network problem resolution, outage notification etc.) - Provisioning of Reverse Domain Name System (DNS) and ENUM delegations - Providing information about the Registrant and Maintainer of Internet number resources when the resources are suspected of being used for unlawful activities, to parties who are authorised under the law to receive such information. - Scientific research into network operations and topology - Providing information to parties involved in disputes over Internet number resource registrations to parties who are authorised under the law to receive such information. ------------------- The RIPE Database Terms and Conditions can be found here: https://www.ripe.net/manage-ips-and-asns/db/support/documentation/terms Kind regards, Athina Fragkouli Legal Counsel RIPE NCC > From: Bengt Gördén <bengan(a)resilans.se> > Subject: Re: [db-wg] Publishing Deleted Objects - Legal Analysis > Date: 9 Jun 2015 17:12:02 GMT+2 > To: db-wg(a)ripe.net > > Den 2015-06-02 15:36, Athina Fragkouli skrev: >> Dear colleagues, > Hi Athina, > > Thank you for the legal clarification i this matter. > >> In response to the question raised on the Database WG mailing list, >> “…whether there would be legal restrictions or considerations with >> regards to publishing information about deleted objects or the deleted >> objects themselves”, please find below a preliminary analysis from a >> legal perspective. >> >> The RIPE Database contains a variety of types of data. A distinction >> should be made between database objects that contain personal data (i.e. >> person and role objects) and those that do not (i.e. inetnum, inet6num, >> autnum, etc.). >> >> For database objects containing personal data, the Personal Data >> Protection Act in the Netherlands applies. More specifically, according >> to the Act personal data may be collected for specific, explicitly >> defined and legitimate purposes. >> Once collected, this data must not be >> kept for any longer than is necessary to achieve the purpose for which >> it has been collected. >> >> In consultation with the RIPE community, the RIPE Data Protection Task >> Force identified the reason why personal data should be inserted into, >> and made publicly available through, the RIPE Database. The reason the >> Internet community initially requested that this data be made publicly >> available was for Internet operation purposes. Internet network >> operators should have each other’s contact details (which is considered >> to be personal data by the Act) in order to facilitate communication >> among the individuals responsible for networks in case of operational >> problems in the network (troubleshooting, abuse, etc.). >> >> Accordingly, the RIPE Database contains the contact details of >> individuals that are responsible for resolving operational problems in a >> network. However, if an individual no longer has this responsibility, >> this individual’s contact details must be deleted from the RIPE Database. >> >> If the RIPE community wishes to have access to contact details of >> individuals that were responsible for resolving operational problems in >> the past, then the RIPE community must have a specific, explicitly >> defined and legitimate purpose for it. If such a purpose is defined, the >> RIPE NCC will proceed with investigating the conditions under which this >> feature can be implemented in compliance with the Act. Implementation of >> this feature may include prior consent of these individuals. >> >> For more information about the implementation of this legislation in the >> RIPE Database and related services, please see the RIPE NCC Data >> Protection Report [1]. >> >> For database objects that do not contain personal data, there are no >> restrictions in terms of personal data protection. If the RIPE Community >> wishes the RIPE NCC to include the feature for publishing the history of >> deleted objects in the RIPE Database, the RIPE NCC will proceed with the >> implementation of this feature. As part of this process the RIPE NCC >> will need to investigate and possibly update its procedures and >> governance documents to ensure compliance with its legal obligations. >> Updating the relevant governance documents is subject to the RIPE NCC >> procedural document “Adoption Process for RIPE NCC Corporate Documents” >> [2]. > > If we can start out with inetnum, inet6num, aut-num, route, route6 and organisation it's good so far. > > I have a question about the word "purposes" of the text. Denis also mentions "purposes" in his e-mail. Are these "purposes" defined somewhere in a RIPE document or is it a legal definition that must be applied to what we believe is the "purpose" of an object? > > regards, > > -- > > Bengt Gördén > Resilans AB > >

1 0

Publishing Deleted Objects - Legal Analysis
by Athina Fragkouli 09 Jun '15

09 Jun '15

Dear colleagues, In response to the question raised on the Database WG mailing list, “…whether there would be legal restrictions or considerations with regards to publishing information about deleted objects or the deleted objects themselves”, please find below a preliminary analysis from a legal perspective. The RIPE Database contains a variety of types of data. A distinction should be made between database objects that contain personal data (i.e. person and role objects) and those that do not (i.e. inetnum, inet6num, autnum, etc.). For database objects containing personal data, the Personal Data Protection Act in the Netherlands applies. More specifically, according to the Act personal data may be collected for specific, explicitly defined and legitimate purposes. Once collected, this data must not be kept for any longer than is necessary to achieve the purpose for which it has been collected. In consultation with the RIPE community, the RIPE Data Protection Task Force identified the reason why personal data should be inserted into, and made publicly available through, the RIPE Database. The reason the Internet community initially requested that this data be made publicly available was for Internet operation purposes. Internet network operators should have each other’s contact details (which is considered to be personal data by the Act) in order to facilitate communication among the individuals responsible for networks in case of operational problems in the network (troubleshooting, abuse, etc.). Accordingly, the RIPE Database contains the contact details of individuals that are responsible for resolving operational problems in a network. However, if an individual no longer has this responsibility, this individual’s contact details must be deleted from the RIPE Database. If the RIPE community wishes to have access to contact details of individuals that were responsible for resolving operational problems in the past, then the RIPE community must have a specific, explicitly defined and legitimate purpose for it. If such a purpose is defined, the RIPE NCC will proceed with investigating the conditions under which this feature can be implemented in compliance with the Act. Implementation of this feature may include prior consent of these individuals. For more information about the implementation of this legislation in the RIPE Database and related services, please see the RIPE NCC Data Protection Report [1]. For database objects that do not contain personal data, there are no restrictions in terms of personal data protection. If the RIPE Community wishes the RIPE NCC to include the feature for publishing the history of deleted objects in the RIPE Database, the RIPE NCC will proceed with the implementation of this feature. As part of this process the RIPE NCC will need to investigate and possibly update its procedures and governance documents to ensure compliance with its legal obligations. Updating the relevant governance documents is subject to the RIPE NCC procedural document “Adoption Process for RIPE NCC Corporate Documents” [2]. Kind regards, Athina Fragkouli Legal Counsel RIPE NCC [1] https://www.ripe.net/about-us/legal/ripe-ncc-data-protection-report [2] https://www.ripe.net/about-us/corporate-governance/adoption-process-for-rip…

4 5

Personalised authorisation
by Tim Bruijnzeels 02 Jun '15

02 Jun '15

Dear working group, Yesterday during the WG session we presented a proposal for implementing personalised authorisation: https://ripe70.ripe.net/wp-content/uploads/presentations/165-ripe70-pers-au… <https://ripe70.ripe.net/wp-content/uploads/presentations/165-ripe70-pers-au…> https://ripe70.ripe.net/archives/video/123 <https://ripe70.ripe.net/archives/video/123> As recorded in the first cut of the minutes: > D. Personalised authentication (Tim Bruijnzeels, RIPE NCC) > (See presentation) > This will allow one click creation of person objects > Maintain credentials in one place. > Allow better auditing. > Done by extending person object to have multiple optional auth: attribute > This will ultimately allow existing auth: sso references to be cleaned up > Last auth: attribute should not be removed from a person object that is used in an authorisation context. Apart from questions about possible additions below, there seemed to be general approval for the above as an addition to the existing maintainer mechanism. We would very much like to implement this soon. We are already working on improving the way users can log in and use the web updates, and manage maintainers (and who is authorised for them), so having this would be extremely useful for that effort. Technically I don't think the above has to depend on further extensions below. Roles can be added at any time that we consensus on them, and showing audit logs is a separate effort - building on this. > Should this be extended to the role object as well? This would involve additional business rules but is technically possible. I understand and fully agree that there is a need to maintain a list of authorised persons centrally. But in effect a maintainer can be used for this purpose. Multiple objects can be maintained by the same maintainer, and the list of persons authorised can then be managed on this single maintainer: obj1 ---\ ---> mnt1 ---> pers1 obj2 ---/ \--> pers2 In other words, just like role objects can group persons in a 'contact' context, 'maintainers' could group persons in a 'authorisation' context, where also other things such as "upd-to:" etc can find a home. So, technically I don't think there is a need to have another role object here: obj1 ---\ ---> mnt1 ---> role1 ---> pers1 obj2 ---/ \--> pers2 Conceptually this can work of course, but it adds some complexity, and things to resolve: a) referencing roles from maintainers, and authorised persons from roles The proposal was to refer to authorised persons from maintainers like this: auth: person-<nichandle> Can we resolve this by allowing: = auth: role-<nichdl> on maintainers = auth: person-<nichdl> on roles But no other auth: flavours for now. Also note that this person is not necessarily an authorisation *contact* for others. If we follow current practice consistently we would filter this value for security purpose. b) business rules regarding auth->role Suggestion: - A role can only be added to a maintainer as "auth: role-<nichdl>" if it has at least one "auth: person-<nichdl>" - The last "auth: person" can not be removed from a role if it's referenced anywhere as "auth: role-" - As before: "auth: person-<nichl>" can only be added if the person has at least one "auth: <something>" - As before: the last "auth:" can not be removed from a person if it's referenced anywhere as "auth: person-" > It would be useful to record what credential (maintainer) was used to make a particular change to an object and this change > would facilitate this. RV was asked to raise this on the mailing list. Currently we do know internally which maintainer was used to submit a successful update, but not which credential. Technically this could be added of course. And in case of SSO or PGP people can get some idea of which user did the update. But showing which password hash was used for an update may not be best security practice. With authorisation delegated to persons (possibly through roles) we will be able to give a much more better output. We can refer to the name of the person, rather than a credential that should be private to that person. Also note that for any of this we will also need to be sure that the user viewing this information is authorised to see this. So what we had in mind here is to show this only on the web interface for logged in users authorised for at least one mnt-by of the object they are looking at.

5 7

Database release 1.80 deployed to RC environment
by Alex Band 01 Jun '15

01 Jun '15

Dear colleagues, We are happy to announce the deployment of RIPE Database software release 1.80 to the Release Candidate (RC) environment. This release contains quite significant changes to long-standing RIPE Database functionality. This is why we urge you to thoroughly test your tools and scripts against the RC environment to make sure nothing in your workflow breaks: https://www.ripe.net/data-tools/db/release-notes/rc-release-candidate-envir… 1. This release continues to gradually phase out the "changed" attribute. We're now in phase 2, where the attribute is marked as optional. For details on this functionality change, please refer to the implementation plan: https://labs.ripe.net/Members/tim/deprecating-the-changed-attribute-in-the-… 2. Also according to plan, the "referral-by" attribute has now been completely removed. It is no longer mandatory when creating or updating maintainers. We will perform a data cleanup following the release, to remove this attribute from current maintainer objects. Documentation for this release is published here: https://www.ripe.net/data-tools/support/documentation/ripe-database-documen… Please contact us if you find any issues with this release, or in case you have any questions or comments. We plan to deploy this release to the production environment on Monday, 13 July. Kind regards, Alex Band Product Manager (standing in for Tim, who is enjoying being a proud father)

1 0