December 2018 - db-wg - mailman.ripe.net

Proposal for restricting authentication concerning use of revoked and expired GPG ID's in key-cert objects
by Christoffer Hansen (Lists) 11 Feb '19

11 Feb '19

Dear DB WG, It came to my attention the RIPE NCC Database does not do validation of signed updates. (Other than checking the key is allowed to sign updates for object(s) in question) I got the understanding from writing to DB-WG-Chairs this was a decision made years back. I think is less than optimal from a security perspective an signed update (with GPG and/or X509 certs) is not validated against (1) when the update was signed (E.g. signing was done 10 minutes ago) and (2) that the expiration date for the keys are not validated. Usually I will expect if I revoke a GPG-key|X509-cert. It cannot be used any more. But the RIPE NCC Database does still allow this currently. This is relevant in the case I ever lose a private GPG-key|X509-cert to less than friendly 3rd-parties. And the lost private GPG-key|X509-cert is the one used for signing updates to the database. What I have in mind. Is the RIPE NCC Database begins verifying validity (not revoked and/or expired) of GPG-key|X509-cert used to sign updates with. Christoffer

7 10

usage of LIR-PARTITIONED status
by Marco Schmidt 20 Dec '18

20 Dec '18

Hello Alex, Allow me to provide some additional clarification. As Gert has already correctly explained, the status LIR-PARTITIONED is used to partition allocations. For inetnum objects with the status ALLOCATED PA, you can create more specific objects with the status LIR-PARTITIONED PA. The same applies for PI. However there are no inetnums with the status ALLOCATED PI in the RIPE Database, and such ranges are no longer provided by the RIPE NCC. Recently, consensus was reached on a policy change to remove the status ALLOCATED PI and LIR-PARTITIONED PI from the RIPE IPv4 Policy document. https://www.ripe.net/participate/policies/proposals/2018-03 Following this policy change, we will also remove this status from the RIPE Database code and documentation shortly. I hope this clarifies things. Kind regards, Marco Schmidt Policy Officer RIPE NCC

1 0

usage of LIR-PARTITIONED status
by Alexander Stranzky 19 Dec '18

19 Dec '18

Hello, recently I stumbled upon some less-used status of the INETNUM object, namely LIR-PARTITIONED PA & LIR-PARTITIONED PI. Since there is no difference in the docs (https://www.ripe.net/manage-ips-and-asns/db/support/documentation/ripe-data…), can anyone tell me when to use PA and when PI? Cheers, Alex -- velia.net Internetdienste GmbH * Hessen-Homburg-Platz 1 * 63452 Hanau Geschäftsführer: Franz G. Köhler, Arek Akilli * AG Hanau * HRB 7588 Tel: +49 6181 1898119 * http://www.velia.net

2 1

Idea: magic mntner for all LIR contacts
by Tore Anderson 03 Dec '18

03 Dec '18

Hi, I'm starting to lose count of how many times I've made changes to the User Accounts list on the LIR Portal, but forgot to update our mntner object to add/remove the corresponding «auth: SSO foo@bar»-attributes. So I was thinking: is this mandatory and error-prone duplication of work really necessary? Wouldn't it be possible to instead have some kind of magic mntner object that is is kept automatically up to date with «auth: SSO»-attributes for all the LIR user accounts? Tore

1 0