- db-wg - mailman.ripe.net

Re: [db-wg] Idea: magic mntner for all LIR contacts
by Tore Anderson 19 Feb '19

19 Feb '19

* Aleksi Suhonen > On 03/12/2018 10:35, Tore Anderson via db-wg wrote: >> So I was thinking: is this mandatory and error-prone duplication of work >> really necessary? Wouldn't it be possible to instead have some kind of >> magic mntner object that is is kept automatically up to date with «auth: >> SSO»-attributes for all the LIR user accounts? > > I second this idea. Perhaps this should be a different object type tho, to make it clear that editing the magic maintainer by hand will have undesired results. It should be interchangeable with normal maintainers of course, a bit like person objects and role objects are. Or maybe just expand the existing SSO attribute to accept a RegID. For example: mntner: FOOBAR-MNT auth: SSO no.foobar Which would allow maintenance by all registered user accounts in LIR no.foobar (except for accounts with the «billing» privilege level). > Do you want someone to co-author a PDP on this? I was hoping that a PDP wouldn't be necessary, to be honest. That is, if the NCC thought it was a good idea they could just go ahead and implement it. (If I recall correctly, the «auth: SSO» functionality was added without there being a community policy demanding it.) That said, if you want to write a proposal to this effect I'd be happy to put my name on it. Tore

9 44

Proposal for restricting authentication concerning use of revoked and expired GPG ID's in key-cert objects
by Christoffer Hansen (Lists) 11 Feb '19

11 Feb '19

Dear DB WG, It came to my attention the RIPE NCC Database does not do validation of signed updates. (Other than checking the key is allowed to sign updates for object(s) in question) I got the understanding from writing to DB-WG-Chairs this was a decision made years back. I think is less than optimal from a security perspective an signed update (with GPG and/or X509 certs) is not validated against (1) when the update was signed (E.g. signing was done 10 minutes ago) and (2) that the expiration date for the keys are not validated. Usually I will expect if I revoke a GPG-key|X509-cert. It cannot be used any more. But the RIPE NCC Database does still allow this currently. This is relevant in the case I ever lose a private GPG-key|X509-cert to less than friendly 3rd-parties. And the lost private GPG-key|X509-cert is the one used for signing updates to the database. What I have in mind. Is the RIPE NCC Database begins verifying validity (not revoked and/or expired) of GPG-key|X509-cert used to sign updates with. Christoffer

7 10

Certain sponsored? ASNs without sponsoring-org
by Cynthia Revström 08 Jan '19

08 Jan '19

So I have now run across several ASNs in which the org is of type "OTHER" yet there is no sponsoring-org, could this please be clarified? Example ASNs: AS200358, AS204842 If it is like I think it is, it must be that they have lost their sponsors but if that is the case, I would like to see a remark that is an "RIPE NCC managed value" saying something like "This ASN does not have any sponsor since YYYY-MM-DD". I am not entirely sure on this but something to clarify what is going on. Kind regards, Cynthia Revström

5 9

usage of LIR-PARTITIONED status
by Marco Schmidt 20 Dec '18

20 Dec '18

Hello Alex, Allow me to provide some additional clarification. As Gert has already correctly explained, the status LIR-PARTITIONED is used to partition allocations. For inetnum objects with the status ALLOCATED PA, you can create more specific objects with the status LIR-PARTITIONED PA. The same applies for PI. However there are no inetnums with the status ALLOCATED PI in the RIPE Database, and such ranges are no longer provided by the RIPE NCC. Recently, consensus was reached on a policy change to remove the status ALLOCATED PI and LIR-PARTITIONED PI from the RIPE IPv4 Policy document. https://www.ripe.net/participate/policies/proposals/2018-03 Following this policy change, we will also remove this status from the RIPE Database code and documentation shortly. I hope this clarifies things. Kind regards, Marco Schmidt Policy Officer RIPE NCC

1 0

usage of LIR-PARTITIONED status
by Alexander Stranzky 19 Dec '18

19 Dec '18

Hello, recently I stumbled upon some less-used status of the INETNUM object, namely LIR-PARTITIONED PA & LIR-PARTITIONED PI. Since there is no difference in the docs (https://www.ripe.net/manage-ips-and-asns/db/support/documentation/ripe-data…), can anyone tell me when to use PA and when PI? Cheers, Alex -- velia.net Internetdienste GmbH * Hessen-Homburg-Platz 1 * 63452 Hanau Geschäftsführer: Franz G. Köhler, Arek Akilli * AG Hanau * HRB 7588 Tel: +49 6181 1898119 * http://www.velia.net

2 1

Idea: magic mntner for all LIR contacts
by Tore Anderson 03 Dec '18

03 Dec '18

Hi, I'm starting to lose count of how many times I've made changes to the User Accounts list on the LIR Portal, but forgot to update our mntner object to add/remove the corresponding «auth: SSO foo@bar»-attributes. So I was thinking: is this mandatory and error-prone duplication of work really necessary? Wouldn't it be possible to instead have some kind of magic mntner object that is is kept automatically up to date with «auth: SSO»-attributes for all the LIR user accounts? Tore

1 0

Re: [db-wg] IRR and Hurricane Electric and RIPE
by Peter Courtney 13 Nov '18

13 Nov '18

thank you for the advice, much appreciated but all sorted now by Net Solutions Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum

1 0

Re: [db-wg] IRR and Hurricane Electric and RIPE
by Peter Courtney 13 Nov '18

13 Nov '18

thank you Christoffer, I am now well on my way to sorting this out with Net Solutions Europe, we will see what tomorrow brings, thank you for the advice Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum

1 0

IRR and Hurricane Electric and RIPE
by Peter Courtney 13 Nov '18

13 Nov '18

First Message on here, please go easy as I am learning every day, just recently a number of our customers have been complaining that they cannot get on to various web sites, so I sent an email to HE, and got this reply back Hello Teledesign AS41614 and your BGP Query Looks like you do not have valid IRR entries for some entries. http://irrexplorer.nlnog.net/search/91.204.244.0/24 says "Prefix is in DFZ, but NOT registered in any IRR You are NOT getting routed to the whole Internet. From BGP.HE.NET https://bgp.he.net/AS41614#_prefixes You should have GREEN check mark next to the prefixes. From route-views.oregon-ix.net: route-views>sh ip b 91.204.244.0/24 l | i 1299 route-views> Please ensure all of your prefixes have valid IRR entries. It seems these may be getting filtered by remote networks. Documentation is available here, but you essentially need to create a route object with your ASN as the origin http://fcix.net/whitepaper/2018/07/14/intro-to-irr-rpsl.html =================================================== could anyone help me find a simple "How To Document" that I can follow and do what HE are asking me to do, or is it something I can ask RIPE to do on my behalf thanks in advance to all Peter ( newbie sysadmin ) Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum

2 2

Re: [db-wg] [Ext] [address-policy-wg] Policies and Guidelines for Assignments for Network Infrastructure and End User Networks
by Töma Gavrichenkov 05 Nov '18

05 Nov '18

Hi Leo, Just to make it 100% clear for me: do you mean to say that you support my proposal No. 2? пн, 5 нояб. 2018 г., 23:12 Leo Vegoda <leo.vegoda(a)icann.org>: > Hi, > > Töma Gavrichenkov wrote: > > [...] > > > > When an End User has a network using public address space this > > > _must_ be registered separately with the contact details of the End > > > User. Where the End User is an individual rather than an > > > organisation, the contact information of the service provider may > > > be substituted for the End Users. > > [...] > > > All in all, RIPE-708 6.2 is a perfect example of an imperfect > > policy, too strict and too vague at the same time. Which is bad, > > because a) some ISPs would just prefer to ignore it, no matter > > the "must", and would be paying less attention to other "musts" > > they would encounter in other policy documents, b) those ISPs > > who would choose to be responsible about RIPE DB usage risk > > losing customers and wouldn't be able to defend their attitude > > against the customers, let alone courts, based on the RIPE DB > > policy. > > Over 20 years ago, the ISP at which I worked had a number of customers > with home networks using public IP address space. The ISP placed its own > contact information in the RIPE Whois Database with a comment that the > address space was assigned to an individual customer. > > If I remember correctly this was done for two key reasons: > > 1. RIPE policy does not override the law of the land. > 2. There was very little value in placing those customers' contact details > in the RIPE Whois Database because they were network users and not network > administrators. The ISP's NOC staff had skills, tools, processes, and > training and were in a much stronger position to provide meaningful > assistance to anyone with a genuine reason to make contact about the > administration of one of those customer networks. > > As I remember, the RIPE NCC was happy with the rationale back then. While > the specific wording of RIPE policy might have changed somewhat in the last > 20 years, I don't think the intent has. > > The contact details of the End User do not have to mean their personal > phone number or e-mail address. And if they do not have the skills, tools, > processes, and training to provide meaningful assistance to anyone with a > genuine reason to make contact about a specific network, providing a > personal phone number or e-mail address is arguably unhelpful. > > Kind regards, > > Leo Vegoda >

2 1