- db-wg - mailman.ripe.net

MD5-PW auth scheme is available in the RIPE Database
by Andrei Robachevsky 17 May '02

17 May '02

Dear Colleagues, [apologies for duplicate messages] Following the request from the RIPE Community a new auth scheme based on MD5-crypt algorithm was implemented and put into production today, 16 May 2002. Implementation details can be found in the proposal circulated in the db-wg mailing list http://www.ripe.net/ripe/mail-archives/db-wg/20020401-20020701/msg00011.html. We also created another FAQ entry "How to use MD5-PW auth scheme in my mntner?" (http://www.ripe.net/ripencc/faq/database/qa5.html#13). The RIPE Database Reference Manual will be updated soon. You may use Crypt CGI interface (http://www.ripe.net/cgi-bin/cgicrypt.pl.cgi) to convert your passphrase to MD5-PW string. Regards, Andrei Robachevsky DB Group RIPE NCC

3 3

Phasing out MAIL-FROM auth scheme
by Andrei Robachevsky 16 May '02

16 May '02

Dear Colleagues, [apologies for duplicate messages] The MAIL-FROM authentication scheme is very weak. Forging RFC2822 headers can be done very easily. With the existence of more secure "auth" schemes in the RIPE Database, it does not make much sense to support it any more. The proposal to phase out the MAIL-FROM authentication scheme was presented to the to the Database Working group. You may find the original proposal at http://www.ripe.net/ripe/mail-archives/db-wg/20020101-20020401/msg00066.html The timeline for this transition presented below was discussed and approved at the RIPE 42 meeting. Please see the minutes of the DB-WG session http://www.ripe.net/ripe/wg/db/minutes/ripe-42.html. To make this transition more smooth we prepared a page with step by step instructions how to update the mntner objects to remove the MAIL-FROM auth scheme. It can be found at http://www.ripe.net/db/MD5-HOWTO.html Regards, Andrei Robachevsky DB Group Manager RIPE NCC Transition phases ================== Use of MAIL-FROM is phased out in four steps, on the following dates: Phase 1: 16 May 2002 - 12 June 2002 Notifying mntners with MAIL-FROM auth scheme -------------------------------------------- An announcement presenting this transition and encouraging the owners of the mntners to remove MAIL-FROM auth scheme from their objects will be sent on 16 May, 2002. The announcement will point to instructions how to update the mntner objects to remove the MAIL-FROM auth scheme. The distribution list will be compiled from e-mail addresses listed in "upd-to:", "mnt-nfy:" attributes of the mntners, as well as using contact information (e-mail) from "admin-c:" and "tech-c:" references. Phase 2: 13 June 2002 - 10 July 2002 Rejecting updates for mntner objects containing MAIL-FROM auth scheme --------------------------------------------------------------------- When updating maintainers the new version must not contain MAIL-FROM "auth:" attributes, otherwise this will be reported as a syntax error. This means that you cannot create any new MAIL-FROM "auth:" attributes, either in new or existing maintainers. Phase 3: 11 July 2002 - 7 August 2002 Rejecting using the MAIL-FROM auth scheme for authorisation ----------------------------------------------------------- When processing an update for an object protected by a mntner that contains MAIL-FROM auth scheme, this scheme will be ignored. That means that if mntner defines other auth schemes different from MAIL-FROM, the credentials relevant to these schemes may be used. If the only auth scheme defined is MAIL-FROM, no update can be authorised by such mntner. Phase 4: 8 August 2002 Cleanup ------- The mntners still containing "auth:" attribute with the MAIL-FROM auth scheme will be modified so that such attributes will be removed from the objects. Before this a final call will be sent to the owners of these mntners ("upd-to:", "mnt-nfy:" attributes of the mntners, as well as to the contacts from "admin-c:" and "tech-c:" references). A "remarks:" attribute will be added with clear explanation of the situation. In case a mntner contains only one "auth" scheme, which is MAIL-FROM, it will be locked and cannot be used by the owner.

2 1

Anti-spam policy for ripe-dbm@ripe.net mailbox
by Andrei Robachevsky 13 May '02

13 May '02

Dear Colleagues, Starting from Monday, 20 May 2002, an anti-spam filtering policy for ripe-dbm(a)ripe.net mailbox will be implemented. Messages not explicitly directed to ripe-dbm(a)ripe.net, that is not containing this e-mail address in "To:" or "Cc:" fields of the mail header will be filtered out and not processed. Spam messages constitute up to a half of the ripe-dbm mailbox, and it takes some of our resources to identify and delete them. If you have any questions or concerns please contact RIPE Database Administration at ripe-dbm(a)ripe.net. Regards, Andrei Robachevsky DB Group Manager RIPE NCC

2 1

Requests to the RIPE DB Administration are now ticketised
by Andrei Robachevsky 03 May '02

03 May '02

Dear colleagues, [apologies for multiple messages] As was announced at the RIPE 42 meeting starting from the next week, 6 May 2002, questions and requests directed to the RIPE Database Administration (ripe-dbm(a)ripe.net) will be processed using a ticketing system. This will allow us to track your requests more efficiently and further improve the quality of support we provide to you. No automatic acknowledgements will be sent to you. In replies from the ripe-dbm the subject line will be modified by prepending a ticket number: Re: NCC#2002044160 <original subject> Please preserve this ticket number in your further correspondence with the ripe-dbm. No other changes should be visible to you. This will not affect submissions sent to the RIPE Database at auto-dbm(a)ripe.net. If you have any more questions regarding this issue please don't hesitate to contact ripe-dbm(a)ripe.net. Regards, Andrei Robachevsky DB Group Manager RIPE NCC

1 0

FYI: [cert-coord] DRAFT 6th TF-CSIRT Agenda - 23-24 May 2002, Copenhagen
by Yuri Demchenko 02 May '02

02 May '02

DB-WG: Please find attached the DRAFT Agenda of the next TF-CSIRT meeting in Copenhagen that contains item on RIPE NCC IRT Object: Implementation status and further deployment. In case you are interested to attend please contact me. > > Dear TF-CSIRT members, > > This is to inform you that the final DRAFT Agenda of the next TF-CSIRT > meeting on > 23-24 May 2002 in Copenhagen is on the web > > http://www.terena.nl/task-forces/tf-csirt/tf-csirt6th020525agenda-draft.html. > > Those of you who still plan to attend the meeting please register at > http://scripts.terena.nl/meetings/6thtfcsirt/ > > Best Regard, > > Yuri Demchenko > Draft AGENDA 6th TF-CSIRT MEETING A TF-CSIRT Seminar will be held on Thursday 23 May 2002, 9:30 - 17:00 (tentatively) The 6th TF-CSIRT meeting will be held on Friday 24 May 2002, 9:00-15:30 (tentatively) Venue for both events: TU campus, the Technical University of Denmark (look for the logistics information at https://www.cert.dk/conference/) Thursday 23 May 2002 TF-CSIRT Seminar 09:30 - Welcome. Overview of the programme. Logistics 09:45 announcements. Network configuration. Apologies. Introduction of those present. Seminar Session 1 Current Practice in CSIRTs Organisation, structure, working methods among CSIRTs 09:45-10:15 Europol's position in relation to IT-crimes - Chief Inspector Mr. Mogens Lund, Europol 10:15-10:45 Vulnerability database developed in schools and universities here in Denmark - DK-CERT 10:45-11:15 CERT-Polska 11:15 - Refreshment break 11:45 11:45-12:15 SUNet CERT - Torbjorn Wictorin 12:15-13:00 CAIF - Common Advisory Interchange Format, a proposal for a standard for writing, interchanging, processing, storing, and presenting security advisories - Oliver Goebel, RUS-CERT, Stuttgart University 13:00 - Lunch break 14:30 Seminar Session 2 RIPE NCC IRT Object: Implementation status and further deployment 14:30 - IRT Object implementation by RIPE NCC - Andrei Robachevsky, 15:00 RIPE NCC 15:00 - Discussion - how to proceed 15:30 15:30 - Refreshment break 16:00 16:00 - Reserved for Discussions 16:30 Friday 24 May 2002 6th TF-CSIRT meeting 09:00 - 1. Welcome and Apologies 09:05 09:05 - 2. Round of Introductions 09:10 09:10 - 3. Minutes of Last Meeting (Stockholm 25 January 2002) 09:25 * Status report on actions from last meeting 09:25 - 4. "Trusted Introducer" Pilot Service 09:55 * Status Report * Presentation of the TI Board 09:55 - 5. EC funded/accepted projects: Presentations and issues 11:15 for cooperation 5.1. TRANSITS: Training (new) staff of (new) CSIRTs - Andrew Cormack 5.2. EISPP - Michel Miqueu, CERT-IST 5.3. eCSIRT - Olaf Gellert, PreSecure 5.4. Overview of other known related projects and activities in EC 11:15 - Refreshment break 11:45 11:45 - 7. Update on FIRST 12:00 * FIRST14 Conference Information * Other FIRST Developments 12:00 - 8. Results of yesterday's Seminar Sessions 12:30 * Summary conclusions and follow-up actions * Summary of the RIPE NCC IRT Object Implementation status 12:30 - Lunch break 14:00 14:00 - 9. IODEF development 14:30 * INCH BOF report - Jan Meijer, CERT-NL * IODEF pilot implementation and related issues 14:30 - 10. Summary of the TF-CSIRT Charter Discussion 15:00 15:00 - 11. Other Work Items 15:30 * Assistance to establishment of new CSIRTs 15:30 - 12. Date and Venue of Next Meetings 15:35 15:35- 15:45 13. Any Other Business Accompanying events: To be announced later Additional information: Registration and list of registered participants - http://scripts.terena.nl/meetings/6thtfcsirt/ Logistics information - https://www.cert.dk/conference/

1 0

Draft Minutes of DB-wg minutes for RIPE 42
by Nigel Titley 02 May '02

02 May '02

Gentlefolk, Here is the first cut of the minutes for the DB working group. Corrections to me please, within 2 weeks, after which the final version will be posted to the group. RIPE webmaster, please post these to the web site as the first draft version Best regards Nigel

1 0

Transferring InterNIC space from ARIN Database to other RIR databases
by Joao Luis Silva Damas 26 Apr '02

26 Apr '02

Dear all, Sometime ago we started a thread about distributing address space issued prior to the existence of the RIRs, which is currently registered at the ARIN database (imported from the InterNIC's database), to the RIR that now operates in the region where the address space is registered as used. Doing this would simplify processes such as modifying the name servers for in-addr.arpa for those addresses, changing contact information, etc as the user will issue requests for change to the RIR in their region, the one with which they will normally be more familiar. Both ARIN and the RIPE NCC are now ready to proceed with this. There are some aspects, however, where community input is required and I would like to ask you to comment on the proposal below. Note: the examples at the bottom are just examples. We do not want to imply there is anything wrong with the objects mentioned. Best regards, Joao Damas RIPE NCC -------------------------------------------- Proposed procedure for migration of legacy objects from ARIN Database When moving data from the ARIN database into the RIPE Database the situation is not, unfortunately, always without conflicts. Some data that is in the ARIN database also has an entry in the RIPE database. While the ARIN database is the one which contains the authoritative information for the set of name servers used in in-addr.arpa resolution for the addresses in question (the in-addr.arpa zone file is generated from that data), sometimes the administrative contacts seem to be more up to date in the RIPE database. Below are a set of proposals for actions when transferring the data: I. inetnum objects 1. There are several types of conflicts with the data in the RIPE Database: 1.1 Exact matches with RIPE networks (4325) *Proposal: to override data in the RIPE Database with ARIN's. If the object in the RIPE database has a "changed" date more recent than the object in the ARIN database, contact information from the RIPE database is kept and the nameservers are the ones in the ARIN database. 1.2 ARIN network contains a RIPE network(s) (169) 1.2.1. ARIN's allocation, while multiple assignments are registered in the RIPE Database *Proposal: to keep RIPE's and ARIN's data 1.2.2. Minor Mismatch *Proposal: to override data in the RIPE Database with ARIN's 1.3 ARIN network is contained in a RIPE network (3060) *Proposal: to keep ARIN's data and delete RIPE network 1.4. Objects in the ARIN database only *Proposal: to put ARIN's data in the RIPE Database 2. Protection of the transferred inetnums *Proposal: To create a mntner object for each ARIN's 'coordinator'. Syntax could be: mntner: <coord hic hdl>-MNT mnt-by: <coord hic hdl>-MNT auth: MAIL-FROM <coord e-mail address> ... Then we protect inetnums 'owned' by the coordinator with this maintainer. Should be the same level of security as currently at ARIN. Note: it could be different if the POC is merged/replaced by existing RIPE person object (see further discussion). II. POC objects 1. Try to match POCs from ARIN DB to the existing person objects in the RIPE DB (762) The implication is that we use the person's e-mail address as authorization (see proposal above) * Proposal: to contact all affected persons in advance and have a more clear picture before the transfer. Questions to ask: - Do both records represent the same person? - Would (s)he like to merge the contact data, in what manner? After an answer to these questions is received: - Discuss protection issue (existing maintainer, coordinator's maintainer, auth). Needs human work. 2. Protection of the transferred POCs * Proposal: to add mnt-by referencing a respective coordinator's maintainer. ---------------- Examples I.1.2.1 inetnum: 130.242.0.0 - 130.243.255.255 netname: SUNETREGAB-RIPE descr: European Regional Internet Registry/RIPE NCC descr: These addresses have been further assigned descr: to European users. Contact information can descr: be found in the RIPE database at whois.ripe.net country: NL admin-c: RIPE-NCC-ARIN rev-srv: sunic.sunet.se rev-srv: falun.dns.swip.net rev-srv: ns.ripe.net status: ALLOCATION changed: hostmaster(a)arin.net 20000329 source: ARIN ... inetnum: 130.242.43.0 - 130.242.43.255 netname: SE-TEKNISKAMUSEET descr: Tekniska Museet country: SE admin-c: HALI1-RIPE tech-c: HALI1-RIPE status: ASSIGNED PA mnt-by: SUNET-MNT changed: fredrik(a)sunet.se 19981022 source: RIPE inetnum: 130.242.48.0 - 130.242.48.255 netname: SE-ARMEMUSEUM descr: Statens Forsvarshistoriska Museer country: SE admin-c: BOMI1-RIPE tech-c: LEPE1-RIPE status: ASSIGNED PA mnt-by: SUNET-MNT changed: fredrik(a)sunet.se 19981022 source: RIPE ... I.1.2.2 inetnum: 131.117.0.0 - 131.117.128.255 netname: ZUERI descr: Municipality of Zuerich descr: Wilhelmstr. 10 descr: Zurich, 8021 descr: CH country: CH admin-c: BM153-ARIN status: ASSIGNMENT changed: hostmaster(a)arin.net 19980824 source: ARIN inetnum: 131.117.0.0 - 131.117.127.255 netname: ZUERI-NET descr: Municipality of Zuerich descr: Zuerich, Switzerland country: CH admin-c: BM16-RIPE tech-c: BM16-RIPE changed: huber(a)switch.ch 19950412 source: RIPE I.1.3 inetnum: 130.138.0.0 - 130.140.255.255 netname: PHILIPS descr: Philips C&P/NBS descr: Eindhoven country: NL admin-c: HS6189-RIPE tech-c: HS6189-RIPE notify: H.Sanders(a)mpn.cp.philips.com changed: geertj(a)ripe.net 19940106 changed: H.Sanders(a)mpn.cp.philips.com 19960131 changed: ripe-dbm(a)ripe.net 19990706 changed: ripe-dbm(a)ripe.net 20000225 source: RIPE inetnum: 130.138.0.0 - 130.138.255.255 netname: PHILIPS-SERI-1 descr: Philips Components BV descr: Building BC136 descr: Hurkesestraat 9 descr: 5600 MD Eindhoven descr: THE NETHERLANDS country: NL admin-c: OK6-ARIN status: REASSIGNMENT changed: hostmaster(a)arin.net 19930413 source: ARIN II.1 person: Antonio_Blasco Bonito address: Rodinet S.a.s. address: Via Cavour 6 address: I-54033 Carrara address: Italy phone: +39 0585 779435 fax-no: +39 0585 757385 e-mail: Antonio-Blasco.Bonito(a)rodinet.com nic-hdl: ABB2 changed: blasco(a)rodinet.com 19990310 source: RIPE person: A. Blasco Bonito address: GARR-NIS address: c/o CNR-Istituto CNUCE address: via Santa Maria 36 phone: +39 50 593246 fax-no: +39 50 904052 e-mail: bonito(a)NIS.GARR.IT nic-hdl: ABB2-ARIN changed: hostmaster(a)arin.net 19931201 source: ARIN

6 6

Announcement: IRRToolSet version 4.7.2 released.
by Katie Petrusha 25 Apr '02

25 Apr '02

[ Apologies for duplicate mails ] Dear collegues, We are pleased to announce the release of Version 4.7.2 of the IRRToolSet, formerly known as RAToolSet. Changes: - aoe is back and working, RPSL compliant - several bugfixes in roe/RtConfig/prpath have been made You can download this release by anonymous FTP from the following URL: ftp://ftp.ripe.net/tools/IRRToolSet/IRRToolSet-4.7.2.tar.gz You may also want to check IRRToolSet page: http://www.ripe.net/ripencc/pub-services/db/irrtoolset/index.html The mailing list archive is available here: http://www.ripe.net/ripencc/mail-archives/irrtoolset/index.html We want to thank everyone participated in testing and sending us suggestions and bug reports. We appreciate your help and feedback. If you have any questions, please don't hesitate to contact katie(a)ripe.net. -- Kind regards, Katie Petrusha RIPE NCC

1 0

synchronous updates
by Can Bican 25 Apr '02

25 Apr '02

Dear colleagues, A prototype for synchronous updates on the RIPE Database has been released. In this initial implementation, the following requirements have been implemented: 1. Adding the ability to interactively update the database through a TCP port. 2. Using a well known protocol to provide an easy way for developing third party clients. 3. Compatibility with the mail updates, so the same submission produces the same result in both ways. 4. To be scalable, to address possible performance problems. The released prototype now acts as a syntax checker. It doesn't really process the updates, but rather checks it against an empty database, and returns as if the update has been processed, after the initial syntax checks from dbupdate have been performed. You can reach the prototype from: http://www.ripe.net/ripencc/pub-services/db/syncupdates/index.html Please communicate with us about ideas, comments and suggestions. Regards, -- Can Bican DB Group RIPE NCC

1 0

draft agenda (v1), for DB-WG meeting, RIPE 42, Amsterdam
by Wilfried Woeber, UniVie/ACOnet 25 Apr '02

25 Apr '02

Dear WG list members, attached please find the 1st draft: Proposed Agenda for the DB-WG Meeting at RIPE 42 in Amsterdam, NL. Looking forward to see many of you in Amsterdam a few days from now, Wilfried. ______________________________________________________________________ Proposed Agenda for the Database Working Group Meeting RIPE-42, Apr. 29 - May 3, 2002, Amsterdam, NL 1. Draft Thursday, May 2nd, 2002 09:00-12:30 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ A. Administrative stuff (WW, chair) . scribe (offer from Nigel received) . circulate list of participants . agenda bashing . status of minutes B. Action Items . status of actions C. DB update (RIPE NCC, Andrei R.) 15..20 min . operations report . development activities D. Complex authentication scenarios (Alex G. SWITCH) 20 min . irt: object, how to "package" signatures? . other open issues? E. Discussion on "hiding" credentials (RIPE NCC, N.N.) 20 min . "shadow password" concept . interaction with maintainers . interaction with shadowing Y. Input from other WGs . Z. AOB: . ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ WW, 25-APR-2002 08:52:07 _________________________________:_____________________________________ Wilfried Woeber : e-mail: Woeber(a)CC.UniVie.ac.at UniVie Computer Center - ACOnet : Tel: +43 1 4277 - 140 33 Universitaetsstrasse 7 : Fax: +43 1 4277 - 9 140 A-1010 Vienna, Austria, Europe : RIPE-DB: WW144, PGP keyID 0xF0ACB369 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~:~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1