- db-wg - mailman.ripe.net

Proposal to limit the use of the RIPE-NCC-RPSL-MNT on mnt-by
by Tim Bruijnzeels 11 Feb '16

11 Feb '16

Dear working group, There is an open action point on us regarding the use of the RIPE-NCC-RPSL-MNT maintainer: https://www.ripe.net/ripe/mail/archives/db-wg/2015-May/004626.html > I'd like to ask RIPE NCC to provide the group with an implementation > plan and a timeline on how to prevent the RIPE-NCC-RPSL-MNT mntner from > being used to authenticate updates to an object after the object has > been created. We also ask that the RIPE NCC look into cleaning up > existing references to RIPE-NCC-RPSL-MNT and tell us their plan. Note that there is an ongoing an important parallel discussion about the authorisation of out-of-region IRR objects in general. But this is specifically about the use of 'RIPE-NCC-RPSL-MNT' on "mnt-by:". As long as we do have RIPE-NCC-RPSL-MNT, there are things we can improve and we want to propose the following to working group: 1) implement a business rule to prevent that this maintainer is used as 'mnt-by' Submitting an object that includes 'mnt-by: RIPE-NCC-RPSL-MNT' would result in a hard error, with a message like: "The RIPE-NCC-RPSL-MNT is used to authorise the creation of out-of-region aut-num and route(6) objects, but may not be used as 'mnt-by'" This is fairly trivial to implement, provided of course that the working group agrees to this. 2) remove the maintainer from existing objects There are roughly 2000 objects that are maintained by 'RIPE-NCC-RPSL-MNT' only, and about 10000 objects that are maintained by 'RIPE-NCC-RPSL-MNT' and at least one other maintainer. In the first case we propose to lock the object, i.e. set 'mnt-by: RIPE-NCC-LOCKED-MNT', and send out a custom notification to any contacts on the object explaining that the object has been locked to prevent a hijack of the object, and that ripe-dbm(a)ripe.net can be contacted to unlock the object. In the second case we propose to leave the remaining maintainer and send out a custom notification informing contacts on the object that the "RIPE-NCC-RPSL-MNT" has been removed to prevent a hijack of the object, and listing which maintainer(s) remain. Technically this is not difficult either, but it can result in a lot of questions. Therefore we prefer to do this in batches to make sure that we can process possible follow up requests to ripe-dbm(a)ripe.net properly. For reference we used a similar approach when dealing with locking the old MD5 passwords earlier this year. Provided that the working group agrees with this, we expect this can be done in the space of a few weeks after the business rule is implemented. Kind regards, Tim Bruijnzeels Assistant Manager Software Engineering RIPE NCC Database Group

9 14

Implementation proposal descr line
by Tim Bruijnzeels 11 Feb '16

11 Feb '16

Dear working groups, Following discussion in this group it was decided that the RIPE NCC should stop enforcing that the first "descr:" attribute of resource objects reflects the name of the organisation, for resources that it alloced or assigned. This practice has been place for a long time, but now that all such objects have a reference to an organisation object and the RIPE NCC ensures that this reflects the resource requests, this is no longer needed. Furthermore it was decided that the RIPE NCC should clean up existing organisation names in "descr:" attributes in order to: (1) avoid confusion about where the organisation name should be found; (2) avoid that the names here are different from the name of the actual organisation; (3) make it very clear which attributes are verified by RIPE NCC, and which attributes are not. Hereby the RIPE NCC would like to propose an implementation plan for these changes. We invite the working group to review and discuss if needed. As soon as the working group co-chairs formally call consensus, we can proceed to implement shortly. Implementation proposal: ======================== = Change "descr:" to an 'optional multiple' attribute We believe that the working group concluded that it would be appropriate to make "descr:" optional. The reason is that when the organisation name is cleaned up, there may be no description lines left. The working group considered whether the attribute should be 'single optional', but there seemed to be no strong preference for this, and it would have a bigger impact. Therefore we propose to go for the easier option of making it 'optional multiple'. Technically this change is not hard to do on the server side, but can impact users of the database because there may be no "descr:" attribute, and this can affect parsers. Because this can have an impact on automated systems the RIPE NCC will announce this change ncc-announce(a)ripe.net, and use a longer week staging period in the Release Candidate environment allowing users to test and update their systems. Dependent on formal consensus call we may be able to combine this with the upcoming release for deprecating "changed:" phase 3, to avoid delays. = Clean up existing "descr:" attributes where RIPE NCC enforced the organisation name The RIPE NCC will remove the "descr:" attributes that it has been enforcing. = Add "descr:" to allocation object editor in LIR Portal So that LIRs can edit this themselves. = Stop setting the "descr:" on new allocations or assignments done by the RIPE NCC We will leave "descr:" blank. It can be edited by the LIR or end-user later.

8 14

Release 1.85 (changed phase 3) deployed to RC
by Tim Bruijnzeels 02 Feb '16

02 Feb '16

Dear working group, We have just deployed release 1.85 to the Release Candidate environment. This release completes the deprecation of the "changed:" attribute: https://labs.ripe.net/Members/tim/deprecating-the-changed-attribute-in-the-… With this release we will: = Filter out "changed:" from all RIPE Database objects = Actively remove "changed:" from all RIPE Database objects = Reject updates that contain "changed:" We encourage all users of the database to test their tools. If no issues are found we plan to deploy this release to production on Monday 1 February 2016. Note that this release includes all changes from the previous release, 1.84.1. But, we only plan to upgrade the RIPE Database hardware, and deploy the 1.84.1 release, in the first half of January. Because this upgrade will involve a brief outage for updates to the Database, we will communicate a more detailed plan with time lines closer to the date. Kind regards, Tim Bruijnzeels Assistant Manager Software Engineering RIPE NCC Database Group

1 1

Re: [db-wg] [members-discuss] ripe objects as single text field
by Alex Band 02 Feb '16

02 Feb '16

Hello everyone, I would just like to clarify a couple of things on the redesigned user interface, based on the feedback we have received so far. First of all, these are the URLs to all of the different parts of the RIPE Database web ui, as it seems some people are getting a bit lost: Query: https://apps.db.ripe.net/search/query.html Create using single text field: https://apps.db.ripe.net/db-web-ui/ Create/Update using multiline text area: https://apps.db.ripe.net/syncupdates/simple-rpsl.html In addition, the TEST database user interface now has its own dedicated URL, instead of having to select it with a radio button: https://apps-test.db.ripe.net/ The option to edit an existing object in a single text area is functionality that was used very infrequently according to our statistics. We decided to leave it out of the first phase of the redesign, as most people use email or scripting to update the RIPE Database in a single text area. If there is a lot of demand, we'll implement that option as well for the web interface as well. Please keep in mind that it not impossible to edit an existing object in a single text area, it is simply a two-step process. You can copy and paste the object you queried into Syncupdates and go from there. This update method will allow you to use your SSO account to authenticate as well, if it is associated with your maintainer. Lastly, I realise "Syncupdates" is not the most descriptive name ever. We will make sure that we have a look at the wording of the different menu items to avoid confusion. Kind regards, Alex Band Product Manager RIPE NCC > On 25 Nov 2015, at 11:28, Andy Betts <A.Betts(a)node4.co.uk> wrote: > > Yep, I just discovered that feature had been removed (or really well hidden) this morning. > > Please bring it back. > > Regards > Andy > From: members-discuss [mailto:members-discuss-bounces@ripe.net] On Behalf Of David Wilkinson > Sent: 24 November 2015 17:06 > To: Tapio Haapala; members-discuss(a)ripe.net > Subject: Re: [members-discuss] ripe objects as single text field > > Hi Tapio, > > Looks like they have removed it. I can't see away to use the single text update either. (Unless both of us are blind) > > That is quite annoying as to update some records it was easier to edit via the single text area than adding each attribute one by one. > > Regards > > David > > > -----Original Message----- > From: members-discuss [mailto:members-discuss-bounces@ripe.net] On Behalf Of Tapio Haapala > Sent: 24 November 2015 16:42 > To: members-discuss(a)ripe.net<mailto:members-discuss@ripe.net> > Subject: [members-discuss] ripe objects as single text field > > Signed PGP part > I was just adding domain objects to DB. Suddenly that ui ask me to login again. After that I did not find way to add objects via single text fied. > Can someone check that do they really remove one of most used feature at whole portal or is it just me who is blind or dumb? > > -- > F-Solutions Oy > > Tapio Haapala > > PL7, 90571 Oulu > GSM 0400 998371 > Skype burner- > IRC Burner@ircnet<mailto:Burner@ircnet> > > > ---- > If you don't want to receive emails from the RIPE NCC members-discuss mailing list, please log in to your LIR Portal account and go to the general page: > https://lirportal.ripe.net/general/ > > Click on "Edit my LIR details", under "Subscribed Mailing Lists". From here, you can add or remove addresses. > > ---- > If you don't want to receive emails from the RIPE NCC members-discuss > mailing list, please log in to your LIR Portal account and go to the general page: > https://lirportal.ripe.net/general/ > > Click on "Edit my LIR details", under "Subscribed Mailing Lists". From here, you can add or remove addresses. > > ________________________________ > This email has been scanned inbound by Node4's Email Security System. > ________________________________ > This email message has been delivered safely and archived online by Mimecast. > ________________________________ > > *************************************************************************************************************************************************** > Node4 Limited is registered in England No: 04759927 and has its registered office at Millennium Way, Pride Park, Derby, DE24 8HZ > The information contained in this email is confidential and is intended for the exclusive use of the email addressee shown. > If you are not the addressee, any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited. > If you have received this mail in error, please notify our mail manager at abuse(a)node4.co.uk and delete it from your system. > Opinions expressed in this email are those of the individual not the company, unless specifically indicated to that effect. > > > > This email has been scanned by Node4's Email Security System. > > This email message has been delivered safely and archived online by Mimecast. > **************************************************************************************************************************************************** > ---- > If you don't want to receive emails from the RIPE NCC members-discuss > mailing list, please log in to your LIR Portal account and go to the general page: > https://lirportal.ripe.net/general/ > > Click on "Edit my LIR details", under "Subscribed Mailing Lists". From here, you can add or remove addresses.

7 9

Fwd: [staff] [ncc-announce] [service] Planned RIPE Database Hardware Upgrade: Monday 18 January, 17:00-18:00 UTC
by Tim Bruijnzeels 18 Jan '16

18 Jan '16

Dear working group, In case you missed the announcement we sent last week. We are planning a hardware upgrade later this afternoon/evening that will involve a short outage for updates. Queries should not be affected. Kind regards, Tim Bruijnzeels > Begin forwarded message: > > From: Tim Bruijnzeels <tim(a)ripe.net> > Subject: [staff] [ncc-announce] [service] Planned RIPE Database Hardware Upgrade: Monday 18 January, 17:00-18:00 UTC > Date: 14 Jan 2016 14:37:57 CET > To: ncc-announce(a)ripe.net > > Dear colleagues, > > The RIPE NCC is planning to upgrade the RIPE Database hardware this coming Monday, 18 January. > > With the new hardware we will start to use MariaDB instead of MySQL as the back-end to the RIPE Database. To support this change we will upgrade the RIPE Database software to version 1.84.1. This software has been running in the Release Candidate environment without issues since 9 December. Detailed release notes can be found here: > https://www.ripe.net/manage-ips-and-asns/db/release-notes/ripe-database-rel… > > Queries to the RIPE Database will be unaffected during the upgrade, but there will be a short outage in updates between 17:00 and 18:00 UTC. > > Kind regards, > > Tim Bruijnzeels > Assistant Manager Software Engineering > RIPE NCC Database Group >

2 1

abuse-c: important points on it's usage
by denis 13 Jan '16

13 Jan '16

HI All I make no apologies for the length of this email, but I would ask anyone concerned with abuse handling, RIPE Database data management and RIPE Database maintenance to read it. I am not trying to be a perfectionist or technical purist, but the changes being forced through now do matter. cheers denis When "abuse-c:" was first proposed, Tobias (co-chair of Anti Abuse WG) and I spent a lot of time discussing how to achieve the intended goal. We came up with the current implementation, which after community discussion was approved. But you never think of everything in the first instance. I believe there is one piece missing that allows the whole system to be broken (see later). I also believe the changes being made (without proper discussion) by the RIPE NCC's 'improvements' to Webupdates will break the abuse-c system over time. As a separate issue, but related to this, I think the RIPE NCC should give advance notice to the community of changes to interfaces like Webupdates and allow some discussion on significant changes like ORGANISATION object creation and authorisation and not just 'slip them in', then try to justify them when someone notices. These are major changes to the way the RIPE Database works. They are not just changing the look and feel of Webupdates as an interface tool. So lets start with some history. The goal of "abuse-c:" When the data model was designed there was no thought given to abuse contacts. The internet was much smaller and more personal. The data model was built on the principle of human readability and not programatic parsing. So when the need for abuse reporting was first considered necessary it was good enough to add things like: remarks: In case of abuse contact me(a)here.com You could put this anywhere and someone would find it. Then it got a bit more formal and we introduced the "abuse-mailbox:" attribute. But this was allowed in five or six object types. None of these were the resource objects. So the information was scattered all over the database. This was still almost impossible to find programatically. The goal of "abuse-c:" was: -to have one way of documenting abuse contact details -parsable programatically -very simple for majority of resources -flexible for any other resource situation The "abuse-c:" design Tobias and I considered many options to achieve these goals. What we focussed in on was that most small to medium LIRs may have many resources but only one person/role handling abuse complaints. All these resource objects in the database referenced their one ORGANISATION object. So by adding the "abuse-c:" attribute to the one ORGANISATION object, referencing a ROLE object containing the contact details, we handled a large number of simple cases in a very simple way. All the resources referencing this one ORGANISATION object and all the more specific resources would inherit this contact information from this one location. Easy to set up, easy to maintain. But there are other situations. For example sub allocations. We also considered that accountability is an important element of this public registry database. There is a notion that when a resource is allocated or assigned by the RIPE NCC to an organisation, then that organisation is ultimately responsible for anything that happens regarding that resource. This is why ORGANISATION objects are mandatory for any organisation that wants to hold internet resources. So we considered that if part of the responsibility has been delegated to another organisation with a sub allocation, it is not unreasonable that another ORGANISATION object should be created to reflect this delegated responsibility. If this second organisation handles the abuse reporting for this sub allocation, then another "abuse-c:" attribute can be added to their ORGANISATION object to reflect this. If the LIR who is responsible for this allocation, including the sub allocation, wants to handle all abuse reports for the whole of their allocation then no "abuse-c:" should be added to the second ORGANISATION object. The sub allocation will then continue to inherit the abuse contact details of the LIR who holds the whole resource. Inheritance vs Scattering The data model for the RIPE Database was not designed with inheritance in mind. In many situations duplicated, redundant data is scattered all over the database. There are over 3 million INETNUM objects in the database. They all contain one or more "admin-c:" and "tech-c:" attributes. In reality all these references are to a few tens of thousands of individual roles. These contacts could be inherited from the ORGANISATION objects in the way "abuse-c:" has been set up. The "abuse-c:" was designed to be inherited and not to be duplicated where it is not needed. The changes made recently to Webupdates by the RIPE NCC (without any discussion) breaks the inheritance of "abuse-c:". It forces the scattering of more redundant data throughout the database. If you create an ORGANISATION object with Webupdates it forces the addition of an "abuse-c:" attribute whether it is needed or not. They argue that you can refer to an existing ROLE object making it the same abuse contact. Even if this was set up correctly it is redundant data. In reality people setting this up quickly will just take the easy option of giving any email address (mickey(a)mouse.com). They may not realise the impact of this. But this simple mistake overrides the LIRs genuine abuse contact details from any point in a network where this new ORGANISATION object is referenced. Understanding your network and the RIPE Database What it comes down to is that you should understand how your network is structured. You should at least know who needs to be contacted, for what reason, from which point in your network. Unfortunately with the current data model you also need to have at least a basic understanding of how the data is structured within the RIPE Database. And to be honest if you don't understand the basic structure of the RIPE Database you should not be managing data in it, maintaining it or documenting it. With knowledge of your network and the database you can decide where you need to put "abuse-c:" attributes. DO NOT add extra, redundant "abuse-c:" attributes. What can possibly go wrong? In defence of their unannounced changes to Webupdates, the RIPE NCC has argued that adding additional "abuse-c:" attributes is harmless and will NOT lead to bad data in the database. Forcing users to add additional, redundant data that breaks the principle of inheritance is in itself technically wrong. But without being a technical purist what else can go wrong? Once these additional references have been added, the seeds have been sown for future mistakes. It all depends now on who maintains what and who is notified of what changes. The referenced ROLE object can be changed or the "abuse-mailbox:" value in the ROLE object can be changed. This could be accidental or with good intent, but just got it wrong or even maliciously. Without the proper checks this can easily go unnoticed. Over time some/many of these redundant references may/will get out of sync with what they should refer to. In a few years time someone will argue that all this contact data is messed up, abuse-c did not work and we will invent a new system... The missing bit The "abuse-c:" attribute does work and will work well if used properly. But there is one bit missing from the original design....proper notifications. We need another attribute adding to the ORGANISATION object abuse-notif: [required] [multiple] [] This will allow the resource holder to keep an audit trail of any changes made to the abuse contact details for any parts of their resources. The 'required' (as defined in the database documentation) means it is syntactically optional, but business rules enforce it's presence in some situations. This should be added to any ORGANISATION object referenced by a resource object. Any addition, change or deletion of any part of the abuse contact details ("abuse-c: attribute, referenced ROLE object, "abuse-mailbox:" attribute) at any part of a network will be notified to the resource holder's email address specified in this attribute. Only the "abuse-notif:" referenced via the top level of a resource object will be notified. Any redundant references in more specific objects will be ignored (and should be removed, warned or disallowed). This means the resource holder will always be notified if anything is changed at any point in the resources/networks they are responsible for. I also think it would be useful if RIPEstat could give a visual representation of where abuse contacts are located within a network. This would allow a resource holder to review who is managing abuse for any part of their networks.

1 0

[training] RIPE NCC Webinars - new dates
by Training Services 13 Jan '16

13 Jan '16

Dear colleagues, We are pleased to announce the launch of new dates for our Webinars. The RIPE NCC Webinars are live and take only one hour. You can interact with our trainers without leaving your desk. We focus on the topics and issues most important for LIRs. Register now at https://www.ripe.net/lir-services/training/e-learning/webinars Participation is limited to 20 people, so don't hesitate if you want to take part! If you have questions, please email <training(a)ripe.net>. We look forward to seeing you online. Kind regards, RIPE NCC Training Services

1 0

Meanwhile, at ICANN...
by Shane Kerr 06 Jan '16

06 Jan '16

All, Not necessarily RIPE Database related, but I thought I'd point out that ICANN is considering replacing WHOIS for gTLD: https://www.icann.org/news/announcement-2016-01-04-en Cheers, -- Shane

3 2

Release 1.84 deployed to RC
by Tim Bruijnzeels 09 Dec '15

09 Dec '15

Dear working group, We have deployed release 1.84 to RC. This release was necessary to prepare for hardware upgrades of the whois infrastructure. Note that this release does not include the work for deprecating "changed:". This work will be part of release 1.85 that we plan to deploy to RC on 21 December, and to production on 1 February 2016. We needed to give precedence to this release, so that we will be able to upgrade the server infrastructure in January, while the release for "changed:" is still being evaluated in RC. Even though we plan to deploy 1.85 to RC on 21 December, we will only upgrade the server hardware and move to 1.84 in production in January. This upgrade does not include any API changes, however the hardware upgrade itself will involve a short outage of the RIPE DB updates. We want to do this operation after the end of year holidays when we are fully staffed, and will communicate a more detailed plan closer to the date. Please let us know if you have any concerns, comments or questions. Kind regards, Tim Bruijnzeels Assistant Manager Software Engineering RIPE NCC Database Group

1 0

[training] RIPE NCC Training Courses January-March 2016
by Training Services 07 Dec '15

07 Dec '15

Dear colleagues, Our training team travels the RIPE NCC service region to deliver training courses to our members without any additional cost. Over the next few months, we'll be in Amsterdam, London, Toulouse, Prague, Baku, St. Petersburg, Helsinki, Vilnius, Chisinau, Bishkek. Visit the following page to register and to check which training courses we are giving in your area: https://lirportal.ripe.net/training/courses The RIPE NCC delivers the following training courses: - LIR Training Course - RIPE Database Training Course - Basic IPv6 Training Course - DNSSEC Training Course - 2 days Advanced IPv6 Training Course - 2 days BGP Operations and Security Training Course For more information visit: https://www.ripe.net/support/training/courses With kind regards, Rumy Spratley-Kanis Training Services Manager

1 0