- db-wg - mailman.ripe.net

test message - please ignore
by denis walker 22 Mar '17

22 Mar '17

Apologies for sending this message out but we need to check some issues with the DB-WG mailing list. cheersdenisco-chair DB-WG

1 0

Re: [db-wg] db-wg Digest, Vol 66, Issue 3
by Alexander Stranzky 20 Feb '17

20 Feb '17

> 2. How are updates authenticated? > I'm aware, each object has a "mntner" but how and where is the Maintainer identity part of request to the API? Authentication is done via the maintainer's password. > 3. the Test-DB did not contain any objects related to our company - that's OK. > But could I add them? And how? I guess I may use 'https://apps-test.db.ripe.net/search/lookup.html?source=test&key=TEST-NCC-H…' > Right? There is the test database maintainer (TEST-DBM-MNT) you can use to set up everything using the password "emptypassword". once you have your own maintainer set up, use that one. see also https://github.com/RIPE-NCC/whois/wiki/WHOIS%20REST%20API%20Migration%20Gui… Regards, Alexander Stranzky -- velia.net Internetdienste GmbH * Hessen-Homburg-Platz 1 * D-63452 Hanau Geschäftsführer: Franz G. Köhler, Arek Akilli * AG Hanau * HRB 7588 Tel: +49 6181 1898119 * http://www.velia.net Follow us on twitter: https://twitter.com/velia_net

2 1

API Documentation
by Andreas Schulze 20 Feb '17

20 Feb '17

Hello, we like to modify RIPE objects using the API under https://rest.db.ripe.net (OK, starting with https://rest-test.db.ripe.net) I found some documentation: - https://github.com/RIPE-NCC/whois/wiki/WHOIS-REST-API-Update - https://www.ripe.net/manage-ips-and-asns/dns/enum/update-enum-delegation But some points are still unclear to me. 1. Is there any documentation about the database definition, which fields an object must or may have? 2. How are updates authenticated? I'm aware, each object has a "mntner" but how and where is the Maintainer identity part of request to the API? 3. the Test-DB did not contain any objects related to our company - that's OK. But could I add them? And how? I guess I may use 'https://apps-test.db.ripe.net/search/lookup.html?source=test&key=TEST-NCC-H…' Right? Thanks for help and nice weekend! Andreas -- A. Schulze DATEV eG

2 2

changes to the implementation of "abuse-c:" - final problem statement
by denis 08 Feb '17

08 Feb '17

1 0

changes to the implementation of "abuse-c:"
by ripedenis＠yahoo.co.uk 06 Feb '17

06 Feb '17

Colleagues The new co-chairs have prioritized existing and proposed NWIs. Our intent is to reach consensus on open items. We accept that we can't tackle them all at once and we may not address them in numerical order. We would like to start with one that has been discussed for many years, without coming to an acceptable solution, the implementation of the "abuse-c:" attribute. We thoroughly reviewed the working group discussion on the “abuse-c:” attribute, including reviewing Tim's initial draft of a problem statement. We removed the examples to make the problem statement brief and to the point. Anyone concerned with "abuse-c:" has most likely encountered one of these problems and doesn't need quoted examples. We also removed comments on the 'good parts' of the current implementation. That can come back when we discuss pros and cons of possible solutions. Then added in the issue Tobias made about the cleanup. So we end up with the problem statement shown below. Can we agree these are the problems that cause issues with some users? Are there any other problems that anyone has encountered? cheers Denis co-chair DB-WG Problem statement on "abuse-c:" implementation: =============================================== It is currently not possible to specify alternative abuse contacts for different resources in the RIPE Database held by different parts of the same organisation. It is currently not reasonably possible to specify alternative abuse contacts for resources in the RIPE Database assigned to organisations other than the parent organisation. In many circumstances these organisations are customers of the parent organisation. The lower organisation wishes to handle the abuse separate from the parent organisation. After the introduction of "abuse-c", the "abuse-mailbox:" attribute in the PERSON, MNTNER, ORGANISATION and IRT objects was intended to be deprecated. This cleanup was never done and the old data causes confusion to users manually searching the database.

7 11

changes to the implementation of "abuse-c:"
by Alexander Stranzky 17 Jan '17

17 Jan '17

> For a handful of customers that is not difficult, although some still > believe it is over complicated. If you have tens or hundreds of > customers wanting to handle abuse complaints themselves, then it moves > into the 'unreasonable' zone if all this has to be handled manually. For what does the RIPE have a REST API (and programmers that know how to use it)? We have to handle RIPE data for 2K+ customers, without the API that would indeed end in the least possible approach. But there are libraries out there that can be used so we can do abuse handling the intended way (via Org/Role). So maybe we should promote this API (and list client libraries that work with it) way more than today, to tell people that it is not that complicated to get it right. cheers, Alex -- velia.net Internetdienste GmbH * Hessen-Homburg-Platz 1 * D-63452 Hanau Geschäftsführer: Franz G. Köhler, Arek Akilli * AG Hanau * HRB 7588 Tel: +49 6181 1898119 * http://www.velia.net Follow us on twitter: https://twitter.com/velia_net

2 1

mntner object updates by mail
by Ulf Kieber 02 Jan '17

02 Jan '17

Dear DB WG members, there currently exists a somewhat tricky deadlock situation in updating mntner objects. Envision the following object: mntner: XOO-MNT admin-c: XOO-RIPE upd-to: kieber(a)xoo.net auth: PGPKEY-B490673F # Ulf Kieber auth: PGPKEY-XXXXXXXX # Somebody Else mnt-by: XOO-MNT source: RIPE Now, XOO is a large, distributed organisation and Someone Else eventually starts adding a bunch of auth: SSO # Filtered None of those SSO accounts is certainly mine. How am I going to update this mntner object without removing those SSO accounts? The issue here is: There is no way of retrieving the SSO account information from the mntner object without an SSO auth on it. Proposal: Add a way to retrieve mntner objects from the DB by encrypted mail (public key PGPKEY-B490673F is already in the database). PS: Mail updates may seem arcane to some, but I've done registry mergers of some 20000 object registries pretty fast that way. Regards, -- Ulf Kieber

4 3

Re: [db-wg] mntner object updates by mail
by Alexander Stranzky 02 Jan '17

02 Jan '17

> Mail updates have 2 reasons to exist: > - massive, bulk updates that would otherwise take too long to execute; > - fire & forget, just send in the update and it would get processed > eventually no matter what. > > In the age of REST APIs, neither of the above stands anymore. > Currently mailupdates is kept as a fallback and/or legacy interface. IIRC, there is an update limit for the current REST API (something like 2000 updates per day) > I think what you really want is being able to authenticate via REST > API, so that you would be able to query and update your own objects > without any kind of dummification or accounting process. Maybe even be > able to use an APIKEY over https for a simple way of authentication? the REST API uses the maintainer password via HTTPS. see also https://github.com/RIPE-NCC/whois/wiki/WHOIS-REST-API for further details. there are also some client libraries for the REST API out there. Best regards, Alex -- velia.net Internetdienste GmbH * Hessen-Homburg-Platz 1 * D-63452 Hanau Geschäftsführer: Franz G. Köhler, Arek Akilli * AG Hanau * HRB 7588 Tel: +49 6181 1898119 * http://www.velia.net Follow us on twitter: https://twitter.com/velia_net

1 0

Reverse DNS Wizard Improvements
by Alex Band 23 Dec '16

23 Dec '16

Dear colleagues, If you don't want to read all the details below, here is a single screenshot that explains the improvements we just launched: https://labs.ripe.net/Members/AlexBand/reverse-dns-real-time-checks A few weeks ago we announced a new wizard for setting up Reverse DNS. When creating a new DOMAIN object you will be taken to it automatically: https://apps.db.ripe.net/webupdates To refresh your memory, a one-minute demo of the wizard is online: https://youtu.be/7JzapYkca-Y After analysing the usage since the launch, we have identified several improvements we could make to the name server pre-checks. I'm happy to announce these are now live. When entering name servers for your reverse zones, we will now do the following real-time checks: - Syntax checks to ensure no illegal characters are used - Verify if a fully qualified domain name is entered and not an IP address - Test if the name server responds on port 53 using both UDP and TCP - Check if the name server is authoritative for the reverse zone Only if these tests are passed the wizard will allow the user to submit the form, after which the full set of checks is performed by the back-end service. By giving immediate feedback, we drastically reduce the amount of errors users generate and the time required to complete the process successfully. In the error messages, we also link to the documentation for an in-depth explanation and troubleshooting steps. We are confident these improvements will greatly enhance the user experience. If you have any questions or feedback, please do not hesitate to let us know! Kind regards, Alex Band Product Manager RIPE NCC

2 1

Thanks to Nigel
by Niall O'Reilly 20 Dec '16

20 Dec '16

On 20 Dec 2016, at 14:42, Piotr Strzyzewski wrote: > Thank you for this hard work. It was always amazing how fast delivered > and accurate your minutes are. It continually amazed me too. Thanks for a great job, Nigel! Niall

1 0

WG Chairs Selection
by ripedenis＠yahoo.co.uk 20 Dec '16

20 Dec '16

Hi All I would like to clarify one point about my candidacy. Whilst it is no secret that I would love to improve the database design and model, that is a personal view and I accept that it is not well supported within the community. There is a time and place for such proposals and this is not the time. The next group of chairs have a growing list of important issues on the table already and that should be the focus. cheersdenis

11 14

Upgrading servers to address memory issues, intermittent outage in mailupdates
by Tim Bruijnzeels 07 Dec '16

07 Dec '16

Dear working group, Following the outage we experienced on 26 November we determined that a an in-memory cache was the cause. We have disabled this cache, and allocated more memory to the whois application process. We also determined that the whois process and the back-end database need more memory. For this reason we are fast-tracking the deployment of new hardware and extending the memory in the servers that we use. Unfortunately the deployment of two new servers led to a failure to deliver some of the mails sent to auto-dbm(a)ripe.net, the Mailupdates service for Whois, from approximately 12:00 UTC on Tuesday 6th December to 16:30 UTC on Wednesday 7th December. Any failure resulted in a reply with the Subject "Mail delivery failed: returning message to sender". Kind regards Tim Bruijnzeels Assistant Manager Software Engineering RIPE NCC Database Group

1 0

WG Chairs Selection
by scott donald 06 Dec '16

06 Dec '16

Hi all, I agree with Nigel that some continuity would be good, so Piotr would get my vote. I also think Denis has deep knowledge of the RIPE Database over many years and his experience would be very useful in the 3 person team. I would also say that David's experience at the RIPE NCC dealing with LIR questions on all aspects of RIPE Database functionality gives him a a very useful insight in how to improve it for the future for the users. Kind regards, Scott Donald Comms-care

2 1

as-set fileds
by Shahin Gharghi 05 Dec '16

05 Dec '16

Hello I was working with RIPE DB to export as-set objects. I downloaded as-set database from FTP server. There were a lot of comments and extra unused information in the members field. So it's difficult to work with this object as a third party software. -- Shahin Gharghi

1 0

RIPE WHOIS down?
by Patrick Velder 29 Nov '16

29 Nov '16

Hi there I just tried to use the RIPE WHOIS but it looks like it's currently down: on terminal: > patrick@patrickhome:~$ whois 185.117.xx.0 > connect: Connection refused web whois: > Proxy Error > > The proxy server received an invalid response from an upstream server. > The proxy server could not handle the request GET /search/query.html. > > Reason: Error reading from remote server Anyone else? Regards Patrick

4 3

WG Chairs Selection
by Piotr Strzyzewski 25 Nov '16

25 Nov '16

Dear DB-WG Members As agreed during DB-WG session at RIPE69 Meeting in London on 06.11.2014, the WG Chair Selection procedure is executed at yearly intervals. This means that it is about time to run it this year. This is the call for interested parties. Interested parties have 2 weeks to make their interest known on this mailing list. All members of the community are encourage to make a discussion and express their approval or otherwise of the presented candidates. After two weeks the chairs will declare consensus. Since there is a limit of 3 co-chairs, if at the end of the discussion phase there will be more than 3 proposed co-chairs then a call will be made for any of the candidates to withdraw. If there still will be more than 3 candidates then names will be put into a hat and the first three names drawn from the hat will take on the role of chairs for the next 12 months. As you may know, Job Snijders decided at the RIPE73, last week, to step down. Moreover, Nigel Titley declare that when a new chair is found, he would like to step down as well. This means, that the only reason Nigel is staying on, is not to leave the WG with only one chair. Taking this opportunity, I would like to express my interest in being co-chair for another term. All the best, Piotr -- gucio -> Piotr Strzyżewski E-mail: Piotr.Strzyzewski(a)polsl.pl

22 43

New wizard for setting up Reverse DNS
by Alex Band 24 Nov '16

24 Nov '16

Dear colleagues, I'm exited to announce that the Software Engineering and Global Information Infrastructure departments have collaborated to provide a wizard for setting up Reverse DNS. The wizard replaces the form for creating RIPE Database objects manually, so when creating a new DOMAIN object you will be taken to it automatically: https://apps.db.ripe.net/webupdates A one-minute demo of the Reverse DNS wizard is online: https://youtu.be/7JzapYkca-Y Requesting reverse delegation for your zones has always been notoriously error prone, causing more user errors and support tickets than the creation of any other RIPE Database object. In order to maximise ease of use and success rate, we implemented the following features: - We present the user with a clear set of guidelines for the configuration of their name servers before starting the wizard - Manually creating reverse zones is no longer necessary, as you can simply fill in a prefix and the wizard will do the rest - Creating DOMAIN objects one by one is no longer necessary, as you can create up to 128 DOMAIN objects in one go - We perform a basic check on the name server before the full set of tests is run, to maximise the chance of success Please keep in mind that this is the first iteration of this functionality. We will now start gathering feedback and will run analytics to see how it can be improved further. For example, the current name server pre-checks are very basic and we can expand them in the future if needed. We are using Zonemaster for these checks and are in the process of migrating the full set of tests to this service. We’d like to thank IIS and AFNIC for their support. In case you are interested in the background story on the Reverse DNS wizard and Zonemaster, there are some presentations from RIPE 73 online: https://ripe73.ripe.net/archives/video/1517/ https://ripe73.ripe.net/archives/video/1511/ Kind regards, Alex Band Product Manager RIPE NCC

1 0

[training] RIPE NCC Training Courses January-March 2017
by Training Services 23 Nov '16

23 Nov '16

Dear colleagues, Our training team travels the RIPE NCC service region to deliver training courses to our members without any additional cost. Over the next few months, we'll be in Barcelona, London, Lebanon, Turin, Hamburg, Moscow, Riga, Turkey, Nicosia, Tashkent, Ljubljana, Oslo. Visit the following page to register and to check which training courses we are giving in your area: https://lirportal.ripe.net/training/courses The RIPE NCC delivers the following training courses: - LIR and RIPE Database Training Course - DNSSEC Training Course - Measurements Tools Training Course - Basic IPv6 Training Course - 2 days Advanced IPv6 Training Course - 2 days BGP Operations and Security Training Course For more information visit: https://www.ripe.net/support/training/courses With kind regards, Rumy Spratley-Kanis Training Services Manager

1 0

Workinggroup Chair Job Description
by Hans Petter Holen 22 Nov '16

22 Nov '16

I see in the ongoing discussion in the chair selection process that there has been some questions regarding the role and commitments of the chair: The "Job Description" can be found in RIPE 542: "Working Group Chair Job Description and Procedures" https://www.ripe.net/publications/docs/ripe-542 As others have stated, it is not necessarily for the chair to be present at every single RIPE meeting. It is however always good to meet in person, at the WG meeting, the WG chairs lunch and informally with other chairs, RIPE NCC staff and myself. While I have enjoyed virtual life for close to 30 years - I do still see the value of meeting in person now and then. -- Sincerely, Hans Petter Holen, RIPE Chair

3 2

Puzzled by RIPE-NCC-LOCKED-MNT
by Ronald F. Guilmette 22 Nov '16

22 Nov '16

I am having a bit of trouble decyphering the explanation/description of RIPE-NCC-LOCKED-MNT given on the following page, and I hope someone will help me to understand. https://www.ripe.net/publications/news/announcements/deprecation-of-the-non… It appears from the above, that there was a transition/reorganization that took place back around 2004, and that RIPE-NCC-LOCKED-MNT was set as the maintainer on various objects that were present in the data base at that time (specifically objects which were not already adequately password protected) in order to protect some such objects from unauthorized modification. Is that description approximately accurate, I mean to a first approximation? (I understand that I'm probably glossing over a number of the fine points here, but I am doing so just because I doubt that any of those are even pertinent to my real question.) So anyway, my real question is this: If in fact RIPE-NCC-LOCKED-MNT was just something which was used as a sort-of "passing phase" stop-gap mechanism, i.e. as just a convenient expedient for securing things that would otherwise poorly secured, and if it was only applied in this way back in 2004, and for perhaps a year or two afterwards, then what would be the explanation for a *recently created* data base object (e.g. a route object) that has a created: date of, say, 2014, 2015, or 2016 and also a mnt-by value of RIPE-NCC-LOCKED-MNT? Regards, rfg

7 12

Creating a mntner
by Ronald F. Guilmette 21 Nov '16

21 Nov '16

Sorry. I know this is probably an faq and a dumb question, but can some kind soul tell me the exact procedure for creating a new RIPE mntner object? Does one already have to be a dues-paying member of RIPE NCC in order to do that? Where is the form that needs to be filled out and what if any supporting documentation must be provided? Birth certificate? Company incorporation documents?

2 2

More-specific abuse-c
by Sebastian Wiesinger 16 Nov '16

16 Nov '16

I'm currently struggling with abuse-c management for a big organisation which wants multiple abuse contacts for different parts of the organisation. The org is using a lot of PI resources, some of them legacy. Currently they all use the same org object which is inextricably linked to the same abuse-c mailbox. They have a new field of business which is mostly decoupled from the rest (own AS, own routers, PI space, etc.) but still uses the same org object. As cumbersome as having to create a new org object would be, I would've gone this road but as all of them are PI I can't change the org object! It is managed by the RIPE NCC. So the only solution right now would be to ask the RIPE NCC to change the org for all objects to a new one just to change the abuse-c for the resources. I would not be surprised if this turns out to be more complicated because of the end-user contract stuff but I'll need input from the NCC how they handle such cases. Also having multiple org objects that have the same data (company name, address, phone,...) just to have a different abuse-c is something that irks me to no end. Now I have to update X orgs when the phone number or address changes. Also: redundant data in the database! I tried to follow past discussions regarding this but it seems they all kind of fizzed out without any conclusion? I would propose to fix this and add an abuse-c to resource objects that would be "more specific" than the org abuse-c and overrides it. If there are other ideas please don't hesitate to state them but to me it seems like a low-cost solution to this mess. Best Regards Sebastian -- GPG Key: 0x93A0B9CE (F4F6 B1A3 866B 26E9 450A 9D82 58A2 D94A 93A0 B9CE) 'Are you Death?' ... IT'S THE SCYTHE, ISN'T IT? PEOPLE ALWAYS NOTICE THE SCYTHE. -- Terry Pratchett, The Fifth Elephant

11 25

WG Chairs Selection
by Piotr Strzyzewski 16 Nov '16

16 Nov '16

Dear DB-WG Members As agreed during DB-WG session at RIPE69 Meeting in London on 06.11.2014, the WG Chair Selection procedure is executed at yearly intervals. This means that it is about time to run it for the very first time. This is the call for interested parties. Interested parties have 2 weeks to make their interest known on this mailing list. All members of the community are encourage to make a discussion and express their approval or otherwise of the presented candidates. After two weeks the chairs will declare consensus. Since there is a limit of 3 co-chairs, if at the end of the discussion phase there will be more than 3 proposed co-chairs then a call will be made for any of the candidates to withdraw. If there still will be more than 3 candidates then names will be put into a hat and the first three names drawn from the hat will take on the role of chairs for the next 12 months. All three of present co-chairs expressed their interest in being co-chairs for another term. All the best, Job, Nigel & Piotr -- gucio -> Piotr Strzyżewski E-mail: Piotr.Strzyzewski(a)polsl.pl

9 11

Fwd: WG Chairs Selection
by Horváth Ágoston János 05 Nov '16

05 Nov '16

While operational experience is indeed important, the role of a chair is different from a role of a president. I find that a chair will need to invest time, a lot of time, into bringing some much-needed life to the db-wg. The database has not had any notable changes since its original redesign in 1999. All what there was was mostly patchwork than real innovation. As far as I see, this was mainly caused by the lack of general interest. Newbies struggled through the years, but once they learned how to do what they wanted, they were OK with not changing anything on it. This did preserve the status quo. I find the fact that RIPE NCC has a whole-day training course over the use of RIPE DB a sign in itself that it is not for this age. I think no matter who goes as a chair, they have to start breathing life into the WG activities; come up and support real, actual redesign with today's usage patterns, mindset and expectations in mind. That will require precious time that a professional would not have or want to invest. For this reason, I'd like to cast my vote on Denis, knowing that the other chairs would have a more professional background. He does have a lot of good ideas and does have the time and energy to see them through. Cheers, Agoston On Fri, Nov 4, 2016 at 10:32 AM, Job Snijders <job(a)instituut.net> wrote: > On Friday, 4 November 2016, Randy Bush <randy(a)psg.com> wrote: >> >> > What role does the database play in your professional work? >> >> is this repeated question trying to elicit conflict of interest? >> >> and could the current co-chairs also answer it? :) > > > Leadership whom clearly have a stake in the well-being of the database would > have my preference. > > Example: people that work for orgs that depend on the database for their > routing security posture have one up on people who don't even work for a LIR > and as such don't face daily operational reality. > > Last meeting Nigel stated that he wants to step down because he doesn't do > actually work with the database any longer. With new chairs I'd like to > prevent such alienation from the get-go. > > Kind regards, > > Job

1 0

numbered work item suggestion: support PGP authentication with whois-api
by Thomas von Dein 03 Nov '16

03 Nov '16

Hello WG, I'd like to propose an enhancement of the whois REST api to support PGP authenticated POST requests for create,update,delete methods. Currently the API doesn't support this, so you have to use the REST interface to download objects and the MAIL interface to modify them if you don't want to use password authentication. A consistent user interface however, would be more reliable, easier to understand and maintain. Thanks in advance, Thomas von Dein -- Thomas von Dein <admins(a)f-i-ts.net> Finanz Informatik Technologie Service GmbH & Co. KG, OE 76052 Tel:089/94511-8833, Fax:089/94511-8941, http://www.f-i-ts.net

4 4