- db-wg - mailman.ripe.net

Re: [db-wg] Slash notation
by Janos Zsako 22 May '03

22 May '03

> From db-wg-admin(a)ripe.net Thu May 22 14:59:10 2003 Dear all, > > ... Just another suggestion (from what I experienced in my environment): > > > >Would it be possible to treat/convert > > > >inetnum: 193.0.0.221 > > > >to > > > >inetnum: 193.0.0.221 - 193.0.0.221 > > > >(the 'single host') > >? > > is there a possibilty for ambiguity? I guess there is, especially if the last element is 0 (e.g. 194.152.133.0, which probably can be confused with 194.152.133.0/24). It cannot be ambiguous, however, if the last element of the dotted quad is an odd number. > Probably not if we have all 4 fields of the dotted quad included. > > Maybe we c/should require 193.0.0.221/32 here to be on the safe side? I would prefer this latter (i.e. requiring the /32). Janos

2 1

Re: [db-wg] Slash notation
by Wilfried Woeber, UniVie/ACOnet 22 May '03

22 May '03

Hi Ulrich, Shane, > ... Just another suggestion (from what I experienced in my environment): > >Would it be possible to treat/convert > >inetnum: 193.0.0.221 > >to > >inetnum: 193.0.0.221 - 193.0.0.221 > >(the 'single host') >? is there a possibilty for ambiguity? Probably not if we have all 4 fields of the dotted quad included. Maybe we c/should require 193.0.0.221/32 here to be on the safe side? Wilfried.

1 0

Re: [db-wg] Slash notation
by Wilfried Woeber, UniVie/ACOnet 22 May '03

22 May '03

Hi Shane! >Short answer: > >When version 3 of the Database software was designed, one of the >principles used was to not change user data as it was submitted. >This included the transformation you defined. Still a reasonable guideline, I'd say.... >The easiest solution would be to convert the CIDR to ranges, as you >suggest, so: > >inetnum: 193.0.0.0/20 > >Would become: > >***Warning: inetnum '193.0.0.0/20' converted to '193.0.0.0 - 193.0.7.255' > >inetnum: 193.0.0.0 - 193.0.7.255 > . > . > . > >If this makes sense, we'll include this change shortly. Yes, please! [ and still: yes, please - even after reading your in-depth explanation... ] Regards, Wilfried.

1 0

RE: [db-wg] Slash notation
by ipmaster＠bt.com 22 May '03

22 May '03

Shane, sounds good to me !! Thanx Dave Trickett BTnet -----Original Message----- From: Shane Kerr [mailto:shane@ripe.net] Sent: 21 May 2003 16:56 To: IPMASTER G Cc: db-wg(a)ripe.net Subject: Re: [db-wg] Slash notation On 2003-05-21 16:26:43 +0100, ipmaster(a)bt.com wrote: > Hi > > Quick question:-) > We used to be able to update (via email) the Database with new > inetnums using slash notation. Since the introduction of RPSL, this > facility has been lost, would it be possible to re-introduce it? > I can see the benefits of using the long hand version if I am > updating with a /27 and a /28, such as (*.*.*.64 - *.*.*.111). > But for Inetnums that fall on the bit boundary would not make sense > to enable the slash? > If I update a route object I can still use the slash notation. Short answer: When version 3 of the Database software was designed, one of the principles used was to not change user data as it was submitted. This included the transformation you defined. The easiest solution would be to convert the CIDR to ranges, as you suggest, so: inetnum: 193.0.0.0/20 Would become: ***Warning: inetnum '193.0.0.0/20' converted to '193.0.0.0 - 193.0.7.255' inetnum: 193.0.0.0 - 193.0.7.255 . . . If this makes sense, we'll include this change shortly. Explaination (for the curious): The reason that these types of modifications were avoided in the original design is because RPSL allows a number of formats that can make the changes difficult. For example: inetnum: # this +# is a valid # inetnum attribute 193.0.0.0 + - # heck, you can even put a comment here 193.0.7.255 + # and at the end too Modifying this kind of attribute can be problematic, because the value is split across many lines, and has comments in the middle. However, with your suggestion it would be possible to do something like converting: inetnum: # this +# is a valid # inetnum attribute 193.0.0.0/21 + # but still parsable! Into the following: inetnum: # this +# is a valid # inetnum attribute 193.0.0.0 - 193.0.7.255 + # but still parsable! Since the CIDR-notation is "atomic", we don't have to worry about values split across lines or with comments inside. Note that comments and split lines in the primary attributes are very, very rare, but it is technically possible for any user that wishes to do so. -- Shane Kerr RIPE NCC

2 1

Slash notation
by ipmaster＠bt.com 21 May '03

21 May '03

Hi Quick question:-) We used to be able to update (via email) the Database with new inetnums using slash notation. Since the introduction of RPSL, this facility has been lost, would it be possible to re-introduce it? I can see the benefits of using the long hand version if I am updating with a /27 and a /28, such as (*.*.*.64 - *.*.*.111). But for Inetnums that fall on the bit boundary would not make sense to enable the slash? If I update a route object I can still use the slash notation. Dave Trickett BTnet

3 2

action item AP-42.3 - problems of multiple hashed passwords
by Larry J. Blunk 14 May '03

14 May '03

This is an update on AP-42.3 regarding identifying users of multiple hashed passwords (CRYPT-PW or MD5-CRYPT) in a mntner. Merit has implemented an option in it's web-based update form to include an "id" in the comment field of an "auth:" attribute. Additionally, the date and time of creation of the hashed password is included (should one want to keep track of the age of a particular password). Below is an example -- auth: CRYPT-PW Fa1QDrka0aOOM #Id:billg Created:20030514 09:42:45(UTC) As a further note, we have implemented (but not deployed) support for hashed password hiding. When this is deployed, the hash value of a CRYPT-PW will be replaced with the string "HIDDENCRYPTPW" when a mntner object is queried or mirrored. I'm not sure how much of this is of interest to the RIPE community (particularly with the PKI support on the horizon), but I thought I would throw it out for consideration. Regards, Larry Blunk Merit Network

1 0

Webcast RIPE 45 Announcement
by RIPE NCC Meeting Registration 13 May '03

13 May '03

Dear Colleages, Please note that several sessions at RIPE 45 are being webcast. These sessions include the following: - - EOF - - Routing Working Group - - LIR Working Group - - Tools Working Group - - The RIPE NCC Services BoF - - IPv6 Working Group - - Database Working Group - - Plenary To see the meeting in real time, please use one of the following URLs. As we have limited bandwith to the meeting venue, we ask that you choose a server that is physically closer to you: - - RIPE Meeting Attendees only: mms://webcast.ripemtg.ripe.net/ripemtg - - Spain Mirror: mms://media.rediris.es/ripelive - - Portugal Mirror: mms://wms.fccn.pt/ripelive - - Italy Mirror: mms://stream1-wg.cineca.it/ripelive - - Denmark Mirror: mms://wmslave.fsknet.dk/ripelive - - Czech Republic Mirror: mms://server1.streaming.cesnet.cz/ripemtg - - United Kingdom Mirror: mms://ccs-web2k.brynmill.swan.ac.uk/ripelive - - Netherlands Mirror: mms://stream-ripe.wind.surfnet.nl/ripelive - - Amsterdam Mirror (RIPE NCC Office): mms://webcast.ripe.net/ripemtg Please note that the webcastings are technical trials only and the broadcasts should not be regarded as an official implementation of a webcasting service. More information on the webcastings with detailed instructions can be found at: http://www.ripe.net/ripe/meetings/ripe-45/webcast.html We welcome your feedback on these trials. Please send your comments to <ripecast(a)ripe.net>. Regards, RIPE Meeting Coordination Team

1 0

Prototype of RPSLng Whois server
by DB-News 12 May '03

12 May '03

[ Apologies for multiple messages ] Dear Colleagues, The RIPE NCC Database Group announces an RPSLng prototype Whois server on host rpslng.ripe.net, port 53001. RPSLng is an effort to extend RPSL language, enabling the language to document routing policies for the IPv6 and multicast address families currently used in the Internet. The prototype RPSLng Whois server implements the draft draft-damas-rpslng-00.txt (ftp://ftp.ripe.net/internet-drafts/draft-damas-rpslng-00.txt). In the near future we will be implementing the new RPSLng draft (http://www.radb.net/rpslng.html). The prototype database contains a snapshot of the RIPE Whois Database. It can be updated by sending mails to <rpslng-auto(a)ripe.net>. Please note that this database is for test purposes only. Updates performed on it will _not_ be reflected in the RIPE Whois Database. More details can be found at: http://www.ripe.net/db/rpslng Please contact ripe-dbm(a)ripe.net for any comments. Best regards, Engin Gunduz RIPE NCC Database Group

1 0

message
by CMC 10 May '03

10 May '03

Hello Friends; I have a specific interest in receiving ripe as I am a registered channel manager on the Undernet & in my role must contact Undernet Administrators on people who abuse this chat network on IRC. I am 33 years old; attend grad school and work my way through Grad school. I have been a registered channel manager since 1997 and as such the Undernet has the same address as above for me. It's a requirement. I can offer hostmasks of people who are IRC abusers and help in anyway I am asked if I can do it . Thank you, Sincerely, charles michael capozzi

1 0

SYNC-Update failed
by Nacamar AS Guardian 09 May '03

09 May '03

hi all, i use the sync for create. delete and update my objects in the ripe-db. Today the dbupdate - routine failed, using pgp. via mail the new version is ok. has i left any statemenat from the ripe ? greetings, sven eisenmann ------------------------------------------------------------------- Sven Eisenmann NCC Senior Manager Network Administration Tiscali Business GmbH Robert-Bosch-Strasse 32 D-63303 Dreieich Telefon: +49(0)6103-916 0 Telefax: +49(0)6103-916 1881 E-Mail: guardian(a)nacamar.net www.tiscali.de www.tiscali-business.de -------------------------------------------------------------------

2 1

(typo corr.) draft agenda (v2), for DB-WG meeting, RIPE 45, Barcelona, ES
by Wilfried Woeber, UniVie/ACOnet 02 May '03

02 May '03

[ correction of a small typo, thanks to Mally for spotting it! ] ______________________________________________________________________ Dear WG list members, dear "Meeting Role" @ the NCC, dear WG-Chairs! Attached please find the 2nd - preliminary - draft: Proposed Agenda for the DB-WG Meeting at RIPE 45 in Barcelona, ES. As usual, if you have any comments, corrections or additions please get back to me directly. Looking forward to see many of you in Catalunya, Wilfried. ______________________________________________________________________ Proposed Agenda for the Database Working Group Meeting 2. Draft A. Administrative stuff (WW, chair) 10 min . scribe: Nigel T. B. Action Items 15 min C. DB operational update (RIPE NCC, Shane K.) 20 min . including status of ERX D. Quality of contact data (RIPE NCC, Shane K.) 10 min . discussion / next steps / which WG? +10 min F. New "dbupdate" (RIPE NCC, Denis W.) 15 min G. Discussion: to disallow auth: NONE ( [ Hank N. ] ) 15 min H. (tbc) DB-SW teams up with... (UniVie-ACOnet, Ulrich K.) 20 min . the UniVie Netw.Info.Sys.: I. follow-Up on last meetings issues (Chair, WW144) 30 min . Organisation object proposal (RIPE NCC, Shane K.) . status: SUB-ALLOCATED PA (Space.Net, Gert D.) . reclaim: - Attribut (Space.Net, Gert D.) . allowing "generated" attributes in updates (WW et.al.) . Key Certificates to person: role: ? Y. Input from other WGs . Z. AOB: . ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ WW, 2-MAY-2003 12:26:17 UTC _________________________________:_____________________________________ Wilfried Woeber : e-mail: Woeber(a)CC.UniVie.ac.at UniVie Computer Center - ACOnet : Tel: +43 1 4277 - 140 33 Universitaetsstrasse 7 : Fax: +43 1 4277 - 9 140 A-1010 Vienna, Austria, Europe : RIPE-DB: WW144, PGP keyID 0xF0ACB369 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~:~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "Only one thing in life is certain: init is Process #1"

1 0

draft agenda (v1), for DB-WG meeting, RIPE 45, Barcelona, ES
by Wilfried Woeber, UniVie/ACOnet 02 May '03

02 May '03

Dear WG list members, dear "Meeting Role" @ the NCC, dear WG-Chairs! Attached please find the 1st - preliminary - draft: Proposed Agenda for the DB-WG Meeting at RIPE 45 in Barcelona, ES. As usual, if you have any comments, corrections or additions please get back to me directly. Looking forward to see many of you in Catalunya, Wilfried. ______________________________________________________________________ Proposed Agenda for the Database Working Group Meeting 1. Draft A. Administrative stuff (WW, chair) 10 min . scribe: Nigel T. B. Action Items 15 min C. DB operational update (RIPE NCC, Shane K.) 20 min . including status of ERX D. Quality of contact data (RIPE NCC, Shane K.) 10 min . discussion / next steps / whihc WG? +10 min F. New "dbupdate" (RIPE NCC, Denis W.) 15 min G. Discussion: to disallow auth: NONE ( [ Hank N. ] ) 15 min H. (tbc) DB-SW teams up with... (UniVie-ACOnet, Ulrich K.) 20 min . the UniVie Netw.Info.Sys.: I. follow-Up on last meetings issues (Chair, WW144) 30 min . Organisation object proposal (RIPE NCC, Shane K.) . status: SUB-ALLOCATED PA (Space.Net, Gert D.) . reclaim: - Attribut (Space.Net, Gert D.) . allowing "generated" attributes in updates (WW et.al.) . Key Certificates to person: role: ? Y. Input from other WGs . Z. AOB: . ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ WW, 2-MAY-2003 11:44:15 UTC _________________________________:_____________________________________ Wilfried Woeber : e-mail: Woeber(a)CC.UniVie.ac.at UniVie Computer Center - ACOnet : Tel: +43 1 4277 - 140 33 Universitaetsstrasse 7 : Fax: +43 1 4277 - 9 140 A-1010 Vienna, Austria, Europe : RIPE-DB: WW144, PGP keyID 0xF0ACB369 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~:~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "Only one thing in life is certain: init is Process #1"

1 0

Announcement RIPE NCC RR Training Course
by RIPE NCC Training 01 May '03

01 May '03

------- Dear Colleagues, [apologies for duplicate postings] As a service to its members the RIPE NCC offers the "Routing Registry Training Course". The main objective of the "Routing Registry Training Course" is to familiarise the LIRs with the features of the Routing Registry, while introducing the relevant tools and services of the RIPE NCC. The course also offers practical exercises. OVERVIEW OF TOPICS COVERED IN THE COURSE: - Routing Registry as a part of the RIPE Whois Database and the Internet Routing Registry (IRR) - Specifying routing policies using (RPSL) Routing Policy Specification Language and the RtConfig tool - IRRToolSet - Routing Information Service (RIS) - Routing Registry Consistency Check Project Please note that this is an advanced course. It will: - NOT teach the basics of routing - NOT describe how to receive Internet resources from the RIPE NCC not describe to operate a Local Internet Registry (LIR) The target audience of the course are technical staff of LIRs: e.g. network operators, engineers etc. This course is not intended for administrative or management staff (e.g. Hostmasters) . It is assumed that all attendees will be familiar with Border Gateway Protocol routing and with the RIPE Database (i.e. creating/modifying objects). This course is based on interactive exercises in a local network set-up. Please bring your laptops equipped with the following: - A working Ethernet card, - Three meters of Ethernet cable, - A secure connection client, - A web browser. Please be prepared to share your laptop (or at least allow another attendee to "look over your shoulder") if necessary. The Routing Registry Training Course is conducted in the English language and is free of charge, since it is covered by the membership fee. More information about the Routing Registry Training Course can be found at: http://www.ripe.net/training/rr/ REGISTRATION: You can register for a Routing Registry Training Course at the following URL: http://www.ripe.net/cgi-bin/trainingform.pl.cgi Or by completing the registration form at the end of this e-mail and replying to <training(a)ripe.net> . In order to register for a Routing Registry Training Course you must be an employee of an LIR and either: - be an LIR contact - be confirmed by an LIR contact LIR contacts are those employees of an LIR who are registered with RIPE NCC as authoritative contact persons. It is expected that most of those interested in the Routing Registry Training Course will not be an authoritative contact person for their LIR, and therefore will be, refused by the course registration "robot". In order to be admitted to the course, a confirmation e-mail must be sent to <training(a)ripe.net>. Please approach the LIR contacts from your organisation personally, since the identity of LIR contacts is confidential, and the RIPE NCC is unable to divulge contact persons for any given LIR. Kind Regards, The RIPE NCC Training Team ******************************************************************************** COURSE DATES AND VENUES ======================= Date: Friday 11 July 2003 Time: 0900 - 1700 Location: Vienna, Austria AND: Date: Friday 29 August 2003 Time: 0900 - 1700 Location: Helsinki, Finland AND Date: Monday 8 September 2003 Time: 0900 - 1700 Location: Amsterdam, The Netherlands *********************************************************************************** REGISTRATION FORM ================= %START PART 1 - Registration 1) Your name Enter First name, Last name in full e.g. John Doe Mary-Beth Walton # NAME [ ] 2) Your Registry ID (format: country-code.<name of registry>) # REG [ ] 3) Your e-mail address # EMAIL [ ] 4) Your NIC handle (optional) # NICHANDLE [ ] 5) The course you plan to attend (date and location) # COURSE [ ] %END

1 0

New Draft Document announcement
by RIPE NCC WebMaster 29 Apr '03

29 Apr '03

Dear Colleagues, The RIPE NCC has prepared a draft document titled "Improved Secure Communication System for RIPE NCC Members": http://www.ripe.net/ripe/draft-documents/pki-20030429.html Abstract There is a need for secure communication between the RIPE NCC and its members. This document presents an overview of the current communication system, and a new approach based on X.509 PKI (Public Key Infrastructure) technology and standards that will make interaction with the services provided by the RIPE NCC to its members more convenient and secure. Finally, the phases necessary to implement the system are described. The idea behind publishing this as a draft document is to give RIPE NCC members time to read it and provide feedback. If the LIRs agree with the ideas presented, then it will become a RIPE document and act as a basis for the project. The draft document can be discussed on the LIR Working Group, <lir-wg(a)ripe.net>, or you can send comments to <pki-suggestions(a)ripe.net>. Best regards, -- Shane Kerr RIPE NCC

1 0

Call for agenda items for DB-WG session in BCN
by Wilfried Woeber, UniVie/ACOnet 25 Apr '03

25 Apr '03

Dear DB-WG! The date for the next RIPE meeting in Barcelona is approaching and I am supposed to submit the draft agenda for the DB-WG meeting in Barcelona. If you want to have a topic on the agenda, please speak up - either on the list or to my personal mailbox. I hope to see many of you in Barcelona! Wilfried. _________________________________:_____________________________________ Wilfried Woeber : e-mail: Woeber(a)CC.UniVie.ac.at UniVie Computer Center - ACOnet : Tel: +43 1 4277 - 140 33 Universitaetsstrasse 7 : Fax: +43 1 4277 - 9 140 A-1010 Vienna, Austria, Europe : RIPE-DB: WW144, PGP keyID 0xF0ACB369 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~:~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Deprecating auth=NONE
by Hank Nussbacher 24 Apr '03

24 Apr '03

Back in March 2002 we started to deprecate auth=MAIL-FROM. In August we finished it: http://www.ripe.net/ripencc/pub-services/db/mailfrom.html We did not do the same for auth=NONE and the RIPE announcement stated: "Though NONE "auth" scheme is even weaker it is not supposed to be consciously used for object protection, but rather as notification facility. Therefore NONE "auth" scheme is outside the scope of this proposal." It has come lately to the attention in the Internet security realm that spammers as well as crackers are hijacking IP address space. One easy way to "steal" IP address space is via those that have auth=NONE on their objects. Go to: http://www.ripe.net/db/whois-free.html select ALL and type in the search bar "auth: none". The results of those that can have their IPs easily hijacked is, how shall I say this, enormous. Luckily the RIPE search form is limited to 100 hits. Just as an example and not to pick on C&W but: aut-num: AS13186 as-name: UNSPECIFIED descr: C&W SA Autonomous System descr: Alcalde Barnils 64-68 descr: Parque Empresarial Sant Joan descr: 08190 Sant Cugat del Valles descr: BARCELONA import: from AS3352 action pref=100; accept ANY import: from AS12541 action pref=100; accept ANY import: from AS3561 action pref=100; accept ANY import: from AS16091 action pref=100; accept AS16091 export: to AS3352 announce AS13186 AS16091 export: to AS12541 announce AS13186 AS16091 export: to AS3561 announce AS13186 AS16091 export: to AS16091 announce ANY default: to AS12541 action pref=100; networks ANY admin-c: RV4415-RIPE tech-c: XL5-RIPE remarks: AS3352 -> anvazque@obscured-domain remarks: AS12541 ->graham.cole@obscured-domain mnt-by: AS13186-MNT mntner: AS13186-MNT descr: Cable and Wireless SA admin-c: RV4415-RIPE tech-c: XL5-RIPE upd-to: d12@obscured-domain auth: NONE mnt-by: AS13186-MNT referral-by: RIPE-DBM-MNT route: 212.66.160.0/19 descr: Intercom Servicios Telematicos Avanzados, S.A. origin: AS13186 notify: xlario@obscured-domain mnt-by: AS13186-MNT I could right now remove the route entry for 212.66.160.0/19 or change it to some other origin and thereby hijack the entry. All those that use auto-build tools based on the info in RIPE would allow me to announce the /19 and not C&W in Spain. Just an example. There are thousands. RIPE NCC won't deprecate auth=NONE without us telling them to do it. Why would we not want this? -Hank

2 1

v6wpd release announcement
by DB Role Account 24 Apr '03

24 Apr '03

[apologies for duplicate messages] Dear Colleagues, We are happy to announce the IPv6 Whois Proxy Daemon source code release. The release contains the software for proxying a RIPE Whois server on an IPv6 network. It contains the facility of mapping individual IPv6 addresses to RFC1918 IPv4 addresses, in order to ensure proper access list controls. The software is available at ftp://ftp.ripe.net/ripe/dbase/software/v6wpd-1.0.0.tar.gz Please contact dbtools(a)ripe.net for any comments. Best regards, -- Can Bican DB Group RIPE NCC

1 0

Improvements to database update software
by DB-News 23 Apr '03

23 Apr '03

[apologies for duplicate messages] Dear Colleagues, The Database Group at the RIPE NCC has been working on restructuring the dbupdate program. This is the part of the RIPE Whois server that processes update requests from users. The main goal has been to improve the acknowledgement messages that users receive from the RIPE Whois Database and provide clearer error reporting and authorisation information. We have also been able to make the software easier to maintain and modify. This will reduce the time spent fixing bugs and adding new features. Details may be found here: http://www.ripe.net/db/dbupdate/ A page further explaining the new acknowledgements can be found here: http://www.ripe.net/db/dbupdate/acknowledgments.html The new dbupdate messages have a different format. Therefore a phased approach to introducing the new server has been taken. For a period we will use the new dbupdate in parallel with the old one. This will allow people using automated tools time to update their software. PRE-MIGRATION Before the new dbupdate was available. auto-dbm-old(a)ripe.net DOES NOT EXIST auto-dbm(a)ripe.net --> old dbupdate auto-dbm-new(a)ripe.net DOES NOT EXIST DAY-X, Wednesday, 23 April, 2003 The new dbupdate is available but must be requested specifically. auto-dbm-old(a)ripe.net --> old dbupdate auto-dbm(a)ripe.net --> old dbupdate auto-dbm-new(a)ripe.net --> new dbupdate DAY-Y, Wednesday, 7 May, 2003 The new dbupdate is the default but the old dbupdate may be requested specifically. auto-dbm-old(a)ripe.net --> old dbupdate auto-dbm(a)ripe.net --> new dbupdate auto-dbm-new(a)ripe.net --> new dbupdate DAY-Z (POST-MIGRATION), Wednesday, 4 June, 2003 The old dbupdate is no longer available. auto-dbm-old(a)ripe.net DOES NOT EXIST auto-dbm(a)ripe.net --> new dbupdate auto-dbm-new(a)ripe.net DOES NOT EXIST Best regards, -- Shane Kerr Database Group RIPE NCC

1 0

announcement of unreferenced person cleanup mechanism
by RIPE Database Manager 16 Apr '03

16 Apr '03

[apologies for duplicate messages] Introduction ------------ The primary function of the person records in the RIPE Whois Database is to document the contact people for IP address space, Autonomous System Numbers, or routing-related records. While all the data in the RIPE Database can be viewed publicly, unnecessary public dispersal of the information may cause infringement privacy rights of individuals. Periodic automatic deletion of person objects that are not referenced as a contact will help to reduce the amount of private data and free the resources consumed by them. This cleanup was discussed on the Database Working Group mailing list, and previously presented as part of the development plans. More information can be found at: http://www.ripe.net/ripe/mail-archives/db-wg/2002/msg00096.html Clean-up Process ---------------- The proposed operation of periodically removing unreferenced person objects will consist of three steps: 1. Periodically counting the references to person objects. 2. Warning the owners of objects by e-mail if they are unreferenced for more than 60 days. 3. Deleting the object automatically if it is still unreferenced 30 days after the warning. The warning will be sent to the e-mail addresses in the "mnt- by:" or the "e-mail:" attributes of person objects. - If the person object is maintained, each maintainer will be notified as follows: - If there are "mnt-nfy:" attributes, the e-mail addresses listed there will be mailed. - Or, the e-mail addresses in the "e-mail:" fields of the "admin-c:" and "tech-c:" entries of the maintainers will be mailed. - If the person object is not maintained, and there are "e-mail:" attributes in the object, those e-mail addresses will be mailed. Due to the initial high amount of unreferenced person objects, the time intervals mentioned above will not be observed for all person objects. In order to eliminate possible service outages, a limited amount of warnings will be mailed and a limited amount of person objects will be deleted every day. Timeline -------- On Tuesday, 29 April, 2003, the first e-mails will be sent notifying the appropriate parties about person objects that have been unreferenced for more than 60 days. The first deletions will occur 30 days later, on Thursday, 29 May, 2003. The process will be an on-going service, and objects that become and remain unreferenced will be treated in the same manner in the future. -- Can Bican DB Group RIPE NCC

1 0

Deprecating auth=NONE
by Hank Nussbacher 15 Apr '03

15 Apr '03

Back in March 2002 we started to deprecate auth=MAIL-FROM. In August we finished it: http://www.ripe.net/ripencc/pub-services/db/mailfrom.html We did not do the same for auth=NONE and the RIPE announcement stated: "Though NONE "auth" scheme is even weaker it is not supposed to be consciously used for object protection, but rather as notification facility. Therefore NONE "auth" scheme is outside the scope of this proposal." It has come lately to the attention in the Internet security realm that spammers as well as crackers are hijacking IP address space. One easy way to "steal" IP address space is via those that have auth=NONE on their objects. Go to: http://www.ripe.net/db/whois-free.html select ALL and type in the search bar "auth: none". The results of those that can have their IPs easily hijacked is, how shall I say this, enormous. Luckily the RIPE search form is limited to 100 hits. Just as an example and not to pick on C&W but: aut-num: AS13186 as-name: UNSPECIFIED descr: C&W SA Autonomous System descr: Alcalde Barnils 64-68 descr: Parque Empresarial Sant Joan descr: 08190 Sant Cugat del Valles descr: BARCELONA import: from AS3352 action pref=100; accept ANY import: from AS12541 action pref=100; accept ANY import: from AS3561 action pref=100; accept ANY import: from AS16091 action pref=100; accept AS16091 export: to AS3352 announce AS13186 AS16091 export: to AS12541 announce AS13186 AS16091 export: to AS3561 announce AS13186 AS16091 export: to AS16091 announce ANY default: to AS12541 action pref=100; networks ANY admin-c: RV4415-RIPE tech-c: XL5-RIPE remarks: AS3352 -> anvazque@obscured-domain remarks: AS12541 ->graham.cole@obscured-domain mnt-by: AS13186-MNT mntner: AS13186-MNT descr: Cable and Wireless SA admin-c: RV4415-RIPE tech-c: XL5-RIPE upd-to: d12@obscured-domain auth: NONE mnt-by: AS13186-MNT referral-by: RIPE-DBM-MNT route: 212.66.160.0/19 descr: Intercom Servicios Telematicos Avanzados, S.A. origin: AS13186 notify: xlario@obscured-domain mnt-by: AS13186-MNT I could right now remove the route entry for 212.66.160.0/19 or change it to some other origin and thereby hijack the entry. All those that use auto-build tools based on the info in RIPE would allow me to announce the /19 and not C&W in Spain. Just an example. There are thousands. RIPE NCC won't deprecate auth=NONE without us telling them to do it. Why would we not want this? -Hank

1 0

Problems with RipeWhois.pm
by Arnd Vehling 28 Mar '03

28 Mar '03

Hi All, i am experiencing the following problem with the RipeWhois perl modul supplied with asused-3.65 / $Id: RipeWhois.pm,v 1.4 2001/04/18 17:01:20 timur Exp $ The "RipeWhois" function only works as long as i have the environment variables WHOIS_HOST set. If i unset the var the function stops working. I verified that with the supplied test client "cwhois". All command-line parameters and in-script defaults are ignored. OS is Solaris, perl version is: v5.6.1 Any Ideas? best regards, Arnd -- NetHead Network Design and Security Arnd Vehling av(a)nethead.De Gummersbacherstr. 27 Phone: +49 221 8809210 50679 Köln Fax : +49 221 8809212

1 1

Ref: Abuse contact
by Wilfried Woeber, UniVie/ACOnet 27 Mar '03

27 Mar '03

>To: s.willing(a)mops.net >CC: anti-spam-wg(a)ripe.net >From: RIPE Database Manager <ripe-dbm(a)ripe.net> >Date: Tue, 25 Mar 2003 10:07:29 +0100 >Subject: [anti-spam-wg(a)ripe.net] Re: NCC#2003034446 Abuse contact > >Dear Sebastian, > >Any changes to database schemas are decided upon in >RIPE Database Working Group, Yes, in principle, but as a matter of fact we prefer requests for object creations or modifications to come in from the "user base" (including a rough blueprint :-), i.e. the appropriate RIPE WG(s). >which is an open working >group. It has a mailing list. You can subscribe to it >and present your proposal there, for the review of other >members of the WG. Its web page is: > >http://www.ripe.net/ripe/wg/db/index.html In this particular case I'd expect (at least) Anti-SPAM to discuss any deployment scenarios, before we go ahead and modifify objects. As a personal note - I tend to think the IRT object might be a better place to put such stuff. Because the IP-address management role(s), being more administartive, often do not have close links to abuse or incident roles within an ISP. >If you have any more questions, please don't hesitate >to contact <ripe-dbm(a)ripe.net>. > >Regards, > >Engin Gunduz >____________________________ >RIPE Database Administration. Cheers, Wilfried (RIPE DB-WG Chair) _________________________________:_____________________________________ Wilfried Woeber : e-mail: Woeber(a)CC.UniVie.ac.at UniVie Computer Center - ACOnet : Tel: +43 1 4277 - 140 33 Universitaetsstrasse 7 : Fax: +43 1 4277 - 9 140 A-1010 Vienna, Austria, Europe : RIPE-DB: WW144, PGP keyID 0xF0ACB369 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~:~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ On Tue, 25 Mar 2003 09:53:28 +0100 (CET), S Willing wrote: * Hello! * * Some RIPE entries already include abuse information, but not in a uniform type. * * Arin has some extra abuse contact attributes: * OrgAbuseHandle: ABUSE23-ARIN * OrgAbuseName: Abuse * OrgAbusePhone: +1-800-436-8489 * OrgAbuseEmail: abuse(a)genuity.com * * I'ld like to suggest a new RIPE-DB attribute: "abuse-mail". * * It should be required for every new allocation and optional for assignments. * Somewhere in the future, the whois server should automatically return the * most-specific "abuse-mail"-entry which exists. * For example: 10.1.0.0/16 allocation has an "abuse-mail"-entry, but * 10.1.2.0/25 has none. In this case, the entry from the allocation * is returned. * 10.1.3.128/26 has an own "abuse-mail"-entry which is returned if * someone queries this object. * * MfG / Regards, * S.Willing * * ************************************************************************ * M / W / S Sebastian Willing * http://www.mops.net Technical director * Telefon: 01803/684310578 e-Mail: s.willing(a)mops.net * Telefax: 01805/445169111 SW88-RIPE * ************************************************************************ * --------------------------------------------------------------------------------

1 0

Mirroring of LEVEL3 database
by Koepp, Karsten 12 Mar '03

12 Mar '03

Hello around, does anyone besides me consider the Level (3) IRR database useful to be mirrored? I can find the Level(3) data on whois.ra.net but I would like to continue using whois.ripe.net. I understand the db admins position but I consider this source valuable. I have no statistics on the number of objects - I just happen to meet source LEVEL3 now and then. Karsten > Dear Karsten.Koepp, > > Regarding you question about the RIPE NCC mirroring the LEVEL > 3 database, > we currently have no plans on doing that as we were not requested by > LEVEL 3 to carry a mirror of their data. > > Our requirements for mirroring are: > 1. The source is a public IRR > 2. It should have considerable size > 3. It should be useful for the users in the RIPE region > > We don't seek out databases to mirror, although if a number > of our users > think that it can be useful we can ask permission for that. > > Best Regards, > Tiago Antao > ---------------------------- > RIPE Database Administration >

2 1

Proposed change 2003.1: notification for more-specific
by Shane Kerr 10 Mar '03

10 Mar '03

Colleagues, This is one of a number of proposed changes to the way the RIPE Database works. These are changes that are intended to make the database work more consistently, as well as provide an increased level of security and control to users. Please have a look, and discuss it here. [2003.1] Notification on more-specific object creation authorisation -------------------------------------------------------------------- Change: When the creation of an object requires authorisation by a less-specific object, normal mntner notification will apply; "upd-to:" is notified of failure, and "mnt-nfy:" is notified of success. Where there are multiple maintainers, only one is needed to successfully authorise the creation, but all the maintainers in the list will be notified. For example: inetnum: 192.168.101.0 - 192.168.101.255 . . . mnt-by: EXAMPLE-MNT mnt-lower: ANOTHER-MNT mnt-lower: YET-ANOTHER-MNT If the successful creation of the more specific inetnum: inetnum: 192.168.201.0 - 192.168.201.255 . . . mnt-by: SOME-MNT Is authorised by YET-ANOTHER-MNT in the less specific inetnum, notifications will be sent to the "mnt-nfy:" listed in both ANOTHER-MNT and YET-ANOTHER-MNT. Motivation: This is useful for two cases. The first is so that the maintainer of an object will be notified when unauthorised attempts to create objects occur and will receive confirmation when objects are successfully created. The second is for cases where there are multiple maintainers in a position to authorise a creation (as in the example above). The maintainers that did not specificially authorise the creation are still notified (this is how notification for updates works today). -- Shane Kerr RIPE NCC

4 5

Proposed change 2003.3: "reclaim:"-like functionality
by Shane Kerr 10 Mar '03

10 Mar '03

Colleagues, This is one of a number of proposed changes to the way the RIPE Database works. These are changes that are intended to make the database work more consistently, as well as provide an increased level of security and control to users. Please have a look, and discuss it here. [2003.3] Implementation of "reclaim:"-like functionality -------------------------------------------------------- Proposal: Any maintainer that would have been able to authorise the creation of an object can authorise the deletion of the same object. If creation of an object requires authorisation from multiple maintainers (e.g. route objects that require authorisation from an aut-num and an inetnum), then any of those maintainers may authorise the deletion. Motivation: The maintainer of an object is responsible for insuring that the data in the object is accurate. For hierarchical objects the maintainer can delegate responsibility for a subset. However, under the current implementation, there is no way for the maintainer to delete objects created and delegated to maintainers who should not or will not have access to the resources represented by these objects any more. For example, if the holder of portable address space changes ISP, then the address space will be advertised from a different AS. This means that the old route object is invalid and should be deleted. However, if the old ISP maintains the object, then the holder of the space has no way to delete the old object. This old route object will prevent the creation of a new route object that represents the new arrangement. The "reclaim:" attribute defined in RPSS allows for very similar functionality, but it may not be added to space that already has objects. This means that any existing more-specific objects cannot be deleted by the maintainers of the less-specific objects. For the case of old objects - the ones most likely to need such deletion - this means that the "reclaim:" attribute does not help. The "reclaim:" attribute also has a different syntax, depending on the specific object type that it is present in. This complicates parsing of objects. -- Shane Kerr RIPE NCC

3 3