- db-wg - mailman.ripe.net

Database development plans
by Andrei Robachevsky 30 Jan '02

30 Jan '02

Dear colleagues, Please find below a list of the projects that we included in our development plan. We would appreciate if you could indicate importance and usefullness of specific projects so we can adjust their priorities. Several more detailed proposals will follow. Here I just included brief description of the projects not to enter premature implementation discussion. Regards, Andrei Robachevsky DB Group Manager RIPE NCC 1. Authorisation checks across multiple databases Migration to v3/RPSL made creating objects in the routing registry a much more complex process due to the introduction of the Routing Policy System Security (RFC 2725). The real problem was with so called "foreign" route objects that either announce non-RIPE address space or are originated from non-RIPE ASN. As there were no corresponding objects in the RIPE database such transactions failed. A workaround is in place now that requires duplication of objects in the RIPE RR and as a result - low security level. The proposed solution is to get this information from sources that contain authoritative information about network objects that are supposed to authorise the transaction. For example, when creating a route from APNIC's address space, but originated from a RIPE ASN, authorisation information will be requested from both RIPE and APNIC sources. 2. Real-time (interactive) updates Currently only e-mail updates are supported by the RIPE Database which complicates automation of the update process at the clients side. The facility that will allow connection oriented interactive, or real-time updates, will simplify development of the client tools and make synchronising of LIR's address management database an easier task. Once implemented this project will present a facility for other tools, such as web-based update interface, or a standalone syntax checker. 3. Automatic cleanup of unreferenced person objects You may find the initial proposals: http://www.ripe.net/ripe/mail-archives/db-wg/20010701-20020101/msg00079.html http://www.ripe.net/ripe/mail-archives/db-wg/20010701-20020101/msg00092.html The problem statement and the solution remains almost the same, with some modifications: - cleanup process is based on internal DB data, rather than object attributes or meta-attributes - "holders" of the objects to be deleted are notified n days before using standard DB notification mechanisms. 4. Further development of the database software - Improving error reporting - Improving server performance - Software portability and configuration 5. Improve database security These ideas were discussed at the RIPE-41, the detailed proposals will follow - Deprecate MAIL-FROM as a weak auth scheme that doesn't serve todays's security requirements. This will be done in several phases starting form not allowing updating mntner objects containing this scheme, and ending with not allowing updates to be authorised with MAIL-FROM. - Implement authentication scheme using MD5 as a more secure mechanism compared to crypt. Passphrases can be used instead of 8 character passwords and MD5 fingerprint will be presented in the auth value. - Implement inverse queries on auth, encryption, signature for PGP keys only (key-cert's).

4 4

Re: Database development plans
by Wilfried Woeber, UniVie/ACOnet 30 Jan '02

30 Jan '02

> In regards to the MD5 fingerprint, would this be a straight MD5 hash, or >something like the FreeBSD MD5-based password hash (which I believe supports >passwords longer than 8 chars)? I would certainly expect support for more than 8 characters, like in newer versions of Linux. >Also, would the hash continue to be openly published? I guess so. Hiding something in the response (by default) has the potential of confusing people while trying to update and/or delete objects. We've been through that already ;-) >It would seem you would still have to deal with potential dictionary attacks. Correct. >I understand the Perl-based RIPE server would use a "*" in place of >the actual crypt-pw and I've been considering adding support for this in IRRd. >Also, I would suggest reading the following paper regarding the strength >of traditional Unix crypt, FreeBSD's MD5-based crypt, and OpenBSD's Blowfish- >based bcrypt -- http://www.usenix.org/events/usenix99/provos.html Thanks for the pointer! > Regards, > Larry Blunk > Merit Regards, Wilfried.

2 1

Draft minutes RIPE41 DB WG (this time with attachment)
by Nigel Titley 17 Jan '02

17 Jan '02

This time with the minutes attached Nigel --

1 0

Draft minutes of RIPE-41 DB WG
by Nigel Titley 17 Jan '02

17 Jan '02

Folks, Please find attached the minutes of the DB WG from RIPE41. This is a first draft. If you spot mistakes or errors then please let me know and I will re-issue a corrected copy. Best regards Nigel --

1 0

draft agenda (v2), for DB-WG meeting, RIPE 41, Amsterdam
by Wilfried Woeber, UniVie/ACOnet 16 Jan '02

16 Jan '02

Dear WG list members, attached please find the 2nd draft: Proposed Agenda for the DB-WG Meeting at RIPE #41 in Amsterdam, NL. There is a new item on the draft agenda: DataBase documentation for the "average" user Looking forward to see many of you in Amsterdam a few days from now, Wilfried. ______________________________________________________________________ Proposed Agenda for the Database Working Group Meeting RIPE-41, Jan. 14-18 2002, Amsterdam, NL 1. Draft Thursday, Jan 17th, 2002 09:00-12:30 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ A. Administrative stuff (WW, chair) . volunteering a scribe . circulate list of participants . agenda bashing . status of minutes B. Actions Items . status of actions C. DB update (RIPE NCC, Andrei R.) 10 min . operations report D. DB software developments (RIPE NCC, N.N.) 30 min . bug fixes, re-writes, platform compatibility . meta-data proposal E. DB consistency and Statistics project (RIPE NCC, N.N.) 15 min F. IRT object implementation (RIPE NCC, N.N.) 15 min . implementation report, last-minute adjustments . how to use and promote the new features? G. Universal Whois Project (Andrew Newton, VeriSign App. Res.) 30 min . Needs of addressing information as it relates to domains in whois. . Overview of two technical solutions. . Unification of the addressing and domain databases into a more coherent "strategy". H. DataBase documentation for the "average" user 15 min . requested by Ruediger Volk . problem statement . how to proceed? (task-force to create requirements?) . other approaches to limit confusion at the consumers' end? I. Modification of changed: attribute (tenative) J. "organisation:" Object re-visited (tentative) Y. Input from other WGs . Z. AOB: . ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ WW, 16-JAN-2002 13:44:46 _________________________________:_____________________________________ Wilfried Woeber : e-mail: Woeber(a)CC.UniVie.ac.at UniVie Computer Center - ACOnet : Tel: +43 1 4277 - 140 33 Universitaetsstrasse 7 : Fax: +43 1 4277 - 9 140 A-1010 Vienna, Austria, Europe : RIPE-DB: WW144, PGP keyID 0xF0ACB369 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~:~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

MInutes of DB WG from RIPE 40
by Nigel Titley 16 Jan '02

16 Jan '02

Folks, After a short but vicious battle with the RIPE major domo, I enclose a copy of the DB wg minutes from RIPE 40. Apologies for the delay. The minutes were in fact sent to the list immediately after the RIPE 40 wg meeting but because I sent them from the wrong address, the list manager silently dropped them (I think). Anyway, read and enjoy. Nigel --

1 0

Announcement - Database Consistency and Statistics Project
by Can Bican 14 Jan '02

14 Jan '02

Dear Colleagues, [Apologies for multiple messages]. The new version of database consistency project, along with whois server usage statistics have been released on the RIPE NCC's web pages, with the following url: http://www.ripe.net/db/dbconstat/ The goal of this project is to find the objects with consistencies not enforced by the database, and provide reports and statistics to help users correct them. It also aims at checking for the necessary protection of objects and tracing the query and update statistics of the RIPE whois server to analyze the current trends of using the database. The goals of the consistency project do not include, for example, reality checks for inetnum objects, but it addresses only internal inconsistencies in the database, such as invalid references. Here are the types of inconsistencies which are addressed in this project: * Inetnum object related: * Inetnum objects without status attribute, * Assigned inetnum objects without allocations, * Overlapping inetnum objects, * Inetnum objects with suspicious boundaries to form a network, * Assigned inetnum objects from assignments, * Inetnum objects with wrong PA or PI status, * Wrongly allocated inetnum objects. * Person object related: * Person objects with multiple identical copies, * Person objects which do not have any references to them, * Person objects not having a valid nic-handle, * Objects which have references to invalid nic-handles. * Maintainer object related: * Maintainer objects which do not have any references to them. * Protection related: * Weak authentications schemes for maintainers. * Inetnum objects with no mnt-lower attribute. Reports about individual inconsistencies are sent only to the maintainers of objects. If you'd like to receive the report for your inconsistencies, send an e-mail to auto-dbcon(a)ripe.net containing the maintainer name in its body, and the appropriate authentication. * If the authentication of your maintainer is MAIL-FROM, mail should be sent from the appropriate e-mail address, and should contain the following in its body: mntner: <maintainer_name> * If the authentication of your maintainer is CRYPT-PW, mail should contain the following lines in its body: mntner: <maintainer_name> password: <password> * If the authentication of your maintainer is PGPKEY, mail should contain the following line and should be signed with the appropriate key: mntner: <maintainer_name> If you supply an existing maintainer and the proper authentication, the report of the inconsistencies related to the maintainer will be mailed back to you. For questions, comments and suggestions, please contact ripe-dbm(a)ripe.net. -- Can Bican RIPE NCC

1 1

Draft Minutes from RIPE-40
by Nigel Titley 14 Jan '02

14 Jan '02

Folks, Looking back on the mailing list, I couldn't see that the minutes had been published from the last meeting. My apologies for this, and please find them attached. Nigel --

1 0

Announcement - Database Consistency and Statistics Project
by Can Bican 14 Jan '02

14 Jan '02

Dear Colleagues, [Apologies for multiple messages]. The new version of database consistency project, along with whois server usage statistics have been released on the RIPE NCC's web pages, with the following url: http://www.ripe.net/db/dbconstat/ The goal of this project is to find the objects with consistencies not enforced by the database, and provide reports and statistics to help users correct them. It also aims at checking for the necessary protection of objects and tracing the query and update statistics of the RIPE whois server to analyze the current trends of using the database. The goals of the consistency project do not include, for example, reality checks for inetnum objects, but it addresses only internal inconsistencies in the database, such as invalid references. Here are the types of inconsistencies which are addressed in this project: * Inetnum object related: * Inetnum objects without status attribute, * Assigned inetnum objects without allocations, * Overlapping inetnum objects, * Inetnum objects with suspicious boundaries to form a network, * Assigned inetnum objects from assignments, * Inetnum objects with wrong PA or PI status, * Wrongly allocated inetnum objects. * Person object related: * Person objects with multiple identical copies, * Person objects which do not have any references to them, * Person objects not having a valid nic-handle, * Objects which have references to invalid nic-handles. * Maintainer object related: * Maintainer objects which do not have any references to them. * Protection related: * Weak authentications schemes for maintainers. * Inetnum objects with no mnt-lower attribute. Reports about individual inconsistencies are sent only to the maintainers of objects. If you'd like to receive the report for your inconsistencies, send an e-mail to auto-dbcon(a)ripe.net containing the maintainer name in its body, and the appropriate authentication. * If the authentication of your maintainer is MAIL-FROM, mail should be sent from the appropriate e-mail address, and should contain the following in its body: mntner: <maintainer_name> * If the authentication of your maintainer is CRYPT-PW, mail should contain the following lines in its body: mntner: <maintainer_name> password: <password> * If the authentication of your maintainer is PGPKEY, mail should contain the following line and should be signed with the appropriate key: mntner: <maintainer_name> If you supply an existing maintainer and the proper authentication, the report of the inconsistencies related to the maintainer will be mailed back to you. For questions, comments and suggestions, please contact ripe-dbm(a)ripe.net. -- Can Bican RIPE NCC

1 0

Some RIPE Database updates were processed twice
by Andrei Robachevsky 14 Jan '02

14 Jan '02

Dear Colleagues, Due to misconfiguration of our main whois server some 300 updates were not processed correctly. We needed to rollback the database and process them again. Those affected may receive acknowledgement and notifications from the RIPE Database twice. In such case please ignore the first message. The service now is back to normal. We are very sorry for the inconvenience. Regards, Andrei Robachevsky DB Group Manager RIPE NCC

3 3