- db-wg - mailman.ripe.net

summary for CERT/IRT object proposal [3]
by Wilfried Woeber, UniVie/ACOnet 23 Aug '01

23 Aug '01

Dear TF-CSIRT, dear DB-WG community, [ and apologiess to those receiving more than one copy ] I was working with the RIPE NCC recently to finalize the implementation plan for the CERT/IRT Object. We had some interesting discussions (also including Yuri working on IODEF et.al.), and the NCC was checking "our" proposals against some implementation constraints. The result of that process is attached below. I'd ask the CERTs and IRTs in particular, and everyone else being interested, to review the summary. Please try to deploy the stuff "on your desk" and maybe submit your comments. I hope to be able to have a very final and brief discussion, and the technical "go-ahead", in Prague. As I understand from the NCC, we can then expect to see a quick implementation! Regards, and thanks to the NCC for offering very helpful suggestions, and thanks to the IRTs which have been patient for so long! Wilfried. ______________________________________________________________________ inetnum: 193.171.2.0 - 193.171.2.255 netname: ACONET-DEMO-2 descr: ACOnet addresses for demos and transient events country: AT admin-c: WW144 tech-c: UVNA1-RIPE tech-c: WW144 status: ASSIGNED PA remarks: ---------------- remarks: 20000720-20001231: UniVie/PTA ADSL trials - core remarks: ---------------- mnt-by: ACONET-LIR-MNT mnt-irt: ACONET-IRT # use irt object name here changed: panigl(a)cc.univie.ac.at 20010629 source: RIPE irt: ACONET-IRT address: ACOnet Incident Response Team address: c/o Vienna University Computer Center address: Universitaetsstrasse 7 address: A-1010 Vienna, Austria phone: +43 1 4277 140 00 fax-no: +43 1 4277 9 140 e-mail: Domain-Admin(a)UniVie.ac.at signature: PGPKEY-<key-id> # IRT team key first (mand.) remark: # member keys next (optional) remark: # messages from the IRT are remark: # signed with this/ese key/s encryption: PGPKEY-<key-id> # use this to encrypt a message remark: # to be sent to the IRT remark: # multiple entries allowed admin-c: WW144 tech-c: WW144 auth: CRYPT-PW bocEHQ0niH52I # checked to authenticate auth: PGPKEY-DBC579D4 # insertion of ref. to this obj. notify: Woeber(a)CC.UniVie.ac.at mnt-by: ACONET-LIR-MNT # use the regular mntner: mech. remark: # to protect the irt object changed: woeber(a)cc.univie.ac.at 20000202 source: RIPE mntner: ACONET-LIR-MNT descr: ACOnet Local-IR admin-c: WW144 tech-c: WW144 upd-to: Domain-Admin(a)UniVie.ac.at mnt-nfy: Domain-Admin(a)UniVie.ac.at auth: MAIL-FROM .*(a)cc\.univie\.ac\.at # a *very* bad example auth: PGPKEY-DBC579D4 notify: Woeber(a)CC.UniVie.ac.at mnt-by: ACONET-LIR-MNT referral-by: RIPE-DBM-MNT changed: woeber(a)cc.univie.ac.at 20000202 source: RIPE Operations: irt: object creation is manual (like mntner:) Semantics/Security: "auth:" mechanisms specified are used for authenticating the reference insertion. For an irt: object, only CRYPT-PW and PGPKEY SHOULD be used! However, this recommendation is not enforced by the DB software. This is considered to be a BCP issue. The 1st entry in the list of signature: SHOULD be the team-key, any additional entries MAY BE secondary team keys and/or team members' keys. This is considered to be a BCP issue. The key-cert objects for the PGP keys will be stored in the public keyring. More generally, only keys supported by the RIPE DB will be allowed. However, as soon as the DB accommodates additional certificate formats, those should be allowed here as well by default. Lookup and use: $whois iplookup Default behaviour, no irt is returned (as expected) because mnt-irt is more a mntner reference, which is never returned automatically. The user will need to perform a second query to retrieve info about the IRT. This will also reduce the abuse of an irt object by people sending reports to whatever e-mail address they see in an output. $whois -c iplookup This query would do a tree-walk, like the referral mechanism, trying to find an entry with an mnt-irt attribute present. The query will display an object containing the reference, but not the irt object itself. Again, people will need to perform a second query to retrieve info about the IRT. The ideas behind this proposal are: - not to alter the default behaviour for object lookups (only contact info is returned, not mntners) - not to modify the behaviour of -l flag. [ed. comment: during the discussion we were thinbking about modifying the behaviour of the -l flag when a -c flag were present.] Questions/Comments: Q: Do we allow any mntner: object in an irt: object's mnt-by: attribute, even those having weak authentication? A: no special provisions in the software. This is considered to be a BCP issue. A: a more useful approach is to deprecate weak authentication mechanisms altogether. Q: Do we want to have/allow a hierarchy similar to mnt-lower: for .e.g. inetnum: and inet6num: objects? A: no Q: should the reference to an irt: object be it's name or it's handle? A: the irt object is very similar to mntner object, so global uniqueness should not be an issue. Q: Do we want something like a trouble: in the role:, or simply use remark or put an (optional) abuse attribute into the irt object? A: probably not. Including uniform info for spam or abuse contacts is a BCP issue. [ed. comment: see discussion on anti-spam list.] Q: do we want to use more descriptive attribute names for signature and encryption? E.g. irt-sig: and encrypt:, or sig-from: and encrypt-to: Q: no clear preference, no decision in WG... so, what? A: stick with signature and encryption Decisions: Do not implement a url: attribute. Can be done with remark: Interaction with (public) key servers is outside the scope of this proposal. Implement irt object for inet[6]num initially. Extending functionality to e.g. AS number objects [ed. comment: and route objects] leads to the interesting question how to extend RPSL. This is similar to the issue of IPv6-extensions to RPSL. Separate project. Suggested object templates: irt: [mandatory] [single] [primary/look-up key] address: [mandatory] [multiple] [ ] phone: [optional] [multiple] [ ] fax-no: [optional] [multiple] [ ] e-mail: [mandatory] [multiple] [lookup key] signature: [mandatory] [multiple] encryption: [mandatory] [multiple] admin-c: [mandatory] [multiple] [inverse key] tech-c: [mandatory] [multiple] [inverse key] auth: [mandatory] [multiple] [ ] notify: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] changed: [mandatory] [multiple] [ ] source: [mandatory] [single] [ ] inetnum: [mandatory] [single] [primary/look-up key] ... mnt-irt: [optional] [multiple] [inverse key] ... inet6num: [mandatory] [single] [primary/look-up key] ... mnt-irt: [optional] [multiple] [inverse key] ... _________________________________:_____________________________________ Wilfried Woeber : e-mail: Woeber(a)CC.UniVie.ac.at UniVie Computer Center - ACOnet : Tel: +43 1 4277 - 140 33 Universitaetsstrasse 7 : Fax: +43 1 4277 - 9 140 A-1010 Vienna, Austria, Europe : RIPE-DB: WW144, PGP keyID 0xF0ACB369 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~:~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: New RIPE-147 needed!
by Sabrina Waschke 23 Aug '01

23 Aug '01

Berislav, Thank you for your comments regarding the AS Number request form. You are correct in that the RIPE-147 document needs updating due to the new RPSL syntax. Over the last couple of months the RIPE NCC has been working hard on writing new documentation, developing training material and updating current documents to adjust to the new database software. RIPE-147 is on our to-do list and you should be able to expect a new version in the near future. Kind regards, Sabrina Waschke -- o------------------------------------------o | Sabrina Waschke sabrina(a)ripe.net | | Registration Services Operations Manager | | | | RIPE NCC tel +31 20 535 4444 | | www.ripe.net fax +31 20 535 4445 | o------------------------------------------o Berislav Todorovic <beri(a)kpnqwest.net> writes: * Maybe this will sound like a hassle, but ... * * ... Everytime I receive a ripe-147 form from teh customer I have to "patch" * it myself, to make it compliant with the new RPSL syntax. * * Any chance to get the new, RPSL-capable form in place (but as a NEW RIPE * document, please!)? Here's what should be changed: * * * Add "as-name:" attribute. * * Replace "as-in:" with "import:" and "as-out:" with "export:". * * Check to see if RPSL syntax is honored. * * Check the examples and make them compliant with RPSL syntax. * * Regards, * Beri * * --------- Berislav Todorovic, Network Engineer --------- * ------- KPNQwest N.V. - IP NOC (formerly EUnet NOC) ------- * ---- Wilhelmina van Pruisenweg 78, 2595 AN Den Haag, NL ---- * --- Phone: +31-70-379-3990; Mobile: +31-651-333-641 --- * -- Email: beri(a)kpnqwest.net <=> beri(a)EU.net -- * --- _ _ ____ _ .--. ____ ____ __/_ --- * ----- /__/ /___/ /\ / / / | / /___/ /___ / ------ * ------ _/ \_ / _/ \/ (__.\ |/\/ /___ ____/ (__. ----- *

1 0

Re: Re[2]: Removal of selected sets of contact information from the RIPEDatabase
by hostmaster＠bsws.de 23 Aug '01

23 Aug '01

owner-db-wg(a)ripe.net wrote on 23.08.2001 15:34:38: > At the moment there is not. I have just spoken to DENIC though, and > they told me they were migrating those person objects to an own DENIC > database. The same was done for domains quite a while ago also by the > way, domains were stored in the RIPE database and have been ported to > DENIC. Also, most other NICs have - according to my infos - already > migrated to own databases, why would not DENIC do also? That's not the question here. The problem is he way DENIC wants to migrate and their non-existant information politics. As always, not a single statement on public-l(a)denic.de - but that's not RIPE's fault of course. Thanks for the information (we should have had from DENIC long time ago) and keep up your good work. Greetings Henning -- BS Web Services | www.bsws.de Roedingsmarkt 14 | hostmaster(a)bsws.de 20459 Hamburg Germany

1 0

RPSL: Providers exchanging full tables.
by Low, Adam 23 Aug '01

23 Aug '01

Hi, Mr. Nipper had pointed out an interesting issue with our as-macro recently, I believe its the first situation we've come across that isn't easily depicted within an RPSL routing policy without the requirement to manually update multiple near identical objects. The situation arises when we exchange full route tables with another provider, we then in turn should announce their prefixes listed in their macro onto our other providers and they too should do the same for our respective macro. So by adding each others macros to each others macros, we effectively create loops. Now is this a real problem ? In my opinion, I don't think it is, I believe that to truly understand the policy between two peers you have to take into account more (aut-num/import/export) than just the contents of an as-macro and that any tool that uses as-macros to generate prefix lists should check for duplicates and loops. It also appears that the tools we use today (RtConfig/peval) are not adversely effected by providers listing each others macros, output is as expected. Does anyone else have a view on this or a good idea of how it can be easily depicted within RPSL ? Cheers, Adam

1 0

Re: Removal of selected sets of contact information from the RIPEDatabase
by Christian Zietz 23 Aug '01

23 Aug '01

Hi, > 1. The following unreferenced person objects will be deleted: > - objects referenced only from *.de domains, according to the list > provided by DENIC (or list of mntners that define that set); > - objects that are un-maintained. Did I understand that correctly? Objects (e.g. persons) referenced only from .de domains are going to be deleted even if they are maintained (e.g. by DENIC-P). Imho that would be quite a big problem because DENIC's database relies on the RIPE database for person objects. Afaik there's no possibility to create a person object directly in the DENIC database. Christian

4 3

draft agenda (v1), for DB-WG meeting, RIPE 40, Prague
by Wilfried Woeber, UniVie/ACOnet 23 Aug '01

23 Aug '01

Dear WG list members, fellow chair persons, dear "meeting" role account! Attached please find the 1st (very rough) draft: Proposed Agenda for the DB-WG Meeting in Prague, CZ. As usual, comments, suggestions and additions are welcome! I am going to be on the road from Aug. 24th to Sept. 16th, probably with very limited access to The Net (if at all). Therefore it might take a while for me to respond.... Looking forward to see many of you in Prague, Wilfried. ______________________________________________________________________ Proposed Agenda for the Database Working Group Meeting RIPE-40, Oct. 1-5 2001, Prague, CZ 1. Draft XyzAday, October ???, 2001 ??:?? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ A. Administrative stuff (WW, chair) . volunteering a scribe . circulate list of participants . agenda bashing . status of minutes B. Actions Items . status of actions . C. DB update (RIPE NCC, N.N.) 30min . operations report . software status . migration summary D. removal of "orphaned" person objects (RIPE NCC, N.N.) 10 min . report and conclusions (if any :-) E. Status of the Merit RADB/IRRd 20 min (Larry J. Blunk, Merit Network, Inc.) F. Report and final discussion: irt: object implementation 20 min (Wilfried W., RIPE NCC, N.N.) . review of implementation proposal . review of operational impact (scripts/marketing...) . interworking with "abuse-pointers"? Y. Input from other WGs . Z. AOB: . ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ WW, 23-AUG-2001 15:34:49 _________________________________:_____________________________________ Wilfried Woeber : e-mail: Woeber(a)CC.UniVie.ac.at UniVie Computer Center - ACOnet : Tel: +43 1 4277 - 140 33 Universitaetsstrasse 7 : Fax: +43 1 4277 - 9 140 A-1010 Vienna, Austria, Europe : RIPE-DB: WW144, PGP keyID 0xF0ACB369 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~:~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Removal of selected sets of contact information from the RIPE Database
by Joao Luis Silva Damas 23 Aug '01

23 Aug '01

Dear all, (apologies for duplicates) As you know, the subject of storage of person and role objects in the RIPE Database has been the focus of attention for some time, particularly information being stored in the Database that is not directly related to RIPE NCC activities and/or some of the people whose information is stored in the RIPE Database are not aware of the fact. During the RIPE 39 meeting in Bologna, I reported on increasing concerns about data privacy issues and potential legal implications the RIPE NCC could be involved in due to some of this data. Call it a coincidence,but we have been approached by the Dutch Data Protection Agency a few weeks ago to discuss this matter. The agency's action is taken on behalf of other similar global agencies who have requested their Dutch counterparts to act as the RIPE NCC is based in the Netherlands. As a result of the discussions, the authorities have requested the RIPE NCC to remove all unreferenced data currently stored in the Database. This affects mainly person objects related to domain name registration information stored in the RIPE Database. In order to minimise annoyances to users and the membership we would like to proceed with the process in a timely manner. In order to prevent undue deletions we propose the following process: 1. The following unreferenced person objects will be deleted: - objects referenced only from *.de domains, according to the list provided by DENIC (or list of mntners that define that set); - objects that are un-maintained. 2. Those who want to protect their objects in the database should tag them with a special mntner (RIPE-NCC-PN-NONE-MNT). This procedure is solely meant for personal use by individuals interested in keeping their personal data in the RIPE Database. However, this is subject to change in the future. 3. All of the object deletions will be performed in one step. There will be an outage in updates for ~1 day. We plan to start the process Friday, 21 September 2001 in the evening and finish by the end of Saturday. More concrete details will be provided in the coming weeks. Best regards, Joao Damas RIPE NCC

2 1

New RIPE-147 needed!
by Berislav Todorovic 23 Aug '01

23 Aug '01

Maybe this will sound like a hassle, but ... ... Everytime I receive a ripe-147 form from teh customer I have to "patch" it myself, to make it compliant with the new RPSL syntax. Any chance to get the new, RPSL-capable form in place (but as a NEW RIPE document, please!)? Here's what should be changed: * Add "as-name:" attribute. * Replace "as-in:" with "import:" and "as-out:" with "export:". * Check to see if RPSL syntax is honored. * Check the examples and make them compliant with RPSL syntax. Regards, Beri --------- Berislav Todorovic, Network Engineer --------- ------- KPNQwest N.V. - IP NOC (formerly EUnet NOC) ------- ---- Wilhelmina van Pruisenweg 78, 2595 AN Den Haag, NL ---- --- Phone: +31-70-379-3990; Mobile: +31-651-333-641 --- -- Email: beri(a)kpnqwest.net <=> beri(a)EU.net -- --- _ _ ____ _ .--. ____ ____ __/_ --- ----- /__/ /___/ /\ / / / | / /___/ /___ / ------ ------ _/ \_ / _/ \/ (__.\ |/\/ /___ ____/ (__. -----

1 0

Limitation in the RPSL DB
by Stephen Burley 08 Aug '01

08 Aug '01

Hi We have hit a small problem with the RPSL DB structure. As the RPSL DB is supposed to reflect the real routing world we need some functionality adding to the DB. It is possable for PA that is part of a multihomed customer to have a differant origin to that of the main block of ip space. Can we get this refelected the in RPSL DB structure? Would you like me to explain further? Regards Stephen Burley UUNET EMEA Hostmaster

4 3

sub-allocations or something similar
by Dmitry Morozovsky 08 Aug '01

08 Aug '01

Hello there colleagues, for some last years I'm working with RIPE DB I think it would be useful to have some kind of "sub-allocation" inetnum objects. Brief example in our current situation: there is downstream provider behind us, currently without its own address block, so I've assigned /21 for them. All that space was of course well-documented, with ripe-141's covering all the nets, and appropriate inetnum objects have been created. But, for aggregating purposes, I suppose aggregating inetnum for the whole /21 would be useful and self-documenting. I can create such object, but such object is considered as overlapped. I think about explicit route-object also, but size behind current minimum allocation size (/19 for 195/8 or /20 for newer) somewhat stops me :) Your (both community and especially RIPE NCC people) suggestions are strongly expected ;-) Thank you. Sincerely, D.Marck [DM5020, DM268-RIPE, DM3-RIPN] ------------------------------------------------------------------------ *** Dmitry Morozovsky --- D.Marck --- Wild Woozle --- marck(a)rinet.ru *** ------------------------------------------------------------------------

4 4