- db-wg - mailman.ripe.net

RIPE Database incident of 27th October
by Vincent De Keyzer 21 Nov '05

21 Nov '05

Hello, the link < http://www.ripe.net/db/incident.html <http://www.ripe.net/db/incident.html> > presented on http://www.ripe.net/ripe/maillists/archives/db-wg/1998/msg00153.html seems to be broken. Can you please reinstall the page? Thanks in advance, Vincent Vincent De Keyzer MAC Telecom S.A. Blue Tower, 8th floor Avenue Louise 326 1050 Brussels, Belgium T +32 2 790 9090 (Direct: -8901) F +32 2 790 9091 M +32 486 423 700 Welcome to www.mactelecom.com <http://www.mactelecom.com>

2 1

whois -B -G
by Randy Bush 18 Nov '05

18 Nov '05

ok, what is the normal way to get around this? freebsd 7-current % whois -h whois.ripe.net -B -G 147.28.160.0/19 whois: illegal option -- B usage: whois [-aAbdgiIklmQrR6] [-c country-code | -h hostname] [-p port] name ... randy

7 10

Announcement Routing Registry Training Courses
by RIPE NCC Training 15 Nov '05

15 Nov '05

------- Dear Colleagues The RIPE NCC Training Services Department invites you to register for one of our upcoming Routing Registry Training Courses: Date: Friday 13 January 2006 Time: 0900 - 1700 Location: Stuttgart, Germany Hosted by T-com: http://www.t-com.de/ And Date: Tuesday 14 February 2006 Time: 0900 - 1700 Location: Manama, Bahrain Hosted by 2connect: http://www.2connectbahrain.com/ And Date: Friday 10 March 2006 Time: 0900 - 1700 Location: Kiev, Ukraine The main objective of the "Routing Registry Training Course" is to familiarise the LIRs with the features of the Routing Registry, while introducing the relevant tools and services of the RIPE NCC. The course also offers practical exercises. OVERVIEW OF TOPICS COVERED IN THE COURSE: - Routing Registry as a part of the RIPE Whois Database and the Internet Routing Registry (IRR) - Specifying routing policies using (RPSL) Routing Policy Specification Language and the RtConfig tool - IRRToolSet - Routing Information Service (RIS) - Routing Registry Consistency Check Project Please note that this is an advanced course. It will: - NOT teach the basics of routing - NOT teach the basics of RIPE Database operations - NOT describe how to receive Internet resources from the RIPE NCC - NOT describe how to operate a Local Internet Registry (LIR) The target audience of the course are technical staff of LIRs: e.g. network operators, engineers etc. This course is not intended for administrative or management staff (e.g. Hostmasters) . It is assumed that all attendees will be familiar with Border Gateway Protocol routing and with the RIPE Database (i.e. creating/modifying objects). This course is based on interactive exercises in a local network set-up. Please bring your laptops equipped with the following: - A working Ethernet card, - Three meters of Ethernet cable, - A secure connection client, - A web browser. Please be prepared to share your laptop (or at least allow another attendee to "look over your shoulder") if necessary. The course is free of charge. We provide lunch and printed training materials. We do not cover any of your travel expenses or accommodation. We give all of our training courses in English. You can find more information about the course at: http://www.ripe.net/training/rr/ How to register: --------------------- You can register up to two people from your LIR for each course. (If there are places left nearer the time of the course, you can register more people). To register for this course, you can either use the LIR Portal at: https://lirportal.ripe.net/lirportal/training/course-list.html Or the online registration form on our website: http://www.ripe.net/cgi-bin/trainingform.pl.cgi If you have any questions, send an e-mail to <training(a)ripe.net>. Kind regards Rumy Kanis Training Services Manager RIPE NCC

1 0

Re: [db-wg] Abuse Complaint procedures
by Dominic Spratley 13 Nov '05

13 Nov '05

Dear der Mouse I can understand your frustration at the apparent lack of response from the RIPE NCC in ensuring address space contacts in the Whois Database are accurate. The RIPE community decided that only the maintainers of objects in the database may make changes to data. The RIPE NCCs role is to implement this decision for the RIPE community. The RIPE Whois Database is a public database and therefore, although we (the RIPE NCC) aid in its operation, we are not responsible for its content. The RIPE community develops and sets policies through an open, bottom-up process of discussion and consensus-based decision making. If you wish to see changes to the policies that the RIPE NCC implement, the RIPE community has published the following process: http://www.ripe.net/ripe/docs/pdp.html We are happy to assist you in drafting any policy proposal you would like to present to the community. The policy proposal template can be found here: http://www.ripe.net/ripe/docs/pdp.html#appendix_b If you have any further questions please do not hesitate to contact me. Yours sincerely, Dominic Spratley, Registration Services Manager RIPE NCC

3 2

Re: [db-wg] Abuse Complaint procedures
by Philippe Bourcier 11 Nov '05

11 Nov '05

Hi, >Fine; that means that RIPE's options are limited to bugging the >assignee or revoking the grant of space. Seems somewhat crippled to >me, but that's a RIPE-internal problem (if it's a problem at all). RIPE-internal ? RIR-internal more likely... Do you know any large RIR that does more to handle abuse ? I'm not saying that the actual system is perfect (or even good), but can you tell us which better system you know ? Sincerely, Philippe Bourcier

1 0

Abuse Complaint procedures
by jrfoleyjr＠comcast.net 08 Nov '05

08 Nov '05

After some searching, it appears that RIPE has no actual abuse policy but that everything is still hanging in limbo. I was looking for an address to report hacker activity to and it appears that you are a) not in the business b) not equipped to handle it c) barely qualified to assign blocks of IP addresses so that the addressee can self-police, unless they are hacker/spammer organizations. In which case the rest of the worlds choice is to ban RIPE assigned addresses. Hopefully RIPE will mature soon! If in fact you DO have a group assigned for the purpose of investigating hackers, please make it available on you web page.

6 5

Deprecation of the NONE Authentication Scheme
by Ziya Suzen 08 Nov '05

08 Nov '05

Dear Colleagues, As announced at RIPE 47 the NONE authentication scheme will be deprecated. After 26 April 2004 the RIPE Whois Database will not accept updates using the NONE authentication scheme. If you have objects protected by a MNTNER object which has the NONE authentication scheme, please assign another authentication scheme or create another MNTNER object to protect these objects. If you are a RIPE NCC member you can create new MNTNER objects through the LIR Portal or send your update to <auto-dbm(a)ripe.net>. History and details: -------------------- 1. Motivation The RIPE Database protects data from unauthorised modification through the use of references to maintainer objects. The maintainer objects contain an "auth:" attribute which specifiy how a user is authenticated during updates to the database. One of the allowed authentication schemes is "NONE", which is actually not an authentication at all, but rather specifies that no authentication is necessary. NONE is intended to be used consciously, as a notification facility or as a means to tag objects. In April 2003, a proposal was sent to the Database Working Group by Hank Nussbacher: It has come lately to the attention in the Internet security realm that spammers as well as crackers are hijacking IP address space. One easy way to "steal" IP address space is via those that have auth=NONE on their objects. It is likely that in many cases NONE is used simply because it is easy. Currently approximately 500 maintainers use NONE - about 5% of all maintainers. 2. Plan Normally with a database cleanup effort, an announcement is sent to the appropriate mailing lists, posted to the RIPE web page, and also sent to the specific users affected. A period of time for cleanup is given. Finally, if the users have not fixed the data then it is modified. However, for the NONE deprecation, it is inadvisable to do this as it means announcing what is in effect a security vulnerability. Also, our operational experience with past cleanups shows that most users do not really participate through the phases of the effort. Therefore, the plan for MNTNER objects with the NONE authentication scheme is: o Announcement only to db-wg mailing list. (This announcement) o Remove "auth: NONE" attributes from all MNTNER objects, by changing them to a "remarks:" attribute with a URL explaining the change. o If that is the only authentication scheme, update the mntner objects, adding MD5-PW with a generated password. o E-mail the "admin-c:" and "tech-c:" of the objects, and the e-mail addresses listed in the "upd-to:" and "mnt-nfy:" attributes of the objects, explaining the change and including the new password if one is added. o Passwords can be requested via an e-mail to <ripe-dbm(a)ripe.net>. The reply with the password will be sent to the same contacts. After a certain period of time the service will be discontinued. Users wishing to use these maintainers may contact <ripe-dbm(a)ripe.net> for assistance. 3. RIPE-NCC-NONE-MNT A maintainer with NONE authentication, RIPE-NCC-NONE-MNT, was added to objects without any maintainer when the database was converted from RIPE-181 format to RPSL format in April 2001. There is a remark in these objects which includes the following: remarks: The RIPE NCC will never use this maintainer object to remarks: enforce any sort of control over user's objects. It is possible this could have been interpreted to mean that no restriction would ever be added to the object. One use of the RIPE-NCC-NONE-MNT has been to allow the creation of objects representing routing policy for resources not allocated or assigned by the RIPE NCC. This is done by using "mnt-routes: RIPE-NCC-NONE-MNT" or "mnt-lower: RIPE-NCC-NONE-MNT" as appropriate. A new maintainer object will be created for these cases, with a well- known password, published in the object: mntner: RIPE-NCC-RPSL-MNT descr: This maintainer may be used to create objects to represent descr: routing policy in the RIPE Database for number resources not descr: allocated or assigned from the RIPE NCC. admin-c: RD132-RIPE upd-to: ripe-dbm-notify(a)ripe.net auth: MD5-PW $1$GUExyzzy$XQtbZHGVqy9GW8BiAckBV1 remarks: ******************************************************* remarks: * The password for this object is 'RPSL', without the * remarks: * quotes. * remarks: ******************************************************* mnt-by: RIPE-DBM-MNT referral-by: RIPE-DBM-MNT changed: ripe-dbm(a)ripe.net 20040301 source: RIPE The main use of this maintainer is for INETNUM objects. There are approximately 60000 such objects - about 6% of the inetnums. Updates for objects with RIPE-NCC-NONE-MNT are rare, less than 2% of all updates. For objects using RIPE-NCC-NONE-MNT: o If there are other "mnt-by:" attributes it will be changed to a "remarks:" attribute. o Otherwise, the "mnt-by:" will be changed to RIPE-NCC-LOCKED-MNT, which has a locked password (or PGP key). o A "remarks:" attribute will be added explaining how to generate a maintainer. o An e-mail will be sent to the "admin-c:" and "tech-c:" of the objects, and the e-mail addresses listed in the "notify:" attributes of the objects, explaining the change and giving a URL which will help to generate a new maintainer or assign another existing maintainer. o At the URL, the object will be automatically updated to have a new maintainer. o After a certain period of time the service will be discontinued. Users wishing to use these maintainers may contact ripe-dbm(a)ripe.net for assistance. 4. Other maintainers with "auth: NONE" The RIPE-NCC-PN-NONE-MNT was used to mark PERSON objects not to be deleted in the 2001 person cleanup. It can be removed and the maintainer deleted. The LIM-MNT is used for limericks. It will have a well-known password similar to the RPSL maintainer. It will also be maintained by another maintainer (not itself, as currently). -- Ziya Suzen RIPE NCC

4 5

Planned network maintenance 3-11-2005
by Ruud de Kooter 02 Nov '05

02 Nov '05

Dear Colleagues, This is to let you know that we will carry out planned network maintenance tomorrow, Thursday, 3 November from 20:00 to 22:00 UTC. We don't expect this to disrupt any RIPE NCC services, though you may notice some small delays. This maintenance is necessary after a high load on one of our border routers caused some service disruption on 29 September 2005. Since then, we have made configuration changes to improve load balancing between the border routers. Unfortunately this has not been as beneficial as we had hoped, and the load continues to increase. The router is approaching its maximum capacity. We have decided to replace the router with a more powerful one. We apologise for inconvenience this may cause. If you have any questions, please send e-mail to <ops(a)ripe.net>. Regards, Ruud de Kooter

1 0

Proposal for Test Database Cleanup
by Can Bican 01 Nov '05

01 Nov '05

Proposal for Periodic Clean-up for the TEST RIPE Database Motivation ---------- The RIPE NCC provides a TEST RIPE Database for users to learn how to use the software and try out new updates without the risk of damaging data in the real database. This database uses the same software as the production version of the RIPE Database. The data in the TEST database is NOT a copy of that in the RIPE Database, it is not authoritative data. Therefore no value should be put on it. The RIPE NCC only carries out maintenance operations in the RIPE Database and not in the TEST database. Over time, however, outdated features in the database software may make some parts of the TEST database unusable. To ensure a clean functioning test environment, we propose a periodic clean-up of the TEST database. Objectives ---------- - To increase the availability of the TEST database with a minimum of administrator interference. - To clean up unneeded items from the TEST database. - To provide a consistent starting point for the TEST database. Implementation -------------- - Every first Tuesday of each month, the TEST database will be reloaded with a set of database objects. Downtime will be brief, and is estimated to be at most half an hour. - After the reinitialisation, the database will contain: * One PERSON, one ROLE, one ORGANISATION and one MAINTAINER object for test purposes. * One MAINTAINER object to maintain the test MAINTAINER object. * 0/0 network ranges for IPv4 and IPv6. * 0/0 ROUTE and ROUT6 objects. * One as-block containing as0 - as65535. * Three DOMAIN objects for 'in-addr.arpa', 'ip6.arpa' and 'e164.arpa'. -- Can Bican Software Engineering Department

1 1

RIPE NCC Launches E-Learning Centre
by Rumy Kanis 01 Nov '05

01 Nov '05

[Apologies for duplicate e-mails] Dear Colleagues, The RIPE NCC is proud to announce the launch of its E-Learning Centre (http://e-learning.ripe.net). The E-Learning Centre is a free resource available to both members of the RIPE NCC and non-members. The E-Learning Centre will: - Enable users to learn in their own space and at their own pace - Supplement the training courses provided by the RIPE NCC - Allow users to contact the RIPE NCC trainers for additional help and support The E-Learning Centre launched on 1 November 2005 with an introduction to creating and updating basic RIPE Database objects. In January 2006, the RIPE NCC is planning to add a second module, covering the RIPE Policy Development Process. The RIPE NCC plans to develop further modules for the E-Learning Centre based on feedback from users. Plans are already underway for additional modules covering subjects such as DNS for LIRs, Advanced Database Objects and IRRToolset. The E-Learning Centre is available at: http://e-learning.ripe.net If you have any questions or feedback about the RIPE NCC E-Learning Centre, please e-mail: <e-learning(a)ripe.net> Regards, Rumy Kanis Training Services Manager RIPE NCC -- RIPE NCC Online learning... at your pace in your space http://e-learning.ripe.net

1 0