January 2024 - ncc-services-wg

Re: [ncc-services-wg] The redesigned www.ripe.net is now live
by Petrit Hasani 22 Jan '24

22 Jan '24

Dear Randy, Thank you for your report. We have investigated the reported issue. The issue is not as a result of the recent work carried out on the new ripe.net <http://ripe.net/> website. Your AS number submission receives an error due to the “AS-“ prefix which is not allowed to be used in an as-name. The “AS-“ prefix is is a reserved prefix for AS SET in accordance with RFC 2622: Routing Policy Specification Language (RPSL): https://datatracker.ietf.org/doc/html/rfc2622#section-2 RFC 2622: Routing Policy Specification Language (RPSL) datatracker.ietf.org The error message received in the request form does not properly clarify it, creating confusion, so we will look to fix it as soon as possible. Please do not hesitate to contact us if you have any questions or concerns. Kind regards, Petrit Hasani RIPE NCC > On 22 Jan 2024, at 16:12, Petrit Hasani <phasani(a)ripe.net> wrote: > > Dear Randy, > > Thank you for reporting the bug. > > We will look into it and hope to resolve it as soon as possible. > > I will contact you once a fix has been deployed. > > Please do not hesitate to contact us if you have any other questions or concerns. > > Kind regards, > > Petrit Hasani > RIPE NCC > >> On 20 Jan 2024, at 21:28, Randy Bush <randy(a)psg.com <mailto:randy@psg.com>> wrote: >> >>> Date: Fri, 19 Jan 2024 13:16:42 +0100 >>> If you visit www.ripe.net today, you might notice some changes. >> >> deploy on friday afternoon and go home for the weekend. i think that is >> covered pretty early in the textbook. >> >> <ripe-asn.jpg> >> which i can fudge past by skipping the hyphens, but then i submit the AS >> allocation form and get >> >> <ripe-ouch.jpg> >> was a show stopper. and it reproduces. with safari and firefox. and >> when i go to re-do, it has not saved the data i entered. >> >> randy-- >> >> To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/listinfo/ncc-services-wg

2 2

The redesigned www.ripe.net is now live
by Phillip Oldham 20 Jan '24

20 Jan '24

Dear colleagues, If you visit www.ripe.net today, you might notice some changes. For the past few months, we’ve been working on redesigning ripe.net, and we released the new version yesterday at approximately 18:00 UTC+1. Here are some of the major changes: • The design of the website has changed • The content management system has been changed from Plone to Wagtail • We migrated servers to make this switch • The website is now significantly more mobile and tablet friendly • We are using a new search engine on the website, so search results should be more relevant, and we will be investing time to make this experience even better • Accessibility has been improved, and we aim to align with WCAG 2.1 standards as soon as possible • Visitors should see some performance improvements, and we aim to continue adding improvements for usability and energy efficiency • The RIPE community is more prominent and easy to access from the top-level navigation under “community”, and we are applying a new community design to community-related pages: https://www.ripe.net/community/ The overall navigation of the website has not been significantly altered to ensure a smooth transition. We will be making more changes to the navigation to improve readability and discoverability. Many of you shared input in a survey and some of you joined us for user interviews at RIPE 86 and for conversations following my presentation at RIPE 87. Thank you for helping us through this process. While we have launched the newly redesigned website, with over 8,000 web pages migrated to the new platform, we know there will be fixes and tweaks needed in the weeks to come. If you notice any issues or have feedback, please let us know on the forum: https://forum.ripe.net/t/www-ripe-net-redesign-is-live/820 For anything urgent, please email us at webmaster(a)ripe.net Kind regards, Phillip Oldham (he/him) <poldham(a)ripe.net> Manager, Web Services RIPE NCC Stationsplein 11, 1012 AB Amsterdam

2 2

RIPE NCC Access 2FA
by Peter Potvin 10 Jan '24

10 Jan '24

Dear List, I'm glad to see that RIPE NCC has followed in ARIN's footsteps regarding the enforcement of two-factor authentication. I have a few questions regarding this that I'm sure quite a few members of the NCC community also have. 1. Is this for all NCC Access accounts or only applicable to LIRs/end users with PI resources? 2. Will there be an option for multiple YubiKeys or U2F keys for authentication, asides from the current TOTP option? If so, is there an ETA for when this would be implemented? 3. Will RIPE NCC have secondary 2FA requirements for high-risk transactions like RPKI issuance/revocation and delegation, requiring users to re-authenticate when performing these actions? If so, would this change anything with regards to the API implementations? Regards, Peter Potvin | Executive Director ------------------------------------------------------------------------------ *Accuris Technologies Ltd.*

1 0

Enforce 2FA for RIPE NCC Access account
by Benedikt Neuffer 04 Jan '24

04 Jan '24

Happy New Year, everyone! However, the year begins with some concerning news: RIPE NCC has announced a Security Breach Investigation[0]. It likely relates to the incident where Orange Spain lost credentials[1][2]. This topic has been discussed in the unofficial RIPE Telegram chat[3] and the German network community on Telegram[4], on the discussion mailing list[5][6] and a lot of more places. The primary issue in this case was the lack of 2FA usage. We must not allow ourselves to be distracted by the debate over weak passwords. Even strong passwords can be compromised. A while ago, I raised a concern with RIPE NCC about the inability to check if 2FA is activated for an account linked to a LIR. It’s also not possible to enforce 2FA for accounts associated with a maintainer object in RIPE DB. Unfortunately, there has been no progress or action taken on this matter yet. After some thought, I've come to the conclusion that RIPE NCC's services are so essential to the internet that enforcing 2FA for RIPE NCC Access accounts globally should be considered. So, I propose a discussion urging RIPE NCC to either enforce 2FA on RIPE NCC access accounts globally, allow a LIR to enforce 2FA for linked RIPE NCC Access accounts, or at the very least, provide visibility in the LIR portal to identify which linked accounts have not activated 2FA. To be honest, I don't get the impression that RIPE NCC takes the security of RIPE NCC Access accounts very seriously. How can we, as a community, influence RIPE NCC in this regard? Would it be possible, for example, to develop a policy in the RIPE NCC Services WG that enforces 2FA for RIPE NCC Access accounts? Kind Regards, Benedikt [0] https://www.ripe.net/publications/news/ripe-ncc-access-security-breach-inve… [1] https://twitter.com/Ms_Snow_OwO/status/1742357282917109928 [2] https://twitter.com/vxunderground/status/1742704099035160612?t=GkJ0_jiIGI3N… [3] https://t.me/ripe_chat [4] https://t.me/bgpde [5] https://www.ripe.net/ripe/mail/archives/ripe-list-unmoderated/2024-January/… [6] https://www.ripe.net/ripe/mail/archives/ripe-list-unmoderated/2024-January/… -- Karlsruher Institut für Technologie (KIT) Scientific Computing Center (SCC) Benedikt Neuffer Netze und Telekommunikation (NET) Büro CN: Hermann-von-Helmholtz-Platz 1 Gebäude 442 Raum 122 76344 Eggenstein-Leopoldshafen Büro CS: Zirkel 2 Gebäude 20.21 Raum 001.1 76131 Karlsruhe Telefon CN: +49 721 608-24502 Telefon CS: +49 721 608-46342 Fax: +49 721 608-47763 E-Mail: benedikt.neuffer(a)kit.edu Web: https://www.scc.kit.edu Sitz der Körperschaft: Kaiserstraße 12, 76131 Karlsruhe KIT – Die Forschungsuniversität in der Helmholtz-Gemeinschaft Signaturversion: 23.1.0 beta

9 12

Re: [ncc-services-wg] Enforce 2FA for RIPE NCC Access account (Hank Nussbacher)
by hmi＠ripe.net 04 Jan '24

04 Jan '24

Hi Hank, > On 04/01/2024 12:04, Benedikt Neuffer wrote: > > I believe I have found a bug in RIPE Portal 2FA access. To whom should > I report it? Feel free to send it to security [at] RIPE [dot] net. Cheers Hisham > > Thanks, > Hank

2 1

Security Breach: Please Enable Two-Factor Authentication
by Hans Petter Holen 04 Jan '24

04 Jan '24

Dear colleagues, In light of the recent incident where a RIPE NCC Access account was compromised, we urge you to review your own account security. ------------------------------- Two-Factor Authentication ------------------------------- If you have not already done so, enable two-factor authentication on your RIPE NCC Access account. Using two-factor authentication across all of your accounts can reduce your exposure to attacks like these. The guide for setting up two-factor authentication on your Access account can be found at: https://www.ripe.net/participate/member-support/ripe-ncc-access/two-step-ve… ------------------------------- Password Recommendations ------------------------------- We also encourage account holders to change their Access account password and follow these recommendations: - Avoid reusing passwords for login credentials. - Use a password manager to automatically create random passwords and store them. - If you use a SaaS based password management tool, enable dark web monitoring for your own credentials. If you choose to create your own password: - Use at least 14 characters to create a password. - Using passphrases can be helpful such as a favourite quote, fictional character name or line of song to greatly increase the length of the password while also making it easier to remember. We are currently investigating the compromise of the RIPE NCC Access account and continue to work with the account holder in question. We would also like to share that we are routinely responding to notifications of possible public breaches containing RIPE NCC Access accounts and actively resetting account passwords while notifying the account holders. In line with the previous resolution by the Executive Board, we are reporting all cases of attempted fraud to the Dutch authorities: https://www.ripe.net/about-us/executive-board/minutes/2017/minutes-110th-ex… Rest assured that the RIPE NCC is committed to taking the necessary steps to ensure the security of our services. We are currently investigating how we can change our roadmaps to make two-step verification mandatory for all RIPE NCC Access accounts as soon as possible and, in the longer term, offer a wider variety of verification mechanisms. If you suspect that your account might be impacted, please report it to security(a)ripe.net. Kind regards, Hans Petter Holen Managing Director and CEO, RIPE NCC

2 1

Draft minutes NCC Service WG - RIPE87
by Bijal Sanghani 03 Jan '24

03 Jan '24

Dear colleagues, All the very best for a happy and healthy 2024, from all the Services-WG chairs. We are pleased to inform you the draft minutes from the NCC Services Working Group sessions at RIPE87 have now been published: https://www.ripe.net/participate/ripe/wg/active-wg/services/minutes/ripe-87 I’d like to take the opportunity to remind you that previous meeting minutes can be found on the services working group pages: https://www.ripe.net/participate/ripe/wg/active-wg/services/ RIPE NCC Services Working Group ripe.net Please let us know if you have any questions or comments. Kind regards, NCC Services WG Chairs Bijal, Rob and Janos

1 0

2023-03 Policy Proposal "Voluntary Transfer Lock" Implemented
by Angela Dall'Ara 03 Jan '24

03 Jan '24

Dear colleagues, We are pleased to announce that we have implemented the RIPE Policy Proposal 2023-03 “Voluntary Transfer Lock”. The new policy allows the holders of resources registered with the RIPE NCC to inform the RIPE NCC that certain resources must not be transferred for a certain amount of time. The archived policy proposal can be found at: https://www.ripe.net/participate/policies/proposals/2023-03 The RIPE Document "Voluntary Transfer Lock" is available at: https://www.ripe.net/publications/docs/ripe-806 The Request Form and Procedure are available at: https://www.ripe.net/manage-ips-and-asns/resource-transfers-and-mergers/vol… Kind regards, Angela Dall'Ara Policy Officer RIPE NCC

1 0