- ncc-services-wg - mailman.ripe.net

[training] RIPE NCC Webinars - new dates
by Training Services 20 Jan '14

20 Jan '14

Dear colleagues, We are pleased to announce the launch of new dates for our Webinars. The RIPE NCC Webinars are live and take only one hour. You can interact with our trainers without leaving your desk. We focus on the topics and issues most important for LIRs. Register now at https://www.ripe.net/lir-services/training/e-learning/webinars Participation is limited to 20 people, so don't hesitate if you want to take part! If you have questions, please email <training(a)ripe.net>. We look forward to seeing you online. Kind regards, RIPE NCC Training Services

1 0

Proposed Implementation of Resource Certification for non-RIPE NCC Members
by Alex Band 16 Jan '14

16 Jan '14

Dear colleagues, We have been working on the implementation of 2013-04, "Resource Certification for non-RIPE NCC Members", and would like to give you an overview of our proposed plan for certifying address space held by Provider Independent (PI) End Users. You can find the full details below. In summary: 1. We propose to only issue certificates for PI End User resources if an End User Assignment Agreement has been submitted and verified by the RIPE NCC and all internal RIPE Registry records match with the associated information in the RIPE Database 2. Users will no longer be able to update the "org-name:” attribute in the organisation object without RIPE NCC involvement. This attribute will only be locked if the organisation object is referenced from a resource object. With this step we are enforcing an existing business rule. 3. RIPE NCC Access authorisation will be added to the RIPE Database. This will simply be an additional value for the "auth:" attribute, referencing your RIPE NCC Access account. Detailed explanation: Currently, when a PI resource is assigned to an End User, we make a record of the organisation name and the organisation-id in our registry. This information is reflected in the related inetnum object for the resource (the org-id attribute), as well as the organisation object (the org-name attribute). However, it is possible that these informational elements can fall out of sync, as the End User is free to update these objects without involving the RIPE NCC. This can negatively impact the accuracy of the registry. One of the primary goals of issuing resource certificates is to make the RIPE Registry as accurate and robust as possible. Therefore, we propose to only issue certificates for PI End User resources: 1. If an End User Assignment Agreement has been submitted and verified by the RIPE NCC 2. If all internal RIPE Registry records match with the associated information in the RIPE Database During the request procedure, we would perform checks to see if the resources are eligible for certification. If all of the records in the RIPE Registry and RIPE Database match, the PI End User or Sponsoring LIR would be able to request a certificate without interaction with the RIPE NCC. However, if registry and database information are out of sync, we would ask you to first resolve this (with our help) to ensure that all records match correctly. In this implementation, you will no longer be able to update the "org-name:” attribute in the organisation object without RIPE NCC involvement. This attribute will only be locked if the organisation object is referenced from a resource object. This would ensure that our registry records remain accurate at all times. Additionally, the RIPE NCC plans to launch a project where we will proactively match the RIPE Registry and RIPE Database records in cooperation with the resource holder. Another aspect we need to implement is the association of a RIPE NCC Access account with the person who has authoritative control over the resources. In order to achieve this, we will introduce the ability to add a RIPE NCC Access account to a MNTNER object in the RIPE Database. Practically, this will simply be an additional value for the "auth:" attribute, referencing your RIPE NCC Access account. This will immediately fulfil a long-standing user request to be able to update RIPE Database objects with your RIPE NCC Access account, making authentication between different RIPE NCC services more seamless. Please do not hesitate to contact us if you have any questions. Kind regards Alex Band Product Manager RIPE NCC

1 0

[service] Report on Wednesday's Technical Outage
by Brian Riddle 10 Jan '14

10 Jan '14

Dear colleagues, We are currently upgrading our network. On Wednesday, between 15:42 and 17:27 (UTC+1), while performing a clean-up operation on our network equipment, we experienced an outage on our network which affected our virtual environment. This caused a number of our services to be unavailable for a period of time, ranging from 20 minutes to 1 hour and 45 minutes. Major services affected: 15:42 - 16:02 Internal network 15:42 - 16:08 RIPE Database 15:42 - 16:50 LIR Portal 15:42 - 16:55 www.ripe.net 15:42 - 17:27 RIPE Labs Major services not affected: DNS, K-root. As a result, we are reviewing our network maintenance procedures to minimise the risks of this occurring again. We apologise for any inconvenience that this may have caused. Kind regards Brian Riddle IT Manager RIPE NCC

1 0

[training] RIPE NCC Webinars - new dates
by Training Services 06 Jan '14

06 Jan '14

Dear colleagues, We are pleased to announce the launch of new dates for our Webinars. The RIPE NCC Webinars are live and take only one hour. You can interact with our trainers without leaving your desk. We focus on the topics and issues most important for LIRs. Register now at https://www.ripe.net/lir-services/training/e-learning/webinars Participation is limited to 20 people, so don't hesitate if you want to take part! If you have questions, please email <training(a)ripe.net>. We look forward to seeing you online. Kind regards, RIPE NCC Training Services

1 0

New RIPE NCC PGP Key
by Ingrid Wijte 17 Dec '13

17 Dec '13

[Apologies for duplicate e-mails] Dear Colleagues, On Monday, 6 January 2014 we will start using our 2014 key to sign e-mails from our ticketing system. The new key has been signed by the old key as described in the key-management policy on our web site: https://www.ripe.net/lir-services/resource-management/contact/pgp-authentic… The old key remains valid until Wednesday, 29 January 2014. If you have any questions about this, please contact <ops(a)ripe.net>. Kind Regards, Ingrid Wijte RIPE NCC

1 0

Proposed Implementation for Two-Factor Authentication
by Alex Band 12 Dec '13

12 Dec '13

Dear colleagues, Firstly, I would like to thank all who provided feedback on our authentication proposal for RIPE NCC Access. Many responded to the request for feedback, both publicly and privately, which is very encouraging to see. Based on your input, and the fact that this functionality is very rarely used, we would like to propose the following: 1. Discontinue X.509 identity certificate login from 1 February 2014 - All users who currently have a certificate will be contacted individually - Users will only use their RIPE NCC Access username and password to log in from 1 February 2014 - Note: a lost password can be recovered at https://access.ripe.net/forgot-password 2. Build an implementation for two-factor authentication for RIPE NCC Access, supporting at least: - HMAC-Based One-Time Password (HOTP) - Time-Based One-Time Password (TOTP) We would like to plan the development effort and scheduling before the end of the year and inform you about our roadmap once the project plan is in place. Please let us know if you have any comments or questions. Kind regards, Alex Band Product Manager RIPE NCC

2 1

IPv6 support in the IP Analyser API
by Alex Band 11 Dec '13

11 Dec '13

Dear colleagues, We are incrementally adding support for IPv6 in the IP Analyser toolset. The first piece of functionality that we deployed is the API. You can read more about this feature at: https://www.ripe.net/data-tools/developer-documentation/the-lir-portal-ip-a… Please do not hesitate to contact us if you have any feedback or questions. Kind regards, Alex Band Product Manager RIPE NCC

1 0

Authentication Proposal for RIPE NCC Access
by Alex Band 06 Dec '13

06 Dec '13

Dear colleagues, In our RIPE NCC Access authentication system, we offer the ability to log in using an X.509 identity certificate instead of a username and password. This functionality was transferred from the legacy authentication system we used to have, without evaluating the value of this feature at the time. Since then, we have encountered several implementation, user interface and support issues surrounding this feature, while it is used by less than 0.7% of the users with a RIPE NCC Access account. Most importantly, the functionality does not actually offer any additional security. This is something that is provided by true two-factor authentication. We would like to propose to put this functionality in maintenance mode, meaning that it would be provided as it is without a service guarantee. Alternatively, it could be removed altogether. This would free us of a maintenance and support burden, meaning that we can spend these resources on other valuable services. If the membership approves, the RIPE NCC could investigate ways to implement true two-factor authentication for RIPE NCC Access. We look forward to hearing your feedback. Kind regards, Alex Band Product Manager RIPE NCC

16 17

Follow up on implementation of Resource Certification (RPKI) for PI End User Resources
by Alex Band 26 Nov '13

26 Nov '13

Dear colleagues, Over the last few weeks, we have been consulting the RIPE community on the practical implementation of providing Resource Certification (RPKI) for Provider Independent (PI) End Users. In about two weeks, we plan to start with the implementation and, based on the feedback that you have provided, we would like to offer the following two solutions: 1. A management interface for sponsoring LIRs in the LIR Portal Sponsoring LIRs will be able to issue access credentials for the RPKI Management interface to either themselves if they manage ROAs on behalf of the PI End User, or directly to the PI End User if they have requested to set up and maintain ROAs. 2. A form on the RIPE NCC website, allowing PI End Users to request access directly from the RIPE NCC PI End Users will be able to log in with their RIPE NCC Access account, enter the resources they would like a certificate for and authenticate against the INETNUM database object to prove they have authoritative control over the address space. If you have any feedback, please do not hesitate to respond to this message. Kind regards, Alex Band Product Manager RIPE NCC P.S. The RIPE NCC has explained the implementation options and associated cost at the following locations: http://www.ripe.net/ripe/mail/archives/ncc-services-wg/2013-March/002145.ht… http://www.ripe.net/ripe/mail/archives/ncc-services-wg/2013-March/002149.ht… http://www.ripe.net/ripe/mail/archives/ncc-services-wg/2013-March/002252.ht… http://www.ripe.net/ripe/mail/archives/ncc-services-wg/2013-March/002256.ht… http://www.ripe.net/ripe/mail/archives/ncc-services-wg/2013-October/002587.…

2 1

RPKI Validator 2.13 released
by Alex Band 25 Nov '13

25 Nov '13

Hello everyone, We just released RPKI Validator 2.13 and I would just like to highlight a couple of important improvements and fixes. 1. Single, unified configuration file We recently received a request to allow overriding the default paths of the application to allow Debian packaging. This meant we ended up with so many startup flags and environment variables that we decided to put every user configurable option together in one single file. You can choose your own name and path for the config file, to allow for easy updating without overwriting your preferences. 2. Application health and trust anchor monitoring Quite some users have asked us to implement monitoring, so they can keep an eye on whether the application itself is running properly and if the RPKI repositories are available and serving data. Application health monitoring currently only checks if the rsync binary can be found and executed. For Trust Anchor monitoring we built a dedicated page. For example: http://localcert.ripe.net:8088/trust-anchor-monitor/44a4f26e67 Both are a basic, initial implementations. We’re actively looking for feedback on which checks you would like to see and how you would like to be able to implement them in your monitoring setups. 3. Deep linking You can specify an AS Number or prefix in the URL of the ROA and BGP Preview pages to get direct, bookmark-able access to information. For example: - http://localcert.ripe.net:8088/roas?q=2001:7fb:fe01::/48 - http://localcert.ripe.net:8088/bgp-preview?q=AS12654 4. Bug and conformance fixes At IETF88 in Vancouver we did some rigorous testing with other implementors to see how the application handles malformed objects. A couple of bugs and other anomalies came to light that have been fixed in this version. You can download RPKI Validator 2.13 here: https://www.ripe.net/lir-services/resource-management/certification/tools-a… We recommend that you update to this release. As always, we look forward to your feedback. Kind regards, Alex Band Product Manager RIPE NCC

1 0