- techsec-wg - mailman.ripe.net

BOUNCE techsec-wg@ripe.net: Non-member submission from [Gabriella Paolini <gabriella.paolini@garr.it>] (fwd)
by Henk Uijterwaal (RIPE-NCC) 07 Jan '02

07 Jan '02

---------- Forwarded message ---------- Date: 7 Jan 2002 17:26:47 -0000 From: owner-techsec-wg(a)ripe.net To: techsec-wg-approval(a)ripe.net Subject: BOUNCE techsec-wg(a)ripe.net: Non-member submission from [Gabriella Paolini <gabriella.paolini(a)garr.it>] Received: (qmail 29595 invoked by uid 0); 7 Jan 2002 17:26:46 -0000 Received: from birch.ripe.net (193.0.1.96) by postman.ripe.net with SMTP; 7 Jan 2002 17:26:46 -0000 Received: from postman.ripe.net (postman.ripe.net [193.0.0.199]) by birch.ripe.net (8.11.6/8.11.6) with SMTP id g07HQkl00806 for <techsec-wg(a)ripe.net>; Mon, 7 Jan 2002 18:26:46 +0100 Received: (qmail 29585 invoked by uid 0); 7 Jan 2002 17:26:45 -0000 Received: from dxgarr.dir.garr.it (193.206.158.1) by postman.ripe.net with SMTP; 7 Jan 2002 17:26:45 -0000 Received: from localhost (paolini@localhost) by dxgarr.dir.garr.it (8.9.3/8.9.3) with ESMTP id SAA13642; Mon, 7 Jan 2002 18:26:44 +0100 (MET) Date: Mon, 7 Jan 2002 18:26:44 +0100 (MET) From: Gabriella Paolini <gabriella.paolini(a)garr.it> To: techsec-wg(a)ripe.net, <db-wg(a)ripe.net>, <lir-wg(a)ripe.net> cc: info(a)cyberabuse.org, <philippe(a)cyberabuse.org>, <enzo.valente(a)garr.it> Subject: Status of IRT object Message-ID: <Pine.OSF.4.40.0201071757070.8825-100000(a)dxgarr.dir.garr.it> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Dear all, which is the status of IRT object? Is the trial implementation available? This example shows again the need for a specific object. If someone uses whois information from cyberabuse.org, as many times people does, that information is wrong, because ciberabuse guys used Admin-c email without considering all other informations in inetnum object and in role object. Thanks and regards, Gabriella Paolini INFN-GARR [ Informations about 193.204.17.211 ] IP range : 193.204.16.0 - 193.204.23.255 Network name : UNIBAS-NET AS number : AS137 Infos : Universita' Degli Studi Di Basilicata Infos : Centro Interfacolta' Servizi Informatici E Telematici - Cisit Phone number : +39 06 49914352 Country : IT Abuse contact : enzo.valente(a)infn.it Source : RIPE right information are inetnum: 193.204.16.0 - 193.204.23.255 netname: UNIBAS-NET descr: Universita' degli Studi di Basilicata descr: Centro Interfacolta' Servizi Informatici e Telematici - CISIT country: IT admin-c: EV182-RIPE tech-c: GL965-RIPE tech-c: GM976-RIPE ... remarks: To notify abuse mailto: cert(a)garr.it remarks: Multiple lan of university departments remarks: GARR - Italian academic and research network mnt-by: GARR-LIR ... role: GARR LIR ... trouble: To notify abuse mailto: cert(a)garr.it trouble: Information at http://www.lir.garr.it/ ... person: Enzo Valente address: INFN - Dipartimento di Fisica address: Universita' La Sapienza address: Piazzale Aldo Moro,2 address: I-00185 Roma address: Italy phone: +39 06 49914352 fax-no: +39 06 4957697 e-mail: Enzo.Valente(a)infn.it ...

1 0

Proposed agenda
by ted＠tednet.nl 04 Jan '02

04 Jan '02

Hi, Proposed agenda for RIPE 41: 0. Administrativia 1. Minutes of previous meeting (Rene Wilhelm <wilhelm(a)ripe.net> ??) 2. DISI status update (30-40 minutes, by Olaf). 3. CSIRT update (Yuri Demschenko/Terena). 4. ... N. A.O.B. Any other items, presentations of other wishes? Please reply quickly, as printing of the agenda's will take place Monday. Regards, -- ted

1 0

DNSSEC course material
by Olaf Kolkman 30 Oct '01

30 Oct '01

Dear colleagues, Excuse me for duplicate mails. The material used for the RIPE 40 DNSSEC course is now on-line. It can be found at http://www.ripe.net/disi/ . --Olaf Kolkman --------------------------------------------------------------------- Olaf M. Kolkman | RIPE NCC DISI Project ----------- | --------------- ---------------- RIPE NCC | Phone: +31 20 535 4444 | Singel 258 | Fax: +31 20 535 4445 | 1016 AB Amsterdam | http://www.ripe.net/disi | The Netherlands | OKolkman(a)ripe.net |

1 0

list
by Paul Vlaar 03 Oct '01

03 Oct '01

list

2 1

Re: Agenda for the Techsec WG
by Yuri Demchenko 01 Oct '01

01 Oct '01

Hi, Henk I would like to give update on TF-CSIRT activity and development. Last TF-CSIRT was in Manchester on Sept. 27-28, 2001 It will take aprox. 15 min. Yuri P.S. For more information about TF-CSIRT http://www.terena.nl/task-forces/tf-csirt/ http://www.terena.nl/task-forces/tf-csirt/tf-csirt010928agenda-draft.txt > * Subject: Agenda for the Techsec WG > * From: "Henk Uijterwaal $RIPE-NCC$" <henk(a)ripe.net> > * Date: Wed, 26 Sep 2001 11:19:59 +0200 (CEST) > ------------------------------------------------------------------------ > > Dear Colleagues, > > The Techsec WG will meet next week in Prague on > > TUESDAY, October 2, 14:45 > > Meeting hall IV > > NOTE that this is DIFFERENT from the schedule that is currently on the > meeting website. The agenda hasn't changed: > > 1. Administrativia > 2. Discussion of charter > 3. Discussion of workplan for the group > 4. DISI project, status and plans > 5. AOB > > and there is still room for other presentations. > > Hope to see you all next week, > > Henk > > -- ----------------------------------------------------------------------- Yuri Demchenko, TERENA, Singel 468D, 1017 AW Amsterdam, The Netherlands Tel: +31 20 530 4488 Fax: +31 20 530 4499 E-mail: demchenko(a)terena.nl -----------------------------------------------------------------------

2 1

Agenda for the Techsec WG
by Henk Uijterwaal (RIPE-NCC) 26 Sep '01

26 Sep '01

Dear Colleagues, The Techsec WG will meet next week in Prague on TUESDAY, October 2, 14:45 Meeting hall IV NOTE that this is DIFFERENT from the schedule that is currently on the meeting website. The agenda hasn't changed: 1. Administrativia 2. Discussion of charter 3. Discussion of workplan for the group 4. DISI project, status and plans 5. AOB and there is still room for other presentations. Hope to see you all next week, Henk ------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(a)ripe.net RIPE Network Coordination Centre WWW: http://www.ripe.net/home/henk Singel 258 Phone: +31.20.5354414 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------ As long as you don't tell your friends how I played the hand, then I won't tell my friends how you defended it. (Anonymous)

1 0

New version of Net::DNS
by Olaf Kolkman 18 Sep '01

18 Sep '01

L.S. A new version DNSSEC extensions to the Perl Net::DNS is available from the DISI web pages at http://www.ripe.net/disi . The additional features w.r.t. Net::DNS are listed in the README.DNSSEC file which I've appended below. The DNSSEC extensions are available as a patch against the development version of Net::DNS: http://www.ripe.net/disi/SRC/patch-0.19-DNSSEC-0.4. A full tar ball of Net::DNS including DNSSEC is also available from the website at: http://www.ripe.net/disi/SRC/Net-DNS-0.19-DNSSEC-0.4.tar.gz Related is a presentation I gave on the subject on Yet Another Perl Conference (YAPC), slides are available at: http://www.ripe.net/disi/Talks/YAPC2001/index.htm. These slides might be a good start if you want to start using the package. Please let me know if you use the package, if you found any bugs or have feature requests. --Olaf ----------------------------------------------------- Olaf M. Kolkman | RIPE NCC DISI Project ----------- | --------------- RIPE NCC | Phone: +31 20 535 4444 Singel 258 | Fax: +31 20 535 4445 1016 AB Amsterdam | http://www.ripe.net/disi The Netherlands | OKolkman(a)ripe.net README.DNSSEC _________________________________________________________________________ + General info. + Since this file is available in your distribution You have extended the Net::DNS package with DNSSEC functionality. DNSSEC is defined in RFC 2535 and related packages. The extensions provide the following additional features on top of the original Net::DNS package (version 0.19). - SIG, KEY and NXT records. These are all implemented as RR objects. The cryptography has been implemented using Crypt::DSA, Crypt::RSA and related modules. - EDNS0 support: Implemented using the OPT pseudo RR object. - DS support: Experimental implementation of DS record. To play with the DS record on the Network you have to assign a QTYPE. You can do this by uncommenting line 77 in Net/DNS.pm This will assign QTYPE 93 to the DS RR. - CERT support: Courtesy of Mike Schiraldi <raldi(a)research.netsol.com> for VeriSign _________________________________________________________________________ + Bug reports and feature requests. + We do not maintain the Net::DNS package. Only the DNSSEC extensions described above. If you find bugs in the extensions or have DNSSEC feature request please mail to okolkman(a)ripe.net. _________________________________________________________________________ + Update + Please see www.ripe.net/disi for the latest versions. _________________________________________________________________________ + Dependencies. + The patches are dependent on the following CPAN modules. FileHandle => 2.00, IO::Socket => 1.26, IO::Select => 1.14, Socket => 1.72, MIME::Base64 => 2.11, Digest::MD5 => 2.12, Digest::HMAC_MD5 => 1.00, Crypt::RSA => 1.37, Crypt::DSA => 0.12, _________________________________________________________________________ + Version history. + 0.19-DNSSEC-0.4: Added CERT support: Courtesy of Mike Schiraldi <raldi(a)research.netsol.com> for VeriSign BUG Fixed MANIFEST file. make dist will result in proper module tar ball 0.19-DNSSEC-0.3: Solved patch problems that where due to the $Id: README.DNSSEC,v 1.2 2001/09/17 19:31:02 olaf Exp $ in headers not being from the original distribution. Added DSA signature creation Added DS support You have to uncomment line 77 in Net/DNS.pm to fully enable DS This will assign QTYPE 93 to the DS RR. That value is not assigned by IANA. Added this README.DNSSEC file Added t/09-dnssec.t to the test script with a number of consistency checks. after patching the original distribution direction perl Makefile.PL make test will call this function among other things. BUG KeyID set to 0 for null keys. BUG Sorting of canonical RDATA; Data over which SIG was created was not sorted properly (RFC2535 sect 8.3) causing signature verification errors for RDATA within a RRset having different length (e.g. some NS RRsets would not verify.) 0.19-DNSSEC-0.2: First somewhat public release.

1 0

fwd: RIPE 40 TechSec-WG Agenda / DISI Progress Report
by Henk Uijterwaal (RIPE-NCC) 17 Sep '01

17 Sep '01

---------- Forwarded message ---------- Date: Mon, 17 Sep 2001 15:43:01 +0200 To: Technical Security Deployment WG <techsec-wg(a)ripe.net> From: Daniel Karrenberg <Daniel.Karrenberg(a)ripe.net> Subject: RIPE 40 TechSec-WG Agenda / DISI Progress Report Dear Colleagues, below you can find an informal progress report form the DISI project in preparation for the meeting in Praha. I am not sure whether this and the charter warrants a full meeting slot or whether we need a meeting at all. This is for the chair to decide. Certainly a full slot looks like way too much time at present. Please propose any additional agenda points quickly in case we are asked to give up meeting time for other WGs. Daniel ------------------------------ RIPE NCC DISI Progress Report - DNSSEC developments The biggest hurdle in DNSSEC deployment is the delegation of signing authority over zone boundaries. Currently things work technically. However the interactions between zone administrators at delegation points are too numerous and complex to be deployable by the RIPE community, or anyone for that matter, in a large scale. We are actively contributing to work in this area. We are confident that the proposed delegation signer (DS) resource record [1] will solve these deployability concerns. Deployment of DNSSEC at the RIPE NCC has been stalled until this problem is shown to be solved. - Tools To enable development of tools to maintain DNSSEC we have extended the Perl Net::DNS library with DNSSEC functionality. - Workshops and tutorials We have been raising awareness about DNSSEC by giving tutorials. Course material is being developed and made available through the DISI web pages. The tutorials help us to understand where the operational difficulties lie and which tools are needed for operational deployment. One such operational problem and a possible solution are presented in the IETF dnsop workingroup [2]. The next tutorial will be October 8 in Prague. - Plans We will continue to actively contribute to the IETF activities around operations of DNSSEC by participate in early adoption and early implementation. We will continue to organize workshops and develop tools which will be needed for operational implementation. On the longer term we plan operational deployment of DNSSEC on the reverse tree as soon as a solution to the delegation of signing authority over zone boundaries has made his way into the standards track. - References [1] ftp://ftp.ripe.net/internet-drafts/draft-ietf-dnsext-delegation-signer-0.2.… [2] ftp://ftp.ripe.net/internet-drafts/draft-ietf-dnsop-resolver-rollover-00.txt

1 1

Draf agenda for RIPE 40 (fwd)
by Henk Uijterwaal (RIPE-NCC) 23 Aug '01

23 Aug '01

Dear Colleagues, This group will meet at RIPE40, the preliminary agenda is; 1. Introduction - Agenda bashing - List of attendees - Scribe - Minutes from the previous meeting 2. Discussion of the charter (already posted to the mailing list). 3. Discussion of work items that this group should take up. (other than the DISI effort at the NCC). 4. Progress report on the DISI effort at the NCC (Olaf Kolkman). 5. ... Time for other presentations on technical security issues ... N. AOB If you like to present something or bring up a topic for items #3 or #5, please send me a mail. Henk ------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(a)ripe.net RIPE Network Coordination Centre WWW: http://www.ripe.net/home/henk Singel 258 Phone: +31.20.5354414 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------ As long as you don't tell your friends how I played the hand, then I won't tell my friends how you defended it. (Anonymous)

1 0

DNSSEC Course, Prague October 8, 2001
by Olaf Kolkman 15 Aug '01

15 Aug '01

*** DNSSEC Course *** Final Announcement This mail is sent to both the ripe-list and the techsec-wg mailinglist excuse us for possible receipt of duplicates. The RIPE NCC will be organising a DNSSEC course The course will be held in Prague on the Monday after the RIPE Meeting, October 8: 9 am to 5 pm. The goal of the course is familiarise the participants with DNSSEC so they can maintain their own secured zone and to identify current difficulties in deployment and possible future directions. To be able to run the program in a day we expect the participants + being able to administer DNS zone files with bind; + to bring their own dummy zone to experiment with; + to bring a laptop running the latest version of bind; + being able to patch bind software if needed; About a week before the course, you will receive a homework assignment. This will take about an hour to complete and has to be done in advance, so that during the course little time will be wasted on configuration issues. The course will consists of two parts: an introduction to DNSSEC and a hands-on part. The hands-on part will cover: + securing zone transfers using TSIG + generating zone keys and signing zones + securing 'corporate' sites with DNSSEC + establishing a chain of trust + key-exchange and rollover The RIPE NCC does not charge for this course but the amount of participants will be limited to 25 persons. If the interest in the course exceeds the number of available places a selection will be made based on first come first serve basis and by limiting the amount of participants from one affiliation. To register please fill in the form below and mail it to disi-ws(a)ripe.net, use subject header: "[DNSSEC RIPE40] Registration". Please, do not reply to the mailinglists. Finally, the RIPE NCC plans to repeat this course on a regular basis in 2002, so if your application for this event is rejected, there will be ample opportunities to take the course at a later time. --Olaf Kolkman RIPE NCC, DISI project http://www.ripe.net/disi - - - - - - - - - - - - ---cut here--- - - - - - - - - - - - - - - --------------------DNSSEC Course Registration Form.--------------- I hereby register for the DNSSEC course in Prague on October 8, 9am-5pm. Name : E-mail : Affiliation : Job title : Street Address : City : Could you shortly describe why you are interested in participating in this course and what you hope to learn? Your registration will be confirmed within 2 work days after it was received. Since the amount of participants is limited you might be put on a waiting list. ----------------------------------------------------------------------

1 0