June 2005 - db-wg - mailman.ripe.net

<auto-dbm@ripe.net> is slow this afternoon.
by RIPE Database Administration 17 May '18

17 May '18

Dear Colleagues, Because of a very high level of use this afternoon, the response time of <auto-dbm(a)ripe.net> is longer than normal. I have made contact with those who are responsible and I expect the situation to improve as the machine works through the queue. Please be patient. Obviously we at the RIPE NCC Database Group are continuously working to make the performance of the database as good as possible. However, we cannot make improvements in zero time. We thank you for your co-operation up to now and we ask for your continued co-operation so that everyone receives the best possible service. If you have anymore questions, please contact <ripe-dbm(a)ripe.net>. Regards, Ambrose Magee ____________________________ RIPE Database Administration.

2 2

Deprecation of the NONE Authentication Scheme
by Ziya Suzen 08 Nov '05

08 Nov '05

Dear Colleagues, As announced at RIPE 47 the NONE authentication scheme will be deprecated. After 26 April 2004 the RIPE Whois Database will not accept updates using the NONE authentication scheme. If you have objects protected by a MNTNER object which has the NONE authentication scheme, please assign another authentication scheme or create another MNTNER object to protect these objects. If you are a RIPE NCC member you can create new MNTNER objects through the LIR Portal or send your update to <auto-dbm(a)ripe.net>. History and details: -------------------- 1. Motivation The RIPE Database protects data from unauthorised modification through the use of references to maintainer objects. The maintainer objects contain an "auth:" attribute which specifiy how a user is authenticated during updates to the database. One of the allowed authentication schemes is "NONE", which is actually not an authentication at all, but rather specifies that no authentication is necessary. NONE is intended to be used consciously, as a notification facility or as a means to tag objects. In April 2003, a proposal was sent to the Database Working Group by Hank Nussbacher: It has come lately to the attention in the Internet security realm that spammers as well as crackers are hijacking IP address space. One easy way to "steal" IP address space is via those that have auth=NONE on their objects. It is likely that in many cases NONE is used simply because it is easy. Currently approximately 500 maintainers use NONE - about 5% of all maintainers. 2. Plan Normally with a database cleanup effort, an announcement is sent to the appropriate mailing lists, posted to the RIPE web page, and also sent to the specific users affected. A period of time for cleanup is given. Finally, if the users have not fixed the data then it is modified. However, for the NONE deprecation, it is inadvisable to do this as it means announcing what is in effect a security vulnerability. Also, our operational experience with past cleanups shows that most users do not really participate through the phases of the effort. Therefore, the plan for MNTNER objects with the NONE authentication scheme is: o Announcement only to db-wg mailing list. (This announcement) o Remove "auth: NONE" attributes from all MNTNER objects, by changing them to a "remarks:" attribute with a URL explaining the change. o If that is the only authentication scheme, update the mntner objects, adding MD5-PW with a generated password. o E-mail the "admin-c:" and "tech-c:" of the objects, and the e-mail addresses listed in the "upd-to:" and "mnt-nfy:" attributes of the objects, explaining the change and including the new password if one is added. o Passwords can be requested via an e-mail to <ripe-dbm(a)ripe.net>. The reply with the password will be sent to the same contacts. After a certain period of time the service will be discontinued. Users wishing to use these maintainers may contact <ripe-dbm(a)ripe.net> for assistance. 3. RIPE-NCC-NONE-MNT A maintainer with NONE authentication, RIPE-NCC-NONE-MNT, was added to objects without any maintainer when the database was converted from RIPE-181 format to RPSL format in April 2001. There is a remark in these objects which includes the following: remarks: The RIPE NCC will never use this maintainer object to remarks: enforce any sort of control over user's objects. It is possible this could have been interpreted to mean that no restriction would ever be added to the object. One use of the RIPE-NCC-NONE-MNT has been to allow the creation of objects representing routing policy for resources not allocated or assigned by the RIPE NCC. This is done by using "mnt-routes: RIPE-NCC-NONE-MNT" or "mnt-lower: RIPE-NCC-NONE-MNT" as appropriate. A new maintainer object will be created for these cases, with a well- known password, published in the object: mntner: RIPE-NCC-RPSL-MNT descr: This maintainer may be used to create objects to represent descr: routing policy in the RIPE Database for number resources not descr: allocated or assigned from the RIPE NCC. admin-c: RD132-RIPE upd-to: ripe-dbm-notify(a)ripe.net auth: MD5-PW $1$GUExyzzy$XQtbZHGVqy9GW8BiAckBV1 remarks: ******************************************************* remarks: * The password for this object is 'RPSL', without the * remarks: * quotes. * remarks: ******************************************************* mnt-by: RIPE-DBM-MNT referral-by: RIPE-DBM-MNT changed: ripe-dbm(a)ripe.net 20040301 source: RIPE The main use of this maintainer is for INETNUM objects. There are approximately 60000 such objects - about 6% of the inetnums. Updates for objects with RIPE-NCC-NONE-MNT are rare, less than 2% of all updates. For objects using RIPE-NCC-NONE-MNT: o If there are other "mnt-by:" attributes it will be changed to a "remarks:" attribute. o Otherwise, the "mnt-by:" will be changed to RIPE-NCC-LOCKED-MNT, which has a locked password (or PGP key). o A "remarks:" attribute will be added explaining how to generate a maintainer. o An e-mail will be sent to the "admin-c:" and "tech-c:" of the objects, and the e-mail addresses listed in the "notify:" attributes of the objects, explaining the change and giving a URL which will help to generate a new maintainer or assign another existing maintainer. o At the URL, the object will be automatically updated to have a new maintainer. o After a certain period of time the service will be discontinued. Users wishing to use these maintainers may contact ripe-dbm(a)ripe.net for assistance. 4. Other maintainers with "auth: NONE" The RIPE-NCC-PN-NONE-MNT was used to mark PERSON objects not to be deleted in the 2001 person cleanup. It can be removed and the maintainer deleted. The LIM-MNT is used for limericks. It will have a well-known password similar to the RPSL maintainer. It will also be maintained by another maintainer (not itself, as currently). -- Ziya Suzen RIPE NCC

4 5

mnt-routes bugs
by Daniel Roesen 29 Jun '05

29 Jun '05

Hi, instead of spending developer time on poem/limerick objects, could we please get all the mnt-routes and other authorization bugs fixed, like: http://www.ripe.net/bugzilla/show_bug.cgi?id=118 http://www.ripe.net/bugzilla/show_bug.cgi?id=136 http://www.ripe.net/bugzilla/show_bug.cgi?id=137 and today I might have found a possible bug that is similar to 118, but IPv6: ***Warning: The parent [route6] 2001:5000::/21AS1273 has invalid prefix ranges in "mnt-routes:" attribute(s): 2001:5001:103::/48 The object has: route6: 2001:5000::/21 ... mnt-routes: CLUE-MNT {2001:5001:103::/48} I'm trying to create route6 2001:5001:103::/48. Is the mnt-routes syntax used wrong? Best regards, Daniel -- CLUE-RIPE -- Jabber: dr(a)cluenet.de -- dr@IRCnet -- PGP: 0xA85C8AA0

2 1

whois lookup limits
by Hank Nussbacher 28 Jun '05

28 Jun '05

What are the current limits on whois lookups and how does one get a specific IP changed? I have someone getting "ERROR:202: access control limit reached for x.x.x.x" Thanks, Hank

2 2

Re: The Cidr Report
by Hank Nussbacher 22 Jun '05

22 Jun '05

On Wed, 22 Jun 2005, Geoff Huston wrote: One potential problem: ERX data. I am looking at all the Israeli entries for example, from 192.114.x.x-192.118.x.x You will find it in RIPE whois, but you won't find it in the RIPE stats file since the block was ERXed as were probably many others. Not sure how you can handle that. Regards, Hank > cleared up BUT changed in one important respect: > > If an entry isin the RIPE whois database but NOT in the RIPE stats file I'm > marking it as potentially bogus. I would like to see the RIPE stats file be > an accurate picture of RIPE managed address space, and the database is > completely unreliable :-( > > Geoff > > > > At 01:08 AM 18/06/2005, Hank Nussbacher wrote: > > >I was hoping the report would be cleaned up by now but it hasn't so sorry > >for the multiple list post. The Bogon section is IMHO, broken. > > > >Taking just the 1st line as an example: > >Prefix Origin AS AS Description Unallocated block > >3.0.0.0/8 AS80 GE-CRD - General Electric Company 0.0.0.0 - 3.0.0.0 > > > >3.0.0.0/8 is allocated, as is AS80. I suspect the algorithm, which > >determines the unallocated block of 0.0.0.0 - 3.0.0.0 to be somewhat > >broken. > > > >There are thousands of lines like that. > > > >The bogus AS section also appears to be broken. > > > >-Hank > > > > +++++++++++++++++++++++++++++++++++++++++++ > This Mail Was Scanned By Mail-seCure System > at the Tel-Aviv University CC. >

3 3

RE: [db-wg] Implementation of POEM object
by Titley, Nigel 22 Jun '05

22 Jun '05

> Sorry, limerick, that you had to die. > And sorry haiku, that you never had the chance to be an object for > yourself. > > I wrote a haiku and a limerick about that topic. Maybe they might help > others who feel just as melancholy as me: > > POEM-HAIKU-OBJECT > POEM-LIMERICK-OBJECT Perhaps I could suggest a minute's silence on the mailing list as a mark of respect. -- Nigel Titley Peering Coordinator, FLAG Telecom +44 20 8564 5812 ********************************************************************** This e-mail message is confidential and is intended only for the use of the individual or entity named above and contains information which is or may be confidential, non-public or legally privileged. Any dissemination or distribution of this message other than to its intended recipient is strictly prohibited. You should not copy it or use it for any purpose nor disclose the contents to any other person. If you have received this message in error, please notify us by email to postmaster(a)flagtelecom.com immediately and delete the original message and all copies from all locations in your computer systems. This e-mail has been swept by Mailsweeper TM for viruses. However, FLAG Telecom cannot accept liability for any damage which you may sustain as a result of software viruses. ********************************************************************** This message has been scanned for viruses by MailControl - www.mailcontrol.com

1 0

irt object useless
by Andre Koopal 21 Jun '05

21 Jun '05

Last week we updated all our allocations with an IRT object. However, this ended out to be quite useless as the IRT object isn't shown in a default query, which 99% of joe-user will do, they don't know to specify -c. Another problem I noticed is that the irt-nfy isn't suppressed if you do specify -c. So I want to propose to show the IRT object in a default query and to also hide the irt-nfy attribute in that default query. Regards, Andre Koopal MCI

5 13

Whois changes
by Erics 20 Jun '05

20 Jun '05

Hi, i noticed that whois gives the full details at the moment. Is this a temporary feature or did you switch back to the old output ? regards Eric Schmidt

3 2

Implementation of POEM object
by Arife Vural 20 Jun '05

20 Jun '05

Dear Colleagues, [Apologies for duplicates] Following discussions in the Database Working Group, we have made changes to the whois server software. These are the proposed changes: - Add a new object POETIC-FORM that will contain the supported poem types. - Add a new object POEM that will hold the poem itself. - Add a new attribute "form:" that shows the type of poem. There is more information about this below. You can find more details about the discussion at: http://www.ripe.net/ripe/maillists/archives/db-wg/2004/msg00246.html We expect to put a new whois server on line with new object support on 3 May 2005 at 16:00 CET. - Add a new POETIC-FORM object: The POETIC-FORM object contains information about the poem type. This is an example of a LIMERICK object: poetic-form: FORM-LIMERICK descr: Poem type for Limerick admin-c: AMR68-RIPE mnt-by: RIPE-DBM-MNT changed: ripe-dbm(a)ripe.net 20050429 source: RIPE These objects will be maintained by RIPE DBM. You can send new POETIC-FORM objects to <auto-dbm(a)ripe.net>. - Add a new POEM object: A POEM object is similar to the LIMERICK object. Unlike the LIMERICK object, it will have a "form:" attribute that contains information about the poem type. This is an example of a simple POEM object: poem: POEM-NT13-1 descr: RIPE24 dinner text: At a RIPE Meeting, held in Berlin, text: The meal was unusual, the din text: Of the two serenades text: Whose repertoire made us text: All smile and want to join in form: FORM-LIMERICK admin-c: LIM1-RIPE author: NT13 mnt-by: LIM-MNT changed: limerick-wg(a)ripe.net 19960529 source: RIPE Add a new "form:' attribute: The "form:" attribute indicates the type of poem. - Changes to the default whois query interface: There will be no changes to the whois query interface. - Data transition All existing LIMERICK objects will will be converted to POEM objects. LIMERICK objects will appear in the database for a while, but we will eventually delete them. Here is an example of a LIMERICK object: limerick: LIM-NT13-3 text: The document RIPE-104 text: Goes on longer than ever before text: If you want an address text: And your network's a mess text: Then Daniel will get very sore admin-c: LIM1-RIPE author: NT13 remarks: Great limerick, but the draft document RIPE-104++ remarks: is now called RIPE-136... mnt-by: LIM-MNT changed: limerick-wg(a)ripe.net 19960529 source: RIPE Here is how it will appear with new object types: poem: POEM-NT13-3 text: The document RIPE-104 text: Goes on longer than ever before text: If you want an address text: And your network's a mess text: Then Daniel will get very sore form: FORM-LIMERICK admin-c: LIM1-RIPE author: NT13 remarks: Great limerick, but the draft document RIPE-104++ remarks: is now called RIPE-136... mnt-by: LIM-MNT changed: limerick-wg(a)ripe.net 19960529 source: RIPE - Object templates Here is the template for the POEM object: poem: [mandatory] [single] [primary/look-up key] descr: [optional] [multiple] form: [mandatory] [single] [inverse key] text: [mandatory] [multiple] [ ] admin-c: [mandatory] [multiple] [inverse key] author: [mandatory] [multiple] [inverse key] remarks: [optional] [multiple] [ ] notify: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] changed: [mandatory] [multiple] [ ] source: [mandatory] [single] [ ] POETIC-FORM object template is: poetic-form: [mandatory] [single] [primary/look-up key] descr: [optional] [multiple] [ ] admin-c: [mandatory] [multiple] [inverse key] remarks: [optional] [multiple] [ ] notify: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] changed: [mandatory] [multiple] [ ] source: [mandatory] [single] [ ] Regards, Arife Vural RIPE NCC, SED

2 2

Draft minutes of DB-WG meeting RIPE 49 V2.0
by Kanner 13 Jun '05

13 Jun '05

pierosciacero(a)hotmail.com

1 0