July 2011 - db-wg - mailman.ripe.net

<auto-dbm@ripe.net> is slow this afternoon.
by RIPE Database Administration 17 May '18

17 May '18

Dear Colleagues, Because of a very high level of use this afternoon, the response time of <auto-dbm(a)ripe.net> is longer than normal. I have made contact with those who are responsible and I expect the situation to improve as the machine works through the queue. Please be patient. Obviously we at the RIPE NCC Database Group are continuously working to make the performance of the database as good as possible. However, we cannot make improvements in zero time. We thank you for your co-operation up to now and we ask for your continued co-operation so that everyone receives the best possible service. If you have anymore questions, please contact <ripe-dbm(a)ripe.net>. Regards, Ambrose Magee ____________________________ RIPE Database Administration.

2 2

Re: [db-wg] Analysis of MNTNER Authentication
by Denis Walker 28 Jul '11

28 Jul '11

Hi Peter We looked a little deeper into this. We noticed there are only 50 MNTNER objects in the database that do NOT have a password. They use a combination of PGP and/or X.509 only. So we looked at where these MNTNERs are used. There are probably many ways to look at this. The one we chose is how allocated address space is managed by LIRs. So we looked at the "mnt-lower:" on the allocation INETNUM objects. Some of these 50 MNTNERs are used in this way. The "mnt-lower:" allows assignments to be created. So this can be seen as a measure of control over the assigned address space. We calculated the cumulative size of the allocation blocks where one of these 50 MNTNERs is used as the "mnt-lower:" as a percentage of the total allocated address space. Cumulative total of allocations 4722688 using one of these 50 MNTNERS Total allocated address space 555648000 Percentage of address space 0.85% controlled by PGP/X.509 only (without any passwords) For the other 99.15% of address space, there may be a PGP or X.509 credential in the MNTNER object, but in addition to a password. Regards Denis Walker Business Analyst RIPE NCC Database Group On 21/06/11:26 7:14 PM, Peter Koch wrote: > Denis, > > thanks a lot for producing the numbers and information. > >> The next step was to look into the referenced MNTNER objects to see how >> many used password, PGP or X.509, and in what combination and numbers. >> >> MNTNER with one auth containing a password = 27,434 85% >> MNTNER with only password = 27,796 86% >> MNTNER with one auth containing a PGP = 952 3% >> MNTNER with only PGP = 1,507 5% >> MNTNER with one auth containing an X.509 = 16 <1% >> MNTNER with only X.509 = 21 <1% >> MNTNER with password plus either PGP or X.509 = 3,023 9% >> MNTNER with PGP plus X.509 (no password) = 50 <1% >> MNTNER with one password plus multiple PGP = 357 1% >> MNTNER with one PGP plus multiple password = 59 <1% > > in addition to what Shane suggested (which methods are actually _used_), I'd > be interested to learn how large of a percentage of the address space (as opposed to > the number of objects) is covered by "password" authentication. This is > to avoid artefacts by passwords being used for small chunks and PGP/X.509 > for the larger ones - or vice versa. > > Thanks, > Peter >

1 0

New Syncupdates service
by Denis Walker 21 Jul '11

21 Jul '11

Dear Colleagues, As part of the RIPE NCC Database Group's ongoing efforts to improve our infrastructure, we are pleased to announce the launch of a completely re-written Syncupdates service. This new Syncupdates is easier to maintain and improve than the old version, which was written almost ten years ago. The Syncupdates interface for users of the service is unchanged, so from a user viewpoint, nothing has changed. Any software or scripts written to access Syncupdates will continue to work without any need for modifications. A more detailed article will follow shortly on RIPE Labs with additional technical details about the new Webupdates and Syncupdates services. If you do have any problems with the new Syncupdates please contact <ripe-dbm(a)ripe.net>. Regards Denis Walker Business Analyst RIPE NCC Database Group

1 0

DOMAIN attributes review
by Denis Walker 14 Jul '11

14 Jul '11

[Apologies for duplicate emails.] Dear Colleagues, At the RIPE 62 Meeting we were asked to consider the attributes in DOMAIN objects. With the removal of any hierarchy in reverse delegations and the removal of forward domain data there is no longer any use case for the "mnt-lower:" attribute. Other attributes that are considered to be used only for forward domains are: - "refer:" - "sub-dom:" - "dom-net:" The statistics listed below show how many of the above attributes have been added to reverse delegations and ENUMs. The RIPE NCC would like to ask the community if anyone sees any justification for the use of these attributes in reverse delegations or ENUMs. If there is no justification, all four of these attributes can be removed from all DOMAIN objects when the last two TLD operators move their data out of the RIPE Database. This is anticipated to occur by the end of 2011. To keep any discussion focussed please send any comments or feedback to the DNS Working Group Mailing list. Regards Denis Walker Business Analyst RIPE NCC Database Group Statistics ---------- Number of each attribute used in reverse delegations or ENUMs and the number of unique maintainers who manage these objects. "refer:" = 6 unique maintainers = 1 "sub-dom:" = 271 unique maintainers = 23 "dom-net:" = 2219 unique maintainers = 140 "mnt-lower:" = 46485 unique maintainers = 4208

1 0