- db-wg - mailman.ripe.net

Puzzled by RIPE-NCC-LOCKED-MNT
by Ronald F. Guilmette 22 Nov '16

22 Nov '16

I am having a bit of trouble decyphering the explanation/description of RIPE-NCC-LOCKED-MNT given on the following page, and I hope someone will help me to understand. https://www.ripe.net/publications/news/announcements/deprecation-of-the-non… It appears from the above, that there was a transition/reorganization that took place back around 2004, and that RIPE-NCC-LOCKED-MNT was set as the maintainer on various objects that were present in the data base at that time (specifically objects which were not already adequately password protected) in order to protect some such objects from unauthorized modification. Is that description approximately accurate, I mean to a first approximation? (I understand that I'm probably glossing over a number of the fine points here, but I am doing so just because I doubt that any of those are even pertinent to my real question.) So anyway, my real question is this: If in fact RIPE-NCC-LOCKED-MNT was just something which was used as a sort-of "passing phase" stop-gap mechanism, i.e. as just a convenient expedient for securing things that would otherwise poorly secured, and if it was only applied in this way back in 2004, and for perhaps a year or two afterwards, then what would be the explanation for a *recently created* data base object (e.g. a route object) that has a created: date of, say, 2014, 2015, or 2016 and also a mnt-by value of RIPE-NCC-LOCKED-MNT? Regards, rfg

7 12

Creating a mntner
by Ronald F. Guilmette 21 Nov '16

21 Nov '16

Sorry. I know this is probably an faq and a dumb question, but can some kind soul tell me the exact procedure for creating a new RIPE mntner object? Does one already have to be a dues-paying member of RIPE NCC in order to do that? Where is the form that needs to be filled out and what if any supporting documentation must be provided? Birth certificate? Company incorporation documents?

2 2

More-specific abuse-c
by Sebastian Wiesinger 16 Nov '16

16 Nov '16

I'm currently struggling with abuse-c management for a big organisation which wants multiple abuse contacts for different parts of the organisation. The org is using a lot of PI resources, some of them legacy. Currently they all use the same org object which is inextricably linked to the same abuse-c mailbox. They have a new field of business which is mostly decoupled from the rest (own AS, own routers, PI space, etc.) but still uses the same org object. As cumbersome as having to create a new org object would be, I would've gone this road but as all of them are PI I can't change the org object! It is managed by the RIPE NCC. So the only solution right now would be to ask the RIPE NCC to change the org for all objects to a new one just to change the abuse-c for the resources. I would not be surprised if this turns out to be more complicated because of the end-user contract stuff but I'll need input from the NCC how they handle such cases. Also having multiple org objects that have the same data (company name, address, phone,...) just to have a different abuse-c is something that irks me to no end. Now I have to update X orgs when the phone number or address changes. Also: redundant data in the database! I tried to follow past discussions regarding this but it seems they all kind of fizzed out without any conclusion? I would propose to fix this and add an abuse-c to resource objects that would be "more specific" than the org abuse-c and overrides it. If there are other ideas please don't hesitate to state them but to me it seems like a low-cost solution to this mess. Best Regards Sebastian -- GPG Key: 0x93A0B9CE (F4F6 B1A3 866B 26E9 450A 9D82 58A2 D94A 93A0 B9CE) 'Are you Death?' ... IT'S THE SCYTHE, ISN'T IT? PEOPLE ALWAYS NOTICE THE SCYTHE. -- Terry Pratchett, The Fifth Elephant

11 25

WG Chairs Selection
by Piotr Strzyzewski 16 Nov '16

16 Nov '16

Dear DB-WG Members As agreed during DB-WG session at RIPE69 Meeting in London on 06.11.2014, the WG Chair Selection procedure is executed at yearly intervals. This means that it is about time to run it for the very first time. This is the call for interested parties. Interested parties have 2 weeks to make their interest known on this mailing list. All members of the community are encourage to make a discussion and express their approval or otherwise of the presented candidates. After two weeks the chairs will declare consensus. Since there is a limit of 3 co-chairs, if at the end of the discussion phase there will be more than 3 proposed co-chairs then a call will be made for any of the candidates to withdraw. If there still will be more than 3 candidates then names will be put into a hat and the first three names drawn from the hat will take on the role of chairs for the next 12 months. All three of present co-chairs expressed their interest in being co-chairs for another term. All the best, Job, Nigel & Piotr -- gucio -> Piotr Strzyżewski E-mail: Piotr.Strzyzewski(a)polsl.pl

9 11

Fwd: WG Chairs Selection
by Horváth Ágoston János 05 Nov '16

05 Nov '16

While operational experience is indeed important, the role of a chair is different from a role of a president. I find that a chair will need to invest time, a lot of time, into bringing some much-needed life to the db-wg. The database has not had any notable changes since its original redesign in 1999. All what there was was mostly patchwork than real innovation. As far as I see, this was mainly caused by the lack of general interest. Newbies struggled through the years, but once they learned how to do what they wanted, they were OK with not changing anything on it. This did preserve the status quo. I find the fact that RIPE NCC has a whole-day training course over the use of RIPE DB a sign in itself that it is not for this age. I think no matter who goes as a chair, they have to start breathing life into the WG activities; come up and support real, actual redesign with today's usage patterns, mindset and expectations in mind. That will require precious time that a professional would not have or want to invest. For this reason, I'd like to cast my vote on Denis, knowing that the other chairs would have a more professional background. He does have a lot of good ideas and does have the time and energy to see them through. Cheers, Agoston On Fri, Nov 4, 2016 at 10:32 AM, Job Snijders <job(a)instituut.net> wrote: > On Friday, 4 November 2016, Randy Bush <randy(a)psg.com> wrote: >> >> > What role does the database play in your professional work? >> >> is this repeated question trying to elicit conflict of interest? >> >> and could the current co-chairs also answer it? :) > > > Leadership whom clearly have a stake in the well-being of the database would > have my preference. > > Example: people that work for orgs that depend on the database for their > routing security posture have one up on people who don't even work for a LIR > and as such don't face daily operational reality. > > Last meeting Nigel stated that he wants to step down because he doesn't do > actually work with the database any longer. With new chairs I'd like to > prevent such alienation from the get-go. > > Kind regards, > > Job

1 0

numbered work item suggestion: support PGP authentication with whois-api
by Thomas von Dein 03 Nov '16

03 Nov '16

Hello WG, I'd like to propose an enhancement of the whois REST api to support PGP authenticated POST requests for create,update,delete methods. Currently the API doesn't support this, so you have to use the REST interface to download objects and the MAIL interface to modify them if you don't want to use password authentication. A consistent user interface however, would be more reliable, easier to understand and maintain. Thanks in advance, Thomas von Dein -- Thomas von Dein <admins(a)f-i-ts.net> Finanz Informatik Technologie Service GmbH & Co. KG, OE 76052 Tel:089/94511-8833, Fax:089/94511-8941, http://www.f-i-ts.net

4 4

Progress on Number Work Items
by Tim Bruijnzeels 01 Nov '16

01 Nov '16

Dear working group, As usual at the beginning of every month, here is an overview of all open Numbered Work Items. Compared to last month we have seen 6 new messages on NWI-3 - in the RIPE 73 agenda thread. NWI-1 Staying on top of abuse contact changes State: Problem Definition 3 messages 3 participants last message: 27 June 16 NWI-2 Displaying history for database objects where available State: Problem Definition 10 messages 5 participants last message: 12 July 16 NWI-3 AFRINIC IRR homing State: Solution Definition 36 messages 11 participants last message: 27 October 16 NWI-4 Role of status: field in multivalued status context State: Problem Definition 4 messages 3 participants last message: 27 June 16 NWI-5 Out of region ROUTE(6) / AUT-NUM objects State: Problem Definition 3 messages 3 participants last message: 28 July 16 NWI-6 Applicable data model not clear from contextless objects State: Problem Definition 3 messages 3 participants last message: 28 June 16 The progress on numbered work items (NWIs) is also available on the web site: https://www.ripe.net/manage-ips-and-asns/db/numbered-work-items Regards, Tim Bruijnzeels Assistant Manager Software Engineering RIPE NCC Database Group

1 0

Release 1.88 deployed to RC
by Tim Bruijnzeels 31 Oct '16

31 Oct '16

Dear working group, We have released whois version 1.88 to the Release Candidate (RC) environment. We plan to deploy this version to production on Monday 10 October. This release contains a number of small improvements: - Users can now delete syntactically incorrect objects (before you would have to update the object before it could be deleted) - Users are now allowed to change the status if a resource object if it is NOT-SET This release also includes some minor fixes for infrequent bugs, and provides an API that can be used in a future release of the Webupdate User Interface that will allow users to set up rDNS for a prefix and create domain objects in bulk. We are currently working on the latter but expect to have this ready just after the RIPE Meeting. Kind regards Tim Bruijnzeels Assistant Manager Software Engineering RIPE NCC Database Group

4 5

Route object authentication for multiple inet(6)num
by fransossen＠yahoo.com 28 Oct '16

28 Oct '16

Hi, Following up on the AP policy WG discussion: https://www.ripe.net/ripe/mail/archives/address-policy-wg/2016-October/0119… If/when implemented it would eventually break up large contiguous inetnums with status ALLOCATED PI/UNSPECIFIED into smaller prefixes. As a consequence, route aggregation will be lost since when the parent inetnum is removed from the RIPE DB, the equivalent route will be removed as well. The current RIPE DB process and rules are not allowing for a /23 route to be created out of two /24s bit boundary contiguous prefixes registered as separate /24s without a common parent range. This is something that could be remedied by allowing a parent route to be created, the system could be rather easily implemented using the current DB rules layout. Existing inetnum objects in DB: inetnum: x.x.x.0/24 mnt-routes: ASXXXX-mnt mnt-by: prefix-holderA-mnt inetnum: x.x.y.0/24 mnt-routes: ASXXXX-mnt mnt-by: prefix-holderB-mnt Submission to the DB update: route: x.x.x.0/23 origin: AS-mnt mnt-by: ASXXXX-mnt authentication credentials for ASXXXX-mnt The DB would currently only look for an exact match and if none found, it will look for a less specific inetnum to authenticate the route creation. So today such an update would get rejected as you would not be able to authenticate whatever is above the /23. If it is changed to look for an exact match, then for more specifics with a matching summary to the route object prefix and then for a less specific, the creation of parent route would be allowed as part of the second step in the checks in the creation logic mechanism. It would not change the current authentication system logic, all will continue to work as it is today. Things to consider: A) Recall mechanism. To allow a prefix holders to recall a route object from a less specific route objects just like they today can with exact match and more specifics. Notifications could then be sent to the involved parties about the route recall having taken place. B) RIPE-NCC-RPSL-MNT! If the above mechanism was to be introduced, that maintainer could then create less specific route for any range, restrictions would need to be implemented in order to prevent mistakes or abuse of RIPE-NCC-RPSL-MNT. C) Adding this to the IRR wizard Alex Band described at the DB WG session. Simple interface and overview of what could be aggregated. D) Could any of this have any negative effect in the RIPE Database? E) Should this also be passed through the routing WG? Cheers, David Hilario

1 0

passwords
by ripedenis＠yahoo.co.uk 27 Oct '16

27 Oct '16

Hi Tim You just said that you can still use passwords with webupdates. I am looking at webupdates right now and I can't see any way to create or update an object using a password. You cannot get past the stage where it says "Login to create" or "Login to update". So where can I enter a password? cheersdenis

2 1