- db-wg - mailman.ripe.net

Update of mntner object with mixed authentication
by Alexander Gall 29 Aug '12

29 Aug '12

I'm trying to update the "shared" 6to4 anycast-relay maintainer object RFC3068-MNT. My own authentication for the object is PGP. But how the heck do I get a full copy of the object including the other people's MD5 hashes if I don't have a password myself? Puzzled, -- Alex

5 6

Deprecation of DOMAIN object attributes
by Denis Walker 21 Aug '12

21 Aug '12

[Apologies for duplicate emails] Dear Colleagues, At RIPE 62, the RIPE NCC was asked to look at the attributes in DOMAIN objects. A suggestion was put forward to deprecate the following attributes: mnt-lower: sub-dom: dom-net: refer: These were considered to be of no use after the removal of forward domain data and no longer allowing hierarchical, reverse delegation data. The RIPE NCC is now removing these attributes from the syntax. It will no longer be possible to create objects with these attributes. To modify objects already containing them, these attributes will need to be removed. As a follow up the RIPE NCC will "clean" the reverse delegation and ENUM DOMAIN object data to remove these attributes. The web forms for both updates and queries will also have these attributes removed. Regards, Denis Walker Business Analyst RIPE NCC Database Group

1 0

New delegation checking software
by Anand Buddhdev 08 Aug '12

08 Aug '12

[Apologies for duplicates] Dear colleagues, Tomorrow, 8 August 2012, the RIPE NCC will deploy a change to the RIPE Database update software. As part of this deployment, we will switch to a new DNS delegation checker, developed by .SE, the Swedish domain name registry. This change should not have any impact on the process of registering a reverse DNS delegation in the RIPE Database. However, the informational and diagnostic messages this software returns will look different from the ones you have been seeing so far. There should be no noticeable outage in any of the services during this deployment. There will be no change to any other parts of the RIPE Database update or query software with this deployment. Along with these changes to the back-end software, the RIPE NCC will also update the web-based delegation checker at: http://www.ripe.net/data-tools/dns This new web-based delegation checker will use the same software as the back-end. We will send another announcement after we have deployed this new software. If you have any questions or comments, please send an email to <dns(a)ripe.net>. Regards, Anand Buddhdev RIPE NCC

1 1

Support for SHA256 in ds-rdata checker
by Alexander Gall 02 Aug '12

02 Aug '12

I'm not sure whether this belongs here or in the dns-wg (or somewhere else?). I just updated the ds-rdata of one of our domain objects and realized that the RDNS checker does not support SHA-256, neither for the DS record nor as part of signature algorithm 8 (RSASHA256) ***RDNS: (related to set) INFO: 6199 8 2 03A50B02CC5FCBCC8071AD93212C923E8C399DE64AE7C042442E2DE2F0029592 ; uses a Digest type that is not implemented by this checker. We cannot verify if the chain of trust is intact. You should be conciously using digest types other than SHA1 ***RDNS: (related to ns2.switch.ch) INFO: The signature over DNSKEY is made with algorithm code 8 The checker does not implement this algorithm and can therefore not validate the chain of trust It is assumed that using algoritm type 8 is a conscious choice. SHA256 has been in use for both purposes for a number of years. Are there any plans to support it in the RDNS checker? Regards, Alex -- SWITCH Serving Swiss Universities -------------------------- Alexander Gall, Global LAN Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland phone +41 44 268 15 15, direct +41 44 268 15 22 alexander.gall(a)switch.ch, http://www.switch.ch

2 2

Syntax of the "nserver:" Attribute in Domain Objects
by Anand Buddhdev 27 Jul '12

27 Jul '12

[Apologies for duplicate emails] Dear colleagues, Following on from the removal of the forward DOMAIN objects from the RIPE Database, all DOMAIN objects are now used for either reverse DNS or ENUM delegations. For both these cases, the "nserver:" attribute is required. Currently this attribute is optional and there are many objects in the RIPE Database that do not have any "nserver:" attributes. These objects are ignored by the DNS provisioning service, because they have no operational value. The RIPE NCC proposes to make the "nserver:" attribute mandatory in DOMAIN objects and delete any objects from the RIPE Database that do not have this attribute. To simplify the parsing of DOMAIN objects, the RIPE NCC also proposes to deprecate the list option on the "nserver:" attribute (a list, when used in combination with end-of-line comments and continuation lines, is very complex to parse). This means adding multiple name servers to a single attribute will no longer be allowed. For example, an attribute currently formatted as: nserver: ns1.example.com ns2.example.net will have to be rewritten as: nserver: ns1.example.com nserver: ns2.example.net If glue records are required, they would be written like this: nserver: ns1.2.0.192.in-addr.arpa 192.0.2.1 nserver: ns1.2.0.192.in-addr.arpa 2001:db8::1 nserver: ns2.2.0.192.in-addr.arpa 192.0.2.2 nserver: ns2.2.0.192.in-addr.arpa 2001:db8::2 There are a number of domain objects in the RIPE Database which use the list feature, and list multiple name servers in a single "nserver:" attribute. As part of this syntax change, we would update these objects to use the new syntax. This would not affect DNS delegation in any way. This message has been sent to both the DNS and Database working groups, but we ask that discussion of this matter be kept on the DNS WG mailing list. Regards, Anand Buddhdev RIPE NCC

1 0

heads-up for the RIPE65 schedule, September 2012
by Wilfried Woeber, UniVie/ACOnet 06 Jul '12

06 Jul '12

Dear friends of the DB-WG, just as an early heads-up and "warning", according to the (draft) meeting plan for the September meeting in Amsterdam, https://ripe65.ripe.net/programme/meeting-plan/ the DB-WG meeting slot will be on *Wednesday morning*! This is a deviation from the usual scheduling for our WG in the past, which regularly placed our slot into Thurday or Friday (morning). Best regards, Wilfried.

1 0

Deprecation of DBConstat service
by Denis Walker 06 Jul '12

06 Jul '12

Dear colleagues, The RIPE NCC has carried out a thorough review of DBConstat, a service to check consistency of data in the RIPE Database and produce statistics. It was written over ten years ago and has changed little over that period. The current software is unmaintainable now. The results of this review are published on RIPE Labs: https://labs.ripe.net/Members/denis/review-of-dbconstat The review showed that this service produces a series of almost flat line graphs and provides an interactive service barely used by anyone and resulting in no significant improvement in data quality in the RIPE Database. The RIPE NCC believes this is not the way to address the few outstanding inconsistencies reported by this service. We therefore intend to deprecate this service, then investigate and address the remaining inconsistencies using other methods, as discussed in the article on RIPE Labs. If anyone has any concerns about this service, please reply to the mailing list within the next two weeks. Regards, Denis Walker Business Analyst RIPE NCC Database Group

2 2

Database Updates service recovery
by Kaveh Ranjbar 03 Jul '12

03 Jul '12

Dear Colleagues, The issues with our RIPE Database update services is resolved. All mail sent during the downtime is now processed and sync updates, web updates and API updates are back to normal. If you experience any problems, please contact ripe-dbm(a)ripe.net. The update service was down between 07:58 CET (05:58 UTC) until 9:55 CET (07:55 UTC) due to hardware issues. Further details on this issue will be posted to RIPE Database Working Group mailing list at db-wg(a)ripe.net. Kind Regards, Kaveh Ranjbar RIPE NCC Database Group Manager

2 1

Database Updates service disruptions
by Kaveh Ranjbar 30 Jun '12

30 Jun '12

Dear Colleagues, RIPE Database sync updates, web-updates and API updates are not responding at the moment. We are dealing with hardware problems on the machines used for the database update cluster. The service was affected from from 07:58 CET (05:58 UTC) and we are working to recover it as soon as possible. Queries will keep working and updates via emails are queued and will be processed as soon as the service is up. We will send an update message as soon as the service is up or when we have an estimate on how long it takes to fix the problem. Kind Regards, Kaveh Ranjbar RIPE NCC Database Group Manager

1 0

MD5 Hashes in the RIPE Database
by Denis Walker 23 May '12

23 May '12

Dear colleagues, It was clear from the discussions at RIPE 64 that we need to change the initial implementation of hiding the hashes for MD5 passwords in MNTNER objects. A suggestion was made to keep the "auth:" attributes in place. If the authentication token is an MD5 password we will remove the hash value. All PGP and X.509 values will remain unchanged. We have already worked on this and a sample MNTNER object would look like the object below. We can deploy this change within the next two weeks. Regards, Denis Walker Business Analyst RIPE NCC Database Group $whois -B DEV-ROOT-MNT % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf [Open URL] % Information related to 'DEV-ROOT-MNT' mntner: DEV-ROOT-MNT descr: Mntner for DEV-DBM-MNT admin-c: AA1-DEV tech-c: AA2-DEV upd-to: bitbucket(a)ripe.net mnt-nfy: bitbucket(a)ripe.net auth: MD5-PW # Filtered auth: PGPKEY-1290F9D2 notify: bitbucket(a)ripe.net mnt-by: DEV-ROOT-MNT referral-by: DEV-ROOT-MNT remarks: This is an automatically created object. changed: bitbucket(a)ripe.net 20051031 source: DEV # Filtered role: DEV ROLE nic-hdl: AA2-DEV address: Somewhere in nowhere phone: +12 34 567 8900 fax-no: +12 34 567 8900 e-mail: bitbucket(a)ripe.net abuse-mailbox: bitbucket(a)ripe.net admin-c: AA1-DEV tech-c: AA2-DEV mnt-by: DEV-ROOT-MNT remarks: This is an automatically created object. changed: bitbucket(a)ripe.net 20051031 source: DEV person: Test Person mnt-by: DEV-ROOT-MNT address: Somewhere in nowhere phone: +12 34 5678900 fax-no: +12 34 5678900 e-mail: bitbucket(a)ripe.net nic-hdl: AA1-DEV remarks: This is an automatically created object. changed: bitbucket(a)ripe.net 20051031 source: DEV % This query was served by the RIPE Database Query Service version 1.9-SNAPSHOT (UNDEFINED)

8 8