- ncc-services-wg - mailman.ripe.net

RIPE NCC Network Maintenance Wednesday 23 May 1700 - 1900 UTC/GMT - COMPLETED
by Mark Guz 24 May '07

24 May '07

Dear Colleagues, The above mentioned maintenance was preformed successfully and within the specified maintenance window. If you have any questions about this, please e-mail ops(a)ripe.net Regards Mark Guz Senior Engineer Operations Dept RIPE NCC

1 0

RIPE NCC Network Maintenance Wednesday 23 May 1700 - 1900 UTC/GMT
by Mark Guz 21 May '07

21 May '07

Dear Colleagues, Between 17:00 and 19:00 (UTC) on Wednesday, 23 May 2007, the RIPE NCC will carry out planned maintenance work on our core network infrastructure. During this period all RIPE NCC services will suffer intermittent interruptions We apologise for any inconvenience that this may cause. If you have any questions about this, please e-mail ops(a)ripe.net Regards Mark Guz Senior Engineer Operations Dept RIPE NCC

1 0

Re: [enum-wg] DNSMON for enum zones
by Ondřej Surý 11 May '07

11 May '07

Ccing to ncc-services-wg. Short summary: Discussion started on enum-wg whether DNSMON service should be extended to ENUM registry operators as well. Patrik summarized discussion so far in several points in mail I am replying at. You can find start of the thread at: http://www.ripe.net/ripe/maillists/archives/enum-wg/2007/msg00024.html Patrik Fältström píše v Čt 10. 05. 2007 v 15:08 +0300: > I see a number of different questions being discussed here, and I > think we should try to separate them: > > 1. RIPE NCC is running DNS for e164.arpa > 2. RIPE NCC should "protect their skin" and monitor the e164.arpa > zone, so they can show their service is up to current standards Shouldn't RIPE NCC do the same for all its delegations. I would broaden scope of this point to monitoring reverse delegations as well. > 3. Registry operators run DNS for zones delegated from e164.arpa, and > the delegation itself should be of some quality for ENUM to work -- > who has responsible for this? I think that responsibility lies in registry operators hands, but NCC should do monitoring and step-in if quality is too low. I don't have idea right now what "step-in" and "quality is too low" definition is. > 4. Registry operators have interest in being monitored, should they > be monitored, or (via opt-in) on request? You probably already know my opinion on that point :-), but together with previous points it gets more complicated. If answer to 2 and 3 is YES, then I think that they should be monitored and on opt-in request they could receive results/warnings/etc. Without opt-in it would be only from RIPE NCC internal needs. > 5. If there is a need for monitoring of DNS operation, is RIPE-NCC to > do that monitoring (they already do in the case of dnsmon)? Let's put another POV in play. If DNSMON was outsourced to let's say commercial service, who will ensure quality of such monitoring? I don't think that niche in this market is so big, that it will self-regulate, because of competition. Then there would be need to _monitor_ monitoring to ensure 2 and 3. Ondrej -- Ondřej Surý technický ředitel/Chief Technical Officer ----------------------------------------- CZ.NIC, z.s.p.o. -- .cz domain registry Americká 23,120 00 Praha 2,Czech Republic mailto:ondrej.sury@nic.cz http://nic.cz/ sip:ondrej.sury@nic.cz tel:+420.222745110 mob:+420.739013699 fax:+420.222745112 -----------------------------------------

1 0

New E-Learning Module: Using PGP and X509 to Protect MNTNER Objects
by Rumy Kanis 03 May '07

03 May '07

Dear Colleagues, We are pleased to announce the launch of the latest module on the RIPE NCC E-Learning Centre: - Using PGP Keys and X509 Certificates in MNTNER objects This module explains the steps required to use a PGP Key and/or X509 Certificate to protect objects in the RIPE Database. The module provides step-by-step guidelines for: - Creating a KEY-CERT object - Adding the KEY-CERT object to an existing MNTNER object as a method of authentication - Updating an object protected by that MNTNER using the PGP key or X509 certificate The RIPE NCC E-Learning Centre is a free of charge service available to everyone, and can be found at https://e-learning.ripe.net. If you have any questions, please feel free to contact us at: e-learning(a)ripe.net Happy Learning, Rumy Kanis Training Services Manager

1 0

RIPE Database update problem
by Denis Walker 26 Apr '07

26 Apr '07

[Apologies for duplicate e-mails] Dear Colleagues, >From 21:30 (UTC) on 24 April 2007 until 10:20 (UTC) on 26 April 2007, e-mail updates sent by users to the RIPE Database update service were not processed by the RIPE Database. This problem has now been resolved. ALL the updates submitted have now been processed. No updates were lost. We apologise for this problem with the RIPE Database update service. This was caused by some network adjustments affecting our firewall and mail servers. It had no effect on updates submitted using syncupdates or webupdates, or changes made using the LIR Portal interface. Any changes made by the RIPE NCC Registration Services Department on behalf of RIPE NCC members were also unaffected. We would like to thank all our users for their patience while we fixed this problem. Regards Denis Walker Database Group RIPE NCC

1 0

Cleanup of unreferenced person objects
by Denis Walker 23 Apr '07

23 Apr '07

Hi There has been some useful feedback already on this proposal. Perhaps I need to clarify some points and suggest some changes to the proposal. We have always wanted to keep the database as clean as possible. So whilst half a million extra person objects has no effect on the operation, we prefer them not to be there if they are serving no useful purpose. We have also been looking more closely at Data Protection issues recently. We have a number of points to discus with the Data Protection Task Force. But the bottom line is, we have to define the purpose(s) of the RIPE Database. We are only allowed to keep personal data in the database if it fits the defined purpose. Although we are only at the stage of drafting these definitions, it is difficult to see how unreferenced person objects could fit any definition that we finally agree on. As for e-mails, I have discussed the numbers with our IT operations guys. They are confident we can handle the worst case scenario with our mail servers. So I suggest we process the deletions with the normal notification procedure where e-mails are sent to any "notify:" addresses in the person objects and to the maintainers if maintained. We will use a modified notification text for this purpose. It will refer to a web page that explains why these person objects are being deleted. Regarding the issue of temporary unreferenced person objects. For example when someone is moving to a new company and de-references their person object from the old companies data and intends to reference it with the new companies data. The proposal allows for a (minimum) one month waiting period before deletion. It could be up to two months, depending on when it is de-referenced. If there is a feeling that this needs to be a longer period it can be extended. I hope this addresses the issues so far raised. Regards Denis Walker Database Group RIPE NCC

1 0

Clean up of unreferenced person/role objects
by Denis Walker 23 Apr '07

23 Apr '07

Introduction ------------ According to our database consistency statistics program (dbconstat [1]) we currently have 460,573 unreferenced person/role objects [2]. Some of these may be maintained, but are still unreferenced. Any personal data not referenced by Internet resources do not fit within the purpose of the RIPE Database. They should not be stored in the RIPE Database beyond a reasonable 'work in progress' period. The RIPE NCC has had a mandate to delete these unreferenced person/role objects since RIPE 40: http://www.ripe.net/ripe/wg/db/minutes/ripe-40.html (2001) At RIPE 41, the Database Working Group agreed that "maintained objects will now be removed" and "gave a mandate to the RIPE NCC to continue with the cleanup process." http://www.ripe.net/ripe/wg/db/minutes/ripe-41.html (2002) The cleanup process of 2003 (http://www.ripe.net/db/news/unref-cleanup-200304.html) involved using a script to run periodic cleanups. This script was put in place. However, it failed about 18 months ago. Because of other priorities, we have not had the time to examine this issue again until now. The graph showing the increase in these unreferenced person objects [3] indicates that the cleanup script appeared not to be performing correctly. At the start of 2006, there were about 300,000 unreferenced person/role objects. Since then there has been a steady increase with a large increase of almost 50,000 in February 2007. The graph also shows a slightly higher rate of increases in these objects since February 2007. Because of the high number now of unreferenced person objects, we want to raise the issue with the community again and propose the below procedure to clean them up. Because redundant personal data is a serious data protection issue, we want to take a new approach to this in the future. Once the initial cleanup is in progress, we will create a new proposal for a new, regular cleanup procedure. This will be sent to the Data Protection Task Force [4] and then to the rest of the community. One time bulk cleanup procedure ------------------------------- Month 1 * Select 80,000 unreferenced person/role objects. Month 2 * Check selected person/role objects. * Those still unreferenced: o Delete using normal update process. o 2000 objects per update message. o Run updates overnight (Saturday/Sunday). o One update every 15 minutes. o This should avoid any unnecessary load on the servers. * Select next 80,000 unreferenced person/role objects. Month 3 * Repeat process until complete. Notes ----- This procedure will take about 6 months to clear the current backlog, not including the extra time that may be necessary due to the increases over that period. Because of the high numbers involved, we prefer NOT to send out individual e-mail notifications, either before or after deletion. This is to prevent a high load on our mail servers, especially in the event of a high number of bounced e-mails. This means that there will be no individual announcements to listed e-mail addresses before the deletion and none of the usual update notifications. This also means that even if the objects are maintained, the maintainer will not be notified directly about the deletion of their unreferenced person/role object. We will, however, announce the cleanup to the Working Group mailing lists and as a news item on our web site home page. The worst problem that can occur is that someone will enter a reference to their person/role object just as we delete it. However, as we are only deleting unreferenced person/role objects, the time needed to re-create them is minimal. We suspect that a very large proportion of the unreferenced person/role objects that we will be deleting are abandoned objects that are no longer used. References ---------- [1] dbconstat http://www.ripe.net/projects/dbconstat/index.html [2] current unreferenced person/role objects http://www.ripe.net/projects/dbconstat/html/cons-current.html [3] graph of unreferenced person object increase http://www.ripe.net/projects/dbconstat/cons-unrefpero.html [4] Data Protection Task Force http://www.ripe.net/ripe/tf/dp/index.html

9 15

Updated RIPE Database Manuals
by Denis Walker 17 Apr '07

17 Apr '07

[apologies for duplicates] Dear Colleagues, We are pleased to announce the publication of three updated RIPE Database Documents. ripe-401 RIPE Database Query Reference Manual ripe-402 RIPE Database User Manual: Getting Started DRAFT RIPE Database Update Reference Manual Previously, the Query and Update Reference Manuals were part of ripe-252, The RIPE Database Reference Manual. The content has been thoroughly revised and updated, and we have also improved the wording to make it clearer. The Update Reference Manual also contains a lot of new content, reflecting many of the changes made to the database software over recent years. Because it is so long since this manual has been revised, the list of changes is considerable. It has not been possible to reflect all these changes in the first revision. This is why it is only released as a draft document at this stage. A second revision will take place after the RIPE 54 Meeting. Together, the Query Reference Manual and Update Reference Manual (currently in draft format) will completely obsolete ripe-252. You can find ripe-401 and ripe-402 at: http://www.ripe.net/ripe/docs/database.html The draft of the RIPE Database Update Reference Manual is available at: http://www.ripe.net/ripe/draft-documents/draft_db_manual.pdf Regards Denis Walker Database Group RIPE NCC

1 0

RIPE NCC Maintenance Wednesday 18/04/2007 http://e-learning.ripe.net 1700 UTC
by Mark Guz 16 Apr '07

16 Apr '07

Dear Colleagues, On Wednesday 18/04/07 between 17:00 and 19:00 UTC we will be renumbering the website http://e-learning.ripe.net. This will result in a small outage during the posted maintenance window while the new IP address filters through DNS. We apologise for any inconvenience this might cause. As usual, if you have any questions please forward them to ops(a)ripe.net Regards Mark Guz Senior Engineer OPS/IT Department RIPE NCC http://www.ripe.net

1 0

RIPE 54 Agenda Items for NCC Services WG
by Sanghani, Bijal 12 Apr '07

12 Apr '07

Hi all, We are currently compiling the draft agenda for the RIPE NCC Services Working Group for RIPE 54 in Tallinn. If anyone would like to suggest a presentation or raise a topic for discussion please let either Kurtis or me know and we'll arrange a spot on the agenda. Regards, Bijal ********************************************************************** This e-mail message is confidential and is intended only for the use of the individual or entity named above and contains information which is or may be confidential, non-public or legally privileged. Any dissemination or distribution of this message other than to its intended recipient is strictly prohibited. You should not copy it or use it for any purpose nor disclose the contents to any other person. If you have received this message in error, please notify us by email to postmaster(a)flagtelecom.com immediately and delete the original message and all copies from all locations in your computer systems. This e-mail has been swept by Mailsweeper TM for viruses. However, FLAG Telecom cannot accept liability for any damage which you may sustain as a result of software viruses. ********************************************************************** This message has been scanned for viruses by MailControl - www.mailcontrol.com

1 0