- ncc-services-wg - mailman.ripe.net

Call for presenations
by Kurt Erik Lindqvist 03 Dec '03

03 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 All, this is the call for presentations for the RIPE NCC-Services Working Group at the RIPE-47 meeting in Amsterdam. Best regards, - - kurtis - -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.2 iQA/AwUBP83ERKarNKXTPFCVEQL8+QCg86NANB9k1T4jIRrD+Y+qT5WX5f4AnA4b yBoWcg0Xodim/eC0OR0vMwsq =dFVW -----END PGP SIGNATURE-----

1 0

Maintenance on RIPE Whois Server, 28 November 2003
by DB-News 27 Nov '03

27 Nov '03

Dear Colleagues, [apologies for duplicate messages] Tomorrow, 28 November 2003, we need to perform a maintenance work on the RIPE Whois Server for hardware replacement. During the maintenance work, - Whois Database updates will be stopped, - all update mails to auto-dbm(a)ripe.net will be queued to be processed later, - Webupdate and syncupdate interfaces will be unavailable, - The whois queries will _not_ be interrupted. The maintenance work will start at 07:00 UTC (08:00 Amsterdam time) on 28 November 2003, Friday, and expected to last 2 to 3 hours. We apologise for the inconvenience caused, and we are sorry for the short notice. Please do not hesitate to contact ripe-dbm(a)ripe.net for any questions. Best regards, -- Engin Gunduz Software Engineering Department RIPE NCC

1 0

Final Reminder - RIPE NCC Dubai Meeting, Dec. 2003
by Membership Liason Officer 24 Nov '03

24 Nov '03

[Apologies for duplicate mails] Dear Colleagues, The RIPE NCC Regional Meeting, Middle East, will be held 7 - 9 December 2003 at the Taj Palace Hotel, Dubai, U.A.E. The meeting will focus on Internet resource management issues. Attendance to the RIPE NCC Regional Meeting is free of charge. However, attendees are responsible for covering their own travel and accommodation costs. AGENDA The agenda has been recently updated with more information about speakers and presentations. For the full agenda, please see: http://www.ripe.net/ripencc/regional-meetings/dubai-2003/plan.html REGISTRATION To register for the RIPE NCC Regional Meeting, Middle East, please see: http://www.ripe.net/cgi-bin/dubai-reg HOTEL RESERVATIONS: The RIPE NCC has arranged for a block of rooms to be held for meeting attendees at the Metropolitan Palace Hotel and the Metropolitan Hotel Sheikh Zayed Road, Dubai. There are a limited number of rooms available. Please note that rooms will be held only until 25 November 2003. After this date we cannot guarantee room availability. To reserve a room directly with the hotel, please use the reservation forms at: http://www.ripe.net/ripencc/regional-meetings/dubai-2003/hotel-information.… Any further questions about the RIPE NCC Regional Meeting, Middle East, can be sent directly to: <contact(a)ripe.net>. Regards, Sabrina Wilmot Membership Liaison Officer RIPE NCC

1 0

new autohm?
by Joerg Schumacher 14 Nov '03

14 Nov '03

Hi! In order to comply with the IPv4 address allocation and assignment policies we pass each and every address request to our local copy of the auto-hm email-robot. Gives us nice automatic record keeping and avoids silly miscalculations in the addressing plan. The latest version is AFAIK available as ftp://ftp.ripe.net/tools/autohm.1.25.tar.gz Unfortunately this version doesn't know how to handle ripe-283 forms. The "RIPE NCC Tools for Members" page http://www.ripe.net/ripencc/mem-services/tools/ lists the same version. Before we start to modify our local copy: Any plans at RIPE NCC to provide an updated version? Thanks in advance, Joerg -- Gaertner Datensysteme 38114 Braunschweig Joerg Schumacher Hamburger Str. 273a Tel: 0531-2335555 Fax: 0531-2335556

4 3

Planned Downtime for LIR Portal Service
by Shane Kerr 13 Nov '03

13 Nov '03

Dear Colleagues, On Saturday, 15th November, between 10:00 and 14:00 CET, there will be a temporary power outage affecting the RIPE NCC LIR Portal. During this period the LIR Portal will be unavailable. It is possible that other services may experience time delays, but it is expected that they will be largely unaffected. We apologise for any inconvenience that this downtime may cause to your operations. Regards, -- Shane Kerr RIPE NCC

1 0

[db-wg] Novel NetMail users (fwd)
by Denis Walker 11 Nov '03

11 Nov '03

------- Forwarded Message Date: Mon, 10 Nov 2003 17:29:14 +0100 From: Denis Walker <denis(a)ripe.net> Sender: db-wg-admin(a)ripe.net To: db-wg(a)ripe.net cc: ncc-services-wg(a)ripe.ne Subject: [db-wg] Novel NetMail users Dear Colleagues, In the process of testing mail clients for s/mime compatibility I am trying to install Novell NetMail on our linux test box running RedHat 8.0. I have no previous knowledge at all about this product. I have tried several times to install it and can never get past a window asking for the Administrator user name and password. I have included the log of what I did below. Any help from users of this mail client would be very much appreciated. Regards Denis Walker RIPE NCC Software Engineering Department. [root@linux setup]# ./nds-install %% Welcome to the installation of Novell eDirectory 8.7.0 %% The Novell eDirectory (8.7.0) for Linux End User License Agreement will now be displayed. %% Please read the agreement carefully before accepting the terms. %% Press ENTER to continue. %% Do you accept the terms of the Novell eDirectory (8.7.0) license agreement '[y/n/q] ? 'y %% List of Novell eDirectory (8.7.0) components available to install %% 1 Novell eDirectory Server %% 2 Novell eDirectory Administration Utilities %% 3 Management Console for Novell eDirectory (ConsoleOne) %% Select the components you wish to install [?, q] : 1,2,3 %% Enter the path to License File (.nfk): /var %% License file Copied. %% Adding packages... Preparing... ########################################### [100%] 1:NDSmasv ########################################### [100%] Preparing... ########################################### [100%] 1:NDSbase ########################################### [100%] Preparing... ########################################### [100%] 1:NLDAPsdk ########################################### [100%] Preparing... ########################################### [100%] 1:NLDAPbase ########################################### [100%] Preparing... ########################################### [100%] 1:NDScommon ########################################### [100%] Preparing... ########################################### [100%] 1:NOVLpkis ########################################### [100%] Preparing... ########################################### [100%] 1:NOVLpkia ########################################### [100%] Preparing... ########################################### [100%] 1:NOVLpkit ########################################### [100%] Preparing... ########################################### [100%] 1:NOVLsas ########################################### [100%] Preparing... ########################################### [100%] 1:ntls ########################################### [100%] Preparing... ########################################### [100%] 1:NDSserv ########################################### [100%] Preparing... ########################################### [100%] 1:NDSrepair ########################################### [100%] Preparing... ########################################### [100%] 1:NDSimon ########################################### [100%] Preparing... ########################################### [100%] 1:NOVLsnmp ########################################### [100%] Preparing... ########################################### [100%] 1:NOVLsubag ########################################### [100%] Preparing... ########################################### [100%] 1:NOVLnmas ########################################### [100%] Preparing... ########################################### [100%] 1:NOVLembox ########################################### [100%] Preparing... ########################################### [100%] 1:NOVLlmgnt ########################################### [100%] Preparing... ########################################### [100%] 1:NOVLstlog ########################################### [100%] Preparing... ########################################### [100%] 1:NOVLxis ########################################### [100%] Preparing... ########################################### [100%] 1:NOVLice ########################################### [100%] Preparing... ########################################### [100%] 1:NDSdxevnt ########################################### [100%] %% Installing ConsoleOne.... The following is a list of languages that are available to install. 1 English 2 French 3 All Select the languages you wish to install [?,q]: 1 The following are all the available snapins you can choose to install 0 NONE 1 ICE Snapin 2 Index Manager Snapin 3 LDAP Snapin 4 SLP Snapin 5 WAN Manager Snapin 6 PKI Snapin 7 Filtered Replica Snapin 8 All Select the snapin(s) you wish to install [?,q]: 8 Do you wish to install Java Runtime Environment [y,n,q] ? y OpenSLP rpm " openslp-1.0.11-0.fdr.6.rh80 " is already installed. NDSslp will not be installed. %% Adding package IBMJava2-JRE ... Preparing... ########################################### [100%] 1:IBMJava2-JRE ########################################### [100%] %% NDSbase package is already installed. %% NDScommon package is already installed. %% NLDAPsdk package is already installed. %% NLDAPbase package is already installed. %% NOVLxis package is already installed. %% NOVLlmgnt package is already installed. %% NOVLice package is already installed. %% NOVLsas package is already installed. %% NOVLpkia package is already installed. %% NOVLpkis package is already installed. %% Adding package NOVLc1 ... error: Failed dependencies: NDSslp is needed by NOVLc1-1.3.4-1 %% ERROR: Failed to add NOVLc1 (NOVLc1) package. %% Installation of packages failed, not all packages were installed. ucd-snmp package is not installed on your system. Please ensure that you install this package before using any SNMP related features of Novell eDirectory (8.7.0) . Please refer to the admin_guide.pdf for more details. %% Novell eDirectory Server packages successfully installed. %% Novell eDirectory Administration Utilities packages successfully installed. %% Use "ndsconfig" to configure Novell eDirectory Server. %% Please update following environment variables to use LDAP tools from Novell - - PATH=/usr/ldaptools/bin:$PATH MANPATH=/usr/ldaptools/man:$MANPATH %% Please go through ../readme.txt carefully before using the product. [root@linux setup]# [root@linux setup]# rpm -i /home/test-receiver/novel/Linux/ConsoleOne/NDSslp-8. 7.0-1.i386.rpm Starting NDS SLP services... Done [root@linux setup]# ./nds-install %% Welcome to the installation of Novell eDirectory 8.7.0 %% The Novell eDirectory (8.7.0) for Linux End User License Agreement will now be displayed. %% Please read the agreement carefully before accepting the terms. %% Press ENTER to continue. %% Do you accept the terms of the Novell eDirectory (8.7.0) license agreement '[y/n/q] ? 'y %% List of Novell eDirectory (8.7.0) components available to install %% 1 Novell eDirectory Server %% 2 Novell eDirectory Administration Utilities %% 3 Management Console for Novell eDirectory (ConsoleOne) %% Select the components you wish to install [?, q] : 1,2,3 %% Enter the path to License File (.nfk): /var %% License file Copied. %% Adding packages... NDSmasv is already installed NDSbase is already installed NLDAPsdk is already installed NLDAPbase is already installed NDScommon is already installed NOVLpkis is already installed NOVLpkia is already installed NOVLpkit is already installed NOVLsas is already installed ntls is already installed NDSserv is already installed NDSrepair is already installed NDSimon is already installed NOVLsnmp is already installed NOVLsubag is already installed NOVLnmas is already installed NOVLembox is already installed NOVLlmgnt is already installed NOVLstlog is already installed NOVLxis is already installed NOVLice is already installed NDSdxevnt is already installed %% Installing ConsoleOne.... The following is a list of languages that are available to install. 1 English 2 French 3 All Select the languages you wish to install [?,q]: 1 The following are all the available snapins you can choose to install 0 NONE 1 ICE Snapin 2 Index Manager Snapin 3 LDAP Snapin 4 SLP Snapin 5 WAN Manager Snapin 6 PKI Snapin 7 Filtered Replica Snapin 8 All Select the snapin(s) you wish to install [?,q]: 8 OpenSLP rpm " openslp-1.0.11-0.fdr.6.rh80 " is already installed. NDSslp will not be installed. %% NDSbase package is already installed. %% NDScommon package is already installed. %% NLDAPsdk package is already installed. %% NLDAPbase package is already installed. %% NOVLxis package is already installed. %% NOVLlmgnt package is already installed. %% NOVLice package is already installed. %% NOVLsas package is already installed. %% NOVLpkia package is already installed. %% NOVLpkis package is already installed. %% Adding package NOVLc1 ... Preparing... ########################################### [100%] 1:NOVLc1 ########################################### [100%] %% Adding package NDSsice ... Preparing... ########################################### [100%] 1:NDSsice ########################################### [100%] %% Adding package NDSsimgr ... Preparing... ########################################### [100%] 1:NDSsimgr ########################################### [100%] %% Adding package NDSsldap ... Preparing... ########################################### [100%] 1:NDSsldap ########################################### [100%] %% Adding package NDSsslp ... Preparing... ########################################### [100%] 1:NDSsslp ########################################### [100%] %% Adding package NDSswan ... Preparing... ########################################### [100%] 1:NDSswan ########################################### [100%] %% Adding package NDSspki ... Preparing... ########################################### [100%] 1:NDSspki ########################################### [100%] %% Adding package NDSsfrep ... Preparing... ########################################### [100%] 1:NDSsfrep ########################################### [100%] %% ConsoleOne Successfully Installed. %% Execute /usr/ConsoleOne/bin/ConsoleOne to run ConsoleOne %% Snapins Successfully Installed. ucd-snmp package is not installed on your system. Please ensure that you install this package before using any SNMP related features of Novell eDirectory (8.7.0) . Please refer to the admin_guide.pdf for more details. %% Novell eDirectory Server packages successfully installed. %% Novell eDirectory Administration Utilities packages successfully installed. %% Use "ndsconfig" to configure Novell eDirectory Server. %% Please update following environment variables to use LDAP tools from Novell - - PATH=/usr/ldaptools/bin:$PATH MANPATH=/usr/ldaptools/man:$MANPATH %% Please go through ../readme.txt carefully before using the product. [root@linux setup]# ndsconfig new -t DW_TREE -o 80 -O 443 -a admin.DW Enter the password for admin.DW: Re-enter the password for admin.DW: Enter server context[org]:dw Starting the service 'ndsd'... Done. Configuring eDirectory with following parameters Admin name = admin.DW Tree name = DW_TREE Server Context = dw dibdir path = /var/nds/dib Searching for Duplicate Tree Name in the network. Please wait... Installing Novell eDirectory Server ... Novell eDirectory Server successfully installed on this system. Extending schema... For more details view schema extension logfile: /var/nds/schema.log Schema extended successfully. Configuring SAS service ... Successfully configured SAS service Nov 10 16:56:22 Could not set the preferred server LINUX Configuring LDAP Server with default SSL CertificateDNS certificate Done Restarting ndsd to load the tree key Stopping the service 'ndsd'... Done. Starting the service 'ndsd'... Done. [root@linux setup]# ps -ef | grep ndsd root 27255 1 0 16:53 ? 00:00:00 /usr/sbin/ndsd root 27257 1 0 16:53 ? 00:00:00 /usr/sbin/ndsd root 27258 1 0 16:53 ? 00:00:00 /usr/sbin/ndsd root 27259 1 0 16:53 ? 00:00:00 /usr/sbin/ndsd root 27260 1 9 16:53 ? 00:00:30 /usr/sbin/ndsd root 27261 1 0 16:53 ? 00:00:00 /usr/sbin/ndsd root 27262 1 0 16:53 ? 00:00:00 /usr/sbin/ndsd root 27263 1 0 16:53 ? 00:00:00 /usr/sbin/ndsd root 27264 1 0 16:53 ? 00:00:00 /usr/sbin/ndsd root 27265 1 0 16:53 ? 00:00:00 /usr/sbin/ndsd root 27266 1 0 16:53 ? 00:00:00 /usr/sbin/ndsd root 27267 1 0 16:53 ? 00:00:00 /usr/sbin/ndsd root 27268 1 0 16:53 ? 00:00:00 /usr/sbin/ndsd root 27269 1 0 16:53 ? 00:00:00 /usr/sbin/ndsd root 27270 1 0 16:53 ? 00:00:00 /usr/sbin/ndsd root 27272 1 10 16:53 ? 00:00:32 /usr/sbin/ndsd root 27273 1 0 16:53 ? 00:00:00 /usr/sbin/ndsd root 27275 1 0 16:53 ? 00:00:00 /usr/sbin/ndsd root 27277 1 0 16:53 ? 00:00:00 /usr/sbin/ndsd root 27278 1 0 16:53 ? 00:00:00 /usr/sbin/ndsd root 27279 1 0 16:53 ? 00:00:00 /usr/sbin/ndsd root 27314 1 0 16:54 ? 00:00:00 /usr/sbin/ndsd root 27315 1 0 16:54 ? 00:00:00 /usr/sbin/ndsd root 27430 7667 0 16:58 pts/0 00:00:00 grep ndsd [root@linux novel]# ./pinstall.lin To accept this license agreement, please enter 'Y': y Pervasive not found. Installing it now! Pervasive SQL server 2000 installed. Now installing NetMail 3.1. Please wait while nimsext loads Nov 10 17:04:39 Could not set the preferred server LINUX At this point it asks me to: ************************************************************** Login as the administrator Administrator name: Password: ************************************************************** I enter the user name admin.DW and password that I thought I had set up with the ndsconfig and I get ************************************************************** Login failed, try again? -Yes No ************************************************************** I do not have any other user name and password for an administrator. I tried entering the root password for the linux system and that did not work either. If I select No then it goes into a loop as below and I have to kill it. Assigning Pervasive rights Your installation is now complete. Thank you for using NetMail 3.1! The NetMail team. Starting NetMail Starting NetMail: [root@linux novel]# Nov 10 17:12:56 Could not set the preferred server LINUX DDB: Logged in with 'Public' identity. Functionality may be limited. (This message is OK if the schema has not been extended yet) [root@linux novel]# No agents configured Module rBåÿ¿sZBrB¬åÿ¿Äq(@Pæÿ¿ýÿÿÌåÿ¿"q'@ýÿÿÜåÿ¿oq'@lÞ @ýÿÿ æÿ¿oq'@lÞ @ died. Restarting. Starting: rbåÿ¿szbrb¬åÿ¿Äq(@pæÿ¿ýÿÿÌåÿ¿"q'@ýÿÿÜåÿ¿oq'@lÞ @ýÿÿ æÿ¿oq'@lÞ @ Load Error: No such file or directory Module rbåÿ¿szbrb¬åÿ¿Äq(@pæÿ¿ýÿÿÌåÿ¿"q'@ýÿÿÜåÿ¿oq'@lÞ @ýÿÿ æÿ¿oq'@lÞ @ did not load Module rbåÿ¿szbrb¬åÿ¿Äq(@pæÿ¿ýÿÿÌåÿ¿"q'@ýÿÿÜåÿ¿oq'@lÞ @ýÿÿ æÿ¿oq'@lÞ @ did not load Module rbåÿ¿szbrb¬åÿ¿Äq(@pæÿ¿ýÿÿÌåÿ¿"q'@ýÿÿÜåÿ¿oq'@lÞ @ýÿÿ æÿ¿oq'@lÞ @ did not load Module rbåÿ¿szbrb¬åÿ¿Äq(@pæÿ¿ýÿÿÌåÿ¿"q'@ýÿÿÜåÿ¿oq'@lÞ @ýÿÿ æÿ¿oq'@lÞ @ did not load Module rbåÿ¿szbrb¬åÿ¿Äq(@pæÿ¿ýÿÿÌåÿ¿"q'@ýÿÿÜåÿ¿oq'@lÞ @ýÿÿ æÿ¿oq'@lÞ @ did not load Module rbåÿ¿szbrb¬åÿ¿Äq(@pæÿ¿ýÿÿÌåÿ¿"q'@ýÿÿÜåÿ¿oq'@lÞ @ýÿÿ æÿ¿oq'@lÞ @ did not load Module rbåÿ¿szbrb¬åÿ¿Äq(@pæÿ¿ýÿÿÌåÿ¿"q'@ýÿÿÜåÿ¿oq'@lÞ @ýÿÿ æÿ¿oq'@lÞ @ did not load Module rbåÿ¿szbrb¬åÿ¿Äq(@pæÿ¿ýÿÿÌåÿ¿"q'@ýÿÿÜåÿ¿oq'@lÞ @ýÿÿ æÿ¿oq'@lÞ @ did not load Module rbåÿ¿szbrb¬åÿ¿Äq(@pæÿ¿ýÿÿÌåÿ¿"q'@ýÿÿÜåÿ¿oq'@lÞ @ýÿÿ æÿ¿oq'@lÞ @ did not load Module rbåÿ¿szbrb¬åÿ¿Äq(@pæÿ¿ýÿÿÌåÿ¿"q'@ýÿÿÜåÿ¿oq'@lÞ @ýÿÿ æÿ¿oq'@lÞ [test-receiver@linux init.d]$ ps -ef | grep ims root 27799 1 0 17:13 ? 00:00:00 /usr/local/nims/bin/ims kill -9 27799 ------- End of Forwarded Message

2 1

Maintenance on RIPE Whois Server, 10 November 2003
by DB-News 07 Nov '03

07 Nov '03

Dear Colleagues, [apologies for duplicate messages] Next Monday, 10 November 2003, we need to perform a maintenance work on the RIPE Whois Server to replace a faulty piece of hardware. During the maintenance work, - Whois Database updates will be stopped, - all update mails to <auto-dbm(a)ripe.net> will be queued to be processed later, - Webupdate and syncupdate interfaces will be unavailable, - The whois queries will _not_ be interrupted. The maintenance work will start at 12:00 UTC (13:00 Amsterdam time) on 10 November 2003 and expected to last 2 to 3 hours. We apologise for the convenience caused. Please do not hesitate to contact <ripe-dbm(a)ripe.net> for any questions. Best regards, -- Engin Gunduz RIPE NCC

1 0

Announcing RISwhois - RIPE NCC IPv4/IPv6 address to origin mapping
by Rene Wilhelm 06 Nov '03

06 Nov '03

[Apologies for duplicate mails] Dear All, RIPE NCC is pleased to announce RISwhois, a new interface to the BGP data collected by the Routing Information Service (RIS). Using a set of ten Remote Route Collectors (RRCs) installed at different locations around the world, the RIS collects BGP information from over 200 IPv4 and IPv6 peers. RISwhois complements our existing prefix query and looking glass tools by providing a higher level view over an entire set of RRC routing tables. The service looks up IPv4 or IPv6 addresses in the most recently collected full RIB dumps and reports the prefixes and origin AS numbers that match the specified IP, as well as the RRCs on which the prefixes were seen. This can help users in obtaining a quick answer on route visibility (i.e. where is it seen, how widely does it spread) and in assigning origin AS numbers to IP numbers in applications such as traceroute. RISwhois listens to the whois port (port 43) and outputs data in a format very similar to the route objects specified in RPSL. Thus applications that, to date, consult a routing registry, like whois.ra.net, can easily obtain more accurate IP to AS assignments by contacting the RISwhois server, riswhois.ripe.net, instead. For example, a study in the context of RIPE NCC's Test Traffic Measurements found 21% of a set of unique IPs unmatched when using the routing registry vs. only 1% unmatched when using RIS data. For more information see: http://www.ripe.net/ris/riswhois.html Please send your comments to ris(a)ripe.net. Best regards, For the RIS team, -- Rene =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Rene Wilhelm RIPE Network Coordination Centre Email: wilhelm(a)ripe.net Amsterdam, the Netherlands Phone: +31 20 535 4444 http://www.ripe.net/ris =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

1 0

New Documents available
by RIPE NCC Document Announcement Service 06 Nov '03

06 Nov '03

[apologies for duplicate mails] New RIPE Documents Announcement -------------------------------------- New documents are available from the RIPE document store. Ref: ripe-291 Title: RIPE NCC Activity Plan 2004 Author: RIPE NCC Date: 05 November 2003 Updates: ripe-255 Ref: ripe-292 Title: RIPE NCC Budget 2004 Author: RIPE NCC Date: 05 November 2003 Updates: ripe-255 Ref: ripe-293 Title: RIPE NCC Charging Scheme 2004 Author: RIPE NCC Date: 05 November 2003 Updates: ripe-255 Ref: ripe-294 Title: RIPE NCC Articles of Association (2003) Author: RIPE NCC Date: 05 November 2003 Obsoletes: ripe-176 Short content description ------------------------- This set of documents was approved by the RIPE NCC members during the RIPE NCC General Meeting 2003. Previously available as draft documents, they are now published as RIPE Documents. Accessing the RIPE document store --------------------------------- You can access the latest RIPE documents in HTML format via our website at the following URLs:. RIPE NCC Activity Plan 2004: http://www.ripe.net/ripe/docs/ap2004.html RIPE NCC Budget 2004: http://www.ripe.net/ripe/docs/budget2004.html RIPE NCC Charging Scheme 2004: http://www.ripe.net/ripe/docs/charging2004.html RIPE NCC Articles of Association (2003) http://www.ripe.net/ripe/docs/articles-association.html The RIPE Document Store is also available via anonymous FTP to ftp.ripe.net, in the directory ripe/docs. The URLs for the new documents on the FTP-server are: RIPE NCC Activity Plan 2004: ftp://ftp.ripe.net/ripe/docs/ripe-291.pdf PDF ftp://ftp.ripe.net/ripe/docs/ripe-291.txt plain text version RIPE NCC Budget 2004: ftp://ftp.ripe.net/ripe/docs/ripe-292.pdf PDF RIPE NCC Charging Scheme 2004: ftp://ftp.ripe.net/ripe/docs/ripe-293.pdf PDF RIPE NCC Articles of Association (2003): ftp://ftp.ripe.net/ripe/docs/ripe-294.pdf PDF ftp://ftp.ripe.net/ripe/docs/ripe-294.txt plain text version Kind Regards, Jeroen Bet RIPE NCC Webmaster

1 0

Reverse DNS Restructuring Project
by Olaf M. Kolkman 04 Nov '03

04 Nov '03

Dear Colleagues, Below you find a proposal for restructuring of parts of the reverse DNS services. The proposal can also be found on http://www.ripe.net/reverse/proposal.html We would appreciate your feedback on this (ncc-services-wg) list. -- Olaf Kolkman Reverse DNS Restructuring Project. Proposal: Restructuring of the reverse DNS setup. The Reverse DNS Restructuring Project involves a number of changes: - Modification of internal databases so that the RIPE Whois Database becomes the authoritative source for zone file generation. - Change of interface for the creation and maintenance of delegation of reverse domains. <auto-inaddr(a)ripe.net> will be deprecated while the Whois Database interfaces will be available for reverse database management. - The introduction of a new attribute, "mnt-domains:", in INETNUM and INET6NUM objects to be able to delegate the authority to create new domain objects. - The introduction of 'name' syntax checks for the ip6.arpa and in-addr.arpa domains, only allowing DOMAIN for names that make sense in the address hierarchy i.e. those that represent "reversed" addresses. - A cleanup of inconsistent data so that the who is Database reflects the data that is in the reverse zones. - Once address space has been allocated the reverse delegations can be made. There is no longer the requirement that address space has to be assigned before a reverse delegation is made. - The introduction of an attribute in the domain object used for storing public DNSSec keys. Background and Motivation: There are a number of issues that give rise to these changes. - LIRs must currently use a separate interface for the maintenance of their domain objects. Having a single entry point for the maintenance of all objects in the Whois Database is more efficient for LIRs and the RIPE NCC. - Deployment of DNSSec requires a method for the exchange of public keys. Using the Whois Database as the authoritative source for zone file creation enables the use of the Whois Database authorization mechanisms including the LIR Portal, PGP keys and X.509 certificates, for DNSSec public key exchanges. - Reverse zones are currently maintained though an e-mail robot, <auto-inaddr(a)ripe.net>, also referred to as 'Marvin'. When DOMAIN objects are submitted Marvin performs a number of DNS checks, updates the Whois database with the submitted object and then updates the zone files. Once a DOMAIN object exists in the Whois database it can be modified using the database interfaces. However changes to it will not end up in the zone file. This allows for the data in the Whois database being inconsistent with the data in the DNS. This leads to confusion and lameness problems in the DNS. - The motivation for introducing the "mnt-domains:" attribute is because the maintenance of the DNS is often done by a different set of people to those that maintain INETNUM objects. With the introduction of this new maintainer attribute and no longer having the restriction that address space is to be assigned before delegations are made, the setup of reverse space is easier and operational delays can be avoided. - The motivation for the 'name syntax check' is because there are currently DOMAIN objects that clearly cannot exist in the address hierarchy (e.g. 666.193.in-addr.arpa). - The Whois Database has several methods to interface with it, moving towards a system where the Whois Database is the authoritative source for reverse delegation information eases the development of web-based tools for zone maintenance. Besides, having uniform interfaces for all RIPE NCC services has benefits for the RIPE NCC and its customers. Details: - Introduction of the MNT-DOMAINS attribute for INETNUM/INET6NUM (INET[6]NUM for short) objects. An INET[6]NUM object can contain multiple instances of the "mnt-domains:" attribute. It is used for authorizing the creation of DOMAIN objects for the reverse DNS namespace to which the INET[6]NUM relates i.e. the smallest less specific range. It protects the creation of DOMAIN objects and allows for fine grained control of who requests a delegation. Once the DOMAIN object is created it is protected through the use of the "mnt-by" attribute. If there is no "mnt-domains:" attribute on a INET[6]NUM the authentication for the creation of a DOMAIN object is passed by the "mnt-lower:" attribute, when this is not available the "mnt-by:" attribute is used. This is a mechanism also used in RPSL and RPSS. - Reverse delegation interface The <auto-inaddr(a)ripe.net> e-mail interface will be deprecated. Reverse delegations can be maintained by submitting DOMAIN objects to the database. This allows for the use of existing database update interfaces in addition to the e-mail interface (<auto-dbm(a)ripe.net>). The RIPE NCC will create DNS zone files for the reverse space from the information in the DOMAIN objects. During the creation of the zone files a filter is applied to ensure that: - Reverse zone delegations are only created for address space allocated by the RIPE NCC (this takes into account ERX space). - Once a delegation at a /16 boundary is made the more specific /24 domain objects are ignored. - Delegations are only allowed on /16 and /24 boundaries (note that it remains possible to submit an object of the form 0-9.xxx.yyy.in-addr.arpa that will be expanded in 10 separate DOMAIN objects). RFC 2317 type 'delegations' for PI space smaller than /24 not allocated by a LIR cannot be handled via this interface but will need to be requested via <inaddr(a)ripe.net>. - Introduction of an attribute for storing DNSSec public key information in DOMAIN objects. When DNSSec is deployed not only the name servers that are authoritative for running a zone need to be registered but also the public key with which those reverse zones are signed. A mechanism is needed to authenticate the exchange of public keys. To avoid the deployment of DNSSec being prohibitively expensive the key exchange should be similar to the procedure used to exchange the information about the authoritative name servers. The authentication methods used during the key exchange should be at least as strong as the authentication methods used for making the actual delegation. Using the Whois Database, in combination with the "mnt-domains:" attribute, the users of address blocks have control over the authentication methods. We expect improved consistency and lower maintenance costs when, during the zone file generation, a single source of data for both DNSSec public keys and name server RRs can be used. - Database consistency and cleanup Currently there is a set of zone files that is the authoritative source for the reverse tree. In addition there are DOMAIN objects in the database. Appendix 1 shows the number and nature of the inconsistencies. The cleanup should not cause existing delegations to change i.e. the zone data has prevalence over Whois database information in case of inconsistencies. A somewhat more detailed cleanup plan will be presented to the DB-WG mailing list. Tentative milestones - A more detailed proposal for the "mnt-domains:" attribute and the cleanup. (October 2003) - Documentation and procedures. (October-November 2003) - Introduction of "mnt_domains:" and reverse delegation processing for <auto-dmb(a)ripe.net> while still allowing the use of <auto-inaddr(a)ripe.net> with the current authorization methods. (December 2003). - As soon as <auto-dbm(a)ripe.net> can handle reverse delegation requests, and the back-end systems have been modified not to introduce new inconsistencies the RIPE NCC will be sending out warnings about inconsistent data (as part of the cleanup process). There will be a 2 months interval to allow users to fix inconsistencies. - Deprecation of the <auto-inaddr(a)ripe.net> interface, allowing only updates via <auto-dbm(a)ripe.net>. (Around February 2004, Details to be worked out). - Around February 2004 (shortly after the previous step) the inconsistent data will be cleaned up. $Id: RDNS-Proposal.txt,v 1.8 2003/09/30 07:21:45 olaf Exp olaf $

10 20