- ripe-atlas - mailman.ripe.net

Understanding participating probes and probe requests
by Malte Tashiro 08 Apr '24

08 Apr '24

Hi, I'm currently looking at measurement metadata and am a bit confused about the different ways of getting the number of probes participating in a measurement and the number of probes requested by the user. I'd like to know how to... 1. get the number of probes _currently_ participating in a measurement (for ongoing measurements) 2. the number of probes that participated when the measurement finished (for stopped measurements) 3. the number of probes a user requested over the lifetime of a measurement The default response to /measurements returns a participant_count and a probes_requested value. However, there are also the optional fields current_probes and participation_requests and these do not add up. For example, this [0][1] measurement (not mine) has a participant_count of 0 (showing as "Actually Participating: None") in the web interface, but one probe listed in current_probes, which shows up in the "Latest Results" list and is still performing measurements (at least while writing this). So it seems like the current_probes list is more accurate to get the number of probes _currently_ (or when the measurement finished) participating in a measurement? Similarly, there are 35 probes_requested, which equals the sum of "requested" probes from the participation_requests, however, some request are actually "remove" actions, which should not be included in this count? Any hints on how to interpret these fields? I think the requested probes and participation requests are more a problem for long-running measurements, but the participant count is sometimes weird for one-offs as well. Thanks, Malte [0] https://atlas.ripe.net/measurements/67903255 [1] https://atlas.ripe.net/api/v2/measurements/67903255?optional_fields=current…

2 1

probe online but not doing any measurements [condmv: not moving, destination]
by Lukas Tribus 07 Apr '24

07 Apr '24

Hello, my probe 1007423 is online, however it does not appear to do any measurements (which is a silent failure one only notices when trying to use it's own probe unfortunately). It's running on OpenWRT 23.05.3 (installed atlas-sw-probe package). I'm not sure since when this is happening. After booting I can see that the sos dns request fails (probably when connectivity is not yet ready): evping: bad address 'U14.H484d19378dbf100f.sos.atlas.ripe.net' evping_ops.init failed And every 3 minutes I see: condmv: not moving, destination '/usr/libexec/atlas-probe-scripts/data/out/v6addr.txt' exists condmv: not moving, destination '/usr/libexec/atlas-probe-scripts/data/out/simpleping' exists Any ideas on what could be happening here? Can I safely delete those files? Thank you, Lukas

1 0

Confused by the documentation
by Stephane Bortzmeyer 05 Apr '24

05 Apr '24

I confess I have a lot of problems finding something in the documentation in its current state. For instance, I assume that HTTP requests can have a "method" parameter to switch from GET, HEAD, etc but where is it documented? Not here: https://atlas.ripe.net/docs/apis/rest-api-manual/measurements/types/type_sp… Not here: https://atlas.ripe.net/docs/apis/rest-api-reference/#measurements

3 3

Empty responses for HTTP tests with a non-existing path?
by Stephane Bortzmeyer 05 Apr '24

05 Apr '24

It seems the anchors, when receiving a HTTP request for a non-existing path, instead of a 404, send a broken response: % curl -v http://fr-par-as2486.anchors.atlas.ripe.net/nonono * Trying 2001:67c:217c:4::2:80... * Connected to fr-par-as2486.anchors.atlas.ripe.net (2001:67c:217c:4::2) port 80 (#0) > GET /nonono HTTP/1.1 > Host: fr-par-as2486.anchors.atlas.ripe.net > User-Agent: curl/7.81.0 > Accept: */* > * Empty reply from server * Closing connection 0 curl: (52) Empty reply from server

2 2

RIPE Atlas maintenance on Wed 10 April
by Christopher Amin 05 Apr '24

05 Apr '24

Dear colleagues, On Wednesday 10 April we will carry out maintenance on a storage solution used by critical backend nodes of the Atlas infrastructure. Work start: 2024-04-10 08:00 UTC Work end: 2024-04-10 11:00 UTC What you should expect during the maintenance window: - The LIR Reachability Test will not work; - Newly connected probes may take longer than usual to connect to the RIPE Atlas system. All other parts of the RIPE Atlas service should continue to work as usual. Regards, Chris Amin RIPE NCC

1 0

Fwd: 2FA
by Ernst J. Oud 27 Mar '24

27 Mar '24

L.S. Oh well, I installed the Authenticator Chrome Extension (https://chromewebstore.google.com/detail/authenticator/bhghoamapcdpbohphigo…) on my PC which could scan (nifty!) the QR code exported from Google Authenticator. All is fine now. Can use 2FA via Chrome on my PC. Regards, Ernst > From: "Ernst J. Oud" <ernstoud(a)gmail.com> > Date: 25 March 2024 at 13:39:45 CET > To: Bogdan-Stefan Rotariu <bogdan(a)rotariu.ro> > Subject: Re: [atlas] 2FA > > Bogdan-Stefan, > > I agree with your remark about the fact that 2FA using an Authenticator on the same system used for the login defeats its purpose. > > However, RIPE refers on the 2FA instruction page (https://www.ripe.net/membership/member-support/ripe-ncc-access/two-step-ver…) under the heading “What if I don't have or want to use a smartphone?” to the OATH Toolkit for Linux. > > Thus, if I accept the risk that my PC could be hacked and RIPE clearly also accepts running 2FA on a PC running Linux then I reckon that running a 2FA Authenticator on Windows or even macOS should also be made possible. > > I therefore stand by my question how to enable an Authenticator on a PC if already enabled on another device. More than 95% of users don’t use Linux on their desktop. Then only referring to an arcane Linux CLI tool is a bit limiting. > > I installed that toolkit on WSL2 on my PC and it installed fine but to use it I still need the secret key that was used to enable 2FA. Which I don’t have and is also not available on my profile page. Tried exporting it in Google Authenticator which gives a QR code, pointed WinAuth to the URL where I stored it. Didn’t work. > > Regards, > > Ernst J. Oud > >>> On 25 Mar 2024, at 12:40, Bogdan-Stefan Rotariu <bogdan(a)rotariu.ro> wrote: >>> >> Hello, >> >> The scope of 2FA is to use a secondary device to get the authorisation codes. We saw hacked PC’s that had Authy or any other 2FA Apps, and the attackers used those to obtain the codes and hijacked accounts. >> So using a 2FA App on the same device that you’re using to login and authorise at the same time defeats the purpose of the 2FA. >> >> We are try now to teach our users and employees to stop using desktop apps for 2FA code generators and I encourage you to do the same, even if it adds a second layer (as expected) of effort for you. >> >> Thanks, >> >> -- >> Bogdan-Stefan Rotariu >> >> >> >>> On 25 Mar 2024, at 13:13, Ernst J. Oud <ernstoud(a)gmail.com> wrote: >>> >>> Hi, >>> >>> I enabled 2FA for Atlas website access. Works fine on my iPad and Android phone, using the Google Authenticator. However not always I have these devices with me when I want access via my Windows PC. >>> >>> I installed WinAuth on my PC but it needs the secret key that is generated when 2FA is enabled. Is there a way to get this secret key for this purpose? Tried exporting from Google Authenticator but that only supplies a QR code, not the key. >>> >>> Is there a way to use both a tablet/phone and a PC for authentication? >>> >>> I read that in Q1 2FA will be enforced. I am a bit amazed that there has been no further announcement in this group with some help. The page on 2FA only mentions the Oauth Toolkit for Linux. No help whatsoever for Windows users. >>> >>> Any clues? >>> >>> Regards, >>> >>> Ernst J. Oud >>> -- >>> ripe-atlas mailing list >>> ripe-atlas(a)ripe.net >>> https://lists.ripe.net/mailman/listinfo/ripe-atlas >> >> -- >> ripe-atlas mailing list >> ripe-atlas(a)ripe.net >> https://lists.ripe.net/mailman/listinfo/ripe-atlas

1 1

Fwd: [ncc-announce] [News] 2FA Mandatory on RIPE NCC Access accounts
by Robert Kisteleki 26 Mar '24

26 Mar '24

Dear RIPE Atlas users, In case you're not following the official RIPE NCC communication channels: this is a heads up regarding 2FA use in RIPE Access, the single sign-on mechanism behind various RIPE NCC services including RIPE Atlas. Action needed from you: please make sure you enable 2FA on your account. Regards, Robert Kisteleki RIPE NCC -------- Forwarded Message -------- Subject: [ncc-announce] [News] 2FA Mandatory on RIPE NCC Access accounts Date: Tue, 26 Mar 2024 12:12:12 +0100 From: Felipe Victolla Silveira <fvictolla(a)ripe.net> To: ncc-announce(a)ripe.net Dear colleagues, This week, two-factor authentication (2FA) will become mandatory on RIPE NCC Access accounts. If you have not already done so, enable 2FA on your account. For accounts that do not have two-factor authentication, when you try to log in from Wednesday 27 March, you will be prompted to check your inbox and follow the instructions in the email sent to you by the RIPE NCC. Once you have enabled 2FA, you can log in as you usually would. We will continue to improve the security and usability of RIPE NCC Access accounts over the next few months. Next week, I will also publish a RIPE Labs article explaining our roadmap and main improvements planned in more detail. We welcome your feedback and suggestions on which features are the most important for you on the RIPE NCC Services Working Group (ncc-services-wg(a)ripe.net) mailing list. If you have any issues setting up 2FA on your account, please email ncc(a)ripe.net. Kind regards, Felipe Victolla Silveira Chief Technology Officer -- Click here to unsubscribe or change your email settings: https://lists.ripe.net/mailman/options/ncc-announce

1 0

2FA
by Ernst J. Oud 25 Mar '24

25 Mar '24

Hi, I enabled 2FA for Atlas website access. Works fine on my iPad and Android phone, using the Google Authenticator. However not always I have these devices with me when I want access via my Windows PC. I installed WinAuth on my PC but it needs the secret key that is generated when 2FA is enabled. Is there a way to get this secret key for this purpose? Tried exporting from Google Authenticator but that only supplies a QR code, not the key. Is there a way to use both a tablet/phone and a PC for authentication? I read that in Q1 2FA will be enforced. I am a bit amazed that there has been no further announcement in this group with some help. The page on 2FA only mentions the Oauth Toolkit for Linux. No help whatsoever for Windows users. Any clues? Regards, Ernst J. Oud

2 1

Question about TLS test
by marcelo bagnulo braun 08 Mar '24

08 Mar '24

Hi, I understand (from a previous post in this ml) that the TLS test available in the Atlas probes uses OpenSSL. Could anyone tell me the exact command used by the probe when executing the test? I was assuming it uses something like: openssl s_client -connect <target>:port Is this correct? Does it includes further options? Thanks, marcelo

2 1

Call for presentation LACNIC’s Internet Measurements WG
by Elisa 08 Mar '24

08 Mar '24

Hi all, I would like to use this mailing list to send a quick reminder about this initiative that is seeking presentations on Internet Measurements (including, but not limited to, Atlas). The Internet Measurements Working Group (IMWG) at LACNIC41 (10 May). Seeking remote/in-person presentations. Submission deadline 12 April. Instructions: https://listas.nog.lat/archives/list/imwg@listas.nog.lat/thread/KEOIK7VC7GQ… Kind regards, Elisa R&D - LACNIC

1 0