You're viewing an archived page. It is no longer being updated.
As announced at RIPE 47 and on the Database Working Group Mailing List the "NONE authentication scheme" has been deprecated as of 26 April 2004.
Interim solutions for re-sending passwords or replacing the mntner RIPE-NCC-LOCKED-MNT with your mntner are no longer operating. If your object is locked or you do not have the password, please contact [email protected] for assistance.
The RIPE Database protects data from unauthorised modification through the use of references to maintainer (mntner) objects. The maintainer objects contain an "auth:" attribute which specify how a user is authenticated during updates to the database.
One of the allowed authentication schemes is "NONE", which is actually not an authentication at all, but rather specifies that no authentication is necessary. NONE is intended to be used consciously, as a notification facility or as a means to tag objects.
In April 2003, a proposal was sent to the Database Working Group by Hank Nussbacher:
It has come lately to the attention in the Internet security
realm that spammers as well as crackers are hijacking IP address
space. One easy way to "steal" IP address space is via those that
have auth=NONE on their objects.
It is likely that in many cases NONE is used simply because it is easy. Currently approximately 500 maintainers use NONE - about 5% of all maintainers.
Normally with a database cleanup effort, an announcement is sent to the appropriate mailing lists, posted to the RIPE web page, and also sent to the specific users affected. A period of time for cleanup is given. Finally, if the users have not fixed the data then it is modified.
However, for the NONE deprecation, it is inadvisable to do this as it means announcing what is in effect a security vulnerability. Also, our operational experience with past cleanups shows that most users do not really participate through the phases of the effort.
Therefore, the plan for mntner objects with the NONE authentication scheme is as follows:
The reply with the password will be sent to the same contacts. After a certain period of time the service will be discontinued. Users wishing to use these maintainers may contact [email protected] for assistance.
A maintainer with NONE authentication, RIPE-NCC-NONE-MNT, was added to objects without any maintainer when the database was converted from RIPE-181 format to RPSL format in April 2001. There is a remark in these objects which includes the following:
remarks: The RIPE NCC will never use this maintainer object to
remarks: enforce any sort of control over user's objects.
It is possible this could have been interpreted to mean that no restriction would ever be added to the object.
One use of the RIPE-NCC-NONE-MNT has been to allow the creation of objects representing routing policy for resources not allocated or assigned by the RIPE NCC. This is done by using "mnt-routes: RIPE-NCC-NONE-MNT" or "mnt-lower: RIPE-NCC-NONE-MNT" as appropriate.
A new maintainer object will be created for these cases, with a well- known password, published in the object:
mntner: RIPE-NCC-RPSL-MNT
descr: This maintainer may be used to create objects to represent
descr: routing policy in the RIPE Database for number resources not
descr: allocated or assigned from the RIPE NCC.
admin-c: RD132-RIPE
upd-to: [email protected]
auth: MD5-PW $1$GUExyzzy$XQtbZHGVqy9GW8BiAckBV1
remarks: *******************************************************
remarks: * The password for this object is 'RPSL', without the *
remarks: * quotes. *
remarks: *******************************************************
mnt-by: RIPE-DBM-MNT
referral-by: RIPE-DBM-MNT
changed: [email protected] 20040301
source: RIPE
The main use of this maintainer is for inetnum objects. There are approximately 60,000 such objects - about 6% of the inetnums. Updates for objects with RIPE-NCC-NONE-MNT are rare, less than 2% of all updates.
For objects using RIPE-NCC-NONE-MNT:
The RIPE-NCC-PN-NONE-MNT was used to mark person objects not to be deleted in the 2001 person clean-up. It can be removed and the maintainer deleted.
The LIM-MNT is used for limericks. It will have a well-known password similar to the RPSL maintainer. It will also be maintained by another maintainer (not itself, as currently).