[ncc-services-wg] RIPE-NCC-LEGACY-MNT

Hi Hank,

Thanks for your email. The error message you received is normal, though
it's understandable that it might be a little confusing.

When a legacy Internet resource is covered by a contractual
relationship, it receives the RIPE-NCC-LEGACY-MNT maintainer, in
addition to the End User's maintainer (as "mnt-by:"). For an object to
be updated, only one of these two maintainers must pass the
authentication. In this case, the update was not authenticated on your
end, and so the error message is correctly telling you that neither our
maintainer nor yours was authenticated.

This legacy maintainer follows the same business rules as other RIPE NCC
maintainers:

- RIPE-NCC-LEGACY-MNT can only be added or removed by the RIPE NCC
- If RIPE-NCC-LEGACY-MNT is present in AUT-NUM and INETNUM objects as
MNT-BY, ORG-ID cannot be changed
- If the ORGANISATION object is referenced in resources where
RIPE-NCC-LEGACY-MNT is present, then the "org-name:" cannot be edited by
anyone other than the RIPE NCC.

So this means that all other attributes can be updated with only the End
User's maintainer and without involving the RIPE NCC.

Please let me know if you have any further questions.

Kind regards

Andrea Cima
Registration Services
RIPE NCC


On 7/4/15 14:03, Hank Nussbacher wrote:
> Not sure which list is appropriate so please reply only to the list that
> people point out as the one which should handle the following issue:
> 
> I have modified a number of objects to be now LEGACY objects.  inet-nums
> and aut-nums.
> When the object is processed and converted into a LEGACY object, RIPE
> auto-adds the following line to each object:
> mnt-by:         RIPE-NCC-LEGACY-MNT
> 
> This is documented here:
> https://www.ripe.net/data-tools/db/release-notes/ripe-database-release-1.77
> Policy 2012-07: Legacy holder organisations cannot change their
> organisation name in their org object if it is referenced by an INETNUM
> or AUTNUM that is maintained by RIPE-NCC-LEGACY-MNT.
> 
> I then noticed I needed to delete some import and export lines on my
> aut-num policy.
> 
> No can do any more.  I now get the error:
> 
> Authorisation for [aut-num] AS378 failed
> using "mnt-by:"
> not authenticated by: RIPE-NCC-LEGACY-MNT, AS378-MNT
> 
> So this now means *every* change to any legacy IP block or ASN has to go
> via RIPE.  But I have been unable to find how to go about informing RIPE
> that I need to make an object modification.    Any pointers would be
> helpful.
> 
> Regards,
> Hank
> 
>