[GTER] Issues with a number of publish-in-parent RPKI CAs?

Douglas Fischer fischerdouglas at gmail.com
Mon Jun 27 07:57:01 -03 2022 

Some of those ASNs CAs are running under a common Krill Server.

We checked for some inconsistencies of 4 CAs that were deleted on that
Krill.
We needed to remove all the files/directories belonging to those 4 CAs
manually, and then restart the krill.

Another thing that caught our attention was that Krill were dying after
retrieving ripe-ris Dumps.
We disabled that (bgp_risdumps_enabled = false).
Let's see how its behavior will be after those adjustments.


Em dom., 26 de jun. de 2022 às 18:58, Job Snijders via gter <
gter at eng.registro.br> escreveu:

> Dear all,
>
> I'm seeing an increasing amount of RPKI publication points fail at the
> rpki-repo.registro.br parent.
>
> It seems the following ASes are potentially impacted to some degree:
>
> 28125, 28215, 28263, 28279, 28287, 52560, 52573, 52742, 52939, 52989,
> 61857, 61872, 262272, 262322, 262346, 262433, 262490, 262574, 262645,
> 262687, 262736, 263043, 263538, 263545, 263569, 263599, 264073, 264118,
> 264364, 264381, 264470, 264953, 264975, 265079, 265126, 265189, 265232,
> 265265, 265355, 266063, 266226, 266487, 266506, 266563, 267128, 267183,
> 267242, 267271, 267576, 267640, 268250, 268281, 268397, 268617, 268651,
> 268672, 268700, 268781, 268797, 269180, 269299, 269314, 269329, 269342,
> 269382, 269674, 270247, 270304, 270514, 270785, 270838, 270904, 271761
>
> Does anyone know the cause?
>
> Kind regards,
>
> Job
>
> Jun 26 17:18:38 rpki-client:
> rpki-repo.registro.br/repo/9vTL6bwuZNcMovGBHY7VqvCgpHmehuyw8jFvmwSc2q3v/0/2020E4386470854F498B76284D60EBE5CCB3BE98.mft:
> no valid mft available
> Jun 26 17:18:38 rpki-client:
> rpki-repo.registro.br/repo/5jGAWQ4guM5JPpAts55LtLmVCsFXMyPhzcPZtSQEk4hk/0/3574A58A568C8AE1ADC3EE503BF56A5366499355.mft:
> no valid mft available
> Jun 26 17:18:39 rpki-client:
> rpki-repo.registro.br/repo/H4qKyFrWr1AeRE6FG9TKBHQhDYZtUT4wGp3iv6Npwe9n/0/1126D25A4DB64A40DC18B85C6BE06C47DA39CCDB.mft:
> no valid mft available
> Jun 26 17:18:39 rpki-client:
> rpki-repo.registro.br/repo/8vy2RcViXpe2PXdx93YYLEhLLBq4pPdBKh9QY6b2Y6mg/0/9B200BCD91DFF47750BD2C67A02D2E1F476C8232.mft:
> no valid mft available
> Jun 26 17:18:39 rpki-client:
> rpki-repo.registro.br/repo/5cbD581Da4ZvApJ2tuZ8MoH37t9nxJsgSzZYPYa69r4D/0/52F74CD9CD82590FB93E8841BA356D693CF1C4E4.mft:
> no valid mft available
> Jun 26 17:18:40 rpki-client:
> rpki-repo.registro.br/repo/4CNxyGAmp4jRYGAPeVei4NitxkpieS2tg78Xnuy1WfjM/0/7B383C5300D182773443C8BA9F5BBF8B32A650A4.mft:
> no valid mft available
> Jun 26 17:18:40 rpki-client:
> rpki-repo.registro.br/repo/CotTTN6JsQeJ9aiZ8ux8tYTLXWx47Hx2YmTFaMdct7Fk/0/14AD04B7B12E0FB321FDAA7C53B69773656F3341.mft:
> no valid mft available
> Jun 26 17:18:41 rpki-client:
> rpki-repo.registro.br/repo/HxCt4Am8PGVjivGshjjPNnbaibVyncrahiUE67ZPAVaT/0/BA4EF388A46AF3E03A8B6D2D69A41EF38AC6DB13.mft:
> no valid mft available
> Jun 26 17:18:41 rpki-client:
> rpki-repo.registro.br/repo/8kjAN1kodZy7qUaSDkEFu9gGZPaDSk65P5VnrL91tmU3/0/38F95E5D5D96543C23B0E3817740D4AA8E4BF10B.mft:
> no valid mft available
> Jun 26 17:18:41 rpki-client:
> rpki-repo.registro.br/repo/Bnmu7YWSCmfoaFek32KR7FU8PfrJo33AgDDuJ7K9xU9N/0/479E06F5B6EE099F824DB92D356B4DBA466A88B2.mft:
> no valid mft available
> Jun 26 17:18:42 rpki-client:
> rpki-repo.registro.br/repo/9nUa6hVWLvnd3YyXxW6YMePALB7Tumbg43BePFJmadd5/0/EF0A0BAAF9F4B46ACEAB9B1DE62E809C251FB153.mft:
> no valid mft available
> Jun 26 17:18:42 rpki-client:
> rpki-repo.registro.br/repo/DabpVK4ptvKPrV5ZUA6GrrS1NBZ1omtagugy7kj6H6jQ/0/074E7C5399BF0B4BA92B7F57D419D9A3D05F05F1.mft:
> no valid mft available
> Jun 26 17:18:43 rpki-client:
> rpki-repo.registro.br/repo/2jriEXnfYNcRJAMVAMAv1SBrNAnafCeeTegjrdSZMnhw/0/A74780F81B7728CA8AF087579AE827C07238EA86.mft:
> no valid mft available
> Jun 26 17:18:44 rpki-client:
> rpki-repo.registro.br/repo/8bbLLJG6U9eWtuny3Lry2aErc3dCgheBEcgB95eGYHhJ/0/A45D3989DF644CDEF7512BADAAAB0091F844EA06.mft:
> no valid mft available
> Jun 26 17:18:44 rpki-client:
> rpki-repo.registro.br/repo/BCneDvRBFSAzp7iw6SH6NKUw9oFjgcLDiHALZ3YEUrT7/0/6746FDD0D33B6A2625BDD9A7BAA13E307C71FF8E.mft:
> no valid mft available
> Jun 26 17:18:45 rpki-client:
> rpki-repo.registro.br/repo/2tFukkqxtwQUPnwww6SZdzBZH6NxixA58k1DGEPo8r6t/0/06752EAA3A633FE6238AF0F9A15355E44C6C7799.mft:
> no valid mft available
> Jun 26 17:18:45 rpki-client:
> rpki-repo.registro.br/repo/84Yx3GrAh7X5b7pXZJRPPm8LeTChq7rWH8zfgaz71Mfe/0/D85C2F0A53887B5856EBE8417E87C096F5817FBE.mft:
> no valid mft available
> Jun 26 17:18:46 rpki-client:
> rpki-repo.registro.br/repo/CbFMaBDDwBcCXWStPkgCQLCEki7dzxgrBEvCA2FZfJiM/0/EDBB71BFB5C814DA471F371C214CD6D1C45122E9.mft:
> no valid mft available
> Jun 26 17:18:46 rpki-client:
> rpki-repo.registro.br/repo/BvnizDybwSScQTGAZYo5gKukuEvZKZtP36XPDDMpmqJ9/0/6DA94CC9665217B326F33F62EEC20C2091A6ECEC.mft:
> no valid mft available
> Jun 26 17:18:46 rpki-client:
> rpki-repo.registro.br/repo/5qbiT6RMp9thCn1GofUaPqhL7SwVZxU6XV5GYuN9s8Bo/0/2A83403E3F327DC79717B586A2AFD087B2A92076.mft:
> no valid mft available
> Jun 26 17:18:46 rpki-client:
> rpki-repo.registro.br/repo/NJdNezN6CG4FSpXacoPXJT4e82iKXRDc7RjmdAVLD4i/0/CBF316E6B2EE03544A2F46C3011C57AA5538C054.mft:
> no valid mft available
> Jun 26 17:18:47 rpki-client:
> rpki-repo.registro.br/repo/ttRqzEcbxTFw4Qz8G6bMbyzBfhqm8R61TYw5PQ1FHdK/0/F2150C97A0C5F33344CC2EF6EADB59C0D7C1EF32.mft:
> no valid mft available
> Jun 26 17:18:47 rpki-client:
> rpki-repo.registro.br/repo/FE6A4NBbkVWHnfGcJ1QRUacz8Nhe92bq7Bf1GshtcqZP/0/A0E11F583624A0AC56335284138F60E583C4783A.mft:
> no valid mft available
> Jun 26 17:18:48 rpki-client:
> rpki-repo.registro.br/repo/9MfHRzzSZ269cnQbozgyRbNpwp4gLnWBNWFPWZEmWGXs/0/4C5E4BEB7398912F161523952333D01C9BF59452.mft:
> no valid mft available
> Jun 26 17:18:48 rpki-client:
> rpki-repo.registro.br/repo/HaXomBQJds5YqaiwhrJc5HstgyGtvnEvVnao7phVagQy/0/D8274A719AFB0FB78FE470195A3A8CECB5272A85.mft:
> no valid mft available
> Jun 26 17:18:49 rpki-client:
> rpki-repo.registro.br/repo/FzAaVKKfPC3FzWFLVvSoCEEWKMSzMM8FK1wGycFwnLLo/0/1CEAB2C57300195DEEB059504286FBA1F7D645FF.mft:
> no valid mft available
> Jun 26 17:18:49 rpki-client:
> rpki-repo.registro.br/repo/9G89gJgZeyhfjANknxDvMdhkyXhQf6VreXRWReDzbAjg/0/BB9365DEF2F89561A2197EE7A90A22E2FE9D724D.mft:
> no valid mft available
> Jun 26 17:18:49 rpki-client:
> rpki-repo.registro.br/repo/AwMMpEUndd1kW3mEGHQ87qQ3yfDAcWPjn1zPkGos1uxu/0/70933D44E981FE4AD73F82CBF756039B2175CBBA.mft:
> no valid mft available
> Jun 26 17:18:50 rpki-client:
> rpki-repo.registro.br/repo/4qfkWRfc3U2f6ZToL5cmdYmTFxsR3Ur9jU9GH7UUxoXm/0/D63F65BC868A989F5016FC5F923857D26EE2A068.mft:
> no valid mft available
> Jun 26 17:18:50 rpki-client:
> rpki-repo.registro.br/repo/7oCcVbyHKkLCf95zkRt3fyisbHYcn3o9oZYZ56ZVbjJk/0/08955ACA1E6ED830C574209FC72217F211993283.mft:
> no valid mft available
> Jun 26 17:18:50 rpki-client:
> rpki-repo.registro.br/repo/6BcxPSTRM3uig1zsp3gqs9UbsKeME4tg4yhymTfytPte/0/469981885A8F7261338D1094A7F2563BC33998EB.mft:
> no valid mft available
> Jun 26 17:18:50 rpki-client:
> rpki-repo.registro.br/repo/GoATXLY3Mftv1uPFeEHsYi9zo17fUc9pEM9EUNyhTFHL/0/193E8C36D989BF227A8F02A647519CEE06467E67.mft:
> no valid mft available
> Jun 26 17:18:50 rpki-client:
> rpki-repo.registro.br/repo/F6CFxpXb4tPjYrGBAXDRqYrxAoscoZLf8ih9mUxGFWct/0/27D022D8AE2F59929545906088E0AD52D9AF7062.mft:
> no valid mft available
> Jun 26 17:18:50 rpki-client:
> rpki-repo.registro.br/repo/ByCxDjvqHw87NiHDgvmYw3AxF9csyng5thtZNYXhvXJs/0/1BC7F4D885BA6381BB4AB613A65BC60075643F9A.mft:
> no valid mft available
> Jun 26 17:18:51 rpki-client:
> rpki-repo.registro.br/repo/6UZysAyTjx2NJrkHbunyrSpdEkCM69Efmns52PN6QHvC/0/A81093E8D47A02B3F27CEA4E88447C3EF19AC2F9.mft:
> no valid mft available
> Jun 26 17:18:52 rpki-client:
> rpki-repo.registro.br/repo/BHKkGzYwWdtTr7njz1B6sFccsAKJtZZ3kDKptXM3ASqx/0/0B4F8A9710EACEB078A4026C4F482E40833DFC98.mft:
> no valid mft available
> Jun 26 17:18:52 rpki-client:
> rpki-repo.registro.br/repo/H3fXuYKThx4oPfofxGQU6CJpsmLmyswNmC6Wu6r1mgUK/0/30E33D2B2C299B5B040A2670023EFAFD2EE3981C.mft:
> no valid mft available
> Jun 26 17:18:52 rpki-client:
> rpki-repo.registro.br/repo/D6Abm7mqturDVRYh5Ki8kaLs9UX95XyjrfmSocy7KJE7/0/36824D1C7AB8CCE4C9C6872488A2302EE8BE4108.mft:
> no valid mft available
> Jun 26 17:18:52 rpki-client:
> rpki-repo.registro.br/repo/5NT38WEqutJGuPbm2J3S1vqdSLBMKS1QRYfJy4ShajHb/0/8755FEBCF039857E1AF03ECE2861AB7D18E1F04C.mft:
> no valid mft available
> Jun 26 17:18:52 rpki-client:
> rpki-repo.registro.br/repo/BcH9omw5UXJCXE1tnrtRWS1hy1Fzu1dFdtTUBG2RUKLg/0/A8A221B1EF3CEEBAB46E7ED8BE2E167FA721C65B.mft:
> no valid mft available
> Jun 26 17:18:53 rpki-client:
> rpki-repo.registro.br/repo/BFn7LQ2HsnA2JbTdLp6FeEpmyc8V8vREpFM3Cua7nduc/0/EBBA326E4563966E8B0B8262E7DCEF83CDC9CB6B.mft:
> no valid mft available
> Jun 26 17:18:53 rpki-client:
> rpki-repo.registro.br/repo/DjtUdPGHvprAC8oCjUuLqiMfB3PnHDzXS5ZiJ8gFW4D6/0/197C5905D5D615C8C6E19730FE6BE6543AD3D727.mft:
> no valid mft available
> Jun 26 17:18:53 rpki-client:
> rpki-repo.registro.br/repo/CyxYUxCGZZTusZXig6xReewDRdipn3LEECEFaYg5Zhsv/0/CC772B1299488BFAB097C81274366C7B69601348.mft:
> no valid mft available
> Jun 26 17:18:53 rpki-client:
> rpki-repo.registro.br/repo/WYgSZv8DUMrZVQXe7wf8z223MfN5tHjHrgeaRe5zp3r/0/143369A8462926C767FB72021BA92477A0B3D307.mft:
> no valid mft available
> Jun 26 17:18:54 rpki-client:
> rpki-repo.registro.br/repo/CjweErX4cvTkT6Ekqp3H9xdDY7RkmhuTp36U3hBy2rDk/0/07250C92A6B7FDE61EAF85D540E7C1CAD3114FE5.mft:
> no valid mft available
> Jun 26 17:18:54 rpki-client:
> rpki-repo.registro.br/repo/cQvxkWdjC5vvvZUnZ42AdLYQVq88ersbdUvozmtNtM8/0/3B650AE130217DC191EA44A022BABF2EECE6BA37.mft:
> no valid mft available
> Jun 26 17:18:54 rpki-client:
> rpki-repo.registro.br/repo/FNu3hUztgjeoyGjGJRhAsMvRHaeRncqn1Emv9MTYq9xa/0/332E0DA86130575BFAD949B0B294C77899BFD68B.mft:
> no valid mft available
> Jun 26 17:18:55 rpki-client:
> rpki-repo.registro.br/repo/BVUH9Yv1QXtFry7CGPUTWiKT74fsMu13kkoA4feuhHbk/0/1B1702BC517065A11637A946F3D5295EB223FCE1.mft:
> no valid mft available
> Jun 26 17:18:55 rpki-client:
> rpki-repo.registro.br/repo/DFJQozo1BZEnJw7est3eaqf6qm8Ppig8FiUb3aFwiKWr/0/7568E6A27B4CE8B4EBD5A330592B70A20FBF6BB8.mft:
> no valid mft available
> Jun 26 17:18:55 rpki-client:
> rpki-repo.registro.br/repo/CzFmgYK2ZVtsWh4wNYP5dJKvoXBxzD9NrnNvxH2oTZfk/0/274C8900E88A82A4C3141304703EB99027E91007.mft:
> no valid mft available
> Jun 26 17:18:55 rpki-client:
> rpki-repo.registro.br/repo/ApE4saDhXZKsctXbwTzFRNAmKAVxx2PnP62vymXoymim/0/86F6097D5D41474A984E795588A70420B258E351.mft:
> no valid mft available
> Jun 26 17:18:56 rpki-client:
> rpki-repo.registro.br/repo/2nC3JYST889rk2r7Di6WQ1yjJ6wtSSAa2dJxqrLbq8bY/1/003AB6DC6AAD8C55BD308CA1AE1EE4841E9DC307.mft:
> no valid mft available
> Jun 26 17:18:56 rpki-client:
> rpki-repo.registro.br/repo/BCneDvRBFSAzp7iw6SH6NKUw9oFjgcLDiHALZ3YEUrT7/0/1C00B42BB28649977C9198D6CD528A3837C8A098.mft:
> no valid mft available
> Jun 26 17:18:57 rpki-client:
> rpki-repo.registro.br/repo/A7JoJYEQEtW1f5eKjZEZgL19b4gNppw4YrKS9sdx87KL/0/6BE04AFAB38F8D99CE4780126F7A2626BCD5488C.mft:
> no valid mft available
> Jun 26 17:18:57 rpki-client:
> rpki-repo.registro.br/repo/A9fBvvuv45P11bx2VnjV3ogt9jWBcrN32V1ZSfyHor5o/0/D4043FF361E9F3F8626E866CD52D1D952930B170.mft:
> no valid mft available
> Jun 26 17:18:57 rpki-client:
> rpki-repo.registro.br/repo/BwU4DDHLNcqper4v9yxamLtnw2Tq9NXCaNitJXCA42Y9/0/4F92F3EF9C1CA1783859927A4E4549F44CF595C7.mft:
> no valid mft available
> Jun 26 17:18:58 rpki-client:
> rpki-repo.registro.br/repo/HcfLhkqu7wwQc4FFSWiSdr2Jfb5nCbXumofhfDXPELXx/0/4F2B2C526ACD0C7496A105A8D8D5802334208EC9.mft:
> no valid mft available
> Jun 26 17:18:58 rpki-client:
> rpki-repo.registro.br/repo/EpdPovdwB2tvJQAM5XPVmbPznSKDRMc3ootUFPsvJs5u/0/5611059C9A2422AD512E529FC7EBD6D360EF3EBD.mft:
> no valid mft available
> Jun 26 17:18:59 rpki-client:
> rpki-repo.registro.br/repo/2BvgVLsf1qVRyeqgSYekiacdg9YE4nHTCbsxwWsuofi3/0/1078C6CBCEB6EEDE3FCC8BFECE988A951FF373EC.mft:
> no valid mft available
> Jun 26 17:18:59 rpki-client:
> rpki-repo.registro.br/repo/6QSwnKALRiWzvtZ3LxV8bVX144oPaH6Js6awaBmEmPoe/0/00AA5522B7E3B9CE022698EAEB6D0CF1051BF337.mft:
> no valid mft available
> Jun 26 17:19:00 rpki-client:
> rpki-repo.registro.br/repo/JBXx1mZbRgwDq1wB99JBcFdsYRY8aJ6aLKXx2Wq6tehN/0/51A0F33A02D240E9A5E660001C9E5741DC12ACCB.mft:
> no valid mft available
> Jun 26 17:19:00 rpki-client:
> rpki-repo.registro.br/repo/Gn2PoZUTVXkuatDUyMatcfUZBG2HPZtCmdRw9YwEJE4d/0/195547676B8BE1E4E5DFEC4C56540978B178C9BA.mft:
> no valid mft available
> Jun 26 17:19:00 rpki-client:
> rpki-repo.registro.br/repo/H88UdHUTsB7UbUmDVvyHJtPX593irterXzDJkSEgg45D/0/7C0967496D9B879D984F400EFDAE9073C30F0EBD.mft:
> no valid mft available
> Jun 26 17:19:01 rpki-client:
> rpki-repo.registro.br/repo/5aRseHMT7bHtNPiaPv8RFaCw5kRE1WG9ysjCGKNEbwtp/0/35F6CB498D4B581CD56EFC2125053A8C6BF1D329.mft:
> no valid mft available
> Jun 26 17:19:01 rpki-client:
> rpki-repo.registro.br/repo/Fqtz5PTUYCdqwJ5CAHruYQiN26ADsUjeJCxdN7ApSjEt/0/CF7CA3C7F6484A8DC2688894F6D7402ED5580BEB.mft:
> no valid mft available
> Jun 26 17:19:02 rpki-client:
> rpki-repo.registro.br/repo/qV76aRC5ze31WWdeE66hfAGVhsqs1DXJsMKcPXAByPe/0/D191195975A68272318E23E810DD7CD49DF1FD6A.mft:
> no valid mft available
> Jun 26 17:19:02 rpki-client:
> rpki-repo.registro.br/repo/7Jgh342HLdQM5GuTVj4ZkLRs53DrBqfEHD8Dx3CaedVo/0/F0FDD9B1C7A2F0700C96F302D518DDD400BE1BFD.mft:
> no valid mft available
> Jun 26 17:19:02 rpki-client:
> rpki-repo.registro.br/repo/9qcYFbmdgit3byHLvEgn1G2RCqLavmCSH4WQeuFDy7pU/0/2585A8C398BE08A08EC2DD74E3C377E02FCC61F1.mft:
> no valid mft available
> Jun 26 17:19:03 rpki-client:
> rpki-repo.registro.br/repo/7wnDMHM12vFdgWCrUUQeTxi4sVAi7HwhxYuPbEYJc9B4/0/2FD34957E649B1523E1FF87A9590244D5E9C6A98.mft:
> no valid mft available
> Jun 26 17:19:03 rpki-client:
> rpki-repo.registro.br/repo/BSxbezzeZAZx9dLR7Aj6BgTy88V2c3xXTzQYhZz2D9ik/0/271C11CFD1ADD1C50A2E4AD6AB9155C08166FCA3.mft:
> no valid mft available
> Jun 26 17:19:03 rpki-client:
> rpki-repo.registro.br/repo/8Bk8XiuAizGByjgB28VnEqNBniSsyn7cMcT15yCJ1ryh/0/EDBE1DD87706B095C3BDF9E56BDB6D025F054136.mft:
> no valid mft available
> Jun 26 17:19:04 rpki-client:
> rpki-repo.registro.br/repo/2f7eY7krXtrN7hvt3xK3p6sf4kDpVCBvTdoXvrAcTKT6/0/3A83B135478F545898B32693E9AB8FD0C1699DEA.mft:
> no valid mft available
> Jun 26 17:19:04 rpki-client:
> rpki-repo.registro.br/repo/Hwomm6ctXQo8AqtnYaGVFkvxTHkw3a9eHSV7ymu1EFUA/0/B37A58E61163D22D689BCC06694E0B41F434AF80.mft:
> no valid mft available
> --
> gter list    https://eng.registro.br/mailman/listinfo/gter
>


-- 
Douglas Fernando Fischer
Engº de Controle e Automação

More information about the gter mailing list