T 3.46 Incorrect configuration of a Lotus Domino server

Misconfigurations of a software system are a frequent reason for successful attacks. Due to the complexity of a Lotus Domino server, there is also the risk that the installed Lotus Notes/Domino environment does not meet the required safety requirements due to a misconfiguration. The wealth of configuration settings and the parameters influencing each other may also entail numerous risks.

Misconfigurations may occur both in the basic configuration of a Lotus Domino server and when configuring specific services provided by the server For example, this includes the integrated web server (HTTP-Task) or the Domino Offline Services (DOLS) used for iNotes and/or Domino Web Access. However, a misconfiguration of Domino's database service constitutes a problem for the overall security of the server.

Some typical misconfigurations are listed in the following:

The issues mentioned are examples of possible risks caused by misconfigurations of a Lotus Domino server. Depending on the corresponding environment, further risks may occur.

Example:

A server is configured in such a way that anonymous certificates are prohibited. Only SSL connections are allowed at the web interface. Therefore, no Anonymous entry is created when the ACLs of the database are configured. Furthermore, forcing SSL-protected web access is relinquished, since the server only accepts SSL connections at the web interface. The Default rights from database templates remained unchanged in order to minimise the administrative work when the templates are changed. The introduction of a new database containing public information causes the server to be configured in such a way that normal web accesses to this database are now allowed as well (anonymous, not SSL-protected). As of now, all server databases can be accessed anonymously. In so doing, the Default rights are applicable, often at least granting a read-only authorisation. This entails the risk of unauthorised persons being enabled to read confidential data or to manipulate information.