Re: Anonymous access to domcfg.nsf, decsdoc.nsf, dolshelp.nsf, lccon.nsf, lsxlc.nsf, readme.nsf, and, HTTP Trace,

[Chris Whisonant <chris.whisonant@xxxxxxxxx>]

That's pretty standard.

For domcfg, you'll have to make some changes so that login screen images
will be able to be visible if you completely disable Anonymous. I'd say
leave Anonymous to just READER and they shouldn't be able to "modify" any
mappings. If IBM says that that's possible, then that means that IBM has a
MAJOR vulnerability that they need to fix if their own domcfg template
allows bypassing the ACL. Here's more information from IBM on that. If you
set Anonymous to No Access, you'll need to still allow reading public
documents. http://www-01.ibm.com/support/docview.wss?uid=swg21230037

Also, open up catalog.nsf and sort ACL by name. Look at Anonymous and make
sure that there are no other db's with anonymous allowed - set them all to
No Access.

For HTTP TRACE, that's a pretty common recommendation as well. You should
be OK changing that.


---------------------------------------------------

Thanks,
Chris
Personal Blog: http://cwhisonant.tk
Work Blog: https://www.socialbizug.org/blogs/lotusnut

On Wed, Mar 16, 2016 at 4:22 PM, Rob Berendt <rob@xxxxxxxxx> wrote:

> We have IBM doing some benevolent hacking.  They've come up with some
> recommendations like the following:
> Any problems with their recommendations
>
> Description:
> The Domino server has been configured to allow anonymous access to the
> Domino Configuration Database (domcfg.nsf).  This database would allow an
> attacker to view and potentially modify URL mappings, URL redirection, and
> other administrative functions of your Domino site.
>
> Vulnerability Solution:
> Open the database in the Lotus Notes client and edit the ACL.
> Change the access level for Default and Anonymous to "No Access".
> If this information is not critical for distribution to other domains,
> also restrict access for OtherDomainServers to "No Access".
> For all entries set to "No Access", also verify that the "Read public
> documents" and "Write public documents" are unchecked.  If not, access
> will still be permitted for any public documents.
>
>
>
> Description:
> The HTTP TRACE method is normally used to return the full HTTP request
> back to the requesting client for proxy-debugging purposes.  An attacker
> can create a webpage using XMLHTTP, ActiveX or XMLDOM to cause a client to
> issue a TRACE request and capture the client's cookies.  This effectively
> results in a Cross-Site Scripting attack.
>
> Vulnerability Solution:
> Lotus Domino
> Disable HTTP TRACE Method for Domino
> Follow IBM's instructions for disabling HTTP methods on the Domino server
> by adding the following line to the server's NOTES.INI file:
> HTTPDisableMethods=TRACE
> After saving NOTES.INI, restart the Notes web server by issuing the
> console command "tell http restart".
>
>
> Rob Berendt
> --
> IBM Certified System Administrator - IBM i 6.1
> Group Dekko
> Dept 1600
> Mail to:  2505 Dekko Drive
>           Garrett, IN 46738
> Ship to:  Dock 108
>           6928N 400E
>           Kendallville, IN 46755
> http://www.dekko.com
>
> --
> This is the Lotus Domino on the IBM i (AS/400 and iSeries) (Domino400)
> mailing list
> To post a message email: Domino400@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/domino400
> or email: Domino400-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/domino400.