Re: OT : Domino WebServer available for INTERNET ?

On Tue, Jun 11, [email protected] wrote:

> a simple , silly question : 
> 
> we have 2 domino servers and want to serve some mail-dbs for 
> Internetusers.
> So we want to activate the domino-webserver to be able to access the 
> mail-dbs.
> one of this domino is in a dmz, the other is in the internal network.
> 
> is it necessary to place the domino into a dmz ?

If you want to have direct access to the Mail DB via the Notes Web
access, yes. (All other solutions involving NAT or similar techniques
like reverse proxying are IMHO nonsense from a security point of view.)

> are there any probs with replicating the mail-dbs ?

No, if you let the internel domino server access port 1352/TCP on the
dmz domino. You should initiate the replication from the internal
server. 

Additionally, you have to take only to provide https (port 443/TCP) to
the outside. Beware of opening 1352 to the externel network. You should
consider to use a firewall on the dmz domino like SuSEfirewall2 or
similar.

Make sure, domino is only talking SSL on port 443. Hint:
(http://IP_of_this_server:443) has to fail. This has to be configured in
domino.
> 
> did anybody have such a solution realized ?

yes. I would also recommend to install an externel SMTP mail relay on
postfix (or similar) basis since SMTP incoming/relaying protection is
seems not to be one of dominos strongest features. But thats personal
preference.
 
> 
> which security features should be activated ? i guess at least ... ssl ?
> 
Yes. I'd say _only_ https! You can consider to use additionally X.509
client certificates for authentification, but I never configured this
with domino.
 
> thank you all !
> Bye
> Bruno

Hope that helps,

Ingo

-- 
Ingo Börnig   -   SuSE Linux AG Professional Services   -   DU Central
        Marie-Curie-Straße 11-17  -   D-53757 St. Augustin
Tel.:+49-2241-92917-0 	 			Fax:+49-2241-314599911
Office Dortmund: Tel.:+49-231-47797-105   E-Mail: [email protected]

-- 
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]