Empty ACL, Default Manager - is there a reason or is it a HUGE security flaw?

HCL Domino Domino Forum
1

Hi Everybody!

I have the following problem: some users files had their ACL changed to Default - Manager, and all other access (the user, administrators, LocalDomainServers, etc) have been deleted.

Other facts:

  • the ACL Log is empty (!)

  • the “last modified” points to a date where the user should have done it by himself, and it appears like this in the server Log.nsf, but it happend to about 40 users (of 800), on different dates. It could not have been them because the ACL Log does not show their activities, but it logs the adds we do to turn back the security rights (default, otherdomainservers and anonynmous noaccess, user,admins and localdomainserver manager)

  • DB Analysis shows the same (user updated the ACL of his mailfile).

  • if a user has delegated access to someone, it appears in ACL and in ACL log, but the default remains manager and every other access right is removed.

  • restoring from backup we noticed that the file was created correctly, so it happened after the creation, during some other process we cannot find which.

If the server does it by itself or the database has corrupted and the way it was fixed by Domino is doing the “default manager” thing, so it is a HUGE security flaw.

Server is 6.5.1 on Sun Solaris 8 (clustered on 2 boxes), clients are 5.0.9 - 5.0.12 on W2k and WXP.

Any idea of a cause for this occurence? IBM? Iris?

TIA!

2

Subject: Empty ACL, Default Manager - is there a reason or is it a HUGE security flaw?

My first thought is that you might have some nasty logic in your template (these are mail databases ?) that is programmatically changing the ACL.

If your users have manager rights (generally true) then this logic could be doing what you described.

In your position, I’d be ripping the template apart and looking for any Lotus Scrip code that is manipulating the ACL.

Clearing the logs would be tricky, as I don’t think there are methods to access them. However, they are stored in a system document , and that can be accessed through the API, so it’s feasible that code could be written to erase them to hide the tracks of the (presumed) perpetrator.

3

Subject: RE: Empty ACL, Default Manager - is there a reason or is it a HUGE security flaw?

Hi Graham, thanks for your answer.

As you guessed, yes, they are mail databases.

I had searched all files in server and did not find a database that could do that action. All mail databases use the default corporate template (customized from the 5.0.4 mail50.ntf), and it did not seem it had a code to empty the acl and leave the default as manager.

Do you know if there is a log in which we could see if someone had cleared the ACL through API and not register it in ACL-log?

It still would be stranger because the ACLs were not affected all at once, but through a period of 1,5 year… almost 2 per month. And we have detected it only a few days ago.

Cheers,

Edson