Hi
Could anyone point me in the right direction or give my any information about the potential security risks or limitations of running the http task on your main production server? I’ve always been under the impression that it was a bit of a security risk but I can’t seem to find anything to back up my thinking.
Thanks
Ang
Subject: HTTP - Security Issues / Limitations
In the past some admins were in the habit of allowing anaonymous access to system databases such as the PAB.
Run http on that and anyone can go to http://yourserver/names.nsf and find out a lot of stuff you probably don’t want them to know.
All you realy need to do is ensure that ACLs on databases on a Domino http server are set correctly. This would mean no anonymous access to any system database and a very good reason for allowing anonymous on any other database.
Subject: HTTP - Security Issues / Limitations
Angela,
Everything is a security risk, it’s just a question of scale and cost-effectiveness.
The most ideal solution, would be to have an outside notes server (replicating via a different-connection method) in a DMZ between firewalls.
Of course, acessing replicated databases can create other problems, depending upon the degree of immediacy required and the size and number of databases to be accessed.
You need to decide whether you are just using http for remote access to Notes DBs, and if so, could this be run from a PC with a VPN connection.
If however, you’re providing services for the public (or an extranet), then you will need to run the http service. You may want to store your other (sensitive) data on a different server.
In any case, the risk is lower if you have a good firewall and have secured your database ACLs (particularly the address books), and your server configuration documents, then you shouldn’t have any trouble. (touch wood).
Gavin.