I work as an internal auditor at a mid sized (around 600 employee) company. Currently, I am auditing the IT department. During auditing I figured out that anyone can access other people’s mailboxes and open them/view them. (we use lotus notes 6)
At the server I found the Company’s Domino Directory / Adress book directory database or whatever it is called. (FOR YOU TO UNDERSTAND WHAT KIND OF DATABSE THAT IS: when the admin cut off my access to that database my address book didnt work. “access is forbidden” message came) I clicked on some person’s name and a new window opened-showing the database’s properties. The UserID of the person was there too. I copied it on my C drive, and following the steps (switch user id/open database) I opened the person’s database and viewed them.
As a curious internal auditor I checked some other people’s databases and saw this:
At the administration tab of someone’s database properties there is a “client Information” area where it includes “notes client machine”. At some people’s databases, in that area, it was written 3-4 computers’ name some of which is not that person’s computer.
My questions are:
How can my IT department fix this problem? (I told them to copy the COMPANY’s DOMINO DIRECTORY without ID’S and delete the old one…they said there will be caos)
at the “notes client machine” area, what it is written-what do those computer names mean?(are those the ones who opened that database)
Are there anly logs showing who copied the IDs to their computers?
Are there any logs to see who accessed whose database with the UserID they copied?
I will be more than pleased if you can inform me on this.
Subject: Security flaw-accessing other people’s databases
How can my IT department fix this problem? (I told them to copy the COMPANY’s DOMINO DIRECTORY without ID’S and delete the old one…they said there will be caos)
USe ID recovery
To recover from loss of, or damage to, an ID file, recommend to your users that they keep backup copies of their ID files in a secure place – for example, on a disk stored in a locked area. Losing or damaging an ID file or forgetting a password has serious consequences. Without an ID, users cannot access servers or read messages and other data that they encrypted with the lost ID. To prevent problems that occur when users lose or damage ID files or forget passwords, set up Domino to recover ID files.
at the “notes client machine” area, what it is written-what do those computer names mean?(are those the ones who opened that database)
Are there anly logs showing who copied the IDs to their computers?No
Are there any logs to see who accessed whose database with the UserID they copied?
no, the only thing you can have is “user activty” but it won’t tell you who was behind the computer (If the ID was stolen)
From the Admin help
Issuing new public keys for a Notes certificate
If you suspect that an ID has been compromised because it was lost, stolen, or copied without permission, you can create a new public key for the ID. Creating a new public key allows you to maintain other parts of the ID – for example, the encryption keys – rather than create an entirely new ID, so that users can still use their old keys to decrypt encrypted email.
Notes users can create a new public key for the Notes certificate. The new public key must be certified before it can be used by Notes.
After certifying a new public key, you should set up servers to verify public keys. Public key verification involves matching the public key stored in the Domino Directory with the public key on the ID. Verifying public keys prevents an unauthorized user from using the ID with the original public key to access the server.
Note This is done in addition to the key verification done by validating the certificate presented by the user during authentication.
For more information on verifying public keys, see the topic To verify a Notes public key.
Subject: Security flaw-accessing other people’s databases
Sounds like whoever is doing the Notes Administration at your company needs to take “Admin 101” to learn basic security practices.
To prevent other users from opening and reading other’s mail use the ACL. Check the access level of -Default-. This is typicallt set to No Access.
The machine names written to this field are the machines the users logged onto their home mail server with. I’m not usre how oftne this is recorded or how long a machine name will saty there if it’s not used. My guess is this is updated daily when StatLog runs but I don’t know for sure. May be updated by Dynamic Client Config process also.
No logs for this. I would recommend getting the ID’s out of the Domino Directory and storing them in a secured folder on the network or in an Encrypted database within Lotus Notes. Check out ID Manager from Help Software.
The server log (log.nsf) keeps track of user access for servers and databases. There’s also an activity log in each database. But if someone is using someone else’s ID there is no way to know who is using it. It is assumed that each user guards there own ID and does not share their password with anyone. Which leads me to a question: when you saved an ID to your PC and switched to it in Lotus Notes were you prompted for a password? If not I could see this as a major security flaw. The person creating the IDs has the password quality set to “0”.
I’d say it might be a good idea to bring in a consultant to evaluate your security model and make suggestions.
Subject: Security flaw-accessing other people’s databases
Marcus,
This is not a security flaw, this is a weak implementation of Lotus Domino security. Domino is very secure when implemented properly and in your case, it was not.
Being the auditor, I would come down hard on the IT group and have them find a solution for moving the ID files out of the domino directory and off of the invalid user’s machines. When a user is created, the notes administrator has the ability to store the ID in the directory or store it out on the file system - your group obviously did not know how to create users properly to have a secure Domino environment.
There are no logs indicating which ID file was copied or detached from the domino directory. There are creative solutions that can be developed to fix the problem and I would ask IT to come up with a solution. There are many solutions and answers to your questions and they can be found in this forum. A login script can be executed to search the user’s system for .id files and write this information out to a log file. At least you would know which users have invalid id files on their systems.
I did not mean to be negative or condescending but If your group does not have domino expertise (and it sounds like you don’t), I would recommend hiring a domino consultant to resolve your issues.