Security Question

HCL Domino Domino Forum
1

I have two issues and follow up questions…

I tend to be quite wordy, I will try not to be and aplogize in advance if I am.

I have researched quite a bit (this forum, security redbooks on R5 and R6) and cannot find a couple answers. Your help would be appreciated.

We have been a notes shop since R3. We are just testing our understanding of security (currenly on R6.0.1 - previously on R4.6, skipped over R5).

ISSUE #1: It used to be in 4.6 that a laptop user, opening there local client, could eventially open up client without entering the userid password, by "esc"ing past error messages. This was a potential security problem in the case the laptop was stolen - some data could be accessed (depending on ACL, etc)

Now in R6 with the new password entry box, I have tried every which way to open the client without a password and I cannot.

QUESTION #1: Is this a true statement, did a change occur to make the client more secure, and if so, can you point me to any documentation specifying this change?

ISSUE #2: In database properties, under encryption settins, if you select “Do not locally encrypt…” the help text in that window states: “This database can be opened without a user ID if someone gains physical access to this computer… if the database is on a laptop that is lost, anyone who finds the computer can open the database without the password to your user ID” - I have found similar statments in User Security, on R6 Technical Papers, etc…

If my ISSUE #1 is TRUE, then the Lotus statement in ISSUE #2 is FALSE.

It seems to me the statement should actually state that ‘anyone finding the laptop, who can gain access to ANY notes ID and password, can open the client, thus gaining access to local databases that are not encrypted AND ACL is not enforced’

QUESTION #2: How can a user without an ID or password, get to data, encrypted or not? Please help in clarifying this.

Thank you all for your input.

2

Subject: Security Question

Actually, you could also manipulate the NOTES.INI file to cause the Notes client to think it was a brand-new install, in which case, you have the option to generate an ID file.

Also, if the database is unencrypted, it’s accessible through the API, with or without an ID file.

Oh, and the answer to Question #1 is yes. It’s a security enhancement, but it’s figleaf protection (due to the items mentioned above.) You can probably find documentation in the release notes database.

3

Subject: Security Question

First off, I agree with the previous responses. Anybody with a file on their hard drive that is not encrypted can read it. Period. Even if you cannot start a specific program that knows how to read it, you can open it in a binary-capable editor and look for text strings, or attempt to reverse engineer the format. That’s not security; that’s obscurity.

Issue 1: You are correct in that the behavior of starting Notes was deliberately changed in 5.0. However, this was not a security enhancement, it was a usability enhancement. Prudent risk analysis would assume that an attacker with access to a copy of the Notes client would also be able to acquire an ID file that they can use to start the Notes client.

Issue 2: Emacs doesn’t require an ID file to start. Neither does the unix “strings” command. ACLs are only truly useful from a security perspective when the file/database/document lives on a server that is willing to enforce them, and is the only means to acquire said file/database/document from that server. ACLs on a database won’t help you if the server’s data directory is a public windows share or exported through NFS, or if anybody can perform remote logins as root/administrator using a password of “password”. The only sound defense against an attacker with local access to the data is to encrypt the data.

dave

4

Subject: Security Question

Scenario:

You are working for a company A while I’m in a company B. These 2 are totally independent. I get a hold of your laptop, copy your database on my system and access it as a local copy using my ID. As you may know, accessing DBs locally is possible as long as you can open Notes client.

cheers

ryan

5

Subject: See his point? You COPY THE NSF FILE to another machine and open it with another Notes client.

Although, if you really wanted to, you could always copy any ID file you know the password to onto the stolen laptop and launch the Notes client with it.