Lotus Domino Administrator 7 Help - Lotus documentation

For more information on connecting a server to the Internet and passthru servers, see the chapter ″Setting
Up Server-to-Server Connections.″
TCP/IP security considerations
In a TCP/IP network, configure all Domino servers to reject Telnet and FTP connections. Furthermore, do
not allow file system access to the Domino server or the operating system on which it runs, unless you
are sure you can properly maintain user access lists and passwords and you can guarantee a secure
environment.
If you use the Network File System (NFS) without maintaining the password file, users can breach
security by accessing files through NFS instead of through the Domino server. If this ″back door″ access
method is needed, isolate the network pathway on a LAN NIC and segment, and make sure that the
ability to access files through NFS is exclusive to this isolated secure network.
Mapped directory links and Domino data security
To ensure data security, do not create a mapped directory link to a file server or shared Network
Attached Storage (NAS) server for a Domino server. These links can cause both database corruption and
security problems.
Database corruption
If the network connection fails while the Domino server is writing to a database on the file server or
shared NAS server, the database can become corrupted. In addition, the interdependence of the file
sharing protocols -- Server Message Block (SMB), Common Internet File System (CIFS), and Network File
System (NFS) -- and the remote file system can affect the Domino server’s performance. Domino
sometimes needs to open large numbers of remote files, and low latency for read/write operations to
these files is desirable.
To avoid these problems on Domino servers, consider doing one or more of the following:
v Create an isolated network and use cut-through (non-buffering) layer-2 switches to interconnect the
Domino server to the NAS system.
v Limit access to the NAS system to the Domino server.
v Reduce the number of hops and the distance between hops in the connection pathways between the
Domino server and the storage system.
v Use a block protocol instead of a file protocol.
v Use a private storage area network (SAN) instead of a shared NAS system.
v Avoid creating any file-access contention between Domino and other applications.
To avoid problems with Notes workstations, consider doing the following:
v Locate Notes workstations so that they are not accessing a remote file server or NAS system over a
WAN.
v To minimize the risk of database corruption because of server failure when a Notes client’s Domino
data directory is on a file server or NAS server, evaluate the reliability of the entire network pathway
as well as the remote system’s ability to maintain uninterrupted sessions to the Notes client over the
file sharing protocols it is using (SMB, CIFS, NFS, NetWare Core Protocol, or AppleShare).
v If a Notes client’s Domino data directory is on a file server or NAS server, remember that only one
user (user session) can have the user data directory files open a time. Lotus Notes does not support
concurrent access to the same ″local″ database by two clients.
Security problems
When ″Encrypt network data″ is enabled, all Domino server and Notes workstation traffic is encrypted.
However, the file I/O between the Domino server and the file server or shared NAS server is not
encrypted, leaving it vulnerable to access by unauthorized users.
16 Lotus Domino Administrator 7 Help