22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

172 Lotus Security Handbook<br />

cache directives. This prevents dynamic Domino content from being cached<br />

when it should not be.<br />

Additionally, the main elements cached by caching reverse proxy servers are<br />

images, Java class files, and image resources. Unfortunately, Domino handles<br />

some images in a manner in which most proxy servers will not recognize them by<br />

default. To provide support, the proxy server must be configured to recognize<br />

two Domino design elements as cacheable entities:<br />

?OpenImageResource<br />

?OpenElement&FieldElemFormat=gif URL<br />

In <strong>IBM</strong> WebSphere Edge Server, this is implemented via “Last Modified Factor”<br />

settings.<br />

5.4.2 HTTP Methods required for Domino<br />

The HTTP Methods support of most proxy servers allows you to define request<br />

types serviced by the proxy server. There are several turned on by default in<br />

most proxies, but the only ones Domino needs to function are GET, HEAD, and<br />

POST. The others are unnecessary and could pose a security risk.<br />

5.4.3 URL mappings required for Domino and Domino-based<br />

products<br />

It is possible to configure a proxy rule for a “pass everything” type of<br />

implementation that will support Domino-based technologies. In fact, this may be<br />

the default setting on many proxy servers.<br />

requests for /* go to http:// xxx.xxx.xxx.xxx/*<br />

In such a case, the rule specifies that if the request does not match any in the<br />

default rule set, then the proxy forwards the request to the server requested,<br />

regardless of what is being requested on the server.<br />

While such a setup may be simple, it is risky, because it allows direct access to<br />

any resource on the Domino server accessible via HTTP.<br />

As an alternative, a specific set of rules can be defined to limit access to only the<br />

functionality needed. For example, the rules for a typical Domino infrastructure<br />

utilized for iNotes would look as follows:<br />

requests for /mail* go to http://xxx.xxx.xxx.xxx/mail*<br />

requests for /iNotes/* go to http://xxx.xxx.xxx.xxx/iNotes/*<br />

requests for /inotes5/* go to http://xxx.xxx.xxx.xxx/inotes5/*<br />

requests for /icons/* go to http://xxx.xxx.xxx.xxx/icons/*<br />

requests for /domjava/* go to http://xxx.xxx.xxx.xxx/domjava/*

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!