22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

11.2 HTTP server security<br />

New for<br />

Domino 6<br />

Starting with Domino 6, Lotus Domino has a completely new HTTP server. This<br />

new HTTP “stack” is more modern than the original code that was incorporated<br />

into Domino at the time of the introduction of support for the HTTP protocol with<br />

Domino 4.5. This new Domino 6 stack no longer incorporates legacy HTTP code<br />

components from the original <strong>IBM</strong> HTTP server (also known as ICS). This means<br />

that Domino 6 has changes in its HTTP stacks API support.<br />

The new stack includes enhanced Web site/virtual host administration, HTTP 1.1<br />

persistent connections, and improved session handling. From the security side of<br />

things, there is also better denial of service (DOS) attack handling, with more<br />

administrative control over the number of path segments, max header size, URL<br />

length, and so forth. One can also do IP filtering with wildcards by having access<br />

or deny lists based on IP address.<br />

Additionally, the new stack includes improved HTTP plug-in support to allow for<br />

the ability to plug the Domino HTTP server into third-party Web servers<br />

(including putting a firewall between the Web server and Domino), and an<br />

extended/improved DSAPI plug-in to make it easier to write custom plug-ins to<br />

the Domino HTTP server. These two features (DSAPI and HTTP plug-ins) are<br />

described in more detail in the next two sections.<br />

11.2.1 Domino Web Server API<br />

The Domino Web Server Application Programming Interface (DSAPI) is a C API<br />

tool that lets you write your own extensions to the Domino Web server. These<br />

extensions, or filters, let you customize the authentication of Web users.<br />

At the time of Domino 4.6.1, the original <strong>IBM</strong> Web Server (ICS) was renamed as<br />

the Domino “GO” Web Server, and the common API for both Domino and this<br />

new Domino “GO” server was called GWAPI (Go Webserver Application<br />

Programming Interface). However, starting with Domino 5.0, a new, totally<br />

cross-platform API was provided to extend the functionality of such custom<br />

plug-ins. This Domino 5 DSAPI interacted with the “legacy” ICS HTTP stack that<br />

was still part of Domino 5, so it still provided GWAPI compatibility (though not<br />

advertised, just tolerated compatibility). This was a source of complexity and was<br />

streamlined in the new Domino 6 HTTP stack, which includes an improved<br />

DSAPI.<br />

Given the historical changes in the DSAPI, it is important to examine any<br />

R5-based DSAPI plug-ins that may exist in your architecture when upgrading to<br />

Domino 6. Despite the fact that a DSAPI designed for Domino 5 “could” run in<br />

Lotus Domino 6, if it has not been designed to support the new HTTP stack<br />

architecture, it may not perform optimally. In other words, it may be functioning,<br />

Chapter 11. Domino/Notes 6 security features 447

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!