As you read elsewhere IBM have finally addressed POODLE and TLS 1.0 are now available for for these releases on all platforms, 9.0.1 FP2, 9.0, 8.5.3 FP6, 8.5.2 FP4 and 8.5.1 FP5.

Now just implementing these fixes may not completely protect you, (thinking BEAST attack here) unless you also disable both AES ciphers in Domino. Basically these are the two ciphers you want enabled:

Image:The Domino fixes for POODLE and TLS, you may not be done yet

It's worth pointing out that with the TLS1.0 fix IBM also addressed a long time pet peeve of mine, low quality ciphers:

Removed support:
  • SSLv2
  • SSL renegotiation has been disabled
  • All weak (<128 bits) cipher suites have been disabled


A good move but you still should really disable 128bit AES ciphers too. Indeed if you have 40 or 56 bit ciphers enabled then the Domino console throws this out:

Image:The Domino fixes for POODLE and TLS, you may not be done yet

If you *do* need to enable these low quality ones then you are doing something really, really wrong.


Disable the AES ones and you may just end up with a "B" grade at https://www.ssllabs.com/ssltest/index.html (the server below was also upgraded to SHA2)

Image:The Domino fixes for POODLE and TLS, you may not be done yet

If you want an "A" use my proxy server as Apache does support TLS1.2.

Now, IBM, you have brought us into 1999 with TLS 1.0, when do we get to the heady heights of 2008 and TLS 1.2? All kidding aside IBM have shown here that they can *still* do amazingly good work in a pretty short period of time. Once the SHTF it took less than 90 days for this to be addressed. Hopefully this is the shape of things to come and this sense of urgency for security will remain and not be left on the shelf until the next end-of-the-world-security-failure scenario.

I won't hold my breath for TLS 1.2 support, but I will cross my fingers.
Darren Duke   |   November 4 2014 04:49:27 PM   |    domino  tls    |   Comments [4]

I got this question from an STS customer:


My question ... is there something I can run from the server console to make sure everyone is set up for DAOS or it is working for all mail accounts?


Well, yes there is. Using a old Domino feature called Indirect Files, copy and paste and Excel. Let me show you how......

If you're on Domino 9 make sure to add the following to your server notes.ini, This will prevent compact from failing by preventing the Router from delivering mail to a compacting NSF (oh, how I wish we had this back in 8.5!!!):

MailFileDisableCompactAbort=1


If you are not on 9, you have to do it the hard way.....either the server needs to be down, you can quit the router or you can try and try again until you get the files compacted. Pick your poison, but I'd suggest the last option until you only have a handful of errant NSF's to do.

Either way, this is how I'd tackle this issue.

1) Go to the Files tab in Domino Administrator, mail folder and sort by the DAOS State tab (in the example below I only have two NSF's, in reality I'd do these manually, but if I had a few more I'd use the process I'm outlining here):

Image:Back to basics - how to DAOS enable (missed?) non-DAOS’d Domino mail files the easy way

2) You are interested in any mail file with a status of anything other than Read/Write. So select all those mail files matching this criteria, go to the Edit menu and select Copy :

Image:Back to basics - how to DAOS enable (missed?) non-DAOS’d Domino mail files the easy way

3) Open Excel (or your preferred spreadsheet app.....Symphony anyone? Bueller? ) and paste in the contents, you should end up with this:

Image:Back to basics - how to DAOS enable (missed?) non-DAOS’d Domino mail files the easy way

4) We're only really interested in the Physical Path column, you can delete everything else. In a new column enter this formula (in my example I've deleted all columns except Physical Path and moved it to the A column):

=RIGHT(A1,LEN(A1)-FIND("\mail\",A1))


Copy that cell (in my case B1) to the rest of the rows and you should end up with something like this (also remove the title row):

Image:Back to basics - how to DAOS enable (missed?) non-DAOS’d Domino mail files the easy way

5) Now select the column with the mail file names as relative to Domino  (not the file names, so in my case column B). Once selected "copy" to the clipboard:

Image:Back to basics - how to DAOS enable (missed?) non-DAOS’d Domino mail files the easy way

6) Now it's time to pay attention.... create a new blank workbook and paste the column using the Paste Special option:

Image:Back to basics - how to DAOS enable (missed?) non-DAOS’d Domino mail files the easy way

7) Select Paste Values:

Image:Back to basics - how to DAOS enable (missed?) non-DAOS’d Domino mail files the easy way

8) Voila, you now have a new workbook with just relative file names of mail files that are not DAOS'd. Save this new file as MS-DOS (*.txt) but use the suffix .IND for the file:

Image:Back to basics - how to DAOS enable (missed?) non-DAOS’d Domino mail files the easy way

9) Get this file on your Domino server. In my case it's on the D: drive called FiletoDAOS.IND. Once there run the following command from the Domino console:

load compact -c -i -ZU -v -n -daos on D:\FileToDAOS.IND


What this does is use an Indirect file (our .IND file) as the source of files to compact....if successful you should see the results on the Domino console:

Image:Back to basics - how to DAOS enable (missed?) non-DAOS’d Domino mail files the easy way

10) If your using Domino 9 and have that notes.ini setting chances are you will get the majority compacted....if your using anything less than R9 you may have to repeat these steps several times (each time getting less and less files to be DAOS'd).

There you go. You will now slowly whittle away at the non-DAOS'd mail files on your server. Sure beats typing on the console....especially if you have more than a few mail files to do.

11) To see if you still have any left to do, look at the mail folder in Domino Admin again (remember to F9). In my case all were completed.....:

Image:Back to basics - how to DAOS enable (missed?) non-DAOS’d Domino mail files the easy way

If yours are not, go back to step 1 and whittle away again......











Darren Duke   |   November 3 2014 05:00:47 PM   |    domino  daos    |   Comments [1]

I got an email from a customer the other day about mitigating POODLE with IBM's Lotus Protector for Mail Security (LPMS). There is a technote for this, 1687838. At the top there is an interesting warning:


IMPORTANT: disabling SSLv3 for XMail may cause severe incompatibility problems with other MTAs that do not support TLS 1.x


I was asked if this was an issue. My response:


It depends on who you are STARTTLS emailing to....

This only affects domains that you have set as requiring TLS between your server and theirs. So I'd check with them before you do it



Now, in reality I'd most likely leave SSLv3 enabled in my SMTP environment (I'm not talking about clients connecting here like Outlook, Thunderbird, just edge SMTP relay servers). My rationale (to date) here is laid out below:

Scenario 1 : Both SMTP servers can do TLS1.0+
1.        I send an email to blah.com
2.        My server and the blah.com are both enabled for STARTTLS
3.        The negotiate TLS1.0, the delivery transaction is encrypted between the servers and email flows

Scenario 2 : One server can (but is not mandated to) do STARTTLS, the other can't
1.        I send an email to blah.com
2.        My server sees that blah.com cannot do STARTTLS
3.        The email is sent in plain text and the email flows

Scenario 3 : Both servers can do STARTTLS, but one will only do TLS1.0+ and the other will do SSLv3.
1.        I send an email to blah.com
2.        My server and the blah.com are both enabled for STARTTLS
3.        The servers cannot negotiate a protocol, so no encryption takes place
4.        The email is sent in plain text and the email flows

Scenario 3 is the interesting one here. You tried  to send an email down an encrypted tunnel but you can't. Even though both servers could. Now POODLE is bad an all, but really, if two SMTP servers are trying to send email to one another via an encrypted tunnel and they fail back to plain text to avoid POODLE what good does that do? POODLE is a  man-in-the-middle attack vector, and you could argue that you have no idea where your SMTP transaction is going, but that's really all I can come up with for causing "fail back to plain text". It's not like you have your SMTP edge gateway servers sitting in a Starbucks hanging off their public wifi (if you are, then you really should disable SSLv3).

As President Obama used to say about same sex marriage, my thoughts on this are still evolving, but it sure feels like disabling SSLv3 on an SMTP server may lead to some unexpected results.

If your SMTP edge server is Domino, then you may have issues leaving STARTTLS enabled (as outlined by Frank Paolino) until IBM release the multi-protocol fix (which I think maybe in the 9.0+ fix, it's starting to get confusing about what fix is going where). But this goes back to my main point....in Frank's case ProofPoint have disabled SSLv3, so now Frank has to send plain text email to ProofPoint.

So, I'll throw this out to the world in general....what are you doing for STARTTLS?
Darren Duke   |   October 23 2014 11:47:17 AM   |    domino    |   Comments [1]

Behold, the silence has ended.....the crescendo that is IBM has finally lifted the veil on some fixes for some very large security holes....AFAIK these are native Domino fixes for all platforms. I'm unsure of the protocols supported, but my understanding is all of them, but only time will tell.

These are not available yet, but should be in "weeks"...

First up, fix POODLE outlined in Technote 1687167. This is coming to:
  • 9.0.1 FP2
  • 9.0
  • 8.5.3 FP6
  • 8.5.2 FP4
  • 8.5.1 FP5

I think that is every supported Domino platform.  

Second is SHA2 support and TLS 1.2 support, as outlined in Technote 1418982. This is coming to
  • 9.x

This is great news, however if you need TLS 1.2 or SHA2 on 8.5.x you are out of luck....but you can still use my reverse proxy for that scenario.
Darren Duke   |   October 21 2014 10:53:44 AM   |    domino    |   Comments [2]

In an effort to help Domino customers mitigate the disaster that is the SSLv3 Poodle bug, I am providing the virtual machine linked at the bottom of this post. Note, you can also use the IBM HTTP Server bundled with R9 if you are on a Windows server....if that is the case, stop reading.

YOU USE THIS POST AT YOUR OWN RISK. For professional services related to this contact STS Sales.


Take backup copies of any files you change, including the Domino Directory. That way if you screw up......


Read this in it's entirety before you start.....it is not for the faint of heart. I take no responsibility for you screwing up your environment. None.


This VM is an Ubuntu 14 LTS server (patched as of Oct 15th 2014) with Apache installed in a way to allow easy integration as a reverse proxy for a Domino server. This allows the user to disable SSLv3 and utilize TLS 1.0, 1.1 and 1.2  thus mitigating Poodle. The apache server will use the best cipher for the client connecting to it, so it will prefer TLS 1.2 if the browser can support it.

No warranty is implied or provided. You use this VM at your own risk. There is no guarantee this will fix any and all security problems. It is suggested that after install you check your installation here https://www.ssllabs.com/ssltest/index.html (although at the time of writing the test site didn't indicate SSLv3 as an issue....IT IS).

OK, so what do you have to do to get this thing working.....

1) You need to be able to install OVF virtual machine templates. If you don't have a virtual infrastructure then this may not help
2) You have Domino working as a web server, or iNotes, or Quickr, or Traveler
3) You want to fix the Poodle bug and you can't or won't wait for IBM to address this properly
4) You don't need Windows XP with Internet Explorer support (this VM uses SNI, XP with IE can't do SNI although I believe Firefox and Chrome on XP can....). If you need XP support I may create another VM. You never know.
5) You don't mind changing the HTTP settings of your domino servers, including adding new DNS records to your internal DNS servers.
6) You want to address Poodle, SHA2 and/or add TLS to Domino.

If all of these are a check marked, continue reading....

The VM contains one Apache site capable of handling three different scenarios, iNotes, Quickr and Traveler.

1) Go download the VM here (there is no warranty, implied or given by use of this VM)
2) Install the VM on your virtual hardware
3) Power up and log in (default is root/root)
4) Change the default password using the passwd command
5) Change the IP address assigned to the machine with vi /etc/network/interfaces command (change all of the settings here to match your network). If you don't know vi then google it.
6) Reboot
7) Get an Apache compatible SSL certificate from your provider. If you need to create a new CSR do not use Domino to do this, but rather use OpenSSL (installed on this VM if you don't have an installation). Your SSL vendors site will have instructions on how to do this, here are GoDaddy's instuctions. When you have the key file and the signed certificate for your site, sites or wildcard copy them to the /etc/apache2/ssl folder (your provider will also give you a "bundle" certificate, copy that over too).
8) Use WinSCP to log into the VM and navigate to /etc/apache2/sites-enabled and double click on the combined.conf

Image:Here is a freely available VM to reverse proxy Domino - shoot the poodle
9) The first two virtual hosts (signified by the tag) are iNotes, the second two are Quickr, the third pair is Traveler. If you don't need a particular host (you don't use Quickr for example), simply delete everything between the two corresponding and tags (including the tags themselves). TAKE A BACKUP FIRST....you might do this wrong.

iNotes: Image:Here is a freely available VM to reverse proxy Domino - shoot the poodle

Quickr: Image:Here is a freely available VM to reverse proxy Domino - shoot the poodle


Traveler : Image:Here is a freely available VM to reverse proxy Domino - shoot the poodle


10) Edit the file changing at least anything with an IP in it, anything with a domain name in it, anything with a server name in it and anything with an SSL certificate in it. Here is what needs to be changed for iNotes:

a) Take a backup of the Domino Directory before you change anything.....I'm not going to outline the Domino part, I figured if you're reading this you know that part.
b) Our Domino server was called webmail.yourdomain.com. We are now moving this name to Apache and have changed the Domino HTTP server to domino1.yourdomain.com.  (if you don't know how to do this, stop and hire me via the link above)
c) Our Domino server was also using HTTPS, but now we've turned this off for Domino and only HTTP is in use on Domino.
d) There is also a new internal DNS entry pointing domino1.yourdomain.com to the Domino server IP (this is not an external DNS entry, only internal).
e) Externally, webmail.yourdomain.com points to Apache (in this case 10.6.69.69).
f) Make sure you can ping the new domino1.yourdomain.com address from both the Apache server and the Domino server.

Remember, there are two Apache virtual hosts per Domino server....one that maps to HTTP that in turn redirects to the second one that handles HTTPS....

Below are the iNotes HTTP virtual host changes:

a) The vitual host address needs to the be the IP address of this VM
b) The host name's should match whatever URL your users use to get to iNotes, in this case webmail.yourdomain.com

Image:Here is a freely available VM to reverse proxy Domino - shoot the poodle



Below are the iNotes HTTPS changes:

a) The vitual host address needs to the be the IP address of this VM
b) The host name's should match whatever URL your users use to get to iNotes, in this case webmail.yourdomain.com
c) The SSL certificates need to match the ones you copied to the SSL folder, also update SSLCertificateChainFile to your providers bundle
d) The iwaredir.nsf needs to be changed to match your web mail redirector NSF file name
e) The ProxyPass and ProsyReversePadd host names need to be changed to your new iNotes server internal name (note this is also now a HTTP link, not HTTPS)

Image:Here is a freely available VM to reverse proxy Domino - shoot the poodle



11) Save the file
12) Restart Apache with the command /etc/init.d/apache2 restart
13) If you get errors, double check everything......and make sure to delete the vitrual hosts you don't need....like Quickr and Traveler for instance. After any changes restart apache
14) If it still doesn't work check the error log at /var/log/apache/ and look at the iNotes files.
15) If it still doesn't work then revert back to your original setup (I did tell you to take backups) and hire me.
16) At some point in the future, prevent Domino HTTP from being accessed anywhere but from the VM IP address.

This proxy has several advantages to IBM's approach of bolting IHS in front of Domino:
1.        You can have one and only one SSL certificate. I have a single wild-card certificate installed on the proxy and all proxied connections use this single certificate. That makes changing to SHA2/256 really, really simple.
2.        You don't have to patch server after server after server. One proxy, one set of patches.....heartbleed and shellshock anyone?
3.         I have significantly reduced my surface area on the web. Now all web servers traffic, be it Domino, Traveler, IIS or any other server are no longer directly connected to the evil internet.

In case you missed the link above, download the VM here (there is no warranty, implied or given by use of this VM).

AGAIN, you do this at your own risk. Unless your paying me to do this for you. you are on your own.
Darren Duke   |   October 15 2014 08:00:27 AM   |    domino  apache    |   Comments [4]

As some of you know, SHA2 support in the native Domino HTTP stack has been a bit of a fire starter of late. As IBM like to say "we've not heard that from our customers", here's your chance to change that.

How do you do that? Simple, if you are able to create a PMR against Domino (if you're on support for Notes and Domino you can) and mention that you want SPR # ABAI7SASE6 (APAR LO48388) addressed. Here's link to the IBM support portal, so head on over there and create an PMR via an Electronic Service Request (ESR) http://www-947.ibm.com/support/entry/portal/support

The actual technote about IBM Domino *not* supporting SHA2 is here http://www-01.ibm.com/support/docview.wss?uid=swg21418982

And because APAR and SPR are confusing, here's what they mean http://www-10.lotus.com/ldd/fixlist.nsf/0/e9c65ccbfc70cf4685256f8f00784bad?OpenDocument

What are you waiting for? Go be heard.





Darren Duke   |   August 20 2014 09:08:48 AM   |    domino    |   Comments [5]

August 19 2014 Tuesday

My customers don’t want Mail.Next

I have customers ranging from names you have heard of, to a few hundred seats, to  5 or less. I’m pretty sure that most customers I come into contact with are not on IBM’s radar. A few maybe, but most? Not so much.  Some of them occasionally ask about “mail.next” but none are excited. You see, these customers are not cutting edge. They are not chasing the next shiny ball of tinfoil. They cherish stability. Not constant change. Not constant “vaporware” demos of stuff that most think fluff. They  may not be cutting edge, but they expect anything they purchase (especially with the IBM name on it) to work. Just work. As advertised. Like they had always been promised when you buy from IBM.

Alas, this is not the IBM that exists any more. It is a shell of it’s former self. A veritable ghost town when you go looking for good technical folks. Product Managers and GM’s run awry creating and releasing software no one wants, no one uses and no one can install. IBM is a hell of a place to be an executive. No accountability that I can see. None. Nada. Zip. It appears to be the closest thing to an executive nirvana that has ever existed.

What my customers want is for IBM to fix things. Stop creating the fluffy, next big failure stuff. Just fix stuff you have already sold us on. The stuff my customers bought from you. The stuff I and IBM had promised works.  Except no, they won’t let things be fixed, to be made better. They just refuse to make an existing product better. That’s not what “executives” (now I need a shower after typing that word so many times) believe will keep them moving up. No, they have their 6-18 month plans.  And improving things is not a home run. Releasing something new is. Despite the odds that it will be an epic failure. But, no, up they go, off on their shareholder value beanstalks. Leaving a crater of crap for us clean up like SHA1, 40 and 56 bit SSL keys, inadequate web administration tools, languished development tools, the list goes on.

I’m pretty sure when an IBM executive (I need a second shower now) replies with “we’ve not heard that from *our* customers” they really mean “no one in my organization will tell me the truth because I’m a vindictive asshole, so don’t cross me or I will end your career”. Either that, or man, they live on another planet.

My customers don’t want mail.next. They want mail.now. But they want it to work in a sane and functional way. My customers are usually right. They didn’t want Symphony, or Workplace, or Mashups, or Alloy. They did want Notes, Domino, Quickr and Sametime.

 IBM, you should really start listening to my customers. They are correct far more often than IBM and it’s analysts are.

Darren Duke   |   August 19 2014 01:28:16 PM   |    domino    |   Comments [38]

With a little over 18 months since I've had to produce weekly tips, you've most likely missed my gems (OK, some weren't gems, but you get what you pay for)....

Anyway, this one is a gem, and I'm sure most of you know this but I surely did not.

On any Windows folder, hold down the Shift key and right click you get these additional options added to your context bar:

Image:How did I not know this feature of Windows existed? AKA - a useful tip

If you do anything with Websphere on Windows this will no doubt save you a ton of time.

Again, how did I not know about this?
Darren Duke   |   August 8 2014 09:55:58 AM   |    misc    |   Comments [0]

IBM are off creating the next "great" thing with Mail.Next. I can see the value of going "client-less" (i.e. web) but hopefully IBM are looking at IdeaJam and implementing many, many, many of the outstanding usability suggestions out there. So here you have it, my best, and last, suggestion to IdeaJam (and can you believe some people still post out there????).
Darren Duke   |   April 22 2014 10:50:26 AM   |    ideajam    |   Comments [5]

I'm also going to update the original post, but it appears there was an issue with the command in that original post:

-compactThreads 0 -updallThreads 2 -stoptime 5AM


You will see something like this in the notes.log on the server:

Image:Addendum to my Domino DBMT post (well, a correction)

use this one instead:

-compactThreads 0 -updallThreads 2 -stoptime 5:00AM


Yes, the ":00" makes all the difference.
Darren Duke   |   April 8 2014 07:39:04 AM   |    domino  dbmt    |   Comments [2]