Tag Archives: Security

Securing Domino Protocols against Brute Force Attacks

Since years i think that the Internet Lockout Feature of IBM Domino is not enough. The function is documented here: IBM Domino Administrator Help

Cite of this document:

There are some usage restrictions for Internet password lockout: You can only use Internet password lockout with Web access. Other Internet protocols and services, such as LDAP, POP, IMAP, DIIOP, IBM® Lotus® Quickr®, and IBM Sametime® are not currently supported. However, Internet password lockout can be used for Web access if the password that is used for authentication is stored on an LDAP server

So documentation tells us, that only HTTP can be secured through inetlockout.nsf and over years the documentation was right. So protocols like LDAP, SMTP or POP3 are prone to dictionary attacks.

Last week at a customer site i can’t login into IBM Connections, even with the right spelled password. After checking the Domino server i found that the user has an entry in the inetlockout.nsf database. That was the first time that i had this behavior, Domino server was version 8.5.3.

Today i had some spare time and checked the other protocols of my demo server for my AdminCamp sessions next week.

So i secured SMTP, POP3 and IMAP for authentication and started to use the wrong password for login and i tried to test wrong passwords on LDAP authenticated Sametime and Connections. What should i say? I was lockedout through all protocols! Martin Leyrer points me to following technote, where the feature is mentioned to secure SMTP against brute force. That’s the only document i can find where the extended inetlockout is mentioned or documented. lockout

I don’t know how many of my customers or friends asks for this feature, but we talked often about this. That’s a feature we asked long time and which is really important for all deployments of Domino with internet access. Now all important protocols are save against brute force or dictionary attacks.

So great news, but the documentation must be updated and the feature must be officially announced.

Why?

  1. It is a really important security feature
  2. If you use already inetlockout for http and you update your Domino server, the feature is active without any additional work! Good for security, but your helpdesk team could be a little bit surprised.

Which Domino version first had this code icluded?

When you want to know how to deploy the lockout feature, please read documentation and this technote.

Update:

I got a mail that with 8.5.3 FP6 only SMTP and LDAP are working with inetlockout. I can’t test this in the moment, but with 9.0.1 pop3 and imap are secured too. Need to test this back with lower version and diiop.

nginx

You can use nginx as a reverse proxy for mail protocols. So this is a way to add SHA256 enabled certifiers in front of your domino servers.

New OpenNTF.org project: Administration Scripts for WebSphere

I started a new project on OpenNTF for the collection of scripts we created to speed up and simplify WebSphere and Connections Administration.

Link to this project: Administration Scripts for WebSphere

In the moment most of documentation is only as comment in these scripts. Descriptions can be found in Github and Slideshare.

Highlights

  • J2EE Security Role Backup and Restore
  • Set initial Security Roles for Connections Applications (Author: Klaus Bild)

Documentation

When you want to start with this collection, copy the jython script to your Deployment Manager bin-folder ($WAS_HOME/profiles/Dmgr01/bin) and call the scripts with wsadmin.sh -f scriptname

I will create more documentation in the next days. Please use the slideshare documents and icon uk presentation to begin using and coding jython.

Dannotes

I will presentate some of these scripts on 50. Dannotes on Thursday 28th November in Korsør.

Hardening Connections – Part 1: IBM HTTP Server

Preamble

Before i begin with my securing article, i want to say something on security on IBM Connections. Mainly i don’t like the thing, that IBM only support very special versions of software.

So we must use WebSphere 7.0.0.21, DB2 9.7.0.5, IHS 7.0.0.11 and so on. Each product had updates the last months and i think we won’t get support when we use other versions.

So i have to chances. On the first side i can update my software to limit vulnerabilities and get perhaps no support, or i will have vulerable software with support.

Just my 2 cent and i hope i will get answer, if i will get support with higher program versions.

SSL and IHS

One of our customers had a pentest the last months and had some vulnerabilities with IBM HTTP Server (IHS), which is used to access IBM Connections.

I used a 2048 Bit key for ssl which was generated with iKeyman, but the pentest doc told me, that short keys were used for encryption (smaller 112 bit). So i read a little bit.

This 2048 bit mean the public key of my hostkey. SSL uses this key to encrypt the connection between browser and webserver. Within the ssl handshake session keys are generated on basis of this hostkey. Browser and Server check which protocols are enabled on both sides and use one of the protocols both support.

You can check your SSL enabled server here: https://www.ssllabs.com/ssltest/index.html.

Information on ciphers with IHS: http://www-01.ibm.com/software/webservers/httpservers/doc/v10/ibm/9acdciph.htm

You can limit the available ciphers and protocols on your IBM HTTP Server.

First you should disable SSL v2: SSLProtocolDisable SSLv2

I configure the directives in my virtual hosts section:
...

<ifmodule mod_ibm_ssl.c>
Listen 0.0.0.0:443
<virtualhost *:443>
ServerName  connections.example.com
SSLEnable
SSLProtocolDisable SSLv2
SSLCipherSpec 3A
SSLCipherSpec 34
SSLCipherSpec 35
SSLCipherSpec 2F
SSLCipherSpec 35b
</virtualhost>
</ifmodule>

...

Poorly TLS v1.1 and v1.2 support comes with IHS 8 and we can’t use it with IHS 7.

This is my first article on securing IHS and Connections. Next part will continue with IHS, i want to disable some parts, which comes with the default httpd.conf and are not used with connections.

SSL VPN von Ubuntu zu Watchguard Firebox

Endlich hab ich es geschafft. Mit kräftiger Hilfe von einigen Twitternutzern, ist es mir gelungen mit Openvpn eine VPN-Verbindung zu unserer Watchguard aufzubauen.

Als erstes sollte man sich die Datei client.wgssl von der jeweiligen Firebox besorgen. Diese Datei kann man am Einfachsten direkt von der Firewall herunterladen:

https://gateway:4100/?action=sslvpn_download&filename=client.wgssl&usern
ame=my_name&password=my_password

Die Datei umbenennen in client.wgssl.tgz und schon kann man sie mit
tar -xvzf client.wgssl.tgz entpacken. Man sollte folgende Dateien erhalten:

  • ca.crt
  • client.crt
  • client.pem
  • client.ovpn
  • VERSION
  • MD5SUM

Ich habe diese Files nach /etc/openvpn verschoben, da es mir erst nicht gelungen ist, als User die VPN Verbindung aufzubauen. Um die DNS-Einstellungen vom VPN zu erhalten, muß man die Datei client.ovpn anpassen. Ich habe folgende Einträge hinzugefügt:

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

Außerdem sollte man das Paket resolvconf nachinstallieren.

sudo apt-get install resolvconf

Den Tunnel baut man dann mit:

cd /etc/openvpn
sudo openvpn ./client.ovpn

auf.

Problematisch ist noch das Beenden des Tunnels, da mit Strg-C zwar der Tunnel weg ist, aber die alten DNS-Einstellungen nicht zurückgestellt werden.

Networkmanager

sudo apt-get install network-manager-openvpn

Die Einstellungen kann man z.B. aus dem client.ovpn importieren. Manche Einstellungen sollte man dann noch etwas anpassen. Bei mir funktionierte die Verbindung erst richtig, als ich die Option “Use this connection only for resources on its network” (unter Routes) aktiviert hatte.