Security issue with names.nsf

[spi200]

All


Our security team ran a PEN test on our Domino Web server and found that the names.nsf could be read form the web. There was only read only access to authenticated users, however there is a great deal of detail contained in there that you would not want to be shown to other web users.
Have any of you seen this:
http:\\servername/names.nsf
Once you authenticate you can browse away. A user with limited right could attempt to hack other account names such as admins etc.
Does anyone know how this can be avoided as my application will not work unless it has "Read" to the names.nsf database.
I have checked version from R4.6 to R6.5 and appear to all fail in my environment.

Any help would be appreaciated.


Dave.

 

[m4ilm4n]

That's how it's designed - once you authenticate to the server you get to see the address book.

What do you mean by "other web users"? Do you mean Internet-based users or just other web users within your network?

 

[spi200]

Thanks m4ilm4n

We have external customers who connect via SSL to our Domino Web Server. Its a mission critical financial application and would prefer that these uses did not see all the details of our names.nsf. Info in names.nsf includes email addresses, group names, test users, Admin names etc. etc.
I guess if that is the way its designed then there is not much I can do about it.

Regards


Dave

 

[m4ilm4n]

You could try putting your more sensitive stuff into another address book and using a cascaded names.nsf config. We put all our administrative addresses (groups, customer notification lists, et al) in a cascaded names.nsf.

 

[spi200]

Hi

Not sure how to cascade the names.nsf, but have cleaned up all my users and groups and assigned stronger passwords to all users.
Not sure how to set a minimum password length for web users, so if any knows a way let me know.
I will post a specfic question for this.


Thanks

Dave.

 

[m4ilm4n]

My bad - in older versions of Domino (think v5) it's called cascaded address books; since v6 it's called Directory Assistance. Search for it in the Domino Admin help - there's tons of info on it (hey, if I can set it up anyone can).

For password length, in Domino 7 admin, from the People & Groups tab go to Policies/Organizational Policies. Open your root organization doc and click on Organization Security Settings. The Password Management tab has what I think you're looking for.