Cryoserver Archive Lotus Notes Configuration

Transcription

1 Lotus Notes Configuration Version 1.0 December 2007 Forensic & Compliance Systems Ltd +44 (0)

2 Contents INTRODUCTION... 3 SMTP ROUTING TO CRYOSERVER... 4 BASIC LOTUS NOTES JOURNALING... 5 ENABLING JOURNALING... 5 SETTING THE RULE FOR JOURNALING... 6 OTHER CONFIGURATION SETTINGS... 8 SERVER CONFIGURATION... 8 LDAP CONFIGURATION... 8 ENABLING THE LDAP SERVICE... 9 CONFIGURING LDAP FOR CRYOSERVER CRYOSERVER LDAP CONFIGURATION LOTUS NOTES MIME CONFIGURATION USER CONFIGURATION SPECIFYING HOW DOMINO LOOKS UP THE RECIPIENTS OF INCOMING SMTP MESSAGES KNOWN ISSUES NO JOURNAL WHEN BOTH INTERNAL AND INTERNET RECIPIENTS USED NO BCC GROUP INFORMATION MULTIPLE SERVER JOURNALING FCS. All rights reserved. Page 2 of 24

3 Introduction This document describes the basic method to route journal mail from Lotus Notes to Cryoserver. Journaling is a standard feature of Lotus Notes 6.5 that, by default, will journal mail to a specified Lotus Notes server. The mail stored in this specified server will contain the mail in encrypted form, together with Lotus Notes metadata relating to each . Cryoserver is used to replace the Lotus Notes Server journaling end-point. The down side of this current approach is that Cryoserver mail does not include Bcc recipient information and other final recipient details (known as the envelope ). Where the Lotus Notes server has integration with an LDAP service, distribution lists may be expanded by Cryoserver. Lotus Notes has supported Journaling since version 6.5. However, we can only recommend the use of Lotus Notes version fixpack 1 (i.e ) and later, as this resolves the initial journaling issues FCS. All rights reserved. Page 3 of 24

4 SMTP Routing to Cryoserver The generated by the Lotus Notes Journaling feature must be sent directly to Cryoserver using SMTP. To do this: 1. Create an SMTP document for the complianceinternet.co.uk domain, and associate it with a Foreign SMTP Domain document that specifies the IP address for the domain: Figure 1 - The Foreign SMTP Domain document. 2. Add a new Foreign SMTP Domain document and type in the IP address of your Cryoserver master server: Figure 2 - The Cryoserver Foreign Domain, routing details The complianceinternet.co.uk domain is not registered as a public end-point so any mail sent to this address on the public Internet will bounce FCS. All rights reserved. Page 4 of 24

5 Basic Lotus Notes Journaling You must specify: Enable Journaling for the local server or for all servers. A rule that filters the required s to the Journal. Basic journaling sends a copy of directly to Cryoserver using Lotus Notes SMTP services. This has the advantage of being very simple to configure. The main disadvantage is that BCC recipient information is not included in the copy sent to Cryoserver. Enabling Journaling To enable jounaling, you will need to edit the local server configuration document, for single server journaling, or the default global configuration document to enable journaling for all servers in a group. If you do not have a local server configuration document, but you want to enable journaling on a single server only, then you must create a new local configuration document and copy the configuration from the default document to the local copy. Then follow the steps below. In the Server Configuration document locate the Router/SMTP tab, or for the Messaging configuration document, locate the Messaging Settings tab. From there, click the Advanced tab and the Journaling tab. You can then enable Journaling, and send the journal to either a Mail-In database, or a local database. For basic journaling, use a Mail-In database, and key in the standard Cryoserver mail recipient address (cryouser@complianceinternet.co.uk) as the destination. The encryption exclusion list is ignored FCS. All rights reserved. Page 5 of 24

6 Figure 3 - Enabling journaling Cryoserver/Lotus Notes currently only supports Basic Journaling where a copy of every mail is sent via SMTP to the Cryoserver, using this mail-in database configuration. Setting the Rule for Journaling Normally, all will be journaled, but a specific set of mail can be journaled if required. A rule must be created in order for any journaling to occur. Figure 4 - Adding a rule for journaling 2007 FCS. All rights reserved. Page 6 of 24

7 NOTE: If the rules tab is missing, then you have an upgraded Lotus Notes system (the Admin template is not fully updated during an upgrade). In this case you will need to access the Global configuration document, via the Server branch from the tree view on the left. Figure 5 - The Journal Everything rule You need to ADD a condition, and ADD an action. The default condition and action will result in ALL mail being journaled FCS. All rights reserved. Page 7 of 24

8 Other Configuration Settings This chapter describes other configuration settings that may be required for Cryoserver to work with Lotus Notes. Server Configuration In a multi-server set up, each server will need the Journaling Enabled (as appropriate). If all servers use just the default server document, but you want to enable journaling on just a single server, then you will need to create a new server configuration document and copy all configuration from the default document into the new document. Then you can adapt the parts of the server document pertaining to Journaling. Figure 6 - Locating the All Servers document If you cannot see the * - [All Servers] entry, then click on the server document and press the UP arrow on the keyboard. You need to the global document in order to access the LDAP settings. LDAP Configuration Cryoserver can use a single LDAP service in order to perform two functions: Login Validation, where the user name and password that was entered into the Cryoserver Login web page is validated against LDAP using the following procedure: Access LDAP using a well-known user id, and perform a search to find the end users DN entry. Use the LDAP Bind feature to validate the Password, for the users DN. If the Bind succeeds, obtain the users internet addresses. Distribution List Expansion, using the following iterative procedure: Extract each address used in the . For each address, locate the entry in LDAP using a search from each BaseDN listed in the Super User configuration FCS. All rights reserved. Page 8 of 24

9 If a search is successful, use the primary address (if different to the address used in the which assumes that alias addresses are included in LDAP) If the search returns a distribution list, then read its list of members, and obtain the address for each entry, or repeat if the entry is another distribution group. Cryoserver does not currently support a dual LDAP interface, where the Login is validated against one LDAP system (e.g. Active Directory) but the address details are obtained from another LDAP system (e.g. Domino Lotus Notes). Note: LOTUS NOTES LDAP will authenticate the User Login against the users internet password. Lotus Notes does not require an internet password so these may need to be manually entered into the Lotus Notes Admin console, for the users who need basic search access to Cryoserver. Enabling the LDAP service 1. The LDAP task runs automatically on the administration server for the primary Domino Directory. On other servers in the domain, either change the ServerTasks setting in LOTUS NOTES.INI, or manually start/stop the service: Start: Enter Load LDAP at the console Restart: Enter Restart Task LDAP at the console Stop: Enter Tell LDAP Quit at the console 2. If your organization uses more than one Global Domain document, specify the one that the LDAP service uses to return Internet addresses to LDAP clients. Open the Global Domain document. In the "Use as default Global Domain" field, choose Yes. 3. (Optional) Customize the default LDAP service configuration. In many cases, the LDAP service default settings are adequate. 4. To check whether you set up the LDAP service correctly, use an LDAP search utility such as ldapsearch provided with Lotus Notes and Domino, to issue a query to the LDAP service. LDAP is accessed using a TCP/IP port. To enable this port: 2007 FCS. All rights reserved. Page 9 of 24

10 Figure 7 - Enabling the LDAP port The default un-encrypted port is 389. It can be altered, as shown here, if it conflicts with another LDAP system that is already running on the server. Figure 8 - Internet Sites should include an LDAP entry Figure 9 - Creating a site against which the LDAP will run 2007 FCS. All rights reserved. Page 10 of 24

11 Configuring LDAP for Cryoserver To see the LDAP Configuration document, locate the All Servers document, and click on the LDAP tab. You need to select the Lotus Notes objects and attributes that LDAP is to publish. Do this through the Global Configuration LDAP tab. Figure 10 - The LDAP record in the Global Configuration document Click Select Attribute Types to open a dialog box, where the User and Distribution Group attributes can be selected. Figure 11 - LDAP Selecting the Distribution Group attributes Make sure that you have selected at least cn. member and mail attributes for the dominogroup and dominouser objects. It will probably be best to click Add All. After selecting the attributes, scroll down to display the general LDAP settings, as shown in Figure FCS. All rights reserved. Page 11 of 24

12 Figure 12 - LDAP Settings Make sure that the DN Required on Bind is set to NO. Cryoserver LDAP Configuration The matching configuration in Cryoserver, as entered into the Super User web interface, Company Edit page is detailed below. Directory user cn=<user> A user whose (internet) password should not expire should be made available for Cryoserver use. The FQDN (Fully Qualified Domain Name) of this user should be entered here. Use an LDAP Browser if you are unsure of the FQDN. It is typically in the form: cn=a user, ou=users, o=company Directory password User DN # with translate = Yes, or cn=#,ou=users,o=dom A password must be used The # is replaced by the Directory User value (above). IF the Translate Users is set to NO, then the users Login ID replaces the # and must create a full FQDN FCS. All rights reserved. Page 12 of 24

13 Base DN Search DN with translate = No Root Or leave it blank Or o=<domain> root or a blank entry IF translate users is set to YES, then the user s Login ID is Searched for. The LDAP system can append this base DN to the login and other DN strings to create a FQDN. Used ONLY if the append base DN is set to Yes. For LOTUS NOTES, the base DN should be blank (or the word root, which means the same thing in Cryoserver). In LOTUS NOTES, distribution groups appear to be directly listed at the root level (though some LOTUS NOTES LDAP configuration may be different use an LDAP Browser to confirm). In this case, all directory searches must start at the root. In LOTUS NOTES the root level does not have a name (unlike Exchange) so the search MUST have a blank (or root ) entry in order to find distribution groups. Append Base DN No As the base is blank no need to append it! Primary field name Mail Used for Address Expansion & Login: This contains the user s internet address. By default, distribution groups do not have internet addresses. If so, Cryoserver CANNOT expand those addresses. LOTUS NOTES Administrator should manually enter internet addresses for Distribution Groups Primary field pattern (.*) This says take the whole value. Cryoserver uses the full text from the Primary Field as the users address. Secondary field name Cn Used for Address Expansion & Login: This is the user s alias address list. Lotus Notes has no formal way of expressing alias addresses. The cn attribute in LOTUS NOTES contains the user s common name 2007 FCS. All rights reserved. Page 13 of 24

14 but it can be extended to include a list of alternative names. The LOTUS NOTES Administrator can manually enter alternative internet addresses for users in the Name field on the Admin User Configuration screen. Secondary fld pattern (.*) This says take the whole value of each secondary address entry. Secondary fld format (cn={0}) this is optional Used for Address Expansion: This allows Cryoserver to perform searches of an alias address. It places the address from the into the {0} part of the format, and then performs a search. Member field name Member Used for Address Expansion: The LDAP attribute that lists the members of a Distribution List. In LOTUS NOTES the members are FQDN strings (cn=user,ou=users,dc=fred). Translate Users Yes Used for login: Translation Key cn Used for Login: However, External addresses are incorrectly prefixed with cn=. Cryoserver version 1.3.4p has a fix for this. IF Yes, then Cryoserver logs in with the well-known user (the User DN, above). It then performs a Search using the users Login ID. SSL No Not used Cache size 300 to 1000 Address Expansion: The number of LDAP entries to store in-memory, for the timeout period. Cache timeout 500 Address Expansion: The number of seconds to keep a cached LDAP entry in-memory. After this timeout, that entry must be re-fetched from LDAP. LDAP Type Custom Login and Address Expansion: IF you use any other type, 2007 FCS. All rights reserved. Page 14 of 24

15 Cryoserver overrides most of the LDAP settings with some hardcoded ones. Login Failure Limit 9 Allow user to enter a reasonable number of incorrect passwords before locking an account. Lock Time 1 Minute(s) if bad passwords are entered and the account becomes locked, how long before the user can attempt more password guesses. Old Pwd Limit 1 NOT USED in version 1.3x Password Expiry Do not expire cryoserver-local passwords In version 1.4+ a grace login is allowed after the Expiry but not in version 1.3. Spool Mode RFC822 LOTUS NOTES only does basic (non-forensic) journaling. It does not include the message envelope [full list of recipients] in the journal copies. Avg Message Interval 0 or 10 To test if the LOTUS NOTES system is sending mail to the Cryoserver. If Cryoserver does not process any within this time period, a special alert is raised by Cryoserver. Cryoserver waits to see if it receives this back again. If so all is OK. If not then there may be an issue so an Engineer Alert message is sent. Feedback Blank or < address> If the message interval not 0, then a special alert is sent to this address. This address MUST be on the LOTUS NOTES server being journaled because Cryoserver is waiting for the to be returned via the LOTUS NOTES journal mechanism FCS. All rights reserved. Page 15 of 24

16 Lotus Notes MIME Configuration MIME is the standard format of the content of any sent over the internet. Some settings determine how Lotus Notes will convert Lotus Notes format s into Internet format s. Other settings determine how Lotus Notes handles incoming Internet s. Incoming Internet Mail will generally be relayed, unchanged, directly to the Journal Recipient if the Mail-In journal option is selected. Internal will be translated into MIME when it is sent to the Mail-In journal recipient and some options here determine how this translation from Internal to Internet format will occur. Figure 13 - Outbound Internet Mail Format Control Internal mail that is to be converted to Internet Mail must have its Lotus Notes Rich Text field converted to either plain text, HTML, or both. The preference is to use both, as shown here FCS. All rights reserved. Page 16 of 24

17 Figure 14 - Incoming Internet Mail Rules BCC Recipients For incoming internet mail, you can ensure that the BCC recipients are actually stored within the Lotus Notes system for all Lotus Notes users. This may be seen as a privacy or compliance issue, and is often set to No. IF Lotus Notes Journaling is sent to a Local Database, rather than a mail-in database, then the BCC information will be preserved in the Local Database s copy except for mail that was Bcc d to a distribution group, when NO RECORD is kept of either the group or the group s recipients in the Journal Copy FCS. All rights reserved. Page 17 of 24

18 Figure 15 - Outbound Message Options The Outbound options determine some key aspects of internet mail formatting and content of Lotus Notes Internal Mail that is translated into an Internet format . RFC822 phrase handling determines the text for each recipients internet addresses display name. Internet addresses (RFC822 addresses) can be formed as Display Name @address.com The display name can be one of the items selected on this configuration page. Lotus Notes Private Items are the meta-data items that exist in the Lotus Notes Mail document that are not usually included in an Internet . Some example items are shown below. X-Lotus Notes-Item: CN=Trinity/O=Cryoserver; flags=44; name=$updatedby X-Lotus Notes-Item: 04-Jan :08:24 GMT =?US-ASCII?Q?=2C_04-Jan- 2006_16=3A08=3A25_GMT?=; type=401; name=$revisions X-Lotus Notes-Item: 0; name=$msgtrackflags X-Lotus Notes-Item: forensiccompliance.com; name=fromdomain X-Lotus Notes-Item: 25; type=300; name=$hops X-Lotus Notes-Item: 1; name=$notehasnativemime 2007 FCS. All rights reserved. Page 18 of 24

19 The Always Send Lotus Notes Items in Header, and the opposite Remove Items From Header options determine if specific Lotus Notes items are to be included or removed from the generated Internet Mail. Simply enter the names of the Lotus Notes Items that you want to include, or exclude, separated with new-lines. There are two caveats with the Always Send option Only a single header will be generated for each item even if that item is a list of values within Lotus Notes, only the first such value is output (unlike the Lotus Notes Private Items option above, that includes the whole set of values) Each value is truncated to 255 characters. Figure 16 - SMTP Basics The Address lookup field determines how rigorous the Lotus Notes system will be when matching an incoming recipient address with an entry in the Domino Directory (LDAP). See Specifying how Domino looks up the recipients of incoming SMTP messages below for further information. The Domain Configuration document determines the default formatting of internet addresses for the domain FCS. All rights reserved. Page 19 of 24

20 Figure 17 - Internet Addressing defaults for a domain User Configuration The user configuration should not affect the Journaling of . However, the fidelity of original internet s is preserved when using the Format preference of Keep in senders format. Figure 18 - Person configuration details 2007 FCS. All rights reserved. Page 20 of 24

21 Specifying how Domino looks up the recipients of incoming SMTP messages When Domino receives a message over SMTP, the message recipient is identified by an Internet-style address, in the format Genevieve_Martin@acme.com, rather than a Lotus Notes-style address, such as Genevieve Martin/Acme. To determine the correct destination mail file, Domino must match the SMTP address to a Person document in the Domino Directory. To find a match, the router checks the $Users view of the directory. This view displays all name entries in all Person documents in the directory, including Internet mail addresses, as well as all user name variations, first names, last names, common names (CN), distinguished names (DN), short names, and soundex names. Note: To display the hidden $Users view: Open the directory, press CTRL-SHIFT and select View-Go To. In the Go To dialog box, select the view ($Users) and click OK. Inbound recipient lookups are controlled by the Address lookup setting on the Router/SMTP - Basics tab of the Configuration Settings document. This setting determines the criteria that the Router uses when attempting to match the SMTP address on an incoming message to an entry in the $Users view. The Router matches addresses based on: The full SMTP address only -- for example, Genevieve_Martin@acme.com The local part of the SMTP address (that is, the part to the left of sign) only -- for example, Genevieve_Martin The full SMTP address, and then if no match is found, the local part address When using full name matching, the Router searches the Domino Directory for an exact match of the entire SMTP address (for example, First_Last@Acme.com). If an exact match is not found, the Router performs a secondary search if the domain suffix of the incoming address is listed in the Global domain document as an Internet domain alias. For this secondary search, the Router replaces the given domain suffix with the domain suffix designated in the Global domain document as the Primary domain name. To prevent the Router from using domain aliases when looking up addresses, do not include alternate Internet domain aliases in a Global domain document. Instead, create multiple Global Domain documents, each specifying a different primary Internet domain. Restricting the Router to matching addresses on the full Internet address only ensures that each user's Internet address complies with a standard format. Users cannot receive inbound mail addressed to their short names, soundex names, or other name variations that exist in the $Users view. When configuring the Router to look up users' full Internet addresses only, complete the Internet address field in all Person documents, and Mail-in database documents for mail-in databases that receive mail over SMTP. To specify how addresses are looked up: 1. Make sure you already have a Configuration Settings document for the server(s) to be configured. 2. From the Domino Administrator, click the Configuration tab and then expand the Messaging section. 3. Choose Configurations. 4. Select the Configuration Settings document to be edited and then click Edit Configuration. 5. Click the Router/SMTP - Basics tab. 6. Complete these fields, and then save the document: 2007 FCS. All rights reserved. Page 21 of 24

22 Field Address lookup Type in Specifies how the Router searches the Domino Directory to determine the Lotus Notes recipient of an inbound Internet message. Choose one: Fullname then Local Part - (default) The Router first searches the Domino Directory for a match for the full Internet address (localpart@domain.com). If no match is found, it searches the directory again, looking for a match for the local part of the address only. Fullname only - The Router searches the Domino Directory for full Internet addresses only. For example, it searches for "user@domain.com" but not for "user." If an exact match is not found and the domain suffix is equivalent to an Internet domain alias defined in the Global domain document, a secondary search is performed using the domain suffix of the primary Internet domain. Local Part only - The Router searches the Domino Directory for a match of the local part of the Internet address, that is, the part before symbol. Local part matching matches periods and underscores in the address with spaces in the directory. Exhaustive lookup Choose one: Enabled - The Router searches all directories to ensure that there are no duplicate recipient names that might prevent the message from getting to the right person. Performing exhaustive lookups is time-consuming and places a heavy load on the server. Disabled - (default) The Router limits its search to the first directory that contains the address. 7. The change takes effect after the next Router configuration update. To put the new setting into effect immediately, reload the routing configuration as below. The Router on each server maintains a dynamic routing table, which specifies the best route to each possible destination server. The routing table builds on information contained in the server's LOTUS NOTES.INI file and in the Configuration Settings, Domain, Connection, and Server documents in the Domino Directory. By default, at intervals of approximately 5 minutes, or after you restart the task, the Router examines the Domino Directory for changes that would warrant rebuilding the routing table. In cases where you want new settings to take effect immediately, but do not want to interrupt the flow of mail by stopping and restarting the Router, you can use a TELL command to force an update. To update the server's routing table Type in the following command at the server console: Tell router update config The Router checks the Server, Server Configuration, Connection, Adjacent and Non- Adjacent domain documents, and the LOTUS NOTES.INI file for changes that might effect 2007 FCS. All rights reserved. Page 22 of 24

23 the routing topology. The Router then builds a new routing table that incorporates the changes. The Router reprocesses any messages currently in MAIL.BOX based on the new routing table. The Router does not check the Global Domain document for changes in response to the update configuration command. The information contained in the Global Domain document is loaded into memory only after server initialization. It is not refreshed when the routing tables reload FCS. All rights reserved. Page 23 of 24

24 Known Issues No Journal when both Internal and Internet recipients used This issue was noted in Lotus Notes version 6.5.4: No journal copy was made where an was sent to both a local Lotus Notes user and an external internet recipient. This issue was fixed in Lotus Notes version fixpack 1 (i.e ). No BCC Group information If an is Bcc d to a distribution group, then the Journal does not keep a record of either the Group address or the recipients in that group. Multiple Server Journaling If the organisation has multiple Lotus Notes servers and corresponding Cryoserver systems, then some Loss of mail will be noticed on each Cryoserver. The reason is that Lotus Notes will journal an only once within a group of Domino servers. This results in an internal mail being sent from one Lotus Notes server to another, being journaled at the sending Lotus Notes server ONLY. Similarly, an external mail being delivered to recipients on multiple Lotus Notes servers will only be journaled at the Gateway Lotus Notes server. The receiving Lotus Notes server will identify the as has been journaled and will not journal again. Where there is a central Cryoserver, regardless of the number of Lotus Notes servers, then this behaviour is ideal. Where each Lotus Notes Server has a corresponding Cryoserver, then there will be apparent loss of mail. We can provide a Global Search facility, which will span a search across remote Cryoservers and thus recover the missing sent items. The Domino Lotus Notes system needs to be extended to log the journal destination. Where this destination is different on the remote servers, then Journaling should be repeated FCS. All rights reserved. Page 24 of 24