SlideShare a Scribd company logo

April, 2021 OpenNTF Webinar - Domino Administration Best Practices

H
Howard Greenberg

The OpenNTF webinar focused on Domino administration best practices, honoring co-founder Nathan Freeman, and provided an agenda featuring HCL ambassadors as speakers. Key topics included server configuration, security practices, and session authentication, along with updates regarding the next webinar. Participants were encouraged to ask questions and get involved in the OpenNTF community while donations were suggested to support Nathan Freeman's family.

Software
1 of 57
Downloaded 37 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
Most read
22
Most read
23
Most read
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
OPENNTF WEBINARS April OpenNTF Webinar: Domino Administration Best Practices
AGENDA ‱ Welcome – Howard Greenberg and Graham Acres ‱ Heather Hottenstein, HCL Ambassador ‱ Roberto Boccadoro, HCL Ambassador ‱ Serdar Basegmez, HCL Ambassador ‱ John Paganetti, HCL (for Q and A) ‱ Q and A - All
TRIBUTE TO NATHAN FREEMAN ‱ Nathan passed away last week ‱ Co-founder of OpenNTF ‱ His vision built this community ‱ Technical genius and a great person ‱ Donations to the family appreciated ‱ https://www.gofundme.com/f/ntf-needs-your- help
ASKING QUESTIONS ‱ First Question – Will this be recorded? ‱ Yes, view on YouTube!!! ‱ https://www.youtube.com/user/OpenNTF ‱ Use the Questions Pane in GoToWebinar ‱ We will get to your questions at the end of the webinar ‱ The speakers will respond to your questions verbally ‱ (not in the Questions pane) ‱ Please keep all questions related to the topics that our speakers are discussing!!! ‱ Unrelated Question => post at: ‱ http://openntf.slack.com/
THANKS TO THE OPENNTF SPONSORS ‱ HCL made a significant contribution to help our organization ‱ Funds these webinars! ‱ Contests like Hackathons ‱ Running the organization ‱ Prominic donates all IT related services ‱ Cloud Hosting for OpenNTF ‱ Infrastructure management for HCL Domino and Atlassian Servers ‱ System Administration for day-to-day operation
THIS IS OUR COMMUNITY ‱ Join us and get involved! ‱ We are all volunteers ‱ No effort is too small ‱ If your idea is bigger than you can do on your own, we can connect you to a team to work on it ‱ Test or help or modify an existing project ‱ Write guides or documentation ‱ Add reviews on projects / stars on Snippets
NEXT WEBINAR ‱ TBD
OPENNTF WEBINARS Domino Administration Best Practices
SPEAKERS ‱ Heather Hottenstein, RPR Wyatt – HCL Ambassador ‱ Roberto Boccadoro, ELD Engineering, HCL Ambassador ‱ Serdar Basegmez, HCL Ambassador
SERVER PLATFORM – 11.0.1X ‱ Operating System ‱ Windows ‱ 2019, 2016, 2012 R2 – Standard and Datacenter Edition ‱ LINUX ‱ Red Hat Enterprise Server 8.x, 7.4+ ‱ SUSE Linux Enterprise Server 15.0+, 12.0+ ‱ CentOS Server 8.x, 7.4x ‱ Docker ‱ AS/400 ‱ V7 r2 ‱ V7 r3 ‱ V7 r4 (On IBM Power 8, 9) ‱ AIX ‱ 7.2 TL1+ ‱ On premises vs Cloud
FILE SYSTEM STRUCTURE ‱ Separate drives/directories for Domino program and data directories ‱ Do NOT install in c:program files... ‱ Avoid brand named directories: opt/ibm/
. /opt/hcl/
. ‱ Use the KISS rule: c:Domino, d:DominoData
NAMING STRUCTURE ‱ Unless really needed, use just an O and do not use OUs ‱ Makes administration simpler ‱ Good for 90% of the cases ‱ Document certifier password ‱ Set certifier expiration to 100 years
SERVER DOCUMENT - BASICS ‱ Internet site documents - Enabled ‱ Automatic server recovery configuration ‱ Run NSD to collect diagnostic information - Enabled ‱ Automatically restart server after fault/crash - Enabled ‱ Maximum fault limits ‱ Mail fault notification
SERVER DOCUMENT - SECURITY ‱ Groups vs Explicit entries ‱ Full Access Administrators vs Administrators ‱ Servers are NOT admins ‱ Programmability Restrictions ‱ Compare public keys – Enforce key checking for all Notes users and Domino servers ‱ Log public key mismatches – Log key mismatches for all Notes users and Domino servers ‱ Check passwords on Notes IDs - Enabled ‱ Internet authentication ‱ Server Access ‱ Create databases & templates, new replicas ‱ Termination groups ‱ Trusted Servers
SERVER DOCUMENT – PORTS ‱ Net Address – FQN vs TCPIP address ‱ Cluster traffic ‱ Internet Ports ‱ Enforce server access settings - Enabled ‱ TCP/IP Port – Redirect to SSL ‱ Authentication options ‱ Name & Password – Yes ‱ Anonymous - No ‱ HTTPPublicUrls=/redir.nsf/* ‱ Mail – SMTP Outbound – TCP/IP Port status ‱ Negotiated SSL
SERVER DOCUMENT – SERVER TASKS ‱ Administration Process ‱ Delayed request settings ‱ Start executing on – list all days ‱ Agent Manager ‱ Max concurrent agents ‱ Max LotusScript/Java execution time
SERVER DOCUMENT – INTERNET PROTOCOLS ‱ HTTP ‱ Number active threads ‱ Traveler devices X 1.2 ‱ Allow HTTP clients to browse databases - No ‱ Log files - Enabled ‱ Domlog.nsf ‱ HTTP persistent connections - Disabled ‱ Domino Web Engine ‱ Maximum Post data
SERVER DOCUMENT – TRANSACTION LOGGING ‱ Log path – separate from Data drive ‱ Logging styles ‱ Set and do not change ‱ After you change the logging style, Domino assigns a new DBIID to each database. You must restart the server and perform another full backup ‱ Database maintenance ‱ DBIID and Backups ‱ Compact ‱ Fixup -J
SERVER DOCUMENT - DAOS ‱ Mail servers ‱ Configuration considerations ‱ DAOS Estimator Tool ‱ http://www.dominonews.com/dnews.nsf/documents/DA OS%20Estimator%20tool?opendocument ‱ Tier 2 storage ‱ Always use a separate disk for DAOS and another for transaction logging
SERVER DOCUMENT – NOTES TRAVELER ‱ Maximum Memory Size/JVM ‱ Access server ‱ MDM ‱ HA Pool
CONFIGURATION DOC - SECURITY ‱ Check vault first, then directory ‱ When enabled, this feature allows HCL Verse, HCL iNotes and other web users with Notes IDs to provide their web name and Notes ID password, to authenticate to the Domino server. This allows the users to remember one password, the Notes ID password. ‱ Enforce Internet Password Lockout
CONFIGURATION DOC – ROUTER/SMTP ‱ Number of mailboxes – 2+ ‱ Address lookup – Fullname only ‱ Relay host for messages leaving the local internet domain ‱ Maximum message size ‱ Deny messages to be sent to the following external internet domains - * ‱ Deny messages from the following internet hosts to be sent to external internet domains - * ‱ Exclude these connecting hosts from anti-relay checks ‱ IP addresses listed in square brackets – [192.10.10.1]
CONFIGURATION DOC – ROUTER/SMTP ‱ Allow connections from the following SMTP internet hostnames/IP addresses ‱ Deny mail rules forwarding to external internet domains ‱ Server Mail Rules – block .zip, .exe ‱ Message Tracking – Enabled ‱ SSL negotiated over TCP/IP port - Enabled ‱ Out-of-Office type – Service ‱ Automatically process dead mail - Enabled
CONFIGURATION DOC – NOTES.INI WHY THE CONFIGURATION DOCUMENT? ‱ HTTPJVMMaxHeapSize ‱ JavaUse64BitJVM ‱ TNEFEnableConversion ‱ NIF_VIEW_USAGE_ENABLED ‱ Create_R*_Databases ‱ UPDATERS=#CPUs ‱ REPLICATORS=#CPUs ‱ LOG_REPLICATION=1 ‱ LOG_SESSIONS=1 ‱ LOG_VIEW_EVENTS=1 ‱ HTTPDisableMethods=Trace ‱ Cluster_Admin_On ‱ D10_ENABLE_REPAIR ‱ FTBasePath ‱ NIFNSFEnable ‱ NIFBasepath ‱ Debug variables ‱ MailFileDisableCompactAbort=1
ALWAYS USE SSL ‱ Some things will not even work with HTTP, e.g. Traveler, Sametime mobile client will stop supporting HTTP soon. ‱ Mandatory for Verse ‱ Redirect port 80 to TLS ‱ Enforce server access setting ‱ Add those lines to notes.ini ‱ DISABLE_SSLV3=1 ‱ SSL_DISABLE_TLS_10=1 ‱ Disable weak ciphers ‱ SSLCipherSpec notes.ini setting is ignored
SETTING UP SSL IN V11 ‱ Do not use the native Domino CA app. Use OpenSSL and kyrtool. ‱ 3 ways to do it ‱ Create a self signed certificate (good for testing) https://support.hcltechsw.com/csm?id=kb_article&sys_id= a3ff10361b926cd4534c4159cc4bcb01&spa=1 ‱ Obtain a certificate from a CA https://support.hcltechsw.com/csm?id=kb_article&sys_id= fb7ba618dbf6e89ca45ad9fcd3961966&spa=1 ‱ Use LE4D , a free Domino app from Midpoints that lets you request and renew free SSL certificates issued by LetsEncrypt
SETTING UP SSL IN V12 ‱ Piece of cake â˜ș ‱ Use the new CertMgr db ‱ More in a webinar in June
DISABLE NOT USED PORTS
WHITELIST ACTIVE CONTENT FILTER (ACF) FOR INOTES AND VERSE ‱ The ACF is used to remove potentially harmful active content from HTML messages such as JavaScriptℱ, Javaℱ, and ActiveX. A whitelist filter removes all entities except those in the whitelist. A blacklist filter (used in previous releases and still the default in this release) retains all entities except those in the blacklist. Blacklist filters need to be continuously maintained to guard against threats from new markup patterns. Whitelist filters are considered a best practice because they are explicit about the patterns that are allowed. ACF is available for iNotes and Verse, it does not apply to the Notes client.
PROGRAM DOCUMENTS ‱ Scheduled server tasks ‱ Database maintenance ‱ DBMT ‱ runs copy-style compact operations ‱ purges deletion stubs ‱ expires soft deleted entries ‱ updates views ‱ reorganizes folders ‱ merges full-text indexes ‱ updates unread lists ‱ ensures that critical views are created for failover ‱ System databases are not compacted ‱ -compactThreads 8 -updallThreads 8 -range 2:00AM 7:00AM - compactNdays 5 -force 1 ‱ Remove ServerTasksAt2=Updall ‱ Compact -B
DOMINO CERTIFICATE AUTHORITY ‱ Domino Directory Administration Server ‱ Domino Certifier IDs – Not SSL ‱ Tools – Certification – Migrate Certifier ‱ ICL database ‱ User registrations, renames and recertifications
ID VAULT SETUP ‱ Centralized storage of live Notes IDs ‱ Required for Verse on Premises ‱ Automatically created in Domino 12 ‱ Configuration – Tools – ID Vaults – Create ‱ IBM_ID_Vaultdbname.nsf ‱ Vault ID – backup! ‱ Volt administrator ‱ Password resets ‱ Configuration – ID Vaults – Manage ‱ Create ID Vault replicas ‱ Assigning users
POLICIES AND SETTINGS DOCUMENTS ‱ Explicit vs Organizational ‱ Registration Settings ‱ Setup ‱ Desktop ‱ Marvel Client ‱ Archiving ‱ Security ‱ Mail ‱ Notes Traveler
DOMINO EMAIL - OPTIONS ‱ Notes client ‱ Web Browser ‱ iNotes (will likely go away after V12) ‱ Verse on Premises ‱ Mobile Devices - Traveler
DOMINO SERVER MONITORING ‱ Domino Domain Management ‱ DDM.NSF ‱ DDM Probes ‱ EVENTS4.NSF ‱ View and Manage events ‱ Third party products ‱ OS resource monitoring ‱ RAM, CPU, Disk ‱ Agents ‱ Tell amgr schedule
DOMINO SERVER MAINTENANCE ‱ Database maintenance ‱ Program documents ‱ System database maintenance ‱ Log.nsf, domlog.nsf, mail.box ‱ Domino Fix packs + upgrades ‱ OS patches ‱ Anti virus/spam updates
USEFUL DOCUMENTATION FROM HCL ‱ Domino cookbook ‱ Domino upgrade guide ‱ https://support.hcltechsw.com/csm?id=kb_article&sysp arm_article=KB0077811&sys_kb_id=bf5c8b72dbe2a41ca 45ad9fcd3961961
TIPS AND TRICKS FOR DEVELOPERS Approved for Test and Development Servers only!
AUTHENTICATION MECHANISMS ‱ Mostly, we don’t really care
 ‱ However
 ‱ Customised Login/Logout ‱ Simulating the same authentication scheme ‱ Apps providing service for “weirdies” ‱ Many options: ‱ Basic Authentication ‱ Session Authentication (Single Server vs Multi-server) ‱ SAML, OAuth, IAM, etc. ==> Not today!
AUTHENTICATION: BASIC HCL Domino Server Browser Request: GET /path/database.nsf Response: 401 Unauthorized WWW-Authenticate: Basic realm=“/path” Request: GET /path/database.nsf Authorization: Basic SXQncyBiaWdnZXIgaW5zaWRlIQ== Response: 200 OK
AUTHENTICATION: SESSION HCL Domino Server Browser Request: GET /path/database.nsf Response: 200 OK Login Form (text/html) Request: POST names.nsf?Login Form Data with UserName + Password + RedirectTo Response: 200 OK Target Content + Authentication Cookie 401?
SINGLE SERVER VS. MULTI-SERVER ‱ Single Server ‱ Server creates a cookie “DomAuthSessId” ‱ Server keeps a list of authenticated sessions ‱ Cookie is only valid for single server ‱ Multiple servers (SSO) ‱ Server creates a cookie “LtpaToken” (customizable) ‱ Token is hashed with the username and expiration time ‱ Multiple Servers share a secret key to hash/verify the token. ‱ Server doesn’t keep track of users (except for monitoring)
DIFFERENCES Basic Single Server Multi-Server Name of the Cookie: No cookie DomAuthSessId LtpaToken (Configurable) Expiration is kept
 On Browser On Server On Cookie Timeout depends on
 Browser Session Last request Cookie Creation tell Http Show Users None Accurate Inaccurate On HTTP Restart Continue Need Authentication Continue
SOME TIPS ON AUTHENTICATION ‱ When Session Authentication is enabled, ‱ Unauthenticated/unauthorized requests returns “200 OK” ‱ 401/404 expected in modern web architecture ‱ Tip: Override Session Authentication ‱ Multi-server session cannot be extended, token cannot be canceled. ‱ Tip: Remove LtpaToken cookie for manual logout ‱ Tip: Keep the expiration time long enough ‱ XPages Session ≠ Authentication Session ‱ XPages session ~ SessionID cookie ‱ Specific to the browser session
TIPS FOR XPAGES DEVELOPERS Always use Internet Sites! Additional settings Multiple domains More practical for testing Enabled from the server document Need site document for all protocols (e.g. IMAP, POP3, SMTP, etc.)
TIPS FOR XPAGES DEVELOPERS ‱ Allowed methods and Domino Access Services ‱ Relevant Internet Site Document Configuration ‱ Important for RESTful developers
TIPS FOR XPAGES DEVELOPERS ‱ Server-wide xsp.properties ‱ Go to “[domino-data]properties” on the server ‱ The sample file is the documentation for all properties.
TIPS FOR XPAGES DEVELOPERS ‱ XPages app connecting to a remote server ‱ XPages as a front-end application layer ‱ Data in another NSF, even in another server ‱ “Trusted Servers” will be useful! ‱ It’s not for production ‱ Low performance ‱ Great to access real data from the production
TIPS FOR XPAGES DEVELOPERS ‱ Debugging HTTP Thread ‱ tell http debug thread on | off ==> Default level ‱ tell http debug postdata on | off ==> for client POST data ‱ tell http debug responsedata on | off ==> for server response data ‱ Save some space! ‱ tell http debug lastonly on | off ==> Keep only the last request! ‱ For more options
 ‱ https://support.hcltechsw.com/kb_view.do?sysparm_article=KB0032210
TIPS FOR XPAGES DEVELOPERS ‱ Use XPages Log File Reader from OpenNTF ‱ https://www.openntf.org/p/xpages log file reader ‱ Send your virtual kudos to Jakob Majkilde!
JVM CUSTOMIZATION ‱ notes.ini parameters for JVM Memory ‱ HTTPJVMMaxHeapSize ==> JVM heap for HTTP ‱ JavaMaxHeapsize ==> JVM heap for the rest ‱ Default values for Domino 8.5+ and 64-bit ‱ HTTPJVMMaxHeapSize=1024M ‱ JavaMaxHeapsize=256M
JVM CUSTOMIZATION ‱ Add JVM arguments via notes.ini ‱ Create a text file with JVM arguments ‱ JavaOptionsFile=c:pathtojvm.txt ‱ Very useful to customize JVM! ‱ Testing different locales ‱ Setting TLS protocols ‱ Additional debugging ‱ Tweak third party libraries
JVM CUSTOMIZATION ‱ Modify Java security policy (like a pro!) ‱ /[domino]/jvm/lib/security/java.policy ==> do not use! ‱ /[user-home]/.java.policy ==> will persist! ‱ What is [user-home]? ‱ Linux: /local/notes (notes is the user for domino service) ‱ Windows (Run as a service): C:WindowsSystem32configsystemprofile ‱ Windows (Run as an app): C:UsersJANE.DOE ‱ Technote: ‱ https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085173 ‱ Reminder and Correction: ‱ /[domino]/jvm/lib/security/java.pol ==> Obsolete as of R11+
SECURITY TIPS ‱ Careful with the HTTPEnableConnectorHeaders ‱ Normally, it should be “0” ‱ It allows an attacker to impersonate any user! ‱ Only for “behind the proxy” scenarios. ‱ In case, Domino HTTP should be secured with Firewall. Image is from Wikipedia. Refer to Jesper Kiaer for more details. https://nevermind.dk/nevermind/blog.nsf/subject/security-hole-leaves-ibm-domino-server-wide-open---part-one
SECURITY TIPS ‱ Use a different Domino domain for Test/development servers ‱ Testing and UAT servers are wide open for breaches! ‱ Open relay attacks ‱ Insecure passwords for test users ‱ Remote debugging (XPages/Agents) ‱ Intel about production
Q&A TIME!
QUESTIONS? Use the GoToWebinar Questions Pane Please keep all questions related to the topics that our speakers are discussing!!! Unrelated Question => post at: http://openntf.slack.com/

More Related Content

PDF
RNUG - Dirty Secrets of the Notes Client
Christoph Adler
 
POTX
IBM Domino / IBM Notes Performance Tuning
Vladislav Tatarincev
 
PDF
60 Admin Tips
Gabriella Davis
 
PDF
Important tips on Router and SMTP mail routing
jayeshpar2006
 
PDF
Domino Server Health - Monitoring and Managing
Gabriella Davis
 
PDF
Domino Adminblast
Gabriella Davis
 
PDF
Engage2022 - Domino Admin Tips
Gabriella Davis
 
PPTX
HCL Domino V12 Key Security Features Overview
hemantnaik
 
RNUG - Dirty Secrets of the Notes Client
Christoph Adler
 
IBM Domino / IBM Notes Performance Tuning
Vladislav Tatarincev
 
60 Admin Tips
Gabriella Davis
 
Important tips on Router and SMTP mail routing
jayeshpar2006
 
Domino Server Health - Monitoring and Managing
Gabriella Davis
 
Domino Adminblast
Gabriella Davis
 
Engage2022 - Domino Admin Tips
Gabriella Davis
 
HCL Domino V12 Key Security Features Overview
hemantnaik
 

What's hot (20)

PDF
Deep Dive AdminP Process - Admin and Infrastructure Track at UKLUG 2012
BCC - Solutions for IBM Collaboration Software
 
PDF
RNUG - HCL Notes V11 Performance Boost
Christoph Adler
 
PDF
How to use the new Domino Query Language
Tim Davis
 
PDF
BewĂ€hrte Praktiken fĂŒr HCL Notes/Domino-Sicherheit. Teil 2: Der Domino-Server
panagenda
 
PDF
Domino Tech School - Upgrading to Notes/Domino V10: Best Practices
Christoph Adler
 
PPT
Configuring Domino To Be An Ldap Directory And To Use An Ldap Directory
Edson Oliveira
 
PDF
HCL Sametime 12.0 on Docker - Step-By-Step.pdf
Ales Lichtenberg
 
PDF
Ugprade HCL Sametime V11.5 to V11.6 - Step by Step
Ales Lichtenberg
 
PPTX
Best Practice TLS for IBM Domino
Jared Roberts
 
PDF
HTTP - The Other Face Of Domino
Gabriella Davis
 
PPT
Daos
Ulrich Krause
 
PDF
dachnug49 - panagenda Workshop - 100 new things in Notes, Nomad Web & MarvelC...
Christoph Adler
 
PDF
IBM Notes Performance Boost - Reloaded (DEV-1185)
Christoph Adler
 
PDF
HCL Sametime V11 installation - tips
Ales Lichtenberg
 
PDF
Domino policies deep dive
Martijn de Jong
 
PDF
RESTful services on IBM Domino/XWork
John Dalsgaard
 
PDF
Engage 2018: IBM Notes and Domino Performance Boost - Reloaded
Christoph Adler
 
PDF
HCL Domino V12 - TOTP
Ales Lichtenberg
 
PDF
RNUG - Virtual, Faster, Better! How to deploy HCL Notes 11.0.1 FP2 for Citrix...
Christoph Adler
 
PDF
IBM Notes Traveler Best Practices
jayeshpar2006
 
Deep Dive AdminP Process - Admin and Infrastructure Track at UKLUG 2012
BCC - Solutions for IBM Collaboration Software
 
RNUG - HCL Notes V11 Performance Boost
Christoph Adler
 
How to use the new Domino Query Language
Tim Davis
 
BewĂ€hrte Praktiken fĂŒr HCL Notes/Domino-Sicherheit. Teil 2: Der Domino-Server
panagenda
 
Domino Tech School - Upgrading to Notes/Domino V10: Best Practices
Christoph Adler
 
Configuring Domino To Be An Ldap Directory And To Use An Ldap Directory
Edson Oliveira
 
HCL Sametime 12.0 on Docker - Step-By-Step.pdf
Ales Lichtenberg
 
Ugprade HCL Sametime V11.5 to V11.6 - Step by Step
Ales Lichtenberg
 
Best Practice TLS for IBM Domino
Jared Roberts
 
HTTP - The Other Face Of Domino
Gabriella Davis
 
Daos
Ulrich Krause
 
dachnug49 - panagenda Workshop - 100 new things in Notes, Nomad Web & MarvelC...
Christoph Adler
 
IBM Notes Performance Boost - Reloaded (DEV-1185)
Christoph Adler
 
HCL Sametime V11 installation - tips
Ales Lichtenberg
 
Domino policies deep dive
Martijn de Jong
 
RESTful services on IBM Domino/XWork
John Dalsgaard
 
Engage 2018: IBM Notes and Domino Performance Boost - Reloaded
Christoph Adler
 
HCL Domino V12 - TOTP
Ales Lichtenberg
 
RNUG - Virtual, Faster, Better! How to deploy HCL Notes 11.0.1 FP2 for Citrix...
Christoph Adler
 
IBM Notes Traveler Best Practices
jayeshpar2006
 
Ad

Similar to April, 2021 OpenNTF Webinar - Domino Administration Best Practices (20)

PPTX
Soccnx10: Best and worst practices deploying IBM Connections
panagenda
 
PPTX
Best And Worst Practices Deploying IBM Connections
LetsConnect
 
PDF
Got Problems? Let's Do a Health Check
Luis Guirigay
 
PDF
Best and worst practices deploying IBM Connections
LetsConnect
 
PDF
BEST AND WORST PRACTICES DEPLOYING IBM CONNECTIONS
Nico Meisenzahl
 
PDF
be the captain of your connections deployment
Sharon James
 
PPTX
Nagios XI Best Practices
Nagios
 
PDF
(ATS6-PLAT06) Maximizing AEP Performance
BIOVIA
 
PDF
SQL Server 2019 CTP2.4
Gianluca Hotz
 
PDF
#DNUG45 - IBM Notes and Domino Performance Boost - Reloaded
Christoph Adler
 
PDF
Dutch Lotus User Group 2009 - Domino Tuning Presentation
Vladislav Tatarincev
 
PDF
1049: Best and Worst Practices for Deploying IBM Connections - IBM Connect 2016
panagenda
 
PDF
(ATS4-PLAT08) Server Pool Management
BIOVIA
 
PDF
CNIT 152: 10 Enterprise Services
Sam Bowne
 
PPTX
Tuenti Release Workflow v1.1
Tuenti
 
PDF
CNIT 121: 10 Enterprise Services
Sam Bowne
 
PPTX
Apache Performance Tuning: Scaling Out
Sander Temme
 
PDF
IBM Connections administration – keep your systems running the right way
LetsConnect
 
PPTX
Citrix Synergy 2014: Going the CloudPlatform Way
Iliyas Shirol
 
PDF
Adding Support for Networking and Web Technologies to an Embedded System
John Efstathiades
 
Soccnx10: Best and worst practices deploying IBM Connections
panagenda
 
Best And Worst Practices Deploying IBM Connections
LetsConnect
 
Got Problems? Let's Do a Health Check
Luis Guirigay
 
Best and worst practices deploying IBM Connections
LetsConnect
 
BEST AND WORST PRACTICES DEPLOYING IBM CONNECTIONS
Nico Meisenzahl
 
be the captain of your connections deployment
Sharon James
 
Nagios XI Best Practices
Nagios
 
(ATS6-PLAT06) Maximizing AEP Performance
BIOVIA
 
SQL Server 2019 CTP2.4
Gianluca Hotz
 
#DNUG45 - IBM Notes and Domino Performance Boost - Reloaded
Christoph Adler
 
Dutch Lotus User Group 2009 - Domino Tuning Presentation
Vladislav Tatarincev
 
1049: Best and Worst Practices for Deploying IBM Connections - IBM Connect 2016
panagenda
 
(ATS4-PLAT08) Server Pool Management
BIOVIA
 
CNIT 152: 10 Enterprise Services
Sam Bowne
 
Tuenti Release Workflow v1.1
Tuenti
 
CNIT 121: 10 Enterprise Services
Sam Bowne
 
Apache Performance Tuning: Scaling Out
Sander Temme
 
IBM Connections administration – keep your systems running the right way
LetsConnect
 
Citrix Synergy 2014: Going the CloudPlatform Way
Iliyas Shirol
 
Adding Support for Networking and Web Technologies to an Embedded System
John Efstathiades
 
Ad

More from Howard Greenberg (20)

PDF
January OpenNTF Webinar - Backup your Domino Server - New Options in V12
Howard Greenberg
 
PDF
BRPA November Meeting
Howard Greenberg
 
PDF
October OpenNTF Webinar - What we like about Domino/Notes 12, recommended new...
Howard Greenberg
 
PDF
September-2021 OpenNTF Webinar: Domino Online Meeting Integration (DOMI)
Howard Greenberg
 
PDF
August OpenNTF Webinar - Git and GitHub Explained
Howard Greenberg
 
PDF
July OpenNTF Webinar - HCL Presents Keep, a new API for Domino
Howard Greenberg
 
PDF
June OpenNTF Webinar - Domino V12 Certification Manager
Howard Greenberg
 
PDF
OpenNTF Webinar, March, 2021
Howard Greenberg
 
PDF
February OpenNTF Webinar: Introduction to Ansible for Newbies
Howard Greenberg
 
PDF
January OpenNTF Webinar: 4D - Domino Docker Deep Dive
Howard Greenberg
 
PDF
December OpenNTF Webinar: The Volt MX LotusScript Toolkit
Howard Greenberg
 
PDF
OpNovember Water Cooler Talk: The Mystery of Domino on Docker - Part 1
Howard Greenberg
 
PDF
OpenNTF Webinar, October 2020
Howard Greenberg
 
PDF
August Webinar - Water Cooler Talks: A Look into a Developer's Workbench
Howard Greenberg
 
PDF
July 2020 OpenNTF Webinar - Hear the Latest from the User Groups!
Howard Greenberg
 
PDF
Open ntf 2020-jun
Howard Greenberg
 
PDF
OpenNTF Webinar, May 19, 2020
Howard Greenberg
 
PDF
Dev112 let's calendar that
Howard Greenberg
 
PDF
Bp101-Can Domino Be Hacked
Howard Greenberg
 
PDF
MWLUG Session- AD112 - Take a Trip Into the Forest - A Java Primer on Maps, ...
Howard Greenberg
 
January OpenNTF Webinar - Backup your Domino Server - New Options in V12
Howard Greenberg
 
BRPA November Meeting
Howard Greenberg
 
October OpenNTF Webinar - What we like about Domino/Notes 12, recommended new...
Howard Greenberg
 
September-2021 OpenNTF Webinar: Domino Online Meeting Integration (DOMI)
Howard Greenberg
 
August OpenNTF Webinar - Git and GitHub Explained
Howard Greenberg
 
July OpenNTF Webinar - HCL Presents Keep, a new API for Domino
Howard Greenberg
 
June OpenNTF Webinar - Domino V12 Certification Manager
Howard Greenberg
 
OpenNTF Webinar, March, 2021
Howard Greenberg
 
February OpenNTF Webinar: Introduction to Ansible for Newbies
Howard Greenberg
 
January OpenNTF Webinar: 4D - Domino Docker Deep Dive
Howard Greenberg
 
December OpenNTF Webinar: The Volt MX LotusScript Toolkit
Howard Greenberg
 
OpNovember Water Cooler Talk: The Mystery of Domino on Docker - Part 1
Howard Greenberg
 
OpenNTF Webinar, October 2020
Howard Greenberg
 
August Webinar - Water Cooler Talks: A Look into a Developer's Workbench
Howard Greenberg
 
July 2020 OpenNTF Webinar - Hear the Latest from the User Groups!
Howard Greenberg
 
Open ntf 2020-jun
Howard Greenberg
 
OpenNTF Webinar, May 19, 2020
Howard Greenberg
 
Dev112 let's calendar that
Howard Greenberg
 
Bp101-Can Domino Be Hacked
Howard Greenberg
 
MWLUG Session- AD112 - Take a Trip Into the Forest - A Java Primer on Maps, ...
Howard Greenberg
 

Recently uploaded (20)

PDF
Why TechBuilder is the Future of Pickup and Delivery App Development (1).pdf
TechBuilder
 
PPTX
Online Work Permit System for Fast Permit Processing
SHEQ Network Limited
 
PDF
How to Migrate SBCGlobal Email to Yahoo Easily
raymondjones7273
 
PPTX
Agentic AI Use Case- Contract Lifecycle Management (CLM).pptx
mhxyzzp
 
PPTX
history of c programming in notes for students .pptx
Vijayakumari829030
 
PDF
Internet Downloader Manager (IDM) Crack 6.42 Build 41
ghrom2211g
 
PDF
SAP S4 Hana Brochure 3 (PTS SYSTEMS AND SOLUTIONS)
pts464036
 
PDF
Claude Code: Everyone is a 10x Developer - A Comprehensive AI-Powered CLI Tool
William Chong
 
PDF
AI in Product Development-omnex systems
omnex systems
 
PDF
How to Choose the Right IT Partner for Your Business in Malaysia
Asian Business Services & Technologies
 
PDF
medical staffing services at VALiNTRY
Tiyan Grayson
 
PDF
How Creative Agencies Leverage Project Management Software.pdf
Orangescrum
 
PDF
Wondershare Filmora 15 Crack With Activation Key [2025
ghrom2211g
 
PDF
Internet Downloader Manager (IDM) Crack 6.42 Build 42 Updates Latest 2025
itskinga12
 
PDF
top salesforce developer skills in 2025.pdf
CloudMetic
 
PPTX
L1 - Introduction to python Backend.pptx
MoizAhmed480282
 
PPTX
ai tools demonstartion for schools and inter college
harshavardhanreddyka11
 
PDF
Addressing The Cult of Project Management Tools-Why Disconnected Work is Hold...
OnePlan Solutions
 
PPT
Introduction Database Management System for Course Database
ReinertYosua
 
PPTX
VVF-Customer-Presentation2025-Ver1.9.pptx
blackmambaettijean
 
Why TechBuilder is the Future of Pickup and Delivery App Development (1).pdf
TechBuilder
 
Online Work Permit System for Fast Permit Processing
SHEQ Network Limited
 
How to Migrate SBCGlobal Email to Yahoo Easily
raymondjones7273
 
Agentic AI Use Case- Contract Lifecycle Management (CLM).pptx
mhxyzzp
 
history of c programming in notes for students .pptx
Vijayakumari829030
 
Internet Downloader Manager (IDM) Crack 6.42 Build 41
ghrom2211g
 
SAP S4 Hana Brochure 3 (PTS SYSTEMS AND SOLUTIONS)
pts464036
 
Claude Code: Everyone is a 10x Developer - A Comprehensive AI-Powered CLI Tool
William Chong
 
AI in Product Development-omnex systems
omnex systems
 
How to Choose the Right IT Partner for Your Business in Malaysia
Asian Business Services & Technologies
 
medical staffing services at VALiNTRY
Tiyan Grayson
 
How Creative Agencies Leverage Project Management Software.pdf
Orangescrum
 
Wondershare Filmora 15 Crack With Activation Key [2025
ghrom2211g
 
Internet Downloader Manager (IDM) Crack 6.42 Build 42 Updates Latest 2025
itskinga12
 
top salesforce developer skills in 2025.pdf
CloudMetic
 
L1 - Introduction to python Backend.pptx
MoizAhmed480282
 
ai tools demonstartion for schools and inter college
harshavardhanreddyka11
 
Addressing The Cult of Project Management Tools-Why Disconnected Work is Hold...
OnePlan Solutions
 
Introduction Database Management System for Course Database
ReinertYosua
 
VVF-Customer-Presentation2025-Ver1.9.pptx
blackmambaettijean
 

April, 2021 OpenNTF Webinar - Domino Administration Best Practices

  • 1. OPENNTF WEBINARS April OpenNTF Webinar: Domino Administration Best Practices
  • 2. AGENDA ‱ Welcome – Howard Greenberg and Graham Acres ‱ Heather Hottenstein, HCL Ambassador ‱ Roberto Boccadoro, HCL Ambassador ‱ Serdar Basegmez, HCL Ambassador ‱ John Paganetti, HCL (for Q and A) ‱ Q and A - All
  • 3. TRIBUTE TO NATHAN FREEMAN ‱ Nathan passed away last week ‱ Co-founder of OpenNTF ‱ His vision built this community ‱ Technical genius and a great person ‱ Donations to the family appreciated ‱ https://www.gofundme.com/f/ntf-needs-your- help
  • 4. ASKING QUESTIONS ‱ First Question – Will this be recorded? ‱ Yes, view on YouTube!!! ‱ https://www.youtube.com/user/OpenNTF ‱ Use the Questions Pane in GoToWebinar ‱ We will get to your questions at the end of the webinar ‱ The speakers will respond to your questions verbally ‱ (not in the Questions pane) ‱ Please keep all questions related to the topics that our speakers are discussing!!! ‱ Unrelated Question => post at: ‱ http://openntf.slack.com/
  • 5. THANKS TO THE OPENNTF SPONSORS ‱ HCL made a significant contribution to help our organization ‱ Funds these webinars! ‱ Contests like Hackathons ‱ Running the organization ‱ Prominic donates all IT related services ‱ Cloud Hosting for OpenNTF ‱ Infrastructure management for HCL Domino and Atlassian Servers ‱ System Administration for day-to-day operation
  • 6. THIS IS OUR COMMUNITY ‱ Join us and get involved! ‱ We are all volunteers ‱ No effort is too small ‱ If your idea is bigger than you can do on your own, we can connect you to a team to work on it ‱ Test or help or modify an existing project ‱ Write guides or documentation ‱ Add reviews on projects / stars on Snippets
  • 9. SPEAKERS ‱ Heather Hottenstein, RPR Wyatt – HCL Ambassador ‱ Roberto Boccadoro, ELD Engineering, HCL Ambassador ‱ Serdar Basegmez, HCL Ambassador
  • 10. SERVER PLATFORM – 11.0.1X ‱ Operating System ‱ Windows ‱ 2019, 2016, 2012 R2 – Standard and Datacenter Edition ‱ LINUX ‱ Red Hat Enterprise Server 8.x, 7.4+ ‱ SUSE Linux Enterprise Server 15.0+, 12.0+ ‱ CentOS Server 8.x, 7.4x ‱ Docker ‱ AS/400 ‱ V7 r2 ‱ V7 r3 ‱ V7 r4 (On IBM Power 8, 9) ‱ AIX ‱ 7.2 TL1+ ‱ On premises vs Cloud
  • 11. FILE SYSTEM STRUCTURE ‱ Separate drives/directories for Domino program and data directories ‱ Do NOT install in c:program files... ‱ Avoid brand named directories: opt/ibm/
. /opt/hcl/
. ‱ Use the KISS rule: c:Domino, d:DominoData
  • 12. NAMING STRUCTURE ‱ Unless really needed, use just an O and do not use OUs ‱ Makes administration simpler ‱ Good for 90% of the cases ‱ Document certifier password ‱ Set certifier expiration to 100 years
  • 13. SERVER DOCUMENT - BASICS ‱ Internet site documents - Enabled ‱ Automatic server recovery configuration ‱ Run NSD to collect diagnostic information - Enabled ‱ Automatically restart server after fault/crash - Enabled ‱ Maximum fault limits ‱ Mail fault notification
  • 14. SERVER DOCUMENT - SECURITY ‱ Groups vs Explicit entries ‱ Full Access Administrators vs Administrators ‱ Servers are NOT admins ‱ Programmability Restrictions ‱ Compare public keys – Enforce key checking for all Notes users and Domino servers ‱ Log public key mismatches – Log key mismatches for all Notes users and Domino servers ‱ Check passwords on Notes IDs - Enabled ‱ Internet authentication ‱ Server Access ‱ Create databases & templates, new replicas ‱ Termination groups ‱ Trusted Servers
  • 15. SERVER DOCUMENT – PORTS ‱ Net Address – FQN vs TCPIP address ‱ Cluster traffic ‱ Internet Ports ‱ Enforce server access settings - Enabled ‱ TCP/IP Port – Redirect to SSL ‱ Authentication options ‱ Name & Password – Yes ‱ Anonymous - No ‱ HTTPPublicUrls=/redir.nsf/* ‱ Mail – SMTP Outbound – TCP/IP Port status ‱ Negotiated SSL
  • 16. SERVER DOCUMENT – SERVER TASKS ‱ Administration Process ‱ Delayed request settings ‱ Start executing on – list all days ‱ Agent Manager ‱ Max concurrent agents ‱ Max LotusScript/Java execution time
  • 17. SERVER DOCUMENT – INTERNET PROTOCOLS ‱ HTTP ‱ Number active threads ‱ Traveler devices X 1.2 ‱ Allow HTTP clients to browse databases - No ‱ Log files - Enabled ‱ Domlog.nsf ‱ HTTP persistent connections - Disabled ‱ Domino Web Engine ‱ Maximum Post data
  • 18. SERVER DOCUMENT – TRANSACTION LOGGING ‱ Log path – separate from Data drive ‱ Logging styles ‱ Set and do not change ‱ After you change the logging style, Domino assigns a new DBIID to each database. You must restart the server and perform another full backup ‱ Database maintenance ‱ DBIID and Backups ‱ Compact ‱ Fixup -J
  • 19. SERVER DOCUMENT - DAOS ‱ Mail servers ‱ Configuration considerations ‱ DAOS Estimator Tool ‱ http://www.dominonews.com/dnews.nsf/documents/DA OS%20Estimator%20tool?opendocument ‱ Tier 2 storage ‱ Always use a separate disk for DAOS and another for transaction logging
  • 20. SERVER DOCUMENT – NOTES TRAVELER ‱ Maximum Memory Size/JVM ‱ Access server ‱ MDM ‱ HA Pool
  • 21. CONFIGURATION DOC - SECURITY ‱ Check vault first, then directory ‱ When enabled, this feature allows HCL Verse, HCL iNotes and other web users with Notes IDs to provide their web name and Notes ID password, to authenticate to the Domino server. This allows the users to remember one password, the Notes ID password. ‱ Enforce Internet Password Lockout
  • 22. CONFIGURATION DOC – ROUTER/SMTP ‱ Number of mailboxes – 2+ ‱ Address lookup – Fullname only ‱ Relay host for messages leaving the local internet domain ‱ Maximum message size ‱ Deny messages to be sent to the following external internet domains - * ‱ Deny messages from the following internet hosts to be sent to external internet domains - * ‱ Exclude these connecting hosts from anti-relay checks ‱ IP addresses listed in square brackets – [192.10.10.1]
  • 23. CONFIGURATION DOC – ROUTER/SMTP ‱ Allow connections from the following SMTP internet hostnames/IP addresses ‱ Deny mail rules forwarding to external internet domains ‱ Server Mail Rules – block .zip, .exe ‱ Message Tracking – Enabled ‱ SSL negotiated over TCP/IP port - Enabled ‱ Out-of-Office type – Service ‱ Automatically process dead mail - Enabled
  • 24. CONFIGURATION DOC – NOTES.INI WHY THE CONFIGURATION DOCUMENT? ‱ HTTPJVMMaxHeapSize ‱ JavaUse64BitJVM ‱ TNEFEnableConversion ‱ NIF_VIEW_USAGE_ENABLED ‱ Create_R*_Databases ‱ UPDATERS=#CPUs ‱ REPLICATORS=#CPUs ‱ LOG_REPLICATION=1 ‱ LOG_SESSIONS=1 ‱ LOG_VIEW_EVENTS=1 ‱ HTTPDisableMethods=Trace ‱ Cluster_Admin_On ‱ D10_ENABLE_REPAIR ‱ FTBasePath ‱ NIFNSFEnable ‱ NIFBasepath ‱ Debug variables ‱ MailFileDisableCompactAbort=1
  • 25. ALWAYS USE SSL ‱ Some things will not even work with HTTP, e.g. Traveler, Sametime mobile client will stop supporting HTTP soon. ‱ Mandatory for Verse ‱ Redirect port 80 to TLS ‱ Enforce server access setting ‱ Add those lines to notes.ini ‱ DISABLE_SSLV3=1 ‱ SSL_DISABLE_TLS_10=1 ‱ Disable weak ciphers ‱ SSLCipherSpec notes.ini setting is ignored
  • 26. SETTING UP SSL IN V11 ‱ Do not use the native Domino CA app. Use OpenSSL and kyrtool. ‱ 3 ways to do it ‱ Create a self signed certificate (good for testing) https://support.hcltechsw.com/csm?id=kb_article&sys_id= a3ff10361b926cd4534c4159cc4bcb01&spa=1 ‱ Obtain a certificate from a CA https://support.hcltechsw.com/csm?id=kb_article&sys_id= fb7ba618dbf6e89ca45ad9fcd3961966&spa=1 ‱ Use LE4D , a free Domino app from Midpoints that lets you request and renew free SSL certificates issued by LetsEncrypt
  • 27. SETTING UP SSL IN V12 ‱ Piece of cake â˜ș ‱ Use the new CertMgr db ‱ More in a webinar in June
  • 29. WHITELIST ACTIVE CONTENT FILTER (ACF) FOR INOTES AND VERSE ‱ The ACF is used to remove potentially harmful active content from HTML messages such as JavaScriptℱ, Javaℱ, and ActiveX. A whitelist filter removes all entities except those in the whitelist. A blacklist filter (used in previous releases and still the default in this release) retains all entities except those in the blacklist. Blacklist filters need to be continuously maintained to guard against threats from new markup patterns. Whitelist filters are considered a best practice because they are explicit about the patterns that are allowed. ACF is available for iNotes and Verse, it does not apply to the Notes client.
  • 30. PROGRAM DOCUMENTS ‱ Scheduled server tasks ‱ Database maintenance ‱ DBMT ‱ runs copy-style compact operations ‱ purges deletion stubs ‱ expires soft deleted entries ‱ updates views ‱ reorganizes folders ‱ merges full-text indexes ‱ updates unread lists ‱ ensures that critical views are created for failover ‱ System databases are not compacted ‱ -compactThreads 8 -updallThreads 8 -range 2:00AM 7:00AM - compactNdays 5 -force 1 ‱ Remove ServerTasksAt2=Updall ‱ Compact -B
  • 31. DOMINO CERTIFICATE AUTHORITY ‱ Domino Directory Administration Server ‱ Domino Certifier IDs – Not SSL ‱ Tools – Certification – Migrate Certifier ‱ ICL database ‱ User registrations, renames and recertifications
  • 32. ID VAULT SETUP ‱ Centralized storage of live Notes IDs ‱ Required for Verse on Premises ‱ Automatically created in Domino 12 ‱ Configuration – Tools – ID Vaults – Create ‱ IBM_ID_Vaultdbname.nsf ‱ Vault ID – backup! ‱ Volt administrator ‱ Password resets ‱ Configuration – ID Vaults – Manage ‱ Create ID Vault replicas ‱ Assigning users
  • 33. POLICIES AND SETTINGS DOCUMENTS ‱ Explicit vs Organizational ‱ Registration Settings ‱ Setup ‱ Desktop ‱ Marvel Client ‱ Archiving ‱ Security ‱ Mail ‱ Notes Traveler
  • 34. DOMINO EMAIL - OPTIONS ‱ Notes client ‱ Web Browser ‱ iNotes (will likely go away after V12) ‱ Verse on Premises ‱ Mobile Devices - Traveler
  • 35. DOMINO SERVER MONITORING ‱ Domino Domain Management ‱ DDM.NSF ‱ DDM Probes ‱ EVENTS4.NSF ‱ View and Manage events ‱ Third party products ‱ OS resource monitoring ‱ RAM, CPU, Disk ‱ Agents ‱ Tell amgr schedule
  • 36. DOMINO SERVER MAINTENANCE ‱ Database maintenance ‱ Program documents ‱ System database maintenance ‱ Log.nsf, domlog.nsf, mail.box ‱ Domino Fix packs + upgrades ‱ OS patches ‱ Anti virus/spam updates
  • 37. USEFUL DOCUMENTATION FROM HCL ‱ Domino cookbook ‱ Domino upgrade guide ‱ https://support.hcltechsw.com/csm?id=kb_article&sysp arm_article=KB0077811&sys_kb_id=bf5c8b72dbe2a41ca 45ad9fcd3961961
  • 38. TIPS AND TRICKS FOR DEVELOPERS Approved for Test and Development Servers only!
  • 39. AUTHENTICATION MECHANISMS ‱ Mostly, we don’t really care
 ‱ However
 ‱ Customised Login/Logout ‱ Simulating the same authentication scheme ‱ Apps providing service for “weirdies” ‱ Many options: ‱ Basic Authentication ‱ Session Authentication (Single Server vs Multi-server) ‱ SAML, OAuth, IAM, etc. ==> Not today!
  • 40. AUTHENTICATION: BASIC HCL Domino Server Browser Request: GET /path/database.nsf Response: 401 Unauthorized WWW-Authenticate: Basic realm=“/path” Request: GET /path/database.nsf Authorization: Basic SXQncyBiaWdnZXIgaW5zaWRlIQ== Response: 200 OK
  • 41. AUTHENTICATION: SESSION HCL Domino Server Browser Request: GET /path/database.nsf Response: 200 OK Login Form (text/html) Request: POST names.nsf?Login Form Data with UserName + Password + RedirectTo Response: 200 OK Target Content + Authentication Cookie 401?
  • 42. SINGLE SERVER VS. MULTI-SERVER ‱ Single Server ‱ Server creates a cookie “DomAuthSessId” ‱ Server keeps a list of authenticated sessions ‱ Cookie is only valid for single server ‱ Multiple servers (SSO) ‱ Server creates a cookie “LtpaToken” (customizable) ‱ Token is hashed with the username and expiration time ‱ Multiple Servers share a secret key to hash/verify the token. ‱ Server doesn’t keep track of users (except for monitoring)
  • 43. DIFFERENCES Basic Single Server Multi-Server Name of the Cookie: No cookie DomAuthSessId LtpaToken (Configurable) Expiration is kept
 On Browser On Server On Cookie Timeout depends on
 Browser Session Last request Cookie Creation tell Http Show Users None Accurate Inaccurate On HTTP Restart Continue Need Authentication Continue
  • 44. SOME TIPS ON AUTHENTICATION ‱ When Session Authentication is enabled, ‱ Unauthenticated/unauthorized requests returns “200 OK” ‱ 401/404 expected in modern web architecture ‱ Tip: Override Session Authentication ‱ Multi-server session cannot be extended, token cannot be canceled. ‱ Tip: Remove LtpaToken cookie for manual logout ‱ Tip: Keep the expiration time long enough ‱ XPages Session ≠ Authentication Session ‱ XPages session ~ SessionID cookie ‱ Specific to the browser session
  • 45. TIPS FOR XPAGES DEVELOPERS Always use Internet Sites! Additional settings Multiple domains More practical for testing Enabled from the server document Need site document for all protocols (e.g. IMAP, POP3, SMTP, etc.)
  • 46. TIPS FOR XPAGES DEVELOPERS ‱ Allowed methods and Domino Access Services ‱ Relevant Internet Site Document Configuration ‱ Important for RESTful developers
  • 47. TIPS FOR XPAGES DEVELOPERS ‱ Server-wide xsp.properties ‱ Go to “[domino-data]properties” on the server ‱ The sample file is the documentation for all properties.
  • 48. TIPS FOR XPAGES DEVELOPERS ‱ XPages app connecting to a remote server ‱ XPages as a front-end application layer ‱ Data in another NSF, even in another server ‱ “Trusted Servers” will be useful! ‱ It’s not for production ‱ Low performance ‱ Great to access real data from the production
  • 49. TIPS FOR XPAGES DEVELOPERS ‱ Debugging HTTP Thread ‱ tell http debug thread on | off ==> Default level ‱ tell http debug postdata on | off ==> for client POST data ‱ tell http debug responsedata on | off ==> for server response data ‱ Save some space! ‱ tell http debug lastonly on | off ==> Keep only the last request! ‱ For more options
 ‱ https://support.hcltechsw.com/kb_view.do?sysparm_article=KB0032210
  • 50. TIPS FOR XPAGES DEVELOPERS ‱ Use XPages Log File Reader from OpenNTF ‱ https://www.openntf.org/p/xpages log file reader ‱ Send your virtual kudos to Jakob Majkilde!
  • 51. JVM CUSTOMIZATION ‱ notes.ini parameters for JVM Memory ‱ HTTPJVMMaxHeapSize ==> JVM heap for HTTP ‱ JavaMaxHeapsize ==> JVM heap for the rest ‱ Default values for Domino 8.5+ and 64-bit ‱ HTTPJVMMaxHeapSize=1024M ‱ JavaMaxHeapsize=256M
  • 52. JVM CUSTOMIZATION ‱ Add JVM arguments via notes.ini ‱ Create a text file with JVM arguments ‱ JavaOptionsFile=c:pathtojvm.txt ‱ Very useful to customize JVM! ‱ Testing different locales ‱ Setting TLS protocols ‱ Additional debugging ‱ Tweak third party libraries
  • 53. JVM CUSTOMIZATION ‱ Modify Java security policy (like a pro!) ‱ /[domino]/jvm/lib/security/java.policy ==> do not use! ‱ /[user-home]/.java.policy ==> will persist! ‱ What is [user-home]? ‱ Linux: /local/notes (notes is the user for domino service) ‱ Windows (Run as a service): C:WindowsSystem32configsystemprofile ‱ Windows (Run as an app): C:UsersJANE.DOE ‱ Technote: ‱ https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085173 ‱ Reminder and Correction: ‱ /[domino]/jvm/lib/security/java.pol ==> Obsolete as of R11+
  • 54. SECURITY TIPS ‱ Careful with the HTTPEnableConnectorHeaders ‱ Normally, it should be “0” ‱ It allows an attacker to impersonate any user! ‱ Only for “behind the proxy” scenarios. ‱ In case, Domino HTTP should be secured with Firewall. Image is from Wikipedia. Refer to Jesper Kiaer for more details. https://nevermind.dk/nevermind/blog.nsf/subject/security-hole-leaves-ibm-domino-server-wide-open---part-one
  • 55. SECURITY TIPS ‱ Use a different Domino domain for Test/development servers ‱ Testing and UAT servers are wide open for breaches! ‱ Open relay attacks ‱ Insecure passwords for test users ‱ Remote debugging (XPages/Agents) ‱ Intel about production
  • 57. QUESTIONS? Use the GoToWebinar Questions Pane Please keep all questions related to the topics that our speakers are discussing!!! Unrelated Question => post at: http://openntf.slack.com/