Daniel Nashed's Blog

Required Notes and Domino anti-virus file exclusions

This discussion came up in an OpenNTF Discord channel.
The question was if this might be a good idea to keep OS level anti-virus enabled for Notes/Domino files.

There is a clear statement from HCL about exclusions. But the technote doesn't explain why those exclusions are important.
The exclusion might be different for each anti-virus production in detail. It also depends on customer IT policies how to exclude data.
This can be either by path, extension or process.

There are also recommendations from some anti-virus vendors stating the same exclusions for their specific product:

Guidelines for excluding Notes and Domino directory and files when running an operating system Antivirus

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0093046


Why are exclusions important

Performance

First of all on access or on write scanning can dramatically slow down performance of a server or client.
On a client even loading all the small Eclipse program/binary files can slow down the client. But that's a different story.

Stability of the server

OS virus scanners run on very low OS level and can block files very low level.
If a file gets blocked/removed while Domino is using the file, the process or at least the operation will fail.
Depending on the file and the state, this could cause a partial or complete server failure (e.g. crash).

Effectiveness of OS level scans

Scanning on access often has a time lack as I found out in my tests. So the file might be written anyway and deleted afterwards when using it.

Even for not encrypted data, The storage of file data inside a NSF or even DAOS NLO are not really consumable. Often data is also compressed on top of it.
For no part of the server OS level anti-virus would add reliable security.


How to scan Domino data for viruses and other threads

To scan Domino data inside a NSF or insider NLOs. you would need a Domino aware solution.
There are business partner solutions out there, which provide mail flow and on rest scanning.

HCL implemented the ICAP standard for mail flow scanning in Domino 12.0.2 to leverage external anti-virus appliances supporting the ICAP standard.
The interest in this new feature was quite low. And also ideas to improve the CScan solution was not really getting many votes.
Even if you have existing gateway solutions to scan attachments, periodically scanning Notes databases would be a requirement high on my wish list.

Surprisingly the interest seems to be very low. Also the idea to provide other protocols like ClamAV protocol support (free, open source based anti-virus) was not getting many votes.

With CScan in place, adding more protocol and a command-line scan, would be incremental effort.
But probably Domino product management would not take it into account with 7 votes.

I would be very interested to understand why there isn't much demand in the field, because I had similar low feedback for my ClamAV integration project earlier (see below).

-- Daniel


AHA ideas to vote for

AHA idea - ClamAV support for Domino CScan -> 9 votes
https://domino-ideas.hcltechsw.com/ideas/DOMINO-I-2472

AHA idea - Periodic CScan on rest scan of databases -> 7 votes
https://domino-ideas.hcltechsw.com/ideas/DOMINO-I-2473



ClamAV related blog posts

https://blog.nashcom.de/nashcomblog.nsf/dx/domino-antivius-powered-by-calmav.htm
https://blog.nashcom.de/nashcomblog.nsf/dx/revisiting-anti-virus-for-domino-do-you-have-feedback.htm

• Comments [7]