Domino on Linux/Unix, Troubleshooting, Best Practices, Tips and more ...

alt

Daniel Nashed

Required Notes and Domino anti-virus file exclusions

Daniel Nashed – 8 October 2023 07:04:21

This discussion came up in an OpenNTF Discord channel.
The question was if this might be a good idea to keep OS level anti-virus enabled for Notes/Domino files.

There is a clear statement from HCL about exclusions. But the technote doesn't explain why those exclusions are important.
The exclusion might be different for each anti-virus production in detail. It also depends on customer IT policies how to exclude data.
This can be either by path, extension or process.

There are also recommendations from some anti-virus vendors stating the same exclusions for their specific product:

Guidelines for excluding Notes and Domino directory and files when running an operating system Antivirus

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0093046


Why are exclusions important

Performance

First of all on access or on write scanning can dramatically slow down performance of a server or client.
On a client even loading all the small Eclipse program/binary files can slow down the client. But that's a different story.

Stability of the server

OS virus scanners run on very low OS level and can block files very low level.
If a file gets blocked/removed while Domino is using the file, the process or at least the operation will fail.
Depending on the file and the state, this could cause a partial or complete server failure (e.g. crash).

Effectiveness of OS level scans

Scanning on access often has a time lack as I found out in my tests. So the file might be written anyway and deleted afterwards when using it.

Even for not encrypted data, The storage of file data inside a NSF or even DAOS NLO are not really consumable. Often data is also compressed on top of it.
For no part of the server OS level anti-virus would add reliable security.


How to scan Domino data for viruses and other threads

To scan Domino data inside a NSF or insider NLOs. you would need a Domino aware solution.
There are business partner solutions out there, which provide mail flow and on rest scanning.

HCL implemented the ICAP standard for mail flow scanning in Domino 12.0.2 to leverage external anti-virus appliances supporting the ICAP standard.
The interest in this new feature was quite low. And also ideas to improve the CScan solution was not really getting many votes.
Even if you have existing gateway solutions to scan attachments, periodically scanning Notes databases would be a requirement high on my wish list.

Surprisingly the interest seems to be very low. Also the idea to provide other protocols like ClamAV protocol support (free, open source based anti-virus) was not getting many votes.

With CScan in place, adding more protocol and a command-line scan, would be incremental effort.
But probably Domino product management would not take it into account with 7 votes.

I would be very interested to understand why there isn't much demand in the field, because I had similar low feedback for my ClamAV integration project earlier (see below).

-- Daniel


AHA ideas to vote for

AHA idea - ClamAV support for Domino CScan -> 9 votes
https://domino-ideas.hcltechsw.com/ideas/DOMINO-I-2472

AHA idea - Periodic CScan on rest scan of databases -> 7 votes
https://domino-ideas.hcltechsw.com/ideas/DOMINO-I-2473



ClamAV related blog posts

https://blog.nashcom.de/nashcomblog.nsf/dx/domino-antivius-powered-by-calmav.htm
https://blog.nashcom.de/nashcomblog.nsf/dx/revisiting-anti-virus-for-domino-do-you-have-feedback.htm


Comments

1Henning Heinz  08.10.2023 9:19:42  Required Notes and Domino anti-virus file exclusions

Most of the things HCL started to implement in Domino have been topics I solved years ago (at least I think so). For example anti-virus is done on a Postfix Gateway, Nginx (together with Certbot) does the Lets Encrypt stuff being the Reverse Proxy for multiple services.

And imho it works.

The weakest point in my setup is Spam handling (AV Spam module, Spamassassin and Postgrey work ok but it could be better, although I for sure have invested too little time in this topic).

So far Domino does not offer much in this area but there are external services that do a good job, so I would not expect many more votes in this area.

Thank you for asking and of course I have upvoted your ideas.

Henning

2Daniel Nashed  08.10.2023 15:58:29  Required Notes and Domino anti-virus file exclusions

@Henning, you are missing the point. This is not about gateway scanning. You need scheduled scans on Domino side as well.

Using the gateway approach for messages received from the internet makes a lot of sense and is not new. Most customer use gateway solutions.

Still some components like DKIM signing introduced in 12.0.1 outbound and 12.0.2 inbound are important additions.

Offloading TLS to NGINX also makes a lot of sense. But I would assume you don't run NGINX on each of your Domino servers. So what protects the channel between NGINX and your Domino server?

Domino V12 is a completely turn around in TLS for Domino. You should really look into CertMgr. Domino does not need to hide behind CertBot and other solutions.

It' perfectly OK to run NGINX in front of Domino and I am a big NGINX fan as well as you can see in the CertMgr GitHub repository where we have added integrations with NGINX.

There is no one size fits one and proper TLS certificate belongs also into Domino. Take a look here for details --> https://opensource.hcltechsw.com/domino-cert-manager/.

AntiSpam is also a gateway responsibility. Not a Domino responsibility. But Domino should provide integrations for spam tagging etc.

I wrote an AntiSpam solution many years ago called "SpamGeek". But this isn't an enterprise solution. It's more for smaller environments. It's very flexible but that makes it not easy to use. that's why it is called "SpamGeek".

3Tinus Riyanto  09.10.2023 1:48:29  Required Notes and Domino anti-virus file exclusions

Most likely it is an awareness issue since everyone seem to think that having a gateway solution is a good enough security measure.

I agree that we should go the extra mile if possible but it is an uphill battle to persuade others to do so.

4Manuel Nientit  09.10.2023 8:56:53  Required Notes and Domino anti-virus file exclusions

I plead guilty. Although I thought that those improvements would be great, I forgot to vote. I did now. Thanks for the reminder.

But I would also give it some time. Most if not all of my customers which are on Domino 12, use additional Software for Mail-Security and are on long-term licenses. I got them interested, though.

Others are not on Domino 12 yet, so that they cannot use it. These are mostly the ones that cannot afford additional AV-Software for Domino. And they would be the ones, I could interest in ICAP the most. And they would be the ones to vote for said improvements. This on the other hand means that it might be to late to wait for them.

5Daniel Nashed  09.10.2023 9:38:09  Required Notes and Domino anti-virus file exclusions

@Manuel, no matter if you have it installed, you need to vote NOW to get it implemented in a next version!

6Henning Heinz  09.10.2023 11:21:38  Required Notes and Domino anti-virus file exclusions

I work for a company with less than 100 users :-).

Maybe I need scheduled scans on the Domino side but so far I have not missed them. Voted for both ideas so I am not against it.

The channel between Nginx and our Domino servers are indeed "unprotected". I will take your advice as a starting point to look into some improvements. From a security point of view we have other areas where it looks much worse.

Thanks a lot

Henning

7Uwe Brahm  09.10.2023 11:48:47  Required Notes and Domino anti-virus file exclusions

The interest is low because we had to solve most issues before Domino had the features available.

Background: we are running Domino since version 3 (Sun Solaris). The need for spam and virus protection evolved much faster than the Domino features have been available to address these issues. We also have a mixed setup. Domino is only a part of a much bigger infrastructure landscape.

So we relied heavily on open source solutions in the mean time for spam and virus protection.

However: without this very special history, today one can start fresh and the new mail protection features are highly appreciated!

Thanks for your hard work in this area,

Uwe

Links

    Archives


    • [HCL Domino]
    • [Domino on Linux]
    • [Nash!Com]
    • [Daniel Nashed]