1Henning Heinz  08.10.2023 9:19:42  Required Notes and Domino anti-virus file exclusions

Most of the things HCL started to implement in Domino have been topics I solved years ago (at least I think so). For example anti-virus is done on a Postfix Gateway, Nginx (together with Certbot) does the Lets Encrypt stuff being the Reverse Proxy for multiple services.

And imho it works.

The weakest point in my setup is Spam handling (AV Spam module, Spamassassin and Postgrey work ok but it could be better, although I for sure have invested too little time in this topic).

So far Domino does not offer much in this area but there are external services that do a good job, so I would not expect many more votes in this area.

Thank you for asking and of course I have upvoted your ideas.

Henning

2Daniel Nashed  08.10.2023 15:58:29  Required Notes and Domino anti-virus file exclusions

@Henning, you are missing the point. This is not about gateway scanning. You need scheduled scans on Domino side as well.

Using the gateway approach for messages received from the internet makes a lot of sense and is not new. Most customer use gateway solutions.

Still some components like DKIM signing introduced in 12.0.1 outbound and 12.0.2 inbound are important additions.

Offloading TLS to NGINX also makes a lot of sense. But I would assume you don't run NGINX on each of your Domino servers. So what protects the channel between NGINX and your Domino server?

Domino V12 is a completely turn around in TLS for Domino. You should really look into CertMgr. Domino does not need to hide behind CertBot and other solutions.

It' perfectly OK to run NGINX in front of Domino and I am a big NGINX fan as well as you can see in the CertMgr GitHub repository where we have added integrations with NGINX.

There is no one size fits one and proper TLS certificate belongs also into Domino. Take a look here for details --> https://opensource.hcltechsw.com/domino-cert-manager/.

AntiSpam is also a gateway responsibility. Not a Domino responsibility. But Domino should provide integrations for spam tagging etc.

I wrote an AntiSpam solution many years ago called "SpamGeek". But this isn't an enterprise solution. It's more for smaller environments. It's very flexible but that makes it not easy to use. that's why it is called "SpamGeek".

3Tinus Riyanto  09.10.2023 1:48:29  Required Notes and Domino anti-virus file exclusions

Most likely it is an awareness issue since everyone seem to think that having a gateway solution is a good enough security measure.

I agree that we should go the extra mile if possible but it is an uphill battle to persuade others to do so.

4Manuel Nientit  09.10.2023 8:56:53  Required Notes and Domino anti-virus file exclusions

I plead guilty. Although I thought that those improvements would be great, I forgot to vote. I did now. Thanks for the reminder.

But I would also give it some time. Most if not all of my customers which are on Domino 12, use additional Software for Mail-Security and are on long-term licenses. I got them interested, though.

Others are not on Domino 12 yet, so that they cannot use it. These are mostly the ones that cannot afford additional AV-Software for Domino. And they would be the ones, I could interest in ICAP the most. And they would be the ones to vote for said improvements. This on the other hand means that it might be to late to wait for them.

5Daniel Nashed  09.10.2023 9:38:09  Required Notes and Domino anti-virus file exclusions

@Manuel, no matter if you have it installed, you need to vote NOW to get it implemented in a next version!

6Henning Heinz  09.10.2023 11:21:38  Required Notes and Domino anti-virus file exclusions

I work for a company with less than 100 users :-).

Maybe I need scheduled scans on the Domino side but so far I have not missed them. Voted for both ideas so I am not against it.

The channel between Nginx and our Domino servers are indeed "unprotected". I will take your advice as a starting point to look into some improvements. From a security point of view we have other areas where it looks much worse.

Thanks a lot

Henning

7Uwe Brahm  09.10.2023 11:48:47  Required Notes and Domino anti-virus file exclusions

The interest is low because we had to solve most issues before Domino had the features available.

Background: we are running Domino since version 3 (Sun Solaris). The need for spam and virus protection evolved much faster than the Domino features have been available to address these issues. We also have a mixed setup. Domino is only a part of a much bigger infrastructure landscape.

So we relied heavily on open source solutions in the mean time for spam and virus protection.

However: without this very special history, today one can start fresh and the new mail protection features are highly appreciated!

Thanks for your hard work in this area,

Uwe