Domino 8.5.2 Adding Email Aliases

Often times people need to receive email for multiple valid variation of their email addresses. On most email systems, these are called email aliases. IBM Domino has a slightly unusual way of allowing system administrators to define aliases:

  • Open the Domino Administrator Tool
  • On the People & Groups tab, select People
  • Edit the Person document of the person you would like to add an email alias to
  • Add the alternative email addresses to Short name/UserID like this:

    "UsedID [email protected]
    [email protected]
  • Save and close the Person document
  • Navigate to the Server... tab
  • Select the Server console
  • To enable the changes on the SMTP server, enter in the Domino Command: TELL ROUTER UPDATE CONFIG

Domino 8.5 SSL Key Import Into Keyring File

Domino Server SSL Key Import

By default, the SSL key order process in the Domino Administrator assumes that only single domain certificates are used. Hence, when you have a multi domain UCC or a wildcard certificate, it has to be loaded into the keyring (a.k.a. kyr file) outside of the Domino Administrator.

The basic overview of the process is this:

  • Create a kyr (keyring) file to hold the keys.
  • Create a p12 (PKCS#12) file with the certificate that needs to be added to the keyring.
  • Add the p12 (PKCS#12) file to the keyring.
  • Install the new keyring on the Domino Servers (mail, traveler, sametime, Quickr)

Domino Server PKCS#12 key generation and import

Create PKCS#12 from SSL KEY and CRT files

For this step I recommend to be on the Linux or AIX with openssl installed. Assuming that you have the certificate key, the CA issued certificate, and the certificate chains all in the same directory, you can run the following command to generate the p12 file:

openssl pkcs12 -export \
-in certificate-from-CA.crt \
-inkey certificate-key-file.key \
-certfile root-ca-bundle.crt \
-out certificate-in-pkcs12-format.p12

Add PKCS#12 to Domino Server Kyr Keyring File

For this step I recommend to be on the sametime server under Linux or AIX. In theory, this should work, but in practice, I found that the version 7 of the gsk tools doesn’t seem to be able to open kyr files. So you may need to skip ahead to the legacy Windows XP method, unless you can find the gsk5bas package on one of your older install media.

rpm -Uvh ${SAMETIME_CD_PATH}/SametimeEntryServer/GSKit/Linux/gsk7bas-7.0-4.28.i386.rpm
vi /opt/ibm/lotus/notes/latest/linux/ibm-jre/jre/lib/security/java.security

Add last provider to list:

security.provider.1=com.ibm.jsse2.IBMJSSEProvider2
security.provider.2=com.ibm.crypto.provider.IBMJCE
security.provider.3=com.ibm.security.jgss.IBMJGSSProvider
security.provider.4=com.ibm.security.cert.IBMCertPath
security.provider.5=com.ibm.security.sasl.IBMSASL
security.provider.6=com.ibm.spi.IBMCMSProvider

remove conflicting jar file:

mv /opt/ibm/lotus/notes/latest/linux/ibm-jre/jre/lib/ext/gskikm.jar /opt/ibm/lotus/notes/latest/linux/ibm-jre/jre/lib/ext/gskikm.removedjar-

set environment:

set JAVA_HOME
JAVA_HOME=/opt/ibm/lotus/notes/latest/linux/ibm-jre/jre export JAVA_HOME

Domino Server Required Utilities for SSL Key Import (legacy Windows XP method)

  • Download and install IKEYMAN.
  • Open the kyr file in gsk5.
  • Import the p12 cert.
  • Save the new kyr file.

Domino Server SSL Key Management References

  • http://www.redbooks.ibm.com/redpapers/pdfs/redp0046.pdf
  • http://www.turtleweb.com/turtleblog.nsf/dx/11022009232215GDAVGR.htm?opendocument&comments
  • http://www.deadspace.de/?p=294
  • ftp://ftp.software.ibm.com/software/webserver/appserv/library/v61/ihs/GSK7c_SSL_Ikm_Guide.pdf
  • https://support.quovadisglobal.com/KB/a93/how-do-i-install-my-digital-certificate-into-lotus-notes.aspx
  • http://replay.waybackmachine.org/20081121002554/http://www.justinclarke.com/archives/2005/08/sending_smime_e.html
  • http://www.eulerhermes.com/en/documents/secure-email/ehcica_howto_import_lotus_notes_en.pdf/ehcica_howto_import_lotus_notes_en.pdf
  • http://publib.boulder.ibm.com/infocenter/sametime/v8r0/index.jsp?topic=/com.ibm.help.sametime.802.doc/Entry/st_adm_security_ssl_ikey_lin_t.html

For more information about Domino Server solutions, visit our collaboration section.


Advice in the Wake of Security Breaches

By Mark Nyquist ‐ Information Systems Director, Epicor HCM

In the wake of the recent security breaches (see links below), I’d like to take just a quick moment to remind everyone that extra vigilance and scrutiny are becoming vital for the security of work and home environments.
I’m sure that many of you have already received notices from retailers you might be associated with (Target, USBank, BestBuy, etc..) stating that their email database for marketing newsletters was breached. The fallout of this is still being explored, but rest assured that will lead to very targeted ‘spear phishing’ attacks in the very near future. If your name and email address was disclosed in this breach, you’ll most likely start to receive emails that look very much like the newsletters you are used to seeing with proper logos, graphics, content, personalization to your name, etc.. – but with links that may go scam sites. Be extremely cautious when emails ask you to ‘change your password’, ‘update your credit card information’, etc.. When in doubt, look up the customer service number for the retailer, and contact them directly asking if the email is legitimate or if you might be able to perform the requested action over the phone.
In a very real example of the damage targeted attacks such as this can cause, look no further than the recent compromise of the RSA security company. Several users at RSA received a targeted email containing an Excel spreadsheet labeled ‘2011 Recruitment Plan’. Even though their junk-filter caught the email, one user still pulled it out of junk and opened it. The spreadsheet had an embedded flash object which executed a zero day exploit (meaning their antivirus program did not yet have a defense for this). The trojan then installed remote control software and the rest was history. Here’s where the story should hit home though: The attackers were then able to leverage this foothold to steal the master encryption key for millions of two-factor security FOBs. There are some government agencies that relied (note the past tense) on these for securing top secret data. The brand reputation of this company has now plummeted and security conscious customers are flocking to other solutions. The harm this one person caused will have major ramifications to the financial future of an entire company.

Takeaway

  • Only open email attachments from trusted people, and only when the content seems relevant. When in doubt, call the sender and ask for confirmation.
  • When possible, don’t click on links in emails. Instead, use your own bookmarks to trusted places and navigate to the destination. If this is not possible, scrutinize links (right click, copy – paste into notepad) to make sure the go to legitimate places.
  • Educate family and friends on the dangers that will certainly escalate in the near future.

Epsilon Breach

http://www.wsj.com/articles/SB10001424052748703806304576240992886577106


Linux Kernel Hangs During Boot

While rebooting a machine for example to apply a kernel update, it hangs. You try older kernels, and it hangs too. Not necessarily at the same spot. Here are some examples:

...
io scheduler cfq registered (default)
...
Real Time Clock Driver v1.12ac

These kernel hangs during boot are interestingly traceable to the USB keyboard. If you use a PS2 keyboard instead, the kernel may just continue booting. No comment.