Creating a security policy settings document
A security policy settings document allows you to manage IBM® Notes® and Internet passwords, configure customized password polices for your organization, set up key rollover, manage administration ECLs, push trusted cross-certificates to clients, and configure an ID vault. You can also configure settings for signed plug-ins and the home portal server for composite applications.
Before you begin
- PolicyCreator role to create a settings document
- PolicyModifier role to modify a settings document
About this task
Procedure
- From the Domino Administrator, select the People & Groups tab, and then open the Settings view.
- Click Add Settings and then choose Security.
- On the Basics tab, complete these
fields:
Table 1. Basics tab fields Field Action Name Enter a name that identifies the users that use these settings. Description Enter a description of the settings. - Complete all the required fields described in the following tasks.
Managing Notes and Internet passwords
Procedure
- On the Password Management tab,
complete the following options fields:
Table 2. Password Management Options Field Action Use custom password policy for Notes clients Choose one: - No (default)
- Yes - to implement a custom password policy. Custom password policies enable you to configure specific password parameters so that passwords are not trivial or predictable. Use settings on the Custom Password Policy tab to set up the policy.
Check password on Notes ID file Choose one: - No (default)
- Yes - to require that all copies of the user ID have the same password
Allow users to change Internet password over HTTP Choose one: - Yes (default) -- to allow users to use a Web browser to change their Internet passwords.
- No
Update Internet password when Notes client password changes Choose one: - No (default)
- Yes -- to synchronize the user Internet password with the Notes client password.
Note: Selecting Yes activates use of the more secure Internet password format if it is not already in use.Don't prompt for a password from other Notes-based programs (reduces security) Selecting Yes sets this option in Your Login and Password Settings in the Security dialog box for Notes client users to whom this policy is applied. Enabling the option eliminates password prompts by re-using the user's initial login to Notes for any Notes-based applications that share data with Notes. Enable Windows single sign-on for Standard Notes Client Enables support for integrated Windows authentication (using SPNEGO/Kerberos) for Eclipse-based features and products such as Widgets and Live Text, Feeds, Connections, Composite Applications, and Sametime. This option does not affect the Notes client startup password prompt, but eliminates password prompts for participating embedded and other applications and components. For additional information on IWA, see the technote Integrated Windows authentication (IWA) for Eclipse-based components within Lotus Notes in the related information.
- Also on the Password Management tab,
complete the following expiration fields:
Table 3. Password Expiration Settings Field Action Enforce password expiration Choose one: - Disabled (default) -- to disable password expiration. If you disable password expiration, do not complete the remaining fields in this section.
- Enabled
Note: If you enable password expiration for any of the following options, the security settings document defaults change.- Notes only -- to enable password expiration for only Notes passwords.
- Internet only -- to enable password expiration for only Internet passwords.
- Notes and Internet -- to enable password expiration for both Notes and Internet passwords.
Note: Internet password expiration settings are recognized only by the HTTP protocol. This means that Internet passwords can be used with other Internet protocols (such as LDAP or POP3) indefinitely.Note: Do not enable password expiration if users use Smartcards to log in to Domino servers.Required change interval Specify the number of days for which a password is valid before it must be changed. Default is 0. Note: If you set this value to less than 30, the value for the Warning period field is calculated automatically. The calculated value is 80% of the value entered for this field.Allowed grace period Specify the number of days that users have to change an expired password before being locked out. Default is 0, meaning users will not be locked out. Password history (Notes only) Specify the number of expired passwords to store. Storing passwords prevents users from reusing old passwords. Default is 0. Warning period Specify the number of days prior to password expiration at which the user receives an expiration warning message. Default is 0. Note: The value of this field is calculated if the Required change interval setting is set at less than 30 days. Password expiration must be enabled in order for the value of this field to be calculated. If this value is calculated, it cannot be overwritten.Custom warning message Enter a custom warning message that will be sent to users whose password has passed the expiration threshold specified in the Warning Period field. Note: The custom warning message is for Notes clients only, regardless of how you enabled password expiration. Internet users do not see the warning message.
Configuring Internet password lockout
About this task
Procedure
- On the Password Management tab,
complete the following lockout settings:
Table 4. Internet Password Lockout Settings Field Action Override server's Internet lockout settings? When this policy document setting is enabled, the settings in the policy override the Internet password lockout settings in the server's Configuration Settings document. Note: The server must enforce Internet password lockout for these policy settings to be in effect.Maximum tries allowed Maximum number of password attempts allowed before a lockout occurs. When set to 0, unlimited password attempts are allowed. Lockout expiration Period of time for which a lockout is enforced. After this time period, a user account is automatically unlocked the next time the user tries to authenticate. When set to 0, automatic unlock is disabled. Maximum tries interval If a user is not locked out, this is the period of time that must elapse before a successful authentication clears any previous failure attempts. Specify a longer protection strength time for greater security. When set to 0, failed password attempts are cleared every time a successful authentication occurs. - Also on the Password Management tab,
complete the following quality settings fields:
Table 5. Password Quality Settings Field Action Required password quality If you require users to choose passwords based on password quality, specify that quality by choosing a value from the list. Use length instead If you require users to choose passwords based on length, click Yes. When you do, the Required Password Quality field changes to Required password length. Specify the minimum password length here. - For information on completing the fields under ID File Encryption Settings, see the topic Configuring encryption for ID files in the related topics.
Configuring custom password policies
About this task
You need to complete the following fields only if you have chosen to implement a custom password policy.
Procedure
- On the Password Management tab,
under Password Management Options, select Yes for
the Use Custom Password Policy for Notes Clients field.
The Custom Password Policy tab appears.
- Complete the following fields:
Table 6. Custom Password Policy tab fields Field Action Change password on first Notes client use Require users to change their passwords the first time they log in using Notes. Note: This only works if the policy is applied during user registration.Allow common name in password Allow combination of common name of user to be used in passwords. For example: John232 is the password for user CN=John Doe/O=Mutt, where the common name is John Doe. Password length minimum Specify the minimum number of characters that users can have in their passwords Password length maximum Specify the maximum number of characters that users can have in their passwords Password quality minimum Specify the minimum password quality value that users can have for their passwords Minimum number of alphabetic characters required Specify the minimum number of alphabetic characters that users are allowed to have in their passwords Minimum number of uppercase characters required Specify the minimum number of uppercase characters that users are allowed to have in their passwords Minimum number of lowercase characters required Specify the minimum number of lowercase characters that users are allowed to have in their passwords Minimum number of numeric characters required Specify the minimum number of special characters, namely punctuation, that users are allowed to have in their passwords Minimum number of special characters required Specify the minimum number of special characters, namely punctuation, that users are allowed to have in their passwords Minimum number of non-lowercase characters required Specify the minimum number of special characters, numbers, and uppercase characters that you require in user passwords. A higher value here makes passwords more difficult to guess. After you enter a number, a checklist appears, listing the character types you can specify for this requirement. You can pick any combination of the following:
- Uppercase character
- Number
- Special character
Maximum number of repeated characters required Specify the maximum number of repeated characters, of any kind, that are allowed in user passwords. Minimum number of unique characters required Specify the minimum number of characters that appear only once in a password Password may not begin with Specify the type of characters with which users cannot begin their passwords Password may not end with Specify the type of characters with which users cannot end their passwords
Configuring administration ECLs
About this task
Complete the fields on the Execution Control List tab to configure administration ECLs used in your organization.
Field | Action |
---|---|
Admin ECL | Choose one:
Note: The Edit and Manage buttons are displayed only when the
security settings document is in edit mode. |
Update mode | Choose one:
If the client ECL lists a signature that the admin ECL does not, than that signature and its settings stay the same in the client ECL. If the admin ECL lists a signature that the client ECL does not, than that signature and its settings are added to the client ECL. If the client ECL and the admin ECL list the same signature, than the settings for the signature in the client ECL are discarded and replaced by those for the signature in the admin ECL.
|
Update frequency | Choose one:
|
Managing administration Execution Control Lists (ECLs)
About this task
Procedure
- On the Security Settings document toolbar, click Edit Settings.
- Click Manage. The Workstation
Security: Admin Execution Control Lists dialog box appears.
Select from the following options:
Table 8. Workstation Security: Admin Execution Control Lists options Field Action Edit an existing admin ECL - Select the name of the admin ECL you want to edit from the list box and click OK. The name of the selected admin ECL is displayed in the Admin ECL field of the Execution Control List tab.
- Click the Edit button to open the selected admin ECL.
Create a new admin ECL - Type a name for the new ECL in the Create New Admin ECL field and click OK. The name of the new admin ECL is displayed in the Admin ECL field of the Execution Control List tab.
- Click the Edit button to create the new admin ECL.
Delete an existing admin ECL - Select the name of the admin ECL you want to delete from the list box and click Delete.
- The selected admin ECL is deleted and the list of existing admin ECLs is refreshed.
Results
Clicking Cancel leaves the name of the admin ECL displayed in the settings document unchanged.
Enabling key rollover
About this task
Complete the fields on the Keys and Certificates tab to configure key rollover for groups of users. You specify triggers that initiate key rollover for a group or groups of users. You have the option of spacing out the rollover process over a specified period of time for the group of users to which this policy applies.
See the related topics for information on configuring AES for mail and document encryption.
Procedure
- In the Default public key Requirements field,
specify settings for parent and child policies. Select one:
- Inherit public key requirement settings from parent policy
- Enforce public key requirement settings in child policies
- Under User Public Key Requirements ,
complete the following fields.
Table 9. User Public Key Requirements Field Action Minimum allowable key strength Note: Keys weaker than the one specified will be rolled over.- No minimum.
- Maximum compatible with all releases (630 bits).
- Compatible with Release 6 and later (1024 bits).
- Compatible with Release 7 and later (2048 bits).
Maximum allowable key Strength Note: Keys weaker than the one specified will be rolled over.- Compatible with all releases (630 bits).
- Compatible with Release 6 and later (1024 bits).
- Compatible with Release 7 and later (2048 bits).
Preferred key strength Choose the preferred key strength to use when creating new keys: - Compatible with all releases (630 bits).
- Compatible with Release 6 and later (1024 bits).
- Compatible with Release 7 and later (2048 bits).
Maximum allowable age for key (in days) Specify the maximum age a key can reach before needing to be rolled over. Default is 36500 days (100 years). Earliest allowable key creation date Any key created prior to this date will be rolled over. Spread new key generation for all users over this many days: Specify the time period, in days, for new keys to be generated for all users to whom this security settings policy document applies. User keys are randomly rolled over during the configured time period. Default is 180 days. Maximum number of days the old key should remain valid after the new key has been created Specify the length of time that the old key can be used during network authentication. During Notes key verification, all of the certificates, old and new, and all of the rollover keys are organized into a tree and then that tree is traversed looking for a set of certificates that can be chained together to verify the key. If a certificate has expired, it cannot be used in that chain. When rolling over a key because you fear that it has been compromised, it is a good idea to set a short value for the length of time the old certificates issued to that key can be used. Valid values for this setting are 1 to 36500 days, and the default is 365. - Complete the field in Document/Mail Encryption Settings using the information in the topic Configuring AES for mail and document encryption in the related topics.
- Under Certificate Expiration Settings, in the Warning period field, specify the number of days prior to certificate expiration at which the user receives an expiration warning message; the default is 0.
- Under Certificate Expiration Settings, in the Custom warning message field, enter a custom warning message that will be sent to users whose certificate has passed the expiration threshold specified in the Warning period field.
Enabling On-line Certificate Status Protocol (OCSP) checking
About this task
Applying trusted cross-certificates to clients
About this task
Configuring installation of signed plug-ins
About this task
Plug-ins can be provisioned to a Notes user and are ordinarily signed with a certificate that is trusted by the Notes client, and verifies that the data they contain is not corrupted. Users can then install or update the signed plug-ins.
Occasionally, a plug-in is found to have a problem. Either it is unsigned, not signed with a trusted certificate, or the certificate has either expired or is not yet valid. For these cases, you can establish a policy for never installing these plug-ins, always installing them, or asking users to decide at the time the plug-in is installed on their computers.
You can time-stamp plug-in jar signatures using the jar signer tool provided by the Java SDK to ensure the long term validity of plug-in signatures. The Notes client uses a time stamp included with a plug-in jar signature to determine if the plug-in signing certificate was valid at the time of signing. If a plug-in signing certificate has expired but was valid at the time of signing, Notes accepts it so that users do not see security prompts during plug-in installation or provisioning. Use the Ignore expiration for time stamping certificate setting on the Signed Plug-ins tab to control whether to allow the installation of signed plug-ins with expired time stamping certificates. Their installation is allowed by default.
Field | Action |
---|---|
Installation of plug-ins that are expired or not yet valid |
|
Installation of unsigned plug-ins |
|
Installation of plug-ins signed by an unrecognized entity |
|
Trust IBM plug-in signing certificate |
|
Ignore expiration for time stamping certificate |
|
Configuring Portal Server settings
About this task
Field | Action |
---|---|
Home portal server | Enter the name of the IBM WebSphere Portal Server that hosts Notes user accounts. |
Authentication URL | Enter the URL that Notes users need to access in order to authenticate with the portal server. |
Authentication type | Choose one:
|