Home
Configuring
Use this information to configure your network, users, servers (including Web servers), directory services, security, messaging, widgets and live text, and server clusters.
Configuring a network
This section presents the planning concepts and setup procedures necessary for a successful HCL Domino® deployment over a network. It provides information on network protocols from a Domino perspective but does not attempt to provide general network information.
Network security
Physical network security is beyond the scope of this documentation, but you must set it up before you set up connection security. Physical network security prevents unauthorized users from breaking through the network and using one of the operating system's native services -- for example, file sharing -- to access the server. Physical network security also comes into play when any data is exposed, as the potential exists for malicious or unauthorized users to eavesdrop both on the network where the Domino® system resides and on the system you are using to set up the server.
NRPC and Internet connection security
To control connection access, you typically use a network hardware configuration, such as a firewall, reverse proxy, or Domino® pass-through server, to which you can authorize connections and define access to network resources.

Configuring
Use this information to configure your network, users, servers (including Web servers), directory services, security, messaging, widgets and live text, and server clusters.
- Configuring a network
  This section presents the planning concepts and setup procedures necessary for a successful HCL Domino® deployment over a network. It provides information on network protocols from a Domino perspective but does not attempt to provide general network information.
  - Domino® and networks
    A variety of client systems can use wireless or wired technology to communicate with Domino® servers over local area networks (LANs), wide area networks (WANs), and metropolitan area networks (MANs). For example, Notes® workstations and Domino servers use the Notes remote procedure call (NRPC) protocol running over the LAN's network protocol to communicate with other Domino servers. Other client systems, such as Web browsers, Internet mail clients, wireless application protocol (WAP) devices, and personal information management (PIM) devices, can also communicate with Domino servers.
  - Network security
    Physical network security is beyond the scope of this documentation, but you must set it up before you set up connection security. Physical network security prevents unauthorized users from breaking through the network and using one of the operating system's native services -- for example, file sharing -- to access the server. Physical network security also comes into play when any data is exposed, as the potential exists for malicious or unauthorized users to eavesdrop both on the network where the Domino® system resides and on the system you are using to set up the server.
    - NRPC and Internet connection security
      To control connection access, you typically use a network hardware configuration, such as a firewall, reverse proxy, or Domino® pass-through server, to which you can authorize connections and define access to network resources.
    - Using a Domino® pass-through server as a proxy
      A proxy is a system that understands the type of information transmitted -- for example, NRPC or HTTP-format information -- and controls the information flow between trusted and untrusted clients and servers. A proxy communicates on behalf of the requester and also communicates information back to the requester. A proxy can provide detailed logging information about the client requesting the information and the information that was transmitted. It can also cache information so requesters can quickly retrieve information again.
    - TCP/IP security considerations
      In a TCP/IP network, configure all Domino® servers to reject Telnet and FTP connections. Furthermore, do not allow file system access to the Domino server or the operating system on which it runs, unless you are sure you can properly maintain user access lists and passwords and you can guarantee a secure environment.
    - Mapped directory links and Domino® data security
      To ensure data security, do not create a mapped directory link to a file server or shared Network Attached Storage (NAS) server for a Domino® server. These links can cause both database corruption and security problems.
  - Setting up Domino® servers on the network
    Before and after installing a Domino® server, perform required tasks.
- Configuring users and servers
  Topics in this section describe how to set up users and servers.

NRPC and Internet connection security

To control connection access, you typically use a network hardware configuration, such as a firewall, reverse proxy, or Domino® pass-through server, to which you can authorize connections and define access to network resources.

In addition, you can encrypt all connections by service type. Encrypting connections protects data from access by malicious or unauthorized users. To prevent data from being compromised, encrypt all Domino® and Notes® services that connect to public networks or to networks over which you have no direct control. Encrypting the connection channel prevents unauthorized users from using a network protocol analyzer to read data.

To encrypt NRPC network traffic, use the Notes® port encryption feature. For traffic over Internet protocols, use SSL. For both NRPC and Internet protocols, you can enforce encryption at the server for all inbound and outbound connections. In the case of the Notes® client, you can also enforce encryption on all outbound connections, even if the server to which you are connecting allows unencrypted connections.

Because encryption adds additional load to the server, you may want to limit the services for which the server uses encryption. Other ways to minimize the load that encryption puts on the system include:

Using an additional Domino® server acting as a pass-through server for NRPC connections
Using a reverse proxy to manage authentication and encryption outside of Domino® servers when using SSL
Removing unnecessary or unused protocols or services on the server system as well as Domino® server services