HCL Sametime 11.6 and MongoDB 4.4 - how to enable mongo security correctly

HCL Sametime 11.6 is supporting MongoDB 4.4 and this is the suggested version in case of new install.

During a Community setup is enable the Mongo security as described here , but the steps there are not enough, because 4.4 version in case of replica set. 

This version require also the creation and the use of a shared key to every Mongo server involved in the replica set, even if the replica set is composed by 1 node.

The first step required is the creation of  the authentication key that I made with the following command:

openssl rand -base64 741 > /etc/mongod.key

After the creation of the key, ownership and permission should be set in the right way:

chmod 600 /etc/mongod.key

chown mongod: /etc/mongod.key

now it's possible to enable the security  inside /etc/mongod.conf

security:

  authorization: enabled

  keyFile: /etc/mongod.key

IBM Domino 9.0.1 Fp4 IF3 and Domino 8.5.3 FP6 IF10 available for download

IBM has released 2 new interim fix for Domino 9.01 FP4 and 8.5.3 Fp6 that address some issue regarding GIF converting process

See the link below for the fixlist and the download links

• Interim Fix 3 for Domino 9.0.1 Fix Pack 4 (fix list & download links)
• Interim Fix 10 for Domino 8.5.3 Fix Pack 6 (fix list & download links)

The release date of Domino 9.0.1 Fp5 originaly planned for October now is delayed to November2015

Domino Vs Padding TLS vulnerability , new security fix released

Yesterday  IBM has released this security bullettin where is confirmed  Domino ( 8.5.x e 9.x) is affected by TLS Padding vulnerability but also has released a new fix to address that issue !


Below you could find the download link, happy fixing and happy holiday !

• 9.0.1 Fix Pack 2 Interim Fix 3 - http://www.ibm.com/support/docview.wss?uid=swg21657963
• 9.0 Interim Fix 7 - http://www.ibm.com/support/docview.wss?uid=swg21653364
• 8.5.3 Fix Pack 6 Interim Fix 6 - http://www.ibm.com/support/docview.wss?uid=swg21663874
• 8.5.2 Fix Pack 4 Interim Fix 3 - http://www.ibm.com/support/docview.wss?uid=swg21589583
• 8.5.1 Fix Pack 5 Interim Fix 3 - http://www.ibm.com/support/docview.wss?uid=swg21595265

Security fix for IBM Connections 4.5

IBM has issued a Security Bulletin for IBM Connections 4.5

The IBM Connections Communities component contains a cross-site scripting vulnerability. IBM Connections v4.5 is impacted.

For more details see here

Do not use Notes client single logon.

IBM has issued a Security Bulletin for Notes Client single logon feature.

Notes Client Single Logon uses an operating system communication mechanism for password transmission between Windows and Notes that can be attacked by malicious code planted on the user workstation to reveal the user password. To prevent the potential for attack, disable Notes Client Single Logon and instead opt to use the more secure Notes Shared Login or Notes Federated Login.

For more details see here

IBM Security Bulletin: Vulnerability (and fix) in Sametime

IBM has published 2 technotes , where are announced security vulnerability on Sametime Advanced, Sametime Client and Sametime Stlinks. This vulnerability has classified with CVSS score 3.5 (minor impact)

Here the technote about Sametime Advanced and client (version affected from 8.5.1 to 8.5.2.1)
Here the technote about Sametime Stlinks (version affected from 8.0.2 to 8.5.2.1)


Inside the technotes, you could find some explainations with download links and patch instructions. If in your environment you are using Sametime Proxy you could  ingnore the (legacy) Stlinks.