Lotus Nut

We've started a new shared blog: BleedYellow Site Feedback. Make sure that you subscribe to it to receive announcements on site updates, maintenance, downtime, etc... as well as some general posts to respond to questions that people may have.

The first post is about some scheduled downtime Saturday evening.

I'm wondering who took the screenshots in this technote? lol

For those of you who have had trouble accessing the im.bleedyellow.com Sametime community from behind your company's firewall, we have just opened access to the community from port 80 - port. Chat away!! :) You can still use 1533 if you haven't had problems with that.

By the way, if for some reason you need to access the web server, you'll need to go to http://im.bleedyellow.com:8088

Go promote this great idea!!

Go check out the latest Taking Notes Podcast  where Nathan and I talk to Bruce and Julian about everything BleedYellow - past, present, and future!

Thanks for having us guys!

If you're like me, then you probably just hid that pesky little Activities sidebar panel in your Notes client. Let me remind you that it's there and that you can add the BleedYellow server. Just go back into your Notes Preferences and for the server use: http://www.bleedyellow.com/activities

Then you can drag and drop content to your (yellow) heart's content!

It appears that there is some type of formatting issue with the native RSS feeds for Lotus Connections servers (not just BleedYellow) and the parser used at PlanetLotus.org. If you wish to get your feed over there, allow me to recommend that you go to FeedBurner and setup a feed there. Then just get that feed over to Yancy via the blog submission page at PlanetLotus.org. This will at least let you showing up there!!

 After nearly 2 years (bad David!) of not blogging, I would like to welcome back David Jones with his BleedYellow blog! David's a developer/admin and works with System i servers too - not a bad chap!

Continuing my series on Domino 8 Administration features, new with Domino 8.0.1 is the option to mandate the encryption standard for ID files. Full details can be found at the infocenter. With Notes 8.0 and Domino 8.0.1, there is an option to use AES for ID file encryption. Here's how strong AES is:

"The design and strength of all key lengths of the AES algorithm (i.e., 128, 192 and 256) are sufficient to protect classified information up to the SECRET level. TOP SECRET information will require use of either the 192 or 256 key lengths. The implementation of AES in products intended to protect national security systems and/or information must be reviewed and certified by NSA prior to their acquisition and use."

Implementation of AES requires a Domino 8.0.1 server. A Security Settings document is used to configure how the ID file's encryption will be enforced on your server. In a new or existing Security Settings document, you will need to go to the Password Management tab and then scroll to the bottom to the ID File Encryption Settings section:


For both the Mandated and Allowed encryption standards fields, you have the following choices (the same choices as when you change your password in Notes 8.0):

• Compatible with all releases (64 bit RC2)
• Compatible with release 6 and later (128 bit RC2)
• Compatible with release 8 and later (128 bit AES)
• Compatible with release 8 and later (256 bit AES)

First of all, this is great that companies can now mandate this. But the super swank option is the "Key derivation strength (iterations)" field. In layman's terms, the higher you set this value (the default is 5000), the longer a dictionary attack will take against the ID file. It won't be impervious to an attack, but you shouldn't be using passwords that are in dictionaries... From the infocenter:

Key derivation strengthening is a technique used to make it more costly for malicious attackers to guess likely passwords through a brute force dictionary attack. They work by increasing the time it takes to generate a key from a password. The value for this field is the number of times an HMAC algorithm is applied as part of the operation that generates a key from the password. Specifying a larger number for this value increases the duration of each attempt during a dictionary attack. The default setting for this field is 5000, which is acceptable in most environments. Organizations with higher security requirements may wish to specify a higher value.

So, once you have your servers at 8.0.1 and then have clients at 8.0 or higher, you can begin enforcing this. However, you may also phase this in with a tiered approach. For instance, if you have admins and/or developers that may have access to sensitive data, you may wish to get them on the Notes 8.0 + client and apply a special security settings document to their policy.

I received a copy of the book  Lotus Notes Domino 8: Upgrader's Guide just before Lotusphere. It is published by Packt Publishing and was authored by a team of 7 people who work at ISSL (IBM Software Services for Lotus). As the title states, this book is for anyone wanting to upgrade to ND8. As 8.0.1 is coming out this week, many shops will be anxious to upgrade at this time. This book will be very beneficial for you.

There are 10 chapters and an appendix:

1. A Short History of Notes and Domino
2. Overview of New Lotus Notes 8 Client Features
3. Lotus Notes 8 and SOA
4. Productivity Tools
5. Lotus Domino 8 Server Features
6. Deployment Enhancements in Notes/Domino 8
7. Upgrading to Notes/Domino 8
8. Coexistence between Notes/Domino Releases
9. What's New in Notes/Domino 8 Development
10. Integration with Other Lotus/IBM Products
    Appendix: Third-Party Products

It's always great to brush up on the history of the platform. Looking back where it's been and then going into chapter 2 on the new Notes 8 client is a great way to start a book like this. Chapter 3 describes how to use Composite Applications to integrate with your infrastructure and is followed by a chapter on the Productivity Tools. As an administrator, I really found chapter 5 to be helpful. As readers of my blog will know, there are tons of new features with Domino 8 and this chapter does a good job at covering those. Some methods for performing upgrades are laid out in Chapter 6.

Chapter 7 is also extremely valuable. Not only does it review the technical aspects of the upgrade, but there is a great section on the planning that should be done prior to any upgrades. Many of the practices listed here should be put in place for shops of all sizes. And in the instances where an entire infrastructure cannot be upgraded at once, Chapter 8 provides some information on running multiple versions (for instance, remember that if you go from 6.x to 8 that you'll need to do the rooms and resources upgrades that were necessary with the 7 upgrade!). Chapter 9 covers many of the new features with development - composite apps, DB/2, formula/LotusScript additions, etc... And we see in chapter 10 many tips on installing and integrating with other Lotus products (Sametime, WPS, Quickr, Connections, etc...). Then there is an appendix with some third party products that may be beneficial in your environment not only for upgrading but for other things such as reporting.

I highly recommend this book for those of you who may be looking for a place to find the information you need to press on with an upgrade to Notes and Domino 8!

Over at IdeaJam, someone posted an idea on certifying NTFS defragmentation utilities for Domino. Below is my comment there - I would love to see what some of you think about this. Also, here is an example of what I see time and again when looking at fragmentation on Domino systems:



I don't care what file system you use, if you are using Domino you will have fragmentation. Even the WAFL fs has a defrag utility, even though it may be less susceptible.

The "problem" with Domino databases is that right after you defrag the volume, the file system starts to fragment because you're adding to the databases and that data has to go somewhere. It cannot go into a contiguous block because there may not be block space available due to the defrag tool keeping all files contiguous when defragging. And this isn't necessarily a problem with Domino - it's more of an issue with the file system and how it allocates storage.

To deal with this and achieve good uptime, I had hoped that a copy-style compact would be a poor man's defrag. Initially, it would seem that this would work because a new copy of the database would be created. However, this is not so because Domino doesn't (or can't?) always allocate a contiguous block that will store the entire database. Besides, Domino creates the database and has to start allocating space for the individual documents. Even if Domino could allocate a contiguous block, it would still suffer from fragmentation when new documents are added. (note: I didn't put this at my Idea Jam comment, but I would note that other transactions on the system will likely start to allocate blocks where the copy-style compact would be placing the data, so this is why more fragmentation may occur).

If Domino could get around this and use a contiguous block, I would propose something like "load compact -c +10" so that you get 10% white space in the new copy. Then you could have some white space in which new documents can be created and not cause further fragmentation.

Taking Domino out of the equation, something that may actually be faster than a defrag is to move all of the databases (or at least the largest or most heavily fragmented) off of the disk onto another volume and then run a defrag on the remaining files on that drive. Then just move the data back and the file system should allocate contiguous blocks for the new data while it's creating them one at a time.

Any other thoughts?

Thanks to Mikkel Heisterberg there is now a "Custom Sametime blackbox for bleedyellow.com" - check out his post for more details. If you're logged into the im.bleedyellow.com Sametime community and you've updated your Profile picture then it will surface in the Sametime business card. Good work Mikkel!

Wanted to pass along two quick InfoCenter tips...

1. When you're searching the Connections InfoCenter, make sure that you hover over the search results links prior to clicking them. This will let you know the version of Connections that the result will take you to (actually, it's the main topic that the results are under - which corresponds to the version in this case and is extremely helpful):
   
   
   
   The same goes for the Quickr InfoCenter. Unfortunately, there is not a main topic in the contents that corresponds to Quickr Services for Portal or for Domino. So after you click the link, you'll need to look at the top of the document to see if the documentation is for Portal or Domino.
   
   
2. When forwarding someone a link to an InfoCenter document, don't just copy the address that's in the address bar. This is the link to the main InfoCenter page. Instead, copy the shortcut from the search results or view the frame info and copy the address from there.