I have a Lotus Domino server 8.5.3 that is publicly reachable via both HTTP and HTTPS. I’m using it to serve generated images, and some backend users can login to manage these images (upload new ones, edit existing, etc.).

To increase the security of the system, I want to restrict the login to certain IP addresses, so that not everyone can try to login.

The basic rules I want to establish, based on the called URLs, are:

  • Allow /viewImage/* from any
  • Allow /* from 10.0.*.*, 10.7.*.*
  • Deny everything else (403)

Is that possible? And if yes, how and where would I configure it?

(Edit: clarified that the server is also reachable via HTTPS.)

  • Does it have Apache as webserver? What is the server type? In Linux, you can limit access by IP address in iptables or in Apache, either in the config or in htaccess. – SPRBRN Dec 7 '15 at 13:03
  • I think it has an Apache as front-end, so it would be possible to let Apache handle this. Using iptables is not possible in this case, since the access is both over http and over https. But Apache configuration should be fine. – Roland Illig Dec 7 '15 at 15:26
  • Why is iptables not possible? You can set rules for both http and https. I don't know how many addresses you want to allow, and how often this is going to change? – SPRBRN Dec 7 '15 at 16:12
  • iptables is not possible because I need different permissions based on the URL, which is encrypted in the TLS case, so iptables cannot analyze it. – Roland Illig Dec 7 '15 at 19:38
  • Well, that's useful information you should include in your question. – SPRBRN Dec 8 '15 at 8:38

Have a look in the Server document -> Internet Protocols -> HTTP
At the bottom you'll find Network Settings IP Allow list and IP Deny list...
Maybe this helps

  • Thanks for the tip, but it doesn’t help in my case. I need to allow or deny the request based on the URL of the request, and I cannot configure that in this section. – Roland Illig Dec 10 '15 at 10:52
  • Maybe putting a proxy (apache or nginx) in front of the domino could help with this. – umeli Dec 10 '15 at 12:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.