Adobe 38043740 - ColdFusion Standard - Mac User manual

Adobe ColdFusion 10 Server Lockdown Guide
Adobe® ColdFusion® 10 Server Lockdown
Guide
Section 1: Introduction
The ColdFusion 10 Server Lockdown Guide is written to help server administrators
secure their ColdFusion 10 installations. In this document you will find several tips
and suggestions intended to improve the security of your ColdFusion server. The
reader is strongly encouraged to test all recommendations on an isolated test
environment before deploying into production.
1.1 Default File Paths and Usernames
This guide will provide example file system paths for installation, you do not need to
use the same example installation paths provided in this guide.
1.2 Operating Systems and Web Servers
This guide focuses on Windows 2008 / IIS 7, and Redhat Enterprise Linux (RHEL)
6.3 / Apache 2.2. Many of the suggestions presented in this document can be
extrapolated to apply to similar Operating Systems and Web Servers.
Contents
Section 1: Introduction………………………………….1
Section 2: Installation Prerequisites……………………. 3
Section 3 - Installing ColdFusion………………………32
Section 4 - Post ColdFusion Installation……………….41
Section 5: ColdFusion Administrator Settings…………57
Section 6: ColdFusion Server Services………………..57
Section 7: Patch Management Procedures…………….83
Appendix A: Sources of Information…………………84
Appendix B: List of Acronyms……………………….85
Acronym……………………………………………85
Meaning…………………………………………….85

2
1.3 ColdFusion Version
This guide was written for ColdFusion 10.0 Enterprise Edition.
1.4 Scope of Document
This document does not detail security settings for the Operating System, the
Web Server, or Network Firewalls. It is focused on security settings for the
ColdFusion server only.
All suggestions in this document should be tested and validated on a non-production
environment before deploying to production.

3
Section 2: Installation Prerequisites
Before running the ColdFusion 10 installer follow the steps in this section to prepare your Web Server for
installation.
2.1 Prerequisites for all ColdFusion installations
Create a separate partition / drive for ColdFusion Installation and website assets. This mitigates the
successfulness of path traversal attacks.
Install the latest security patches for your Operating System
Install the latest security patches for your Web Server Software
Configure your Firewall to block all non-administrative traffic to the server during installation.
Download ColdFusion 10 from Adobe.com
Verify that the MD5 checksum of the downloaded file matches the MD5 specified on the Adobe.com download page.
On Mac OSX:
To obtain the MD5 checksum of a file on Mac OSX launch Terminal.app and type: md5 filename
On Linux:
To obtain the MD5 checksum of a file on RedHat Enterprise Linux open a shell and type: md5sum filename
On Windows:
Windows installations do not include a MD5 checksum verifier by default. Microsoft provides a free MD5 checksum verifier called
sigcheck.exe as part of SysInternals toolkit. Download the utility, open the command prompt and type sigcheck -h
filename. The sigcheck utility not only generates a MD5 sum, it also verifies the signature of the ColdFusion installation
executable (you should see Verified: Signed in the program output).
2.2 Prerequisites for a Windows 2008 Server Installation
Read the Microsoft Windows Security Compliance Management Toolkit (see Appendix A.1)
Run Windows Update to ensure all software is up to date

4
Create Dedicated User Accounts
Ensure that all partitions use NTFS to allow for fine grained access control.
Setup a dedicated website for CF administrator
2.2.1 Create Dedicated User Accounts
Create a new User for the ColdFusion Service to Run As, in the screenshot below we call this user cfusion,
choose a unique username that may not be easily guessed.
Create ColdFusion Service User Account

5

6
Next create a new user for the IIS Application Pool:
For both users right click and select Properties. In the Remote Desktop Services Profile tab check the box that
says Deny this user permission to log on to Remote Desktop Session Host server.
If you are setting up multiple instances of ColdFusion for different applications you will want to create dedicated
user accounts for each instance to isolate them from each other. In addition each IIS application pool can have
a dedicated user account, typically each website in IIS is assigned its own application pool.
If the new users were added to any default groups (such as Users) remove them from that group.

7
2.2.2 Create Web Root Directory
Created a separate partition for the CFML source and web site assets, for the examples in this guide it is
mapped to drive f:\.
Create a directory to contain the web sites for example f:\web\and then create a sub directory to house
each web site.
2.2.3 Grant the Permission to Web Site Root Directories
Right click on the Web site partition folder (eg f:\web\), and select properties. Select the Security tab and
click the Advanced button:

8
In the Advanced Security Settings Dialog click the Edit Button:
Uncheck the checkbox labeled Include inheritable permissions from this object’s parent. A confirmation box will
appear, select remove:

9
Table 2.2.3.1 Web Root Content Security Permissions
User / Group
Permissions
Administrators (or equivalent users and groups)
Full Control
iisservice (Your Application Pool Identity User)
•List folder / read data
•Read attributes
•Read extended attributes
•Read permissions
IUSR (the anonymous authentication account)
•List folder / read data
•Read attributes
•Read extended attributes
•Read permissions

10
User / Group
Permissions
cfusion (Your ColdFusion Service Identity)
•List folder / read data
•Read attributes
•Read extended attributes
•Read permissions
(Add additional write/delete permissions
to folders or files that CF must write to)
Click the Add button and add the iisservice user grant Read and List Folder Contents Permission. Add the
cfusion user and grant Read, List Folder Contents Permission. Grant cfusion Write and Delete permission if
your applications make use of the file system via (cffile, cfdirectory, etc). Also give the Administrators full
control over this folder, and remove any unnecessary privileges.
Check the Replace all existing inheritable auditing entries on all descendants with inheritable auditing entries
from this object checkbox to propagate this setting to all sub folders and files existing or created below this
folder.
Select the Auditing tab in the Advanced Security Settings dialog. Click the Edit button and ensure that some
level of auditing exists. Auditing can generate a large amount of logs, and if too verbose can make the job of
monitoring the server logs difficult. Auditing every successful file read in this directory may not be necessary.
Use your judgement to determine an appropriate auditing policy based on your security requirements. A good
minimal policy would be to audit all Fails, and certain Success events (Delete, Change Permissions, etc).

11
2.2.4 Add / Remove IIS Server Roles
On a clean Windows 2008 install IIS may need to be installed. This is done by opening the Server Manager
and selecting Roles:

12
Next Click Add Roles, and select the checkbox next to Web Server (IIS):

13
The IIS role includes a number of optional sub-components called “Role Services”. ColdFusion requires that
the ASP.NET, CGI, ISAPI Extensions and ISAPI Filters Role Services are selected. After we have configured
the ColdFusion 10 IIS connection we can actually remove the ASP.NET and CGI Role Services.

14
Review the list of Role Services and remove any that may not be necessary (for example Directory Browsing).
You may find other Role Services to be useful or necessary, such as Logging Tools, HTTP Redirection,
Request Filtering, and IP and Domain Restrictions.

15
2.2.5 Delete Default IIS Web Site
A web site is installed with IIS called Default Web Site, right click and select Remove.
2.2.6 IIS Application Pool Settings
Click on Application Pools in IIS Manager and then click Set Application Pool Defaults in the Actions menu.
This allows you to change the defaults used when a new Application Pool is created. By default each new web
site in IIS gets it’s own Application Pool. Remove any unused application pools (such as the one created by
default).
Change the .NET Framework Version to No Managed Code if your web sites do not require .NET

16
Under Process Model change the Identity to be the IIS user you created (for example iisservice). You will be
prompted for the password of this user:

17
Remove any Application Pools that are defined and not in use, such as the DefaultAppPool
2.2.7 Anonymous Access Identity
By default IIS7 is setup to use the built-in Windows user account called IUSR for anonymous request
authentication. This means that when a request is made to your web site without authenticating with the web
server will use IUSR for the NTFS file permissions.
The IUSR account is setup to be a low privilege account, but there may be cases where you want to change
this to another account, for example if you want to isolate between multiple web sites or applications. The
IUSR account is inherently a member of the Users group which may allow for additional unnecessary access to
files.
2.2.8 Setup Request Filtering
Make sure that you have the Request Filtering Role Service for IIS installed. Under the IIS root (applicable for
all web sites) click on Request Filtering. Select the URL tab and click Deny Sequence.
When a string is added to the Deny Sequence if it is matched in the url IIS will return a 404 Not Found
response, and the request will not reach the ColdFusion server.

18
URI
Purpose
Safe to Block
/CFIDE/administrator
ColdFusion Administrator
Yes, we will create a dedicated web site
for ColdFusion administrator access.
/CFIDE/adminapi
Admin API
Usually, if the admin api is called from
internal CFML code it will still work when
the URI is blocked. If the admin api is
accessed through a remote cfc function
call then use another method to protect
this uri (eg IP restriction)
/CFIDE/AIR
AIR Sync API
Usually, unless AIR sync API is used.
/CFIDE/appdeployment
Yes
/CFIDE/classes
Contains java applets for
cfgrid, cftree, and cfslider
Usually, unless java applets are used.
/CFIDE/componentutils
CFC Documentation viewer
Yes
/CFIDE/debug
Used when debugging is
enabled on the server.
Yes
/CFIDE/images
Contains two image files that
do not appear to be used
anymore
Yes

19
/CFIDE/multiservermonitor-
access-policy.xml
Used to set a policy for
allowing viewing the server
monitor from multiple
domains.
Yes - the server monitor now runs on its
own web server on port 5500.
/CFIDE/orm
Contains interfaces used with
ORM. These interfaces do
not need to be accessible
through the web server.
Yes
/CFIDE/portlets
Contains API for building
portlets with JSR-286, JSR-
168 or WSRP. The API does
not need to be accessible
through the web server.
Yes
/CFIDE/probe.cfm
You can configure probes in
the ColdFusion administrator
which are used to monitor a
URL for failures. This will
throw an exception if not run
over 127.0.0.1.
Yes, however if you want to use probes
you should create a web site that only
listens on 127.0.0.1 and remove this
block.
/CFIDE/scheduler
Contains an interface for
scheduled task event
handlers. Does not need to
be accessible through the
web server.
Yes
/CFIDE/scripts
Contains javascript and other
assets for several ColdFusion
features cfform, cfchart, ajax
tags, etc.
Yes - we will create a new, non default
URI for this folder, and specify the new
URI in the ColdFusion administrator.

20
/CFIDE/ServerManager
Contains the AIR application
binary for the Server
Manager.
Yes
/CFIDE/services
Contains CFCs that can act
as a service layer to Flex, or
other client side applications.
The client application must
have a username / password
and also an allowed IP.
Enabling this feature can
open up a large amount of
security risk to the application
server.
Yes
/CFIDE/websocket
API for web socket listener
CFCs. Does not need to be
open via the web server if
used.
Yes
/CFIDE/wizards
Possibly used for IDE
integration, not needed on
production.
Yes
/CFIDE/GraphData
Used to render cfgraph and
cfchart assets.
Only if cfchart and cfgraph is not used.
/CFIDE/main
Used for RDS
Yes