Adobe 38043740 - ColdFusion Standard - Mac Bedienungsanleitung

Adobe ColdFusion 10 Server Lockdown Guide

Adobe® ColdFusion® 10 Server Lockdown

Guide

Section 1: Introduction

The ColdFusion 10 Server Lockdown Guide is written to help server administrators

secure their ColdFusion 10 installations. In this document you will find several tips

and suggestions intended to improve the security of your ColdFusion server. The

reader is strongly encouraged to test all recommendations on an isolated test

environment before deploying into production.

1.1 Default File Paths and Usernames

This guide will provide example file system paths for installation, you do not need to

use the same example installation paths provided in this guide.

1.2 Operating Systems and Web Servers

This guide focuses on Windows 2008 / IIS 7, and Redhat Enterprise Linux (RHEL)

6.3 / Apache 2.2. Many of the suggestions presented in this document can be

extrapolated to apply to similar Operating Systems and Web Servers.

Contents

Section 1: Introduction………………………………….1

Section 2: Installation Prerequisites……………………. 3

Section 3 - Installing ColdFusion………………………32

Section 4 - Post ColdFusion Installation……………….41

Section 5: ColdFusion Administrator Settings…………57

Section 6: ColdFusion Server Services………………..57

Section 7: Patch Management Procedures…………….83

Appendix A: Sources of Information…………………84

Appendix B: List of Acronyms……………………….85

Acronym……………………………………………85

Meaning…………………………………………….85

1.3 ColdFusion Version

This guide was written for ColdFusion 10.0 Enterprise Edition.

1.4 Scope of Document

This document does not detail security settings for the Operating System, the

Web Server, or Network Firewalls. It is focused on security settings for the

ColdFusion server only.

All suggestions in this document should be tested and validated on a non-production

environment before deploying to production.

Section 2: Installation Prerequisites

Before running the ColdFusion 10 installer follow the steps in this section to prepare your Web Server for

installation.

2.1 Prerequisites for all ColdFusion installations

Create a separate partition / drive for ColdFusion Installation and website assets. This mitigates the

successfulness of path traversal attacks.

Install the latest security patches for your Operating System

Install the latest security patches for your Web Server Software

Configure your Firewall to block all non-administrative traffic to the server during installation.

Download ColdFusion 10 from Adobe.com

Verify that the MD5 checksum of the downloaded file matches the MD5 specified on the Adobe.com download page.

On Mac OSX:

To obtain the MD5 checksum of a file on Mac OSX launch Terminal.app and type: md5 filename

On Linux:

To obtain the MD5 checksum of a file on RedHat Enterprise Linux open a shell and type: md5sum filename

On Windows:

Windows installations do not include a MD5 checksum verifier by default. Microsoft provides a free MD5 checksum verifier called

sigcheck.exe as part of SysInternals toolkit. Download the utility, open the command prompt and type sigcheck -h

filename. The sigcheck utility not only generates a MD5 sum, it also verifies the signature of the ColdFusion installation

executable (you should see Verified: Signed in the program output).

2.2 Prerequisites for a Windows 2008 Server Installation

Read the Microsoft Windows Security Compliance Management Toolkit (see Appendix A.1)

Run Windows Update to ensure all software is up to date

Create Dedicated User Accounts

Ensure that all partitions use NTFS to allow for fine grained access control.

Setup a dedicated website for CF administrator

2.2.1 Create Dedicated User Accounts

Create a new User for the ColdFusion Service to Run As, in the screenshot below we call this user cfusion,

choose a unique username that may not be easily guessed.

Create ColdFusion Service User Account

Next create a new user for the IIS Application Pool:

For both users right click and select Properties. In the Remote Desktop Services Profile tab check the box that

says Deny this user permission to log on to Remote Desktop Session Host server.

If you are setting up multiple instances of ColdFusion for different applications you will want to create dedicated

user accounts for each instance to isolate them from each other. In addition each IIS application pool can have

a dedicated user account, typically each website in IIS is assigned its own application pool.

If the new users were added to any default groups (such as Users) remove them from that group.

2.2.2 Create Web Root Directory

Created a separate partition for the CFML source and web site assets, for the examples in this guide it is

mapped to drive f:\.

Create a directory to contain the web sites for example f:\web\and then create a sub directory to house

each web site.

2.2.3 Grant the Permission to Web Site Root Directories

Right click on the Web site partition folder (eg f:\web\), and select properties. Select the Security tab and

click the Advanced button:

In the Advanced Security Settings Dialog click the Edit Button:

Uncheck the checkbox labeled Include inheritable permissions from this object’s parent. A confirmation box will

appear, select remove:

Table 2.2.3.1 Web Root Content Security Permissions

User / Group

Permissions

Administrators (or equivalent users and groups)

Full Control

iisservice (Your Application Pool Identity User)

•List folder / read data

•Read attributes

•Read extended attributes

•Read permissions

IUSR (the anonymous authentication account)

•List folder / read data

•Read attributes

•Read extended attributes

•Read permissions

User / Group

Permissions

cfusion (Your ColdFusion Service Identity)

•List folder / read data

•Read attributes

•Read extended attributes

•Read permissions

(Add additional write/delete permissions

to folders or files that CF must write to)

Click the Add button and add the iisservice user grant Read and List Folder Contents Permission. Add the

cfusion user and grant Read, List Folder Contents Permission. Grant cfusion Write and Delete permission if

your applications make use of the file system via (cffile, cfdirectory, etc). Also give the Administrators full

control over this folder, and remove any unnecessary privileges.

Check the Replace all existing inheritable auditing entries on all descendants with inheritable auditing entries

from this object checkbox to propagate this setting to all sub folders and files existing or created below this

folder.

Select the Auditing tab in the Advanced Security Settings dialog. Click the Edit button and ensure that some

level of auditing exists. Auditing can generate a large amount of logs, and if too verbose can make the job of

monitoring the server logs difficult. Auditing every successful file read in this directory may not be necessary.

Use your judgement to determine an appropriate auditing policy based on your security requirements. A good

minimal policy would be to audit all Fails, and certain Success events (Delete, Change Permissions, etc).

Andere Handbücher für 38043740 - ColdFusion Standard - Mac

Dieses Handbuch passt für folgende Modelle

Inhaltsverzeichnis

Andere Adobe Software Handbücher

Adobe

Adobe 65007312 - Photoshop Lightroom Handbuch

Adobe

Adobe 25520388 - Premiere Pro - PC Bedienungsanleitung

Adobe

Adobe 38000827 - Macromedia ColdFusion MX Standard... Bedienungsanleitung

Adobe

Adobe 13101332 - Photoshop - Mac Bedienungsanleitung

Adobe

Adobe 22011302 Bedienungsanleitung

Adobe

Adobe 16001500 - Illustrator CS2 - Mac Bedienungsanleitung

Adobe

Adobe 65015459 - Contribute CS4 Bedienungsanleitung

Adobe

Adobe 37980039 - FrameMaker Server - Unix Bedienungsanleitung

Adobe

Adobe 65015459 - Contribute CS4 Bedienungsanleitung

Adobe

Adobe 38039336 - Flash CS3 Professional Referenzhandbuch

Adobe

Adobe ACROBAT 7.0.5 SDK Bedienungsanleitung

Adobe

Adobe 65014912 - Photoshop CS4 Extended Bedienungsanleitung

Adobe

Adobe 22020807 Montage- und Bedienungsanleitung

Adobe

Adobe 8500 Bedienungsanleitung

Adobe

Adobe 38040334 - Dreamweaver CS3 Bedienungsanleitung

Adobe

Adobe 37980039 - FrameMaker Server - Unix Bedienungsanleitung

Adobe

Adobe 22002484 Bedienungsanleitung

Adobe

Adobe 65008009 - After Effects CS4 Leitfaden

Adobe

Adobe CONNECT ENTERPRISE SERVER 6-INSTALLATION... Bedienungsanleitung

Adobe

Adobe ILLUSTRATOR 10 Montage- und Bedienungsanleitung

Adobe

Adobe ILLUSTRATOR CS4 Bedienungsanleitung

Adobe

Adobe 12001196 - Acrobat - Mac Bedienungsanleitung

Adobe

Adobe 65030089 - Robohelp - PC Leitfaden

Adobe

Adobe LIVE CYCLE 7.2 - INSTALLING AND CONFIGURING LIVECYCLE FOR... Bedienungsanleitung

Beliebte Software Handbücher anderer Marken

COMPRO

COMPRO COMPROFM Bedienungsanleitung

Muratec

Muratec OFFICEBRIDGE ONLINE Bedienungsanleitung

Oracle

Oracle Contact Center Anywhere 8.1 Bedienungsanleitung

Avaya

Avaya NULL One-X for RIM Blackberry Bedienungsanleitung

HP ProLiant BL420c Bedienungsanleitung

PS Audio

PS Audio PowerPlay Betriebsanleitung

Brady

Brady LOCKOUT PRO 3.0 Service-Handbuch

Avaya

Avaya Interaction Center Bedienungsanleitung

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Handbuch

Novell

Novell GROUPWISE 8 - INTERNET AGENT Bedienungsanleitung

Oracle

Oracle Application 9i Bedienungsanleitung

Acer

Acer RDM Bedienungsanleitung

Canon

Canon Vixia HF21 Bedienungsanleitung

Canon

Canon ZR950 Bedienungsanleitung

Samsung

Samsung Auto Backup Bedienungsanleitung

Polycom

Polycom Vortex EF2201 Montage- und Bedienungsanleitung

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Bedienungsanleitung

Novell

Novell SP2 - S Bedienungsanleitung