Adobe® ColdFusion® 10 Server Lockdown Guide

Create a user for ColdFusion to run as, in this guide we use cfusion, but again feel free to choose a unique
name:
# adduser -g webservices -s /sbin/nologin -M -c ColdFusion cfusion
Specify a strong password for the new user:
# passwd cfusion
2.3.6 - Apache Configuration
Create a directory for ColdFusion Administrator web site:
# mkdir /web/cfadmin
# mkdir /web/cfadmin/wwwroot
Setup permission on web partition:
# chgrp -R webservices /web
# chown -R cfusion /web
# chmod -R 750 /web
Note the permission 750 grants rwxr-x--- permission, meaning owner (cfusion) has full control, while the group
(webservices) only has read and execute permission (execute permission is needed to allow directory traversal
by the user).
Most applications will require some write permission under the web root, you can change owner to root (by
running chgrp root /web/path) for files and directories that do not need write permission. In addition
while directories will require execute permission, files in those directories will not require execute permission.
To Lock Down /CFIDE add the following to your /etc/httpd/httpd.conf file:
Order Deny,Allow
29