Adobe® ColdFusion® 10 Server Lockdown Guide

More documents

Recommendations

Info

Appendix A: Sources of Information A.1 - Microsoft Security Compliance Management Toolkit: http://www.microsoft.com/downloads/details.aspx?FamilyID=5534bee1-3cad-4bf0-b92b-a8e545573a3e A.2 - NSA Operating System Security Guides: http://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/operating_systems.shtml A.3 - NSA Guide to Secure Configuration of Red Hat Enterprise Linux 5: http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf A.4 - ColdFusion and SELinux: http://www.talkingtree.com/blog/index.cfm?mode=entry&entry=28ED0616- 50DA-0559-A0DD2E158FF884F3 A.5 - ColdFusion MX with SELinux Enforcing: http://www.ghidinelli.com/2007/12/06/coldfusion-mx-with-selinuxenforcing A.6 - Tips for Securing Apache: http://www.petefreitag.com/item/505.cfm A.7 - Apache Security by Ivan Ristic, 2005 O’Reilly ISBN: 0-596-00724-8 A.8 - Tips for Secure File Uploads with ColdFusion: http://www.petefreitag.com/item/701.cfm A.9 - HackMyCF.com Remote ColdFusion vulnerability scanner: http://hackmycf.com/ A.10 - Fixing Apache (13) Permission Denied 403 Forbidden Errors: http://www.petefreitag.com/item/793.cfm A.11 - Apache Tomcat 7 Security Considerations: http://tomcat.apache.org/tomcat-7.0-doc/security-howto.html 84
Appendix B: List of Acronyms Acronym Meaning RHEL Red Hat Enterprise Linux IIS (Microsoft) Internet Information Server DOS Denial of Service SSL Secure Socket Layer - Protocol often used for https HTTPS Hypertext Transfer Protocol Secure - Encryption layer for HTTP HTTP Hypertext Transfer Protocol SSH Secure Shell - Protocol used to connecting to a remote server, typically on unix. NTFS New Technology File System - File System for Windows which allows for fine grained ACL ACL Access Control List XML Extensible Markup Language JSP Java Server Page JWS Java Web Service CFML ColdFusion Markup Language 85
Page 1 and 2:
Adobe ColdFusion 10 Server Lockdown
Page 3 and 4:
Section 2: Installation Prerequisit
Page 6 and 7:
Next create a new user for the IIS
Page 8 and 9:
In the Advanced Security Settings D
Page 10 and 11:
User / Group Permissions cfusion (Y
Page 12 and 13:
Next Click Add Roles, and select th
Page 14 and 15:
Review the list of Role Services an
Page 16 and 17:
Under Process Model change the Iden
Page 18 and 19:
URI Purpose Safe to Block /CFIDE/ad
Page 20 and 21:
CFIDE/ServerManager Contains the AI
Page 22 and 23:
Table 2.2.8.1 : CFIDE URIs Addition
Page 24 and 25:
Next click on Sites and Add Web Sit
Page 27 and 28:
2.3 Prerequisites for a RedHat Ente
Page 29 and 30:
Create a user for ColdFusion to run
Page 31 and 32:
SSLRequireSSL The above requires t
Page 34 and 35: Do not install ColdFusion 10 ODBC S
Page 36 and 37: Select an install directory, a non-
Page 39 and 40: Choose a strong password and unique
Page 41 and 42: Section 4 - Post ColdFusion Install
Page 43 and 44: 4.1.3 Specify Log On User for ColdF
Page 45 and 46: When the ColdFusion IIS connector i
Page 47 and 48: 4.1.8 Remove Unused Handler Mapping
Page 49 and 50: without these settings enabled so y
Page 51 and 52: -bin /usr/sbin/httpd \ -script /etc
Page 53 and 54: # cp jvm.config jvm.config.backup T
Page 55 and 56: connectionTimeout="20000" redirectP
Page 57 and 58: Section 5: ColdFusion Administrator
Page 59 and 60: Setting Default Recommendation Desc
Page 63 and 64: 5.2 Server Settings > Request Tunin
Page 65 and 66: 5.3 Server Settings > Client Variab
Page 69 and 70: 5.8 Debugging & Logging > Debug Out
Page 71 and 72: 5.11 Event Gateways > Settings Sett
Page 73 and 74: 5.15 Security > Allowed IP Addresse
Page 75 and 76: Section 6: ColdFusion Server Servic
Page 77 and 78: JWS Files are Java Web Services fil
Page 79 and 80: If you are not using the cfreport y
Page 81 and 82: Note: it is important that you do n
Page 83: Section 7: Patch Management Procedu
Page 87: Written by Pete Freitag For more in
show all

Adobe® ColdFusion® 10 Server Lockdown Guide

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?