Home » Adobe Manuals » Computer Software » Adobe 38043740 » Manual Viewer

Adobe 38043740 Lockdown Guide - Page 41

Windows 2008 Post ColdFusion Installation, 4.1.1 Install ColdFusion Hotfixes

UPC - 883919135168

Add to My Manuals
Save this manual to your list of manuals

Page 41 highlights

Section 4 - Post ColdFusion Installation 4.1 Windows 2008 Post ColdFusion Installation 4.1.1 Install ColdFusion Hotfixes Note: At the time of this writing you will need to install the ColdFusion 10 Mandatory Update before you can install any Hotfixes: See http://helpx.adobe.com/coldfusion/kb/coldfusion-10-mandatory-update.html Login to ColdFusion administrator and click on Server Updates > Updates and then select the latest hotfix, and click Download. Verify the integrity of the download by performing verifying the md5 checksum on the hotfix_XXX.jar file, see that it matches the value found in Adobe ColdFusion update feed: https://www.adobe.com/go/coldfusionupdates If the md5 checksum matches install the hotfix from the command prompt: java -jar {coldfusion-home}\cfusion\hf-updates\hotfix_XXX.jar Replace hotfix_XXX.jar with the filename of the hotfix jar you are installing, and follow the prompts. The installer will typically attempt to restart ColdFusion when done, you can however disable that, see documentation for details. You may need to reinstall the IIS connectors at this point, consult the hotfix release notes. 4.1.2 Setup Permissions on ColdFusion installation directory Grant the user you created for ColdFusion to run as (cfusion in our example) and the Administrators group full control over the ColdFusion installation directory. Enable auditing on this directory as well. In a maximum security environment you may consider a more detailed permission structure for the ColdFusion installation directory to prevent runtime changes to certain resources or configuration, this may however break features like security hotfix installation from ColdFusion administrator. 41

Section	Page
Adobe® ColdFusion® 10 Server Lockdown Guide	1
Section 1: Introduction	1
1.1 Default File Paths and Usernames	1
1.2 Operating Systems and Web Servers	1
1.3 ColdFusion Version	2
1.4 Scope of Document	2
Section 2: Installation Prerequisites	3
2.1 Prerequisites for all ColdFusion installations	3
2.2 Prerequisites for a Windows 2008 Server Installation	3
Table 2.2.3.1 Web Root Content Security Permissions	9
2.2.7 Anonymous Access Identity	17
2.2.8 Setup Request Filtering	17
Table 2.2.8.1 : CFIDE URIs	22
Additional URI Sequences to consider blocking:	22
2.2.9 Create a Website For ColdFusion Administrator	23
Remove Request Filtering Rule for ColdFusion Administrator Site	25
2.3 Prerequisites for a RedHat Enterprise Linux 6.3 Installation	27
Section 3 - Installing ColdFusion	32
3.1 Run ColdFusion Installer	32
4.1 Windows 2008 Post ColdFusion Installation	41
4.1.1 Install ColdFusion Hotfixes	41
4.1.10 Optionally Remove ASP.NET	48
4.2 Red Hat Enterprise Linux Post Installation	49
4.2.1 Install ColdFusion Hotfixes / Updates	49
4.2.3: Specify permissions for ColdFusion Directories	50
4.2.4: Install Apache Connector	50
4.2.7 Setup Auditing	53
4.2.8 Add umask to startup script	54
4.3 Post Configuration Settings for Windows and Linux	54
4.3.4 Tomcat Shutdown Port	55
4.3.5 Add a connector shared secret	56
4.3.6 Additional Tomcat Security Considerations	56
4.3.7 Additional File Security Considerations	56
5.1 Server Settings > Settings	57
5.2 Server Settings > Request Tuning	63
5.3 Server Settings > Client Variables	65
5.4 Server Settings > Memory Variables	65
5.5 Server Settings > Mail	67
5.6 Data & Services > Data Sources	67
5.7 Data & Services > Flex Integration	68
5.8 Debugging & Logging > Debug Output Settings	69
5.9 Debugging & Logging > Debugger Settings	69
5.10 Debugging & Logging > Logging Settings	70
5.11 Event Gateways > Settings	71
5.12 Security > Administrator	71
5.13 Security > RDS	72
5.14 Security > Sandbox Security	72
5.15 Security > Allowed IP Addresses	73
6.1 Servlets and Servlet Mappings in web.xml	75
6.2 Disabling RDS if Already Installed	76
6.3 Disabling support for JWS files	76
6.4 Disabling the GraphServlet	77
6.5 Disabling Flash Remoting Servlet Mappings	77
6.6 Disabling Flash Form Servlet Mappings	78
6.7 Disabling the CFReport Servlet Mapping	78
6.8 Remove WSRP Servlet Mapping	79
6.9 Disabling the CFFileServlet Mapping	79
6.10 Disabling Remote CFC Invocation	80
6.11 Adding ClickJacking Protection	82
6.12 Security Constraints in web.xml	82
Section 7: Patch Management Procedures	83
Meaning	85

Match case Limit results 1 per page

Section 4 - Post ColdFusion Installation

4.1 Windows 2008 Post ColdFusion Installation

4.1.1 Install ColdFusion Hotfixes

Note: At the time of this writing you will need to install the ColdFusion 10 Mandatory Update before you can

install any Hotfixes: See

http://helpx.adobe.com/coldfusion/kb/coldfusion-10-mandatory-update.html

Server Updates > Updates

and then select the latest hotfix, and

click

Download

Verify the integrity of the download by performing verifying the md5 checksum on the hotfix_XXX.jar file, see

that it matches the value found in Adobe ColdFusion update feed:

https://www.adobe.com/go/coldfusion-

updates

If the md5 checksum matches install the hotfix from the command prompt:

java -jar {coldfusion-home}\cfusion\hf-updates\hotfix_XXX.jar

Replace hotfix_XXX.jar with the filename of the hotfix jar you are installing, and follow the prompts. The

installer will typically attempt to restart ColdFusion when done, you can however disable that, see

documentation for details.

You may need to reinstall the IIS connectors at this point, consult the hotfix release notes.

4.1.2 Setup Permissions on ColdFusion installation directory

Grant the user you created for ColdFusion to run as (cfusion in our example) and the Administrators group full

control over the ColdFusion installation directory. Enable auditing on this directory as well.

In a maximum security environment you may consider a more detailed permission structure for the ColdFusion

installation directory to prevent runtime changes to certain resources or configuration, this may however break

features like security hotfix installation from ColdFusion administrator.