Skip to main content
A
Aegis_Kleais
Inspiring
November 6, 2012
Answered

Best practices with the CFIDE and Jakarta virtual directories

  • November 6, 2012
  • 1 reply
  • 9873 views

Right now I'm going through setting up our new virtualized ColdFusion 10 Application/Web/Data server, and I noticed that during install, since I had 'Connect all IIS sites' selected, it created the handler mappings for each but also gave each a virtual directory for 'CFIDE' and 'Jakarta'.

Best practice guides have said to restrict access to the 'adminapi', 'administrator', 'componentutils' and 'wizards' folders under the CFIDE directory, but is it safe to just remove these virtual directories (and leave the handler mappings) so that the sites can still process CF-related file types?

The 1 site we have that is the default that localhost is bound to, I felt I would just leave those virtual directories there, since in order to get to that server's CF ACP, we'd have to goto: http://localhost/CFIDE/administrator/index.cfm

I know that if a file in a site needs access to things like the CFScripts folder, CF will automatically assume the virtual directory is there and create <script> tags that use a src of '/CFIDE/scripts' (which if I remove that virtual directory, would break functionality, but assuming I'm not using such tech in other sites, is removing 'CFIDE' and 'Jakarta' going to hurt anything?

    This topic has been closed for replies.
    Correct answer Carl Von Stetten

    Look at the ColdFusion 9 Lockdown Guide that Pete Freitag wrote.  Much of it still applies to ColdFusion 10, especially the IIS security aspects.  There is a section on creating global request filters which will block access to most (or all) of the subdirectories under CFIDE.

    As for the Jakarta virtual directory, you need that one.  It is what enables the IIS connector to function.

    -Carl V.

    1 reply

    Carl Von Stetten
    Carl Von StettenCorrect answer
    Legend
    November 7, 2012

    Look at the ColdFusion 9 Lockdown Guide that Pete Freitag wrote.  Much of it still applies to ColdFusion 10, especially the IIS security aspects.  There is a section on creating global request filters which will block access to most (or all) of the subdirectories under CFIDE.

    As for the Jakarta virtual directory, you need that one.  It is what enables the IIS connector to function.

    -Carl V.

    Carl Von Stetten
    Carl Von Stetten
    Legend
    November 7, 2012

    Also, I believe a ColdFusion 10 Lockdown Guide is in the works.  Not sure when it will be released, but it is coming.

    -Carl V.

    A
    Aegis_KleaisAuthor
    Inspiring
    November 7, 2012

    Good deal.  I was reading a Best Practices guide that was designed for CF8 (even though we use CF10).  CF9 is a better step forward (and Ill be very interested when the version 10 comes out)  I want to run a tight ship for my web servers.  I'm gonna give this a read through and impart it's wisdom where I can, thanks.

    So the Jakarta virtual directory is what gives it access to the ISAPI DLL file eh?  Wonder what reasoning they used behind using a virtual directory for that....

    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices