Skip to main content
R
rzindler
Participant
September 19, 2018
Answered

ColdFusion 2018 - Lockdown

  • September 19, 2018
  • 2 replies
  • 1185 views

Is it possible to get an actual lockdown guide for CF 2018?

The documentation for the auto-lockdown tool is not very detailed and it has been finishing with errors, with most of the lockdown tasks remaining incomplete.

I've hardened instances from CF8 and up several times before - at this point it would be much faster to follow a guide rather than continue to troubleshoot the tool.

This topic has been closed for replies.
Correct answer Dave Watts

I don't think there's a lockdown guide for CF 2018 yet. But there is one for CF 2016, and almost all of that would directly apply here. The only major difference I can think of is how the /CFIDE virtual directory isn't exposed to external web servers (IIS, Apache) the same way as before, and that's basically just less stuff you'll have to do.

Dave Watts, Fig Leaf Software

2 replies

S
SSemrauSr
Participating Frequently
February 11, 2020

Has there been an update about an actual lockdown guide for 2018?  Due to the enhanced security architecture of where I am I'm running into problems and I too would like to be able to due the step-through like the old days to see what might actually be the cause of my issue(s).

D
Community Expert
Dave WattsCommunity Expert
Community Expert
February 11, 2020

So I just looked, and there is one!

 

https://www.adobe.com/content/dam/acom/en/products/coldfusion/pdfs/coldfusion-2018-lockdown-guide.pdf

 

I don't know how new it is, I don't remember seeing it before.

 

Dave Watts, Eidolon LLC

Dave Watts, Eidolon LLC
S
SSemrauSr
Participating Frequently
February 11, 2020

Thanks Dave - unfortunately that is the document that includes using the Auto Lockdown Tool. 

 

I need the manual process - without using the Lockdown Tool.  Old school step through.

 

We never setup 2016 but if the 'manual' lockdown for 2016 is applicable to 2018 then okay I'll use that document.  I just need to know if there is any differences in locking down 2016 vs 2018.

D
Community Expert
Dave WattsCommunity ExpertCorrect answer
Community Expert
September 19, 2018

I don't think there's a lockdown guide for CF 2018 yet. But there is one for CF 2016, and almost all of that would directly apply here. The only major difference I can think of is how the /CFIDE virtual directory isn't exposed to external web servers (IIS, Apache) the same way as before, and that's basically just less stuff you'll have to do.

Dave Watts, Fig Leaf Software

Dave Watts, Eidolon LLC
R
rzindlerAuthor
Participant
September 19, 2018

Thank you, Dave.

I just started going through the 2016 Lockdown Guide a few minutes ago, deciding that it couldn't be that different.

I get why Adobe made the auto-lockdown tool (I was even excited when I heard about it!), but a little too much is happening under the hood for my taste. I want to go through and verify each step, so I might as well do it too! lol

Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices