Skip to main content
A
Anonymous
January 12, 2013
Answered

How does one disable the built-in web server?

  • January 12, 2013
  • 2 replies
  • 1761 views

In my case an Adobe tech enabled the built-in web server for some sort of testing and left it enabled.  I would like to once again disable it to limit the attack surface as I can see it is getting some hits by an internal vulnerability scanner on our network.

Where is the config file and specific setting to disable only the built-in web server?

The undesirable change made to the built-in web server is referenced in this forum entry:  http://forums.adobe.com/message/4388179

This topic has been closed for replies.
Correct answer Anit_Kumar

Adding to Miguel-F's information, in case you are using ColdFusion 9 then, only adding the below code, in the section above will serve the purpose.

<attribute name="deactivated">true</attribute>

2 replies

Miguel-F
Miguel-F
Inspiring
January 14, 2013

From the post that you referenced it appears that you are running ColdFusion 9.  I would suggest that you read the ColdFusion server lockdown guide written by Pete Freitag.  http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/91025512-cf9-lockdownguide-wp-ue.pdf

From that document:

Remove the JRun web server on the cfusion instance

When you install ColdFusion, it sets up the JRun web server running on port 8300. This is not needed and should be disabled. Back up the {cf.install.root}/servers/cfusion/SERVER-INF/jrun.xml file, and then remove the following:

<service class=”jrun.servlet.http.WebService” name=”WebService”>

    <attribute name=”activeHandlerThreads”>25</attribute>

    <attribute name=”backlog”>500</attribute>

    <attribute name=”interface”>*</attribute>

    <attribute name=”keepAlive”>false</attribute>

    <attribute name=”maxHandlerThreads”>1000</attribute>

    <attribute name=”minHandlerThreads”>1</attribute>

    <attribute name=”port”>8300</attribute>

    <attribute name=”threadWaitTimeout”>300</attribute>

    <attribute name=”timeout”>300</attribute>

</service>

You must remove this information for each ColdFusion instance created.

Anit_Kumar
Anit_KumarCorrect answer
Inspiring
January 14, 2013

Adding to Miguel-F's information, in case you are using ColdFusion 9 then, only adding the below code, in the section above will serve the purpose.

<attribute name="deactivated">true</attribute>

A
Anonymous
January 14, 2013

I recall this looks familiar to the change that was made.  I'll revert it.

Anit_Kumar
Anit_Kumar
Inspiring
January 13, 2013

Can you describe your enviroment?

-Coldfusion Version

-Single/Multiserver Installation

Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices