Cold Fusion 2023 Lockdown Guide

[LarryRamp]

Installed lockdown guide but it destroyed permissions on the websites. Does anyone have a manual lockdown guide for Cold Fusion 2023 Standard Edition?

[BKBK · Accepted solution]

As far as I know, there is just one ColdFusion 2023 Lockdown Guide for both Standard Edition and Enterprise Edition.

See the Troubleshooting tips in chapter 13 of the guide. You should also have a look at Adobe's documentation on Server Auto-Lockdown. It contains suggestions that pertain to your specific web server and Operating System.

[LarryRamp]

Thanks, I will read through that info. 

[Charlie Arehart · Accepted solution]

To be clear, you installed the lockdown TOOL, which is what caused your trouble. The lockdown GUIDE would walk you through doing the process manually.

Sadly, since the introduction of that tool with cf2018, the guide was modified to mostly presume you were also using the tool. Some content was removed as seeming therefore to be redundant. But not everyone wants to (or should) run the tool.

As bkbk noted, the docs for the TOOL may be better for solving problems using it. Honestly, I tell anyone running it to be sure to have a backup or VM snapshot before running the tool. It is so invasive that some even find the locked-down configuration too difficult to work with. (There's always a tension between security and convenience/familiarity.) Ande  while the tool has an uninstall feature, sometimes it fails to revert things entirely.

Have you tried it yet? Or maybe you did such a manual reversion of a backup or snapshot (good for you anticipating that need), and now you just want to do lockdown by hand.

The lockdown guides bkbk pointed to will be your best current resource. You may want to also checkout the cf2016 version of the guide to supplement it. It and other versions are here:

https://cfdocs.org/security

[LarryRamp]

Thank you!

I have used the CF2016 lockdown guide and it worked well. I thought I would give the 2023 version a shot to ease a bit of work...lol  back to the manual lockdown!

Thanks,

Larry