HTTP Error 404.2 after running CF 2018 lockdown

[fred f]

So... finally got the lockdown issue all sorted out... but...

Now when I try to access the .cfm test page I get:

HTTP Error 404.2 - Not Found

The page you are requesting cannot be served because of the ISAPI and CGI Restriction list settings on the Web server.

Detailed Error Information:

Module	IsapiModule
Notification	ExecuteRequestHandler
Handler	ExtensionlessUrlHandler-ISAPI-4.0_64bit
Error Code	0x800704ec

Requested URL	http://127.0.0.1:80/
Physical Path	D:\DATA\SITES\DefaultWebsite
Logon Method	Anonymous
Logon User	Anonymous

Any ideas?

The page worked just fine before the lockdown tool was applied.

[fred f]

Ok... interesting...

If I have an index.cfm file in the root and access via:

127.0.0.1\

I get that error... and yes index.cfm is the first file listed at the top of default document in iis

but...

if I access via:

127.0.0.1\index.cfm

It comes up just fine...

huh?!?!?  ideas?

[Dave Watts]

Try going to /index.cfm instead of just /, and see if that works. If so, the lockdown may have interfered with an IIS setting. There are two ways that IIS talks to CF. One is through the /jakarta virtual directory, and the other is through Handler Mappings. I suspect that the /jakarta virtual directory is broken or has been removed. Unfortunately I don't have an IIS+CF install in front of me to look at, but I've run into similar problems.

Dave Watts, Fig Leaf Software

[fred f]

Thanks Dave.  Yep as noted above I can access via \index.cfm just fine.  I just get the error via \.

Sounds like you have some idea of why.  Any suggestions how to proceed?

[Dave Watts]

Unfortunately, I don't really remember enough of the details to step you through it without having an IIS+CF machine to look at, but this link can probably help.

ColdFusion IIS manual connector configuration

Dave Watts, Fig Leaf Software

[fred f]

Thanks Dave,

I actually just did a full re-install of IIS, CF 2018, CF Lockdown from scratch.  That way all is clean and none of the things we tried are there to trip us up.

Interestingly, after the CF 2018 install, everything worked perfectly.  Both as / and as /index.cfm.

Once I do the lockdown install though it's back to / being broken.

Note I did have a couple of error popups during the install:

"An unhandled win32 exception occurred in w3wp.exe [11268].  Just-In-Time debugging this exception failed with the following error:  No installed debugger has Just-In-Time debugging enabled..." more to it but that's the key stuff.

and in the lockdown log there is 1 NonFatalErrors:

Custom Action:	com.adobe.ia.action.iis.WebserverValidator
	Status: ERROR
	Additional Notes: ERROR -	class com.adobe.ia.action.iis.WebserverValidator.install() runtime exception:

So am sooooooooooooo close... just not sure why the / won't work for cfm files once I do the lockdown.  Something there is tripping it all up...

Any help greatly appreciated...

[fred f]

Note that popup about just-in-time debugger is popping up occasionally even when server is idling... so might have not been directly related to install... not sure...

[Charlie Arehart]

As Dave has said,  check or add the Jakarta virtual directory for the site in question.  Let's see if that gets you working. THEN we can sort out what running the lockdown took may have to do with that.

/Charlie

Sent via the Samsung Galaxy S7 active, an AT&T 4G LTE smartphone

[fred f]

Hi Charlie,

Yep, checked and /jakarta virtual directory is there.  This is on the default site.  Haven't setup any other sites yet.

And worked fine prior to applying lockdown so definitely something in that process had the affect.

Thanks!

[fred f]

<vent> Must say that after working with Coldfusion since 1996, I've never had so many issues setting up CF on a new server as I have had this time around.  I know am close now but frustration is high with it being one thing after another.  Sandip from Adobe has been working hard to help (Thank you Sandip!) but the amount of time I've had to invest working through one problem after another is staggering.  And with delays on answers it's been days now just trying to get CF installed...

For a critical business level product it shouldn't be this hard.  Especially when the whole idea of the lockdown automation tool is to make things easier... it's one of the big advertising points of CF2018...

Hopefully someone here can help me figure this out and take me out of my misery... Am way past deadline to have this up and running...</vent>

[bihani]

Hi Fred,

Can we get on a call to look at the issue?

Please share your email so that I can set it up

Thanks,

Kailash

[fred f]

Hi Kailash,

We can and I can setup a zoom room to share screen with you but... and don't take this personally ... I'd need to know a little more about you.... here it just shows you to me as a level 1 user and not necessarily associated with Adobe... just being safe.   You can message me directly if need be.

Thanks!

[fred f]

Hi Kailash,  Thank you.  Sent you invite to your adobe email.

[fred f]

Kailash Rocks!!!!  Between him and Sandip I think I am finally up and running.

For reference, the issue here turns out that lockdown for some reason did not change the setting:

> Application Pools > DefaultAppPool > Basic Settings > .NET CLR version

to "No Managed Code".

Once we switched that suddenly the / behaved just like the /index.cfm

Fantastic.  Thank you Kailash and Sandip for all your hard work!

[fred f]

Note that unhandled win32 exception just popped up again but Kailash thinks he has ideas on that so we're working on that one.  That is the last outstanding item I am aware of.

[Doug Cain]

I've had a hard time getting the lockdown tool to work on a clean server install so I have given up until the first hot fix is released. I have to say this release has been very frustrating so far it seems like were back to the good old days of don't bother until the third or fourth hot fix is out.

On the positive side excellent work persevering with the issue to the bitter end, I may have another go based on your hard earned feedback. Appreciate your efforts.

[bihani]

Hi Doug,

We would definitely like you to give the tool another shot. Please share any concerns you might have with errors you might be seeing at bihani@adobe.com, and I will try to get it resolved for you

Thanks,

Kailash

[fred f]

Thanks Doug.  And yes, I know exactly how you feel.  I normally make it a rule to wait till it's been out long enough for the bugs to be fully ironed out but we were deploying a new server and seemed like more work and possibly issues later on to deploy now with 2016 and then in a year or so have to migrate all to 2018.

If you do give 2018 a go again, let me know if you run into any issues... I ran into quite a few but have documented every step so have good solutions on everything I hit aside from the popup error we're dealing with now.  I've probably fully installed/uninstalled/re-installed iis and CF2018 about 20 times now so quite familiar with the process...

Kailash and Sandip worked hard to help as well and each assisted with some of the issues we hit.

Cheers!