Locking down a Coldfusion instance admin page

[JimGilley]

I am have been looking around and cannot find the answer anywhere.  I have a web site running on a coldfusion instance, which now has become a problem because you can reach the admin page (www.domain.com/cfide/administrator/index.cfm) which is causing a security issue.

Obviously we have changed the default passwords for all the default accounts but we need to hide this page from outside viewers.  Since this is the way into the administrator for that instance how do I lock this down?

[JR__Bob__Dobbs-qSBHQ2 · Accepted solution]

You have two options

1. Use the security provided by your web server (Apache or IIS) to restrict access to the admin site.

2. Remove the admin pages from your production web server.

See this article from Adobe.

http://kb2.adobe.com/cps/172/tn_17254.html

[JimGilley]

I had tried locking it down through IIS but that did not work at first.  So when I recieved your message I tried again by creating a virtual directory and pointing it to the actual folder this time (instead of the fake empty one before) and then locking that down and that worked.

[ilssac]

A slight variation that is a combonation of the previous two suggestions.

On our production server we installed the CFIDE instance into a private virtural host that can only be accessed from a limited white list of IP address.