Brian, this is an interesting discussion you raise. I hope folks will forgive/appreciate my blog-length reply and elaboration.
First, while Adobe can and should answer your question, I suspect the change in fact may not apply to EITHER update. Instead, the verbiage on this point in the technote is talking about how the CF installer would work--and I have confirmed first that there are not new/refreshed installers released with this update. Adobe, do you agree? (I have downloaded the zip and gui installers, and compared them to those I got in July, and they are identical.) (As an update, 4 days later: Adobe modified this post on Oct 10 to indicate that in fact there WERE new CF installers that include these updates. I have confirmed they are indeed different from the previous installers. The rest of what I say in thie comment applies and remains unchanged)
As for whether the update may indeed make any change, it will be interesting to hear from anyone who may have installed CF a) with the production profile (rather than production+secure), and b) who may have had no value entered for "Allowed IP Addresses for accessing ColdFusion Administrator and ColdFusion Internal Directories" before the update: do they now see these localhost values entered for them? (For anyone interested, this setting is at the bottom of the "allowed ip addresses" page in the 'Security" section of the Admin.)
And lest casual readers misconstrue things, this is talking about the production vs developer PROFILE (an option in the installer has long had) rather than the prod vs dev DEPLOYMENT TYPE (which is a new option in the installer since CF2021, also offering values like test, stage, qa, and dr). The latter is tracked (once chosen) on the Licensing and Activation page of the CF Admin (and for now cannot be changed in the Admin, and there's a tracker ticket requesting that).
As for the security aspect of this change, I'll say I've always found it odd not only that the installer prompt discussed (in the technote) would be greyed out for ANY profile selected (even "developer"), as there's value (as you're getting to) for everyone to have the admin locked down to only localhost access (unless you choose to open it up). But I've wondered why it didn't pre-populate with these localhost ips discussed in the technote.
And yes, I realize that with the CF Admin exposed by default only on the built-in web server (which defaults to port 8500), that web server's port would be blocked by any firewall. But if other machines within the firewall/network have that port open, that doesn't mean that everyone who CAN access the port SHOULD be able to try to login to the CF Admin.
So in summary, I'd argue that a) an update should change any servers that have NO value for this field to have localhost ips (with a warning to people that if this change blocks them being able to access the admin, they can use the cfsetup tool--new in cf2021--to be able to modify that ip list). Then b) the installer prompt should also be pre-populated with those localhost ips regardless of profile, with the freedom for the installing user to add to or change that list of ips (if somehow they feel they must). And an argument could be made that c) the admin (and installer) should NO longer allow there to be NO value entered for this allowed ip field, as that means it's open to anyone who can reach that built-in web server port.
If I have anything wrong here in any of the above, I welcome correction.
/Charlie (troubleshooter, carehart.org)
49
Replies
AdChoices
