Skip to main content
E
ebcohen
Inspiring
September 25, 2023
質問

Weirdness After CF Auto Lockdown Tool

  • September 25, 2023
  • 返信数 1.
  • 1705 ビュー

I ran the CF Auto Lockdown Tool after a new installation of CF 2023 on a Windows 2022 server. Things have stopped working and I can't figure out why.

 

  • I followed almost all of the prerequisites before running; the only one I didn't follow was the recommendation to put CF on its own drive. I can't do that in this case. I haven't proceeded with the lockdown guide after the part where I ran the auto lockdown tool.

  • The CF Admin seems to work just fine. And the public-facing site works to some extent but hits errors on certain pages. The errors are cryptic to me. Some examples are:

    - Sep 25, 2023 3:07:45 PM org.apache.catalina.core.StandardContext setPath
    WARNING: A context path must either be an empty string or start with a '/' and do not end with a '/'. The path [/] does not meet these criteria and has been changed to []

    -INFO: The Apache Tomcat Native library which allows using OpenSSL was not found on the java.library.path: [C:\CF2023\cfusion\lib;C:\CF2023\cfusion\jintegra\bin;C:\CF2023\cfusion\jintegra\bin\international;C:\\CF2023\\jre\bin]
    Sep 25, 2023 3:07:46 PM org.apache.coyote.AbstractProtocol init

    - Sep 25, 2023 15:08:45 WARN [main] - Unable to determine dialect of the StAX implementation at jar:file:/C:/CF2023/cfusion/lib/bundleaxis/wstx-asl-3.2.9.jar!/
    Sep 25, 2023 15:08:45 PM Warning [main] - Unable to determine dialect of the StAX implementation at jar:file:/C:/CF2023/cfusion/lib/bundleaxis/wstx-asl-3.2.9.jar!/

    And also this one:
    Connect to 127.0.0.1:8989 [/127.0.0.1] failed: Connection refused: no further information http://127.0.0.1:8989/PDFgServlet/
    Sep 25, 2023 15:08:37 PM Error [Thread-17] - Cannot invoke "String.equalsIgnoreCase(String)" because the return value of "coldfusion.document.webkit.PDFgServiceManager.getEngine()" is null
    java.lang.NullPointerException: Cannot invoke "String.equalsIgnoreCase(String)" because the return value of "coldfusion.document.webkit.PDFgServiceManager.getEngine()" is null
    at coldfusion.pdfg.jetty.PDFGServiceImpl.initializePDFGService(PDFGServiceImpl.java:247)
    at coldfusion.pdfg.jetty.PDFGServiceImpl.access$000(PDFGServiceImpl.java:76)
    at coldfusion.pdfg.jetty.PDFGServiceImpl$1.run(PDFGServiceImpl.java:169)

Does anyone have any ideas? I know I can just uninstall the lockdown tool, but I'd rather try to figure out what went wrong.  

 

Thank you

    このトピックへの返信は締め切られました。

    返信数 1

    Charlie Arehart
    Community Expert
    Charlie ArehartCommunity Expert
    Community Expert
    September 25, 2023

    While it's indeed common for people to have problems after running the autolockdown tool (while others love it and have zero issues), you will need to give us more to go on to resolve your issues. The error messages you offer are not uncommon nor are they at ALL unique to your having run the tool. As important, most of those are messages from cf's startup.  

     

    So please tell us what errors you get on screen when running your app? And/or what ones appear in any cf log at that very moment? Don't rely on the date modified of files to decide if they may have something useful for you in recent minutes. Look at the application.log (which will have a single line per error) and the exception.log (which may have dozens of lines per error).

     

    Beware also that your app or cf admin config may have an error handler of your own writing that never writes the error to the logs, but instead just emails it to someone or stores it in a db. That's worth supplementing with a cflog or writelog to show the error ALSO in the cf logs.

     

    Finally, it could be that the error is in the web server or web server connector (connecting the web server to cf). That would be reflected in their teeosevrivr) respective logs, not cf's logs folder. 

     

    Bottom line: the lockdown could well be the cause of your problem, but we need more diagnostics to know the actual problem to be solved. 

    /Charlie (troubleshooter, carehart. org)
    E
    ebcohen作成者
    Inspiring
    September 25, 2023

    Thank you very much Charlie. I found the problem. I checked the IIS logs and see that it is logging a 500 error with a 183 subcode.   I am seeing a more detailed error if I go in via 127.0.0.1:

    Module RequestFilteringModule
    Notification BeginRequest
    Handler StaticFile
    Error Code 0x800700b7
    Config Error Cannot add duplicate collection entry of type 'add' with unique key attribute 'url' set to '/jakarta/isapi_redirect.dll'
    Config File \\?\C:\inetpub\wwwroot\LLWindows.com\web.config

     

    [web.config file mentioned above]
    <?xml version="1.0" encoding="UTF-8"?>
    <configuration>
    <system.webServer>
    <defaultDocument>
    <files>
    <clear />
    <add value="index.cfm" />
    <add value="Default.htm" />
    <add value="Default.asp" />
    <add value="index.htm" />
    <add value="index.html" />
    <add value="iisstart.htm" />
    <add value="default.aspx" />
    <add value="index.php" />
    </files>
    </defaultDocument>
    <httpProtocol>
    <customHeaders>
    <remove name="X-Powered-By" />
    </customHeaders>
    </httpProtocol>
    <security>
    <requestFiltering>
    <denyUrlSequences>
    <add sequence="/Application.cfc" />
    <add sequence="/WEB-INF" />
    <add sequence="/cfformgateway" />
    <add sequence="/flex2gateway" />
    <add sequence="/cfform-internal" />
    <add sequence="/flex-internal" />
    <add sequence="/WSRPProducer" />
    <add sequence="/JSDebugServlet" />
    <add sequence="/securityanalyzer" />
    <add sequence=".svn" />
    <add sequence=".git" />
    <add sequence="/CFIDE" />
    <add sequence="/jakarta" />
    </denyUrlSequences>
    <alwaysAllowedUrls>
    <add url="/jakarta/isapi_redirect.dll" />
    </alwaysAllowedUrls>
    </requestFiltering>
    </security>
    </system.webServer>
    </configuration>

    Interestingly, if I replace the contents of this file with something more along the lines of the default, it all works again--but now I don't know what to do to fix the more secure version:

    <?xml version="1.0" encoding="UTF-8"?>
    <configuration>
    <system.webServer>
    <defaultDocument>
    <files>
    <clear />
    <add value="index.cfm" />
    <add value="Default.htm" />
    <add value="Default.asp" />
    <add value="index.htm" />
    <add value="index.html" />
    <add value="iisstart.htm" />
    <add value="default.aspx" />
    <add value="index.php" />
    </files>
    </defaultDocument>
    <httpProtocol>
    <customHeaders>
    <remove name="X-Powered-By" />
    <add name="X-Powered-By" value="ASP.NET" />
    </customHeaders>
    </httpProtocol>
    </system.webServer>
    </configuration>

    Thanks again.

    Charlie Arehart
    Community Expert
    Charlie ArehartCommunity Expert
    Community Expert
    September 26, 2023

    Well, at least WRT the error you shared, that's telling you to remove the "add url" line from your original web.config. It's simply redundant, already defined at the server level for you (as an "allowed url" in the "request filtering" feature at the server level in iis).

     

    I realize this may all be greek to you (given how you've presented the info), but it really is that simple. And there's no risk that you're "breaking the security" of things by this.

     

    You'll likely ask "then why didn't the lockdown tool set this right", but my suspicion is that it DID set this right--at the server level, and that it did not consider that your site's web.config file might have that redundancy.

     

    So now if you try that change (to the original file), it may move the error to another line which it says is redumdant. Just keep repeating the process.

     

    Let us know how it goes. 

    /Charlie (troubleshooter, carehart. org)
    契約条件Accessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices