Brad Wood

January 27, 2020

Spread the word

Share your thoughts

I wanted to highlight a recent project I help a client out with, where we used CFConfig to help automate the process of applying government STIGs to ColdFusion servers.  A STIG, or Security Technical Implementation Guide, is meant to standardize the process of setting up and auditing secure servers.  If you manage servers in a government or corporate setting, you may be familiar with this.  If not, you should still be automating your locks downs anyway, so keep reading.  

So first things first, CFConfig is primarily a CLI tool that runs on CommandBox, however this article is NOT about CommandBox servers.  In fact, the client in question doesn't use CommandBox at all, but just regular ColdFusion installations.  They run CFConfig via a CommandBox installation on a thumb drive so it's never even installed and nothing remains on the server.  Of course, if you're using CommandBox for your servers, it gets even easier, but this is not a requirement.  And finally, credit goes to George Murphy for coming up with this idea and helping assemble all the required lock down elements.


So back to the STIG, here's an example lockdown guide for ColdFusion

Among other things, they cover dozens of settings that must be checked in the ColdFusion administrator-- a process which is manual, time consuming, and prone to mistakes.  We reviewed the lockdown requirements for our project and enhanced CFConfig to ensure it supported all of the settings that we needed to automate.  Then, we created a JSON file representing the lockdown profile that was required for the application servers.  Note, if you're already using CFConfig to manage your datasources, custom tags, or mappings, your lockdown settings can be incorporated into that same JSON, or into a separate JSON you apply only on top of production servers.

So given the file above which is an EXAMPLE, you can apply it to any ColdFusion server like so:

box cfconfig import STIG-CFConfig.json C:/coldfusion2018/cfusion

Adjust the filename and server home path as necessary.  You can review the docs for this here:

And just like that you can apply hundreds of individual lock down settings to a server in seconds.  


The other nifty thing that George used CFConfig for was nightly reporting to verify if anyone had changed any settings directly in the administrator of the servers.  Again, this was done by running CommandBox out of a temporary folder on the machines so nothing was ever "installed", which made it much easier to get approval for the process.  CFConfig has a cfconfig diff command that can compare two servers OR a server and a config JSON file and report any differences between the two.  We added the ability to export the diff report to HTML or PDF so you can create an audit trail of whether your server's settings match the "gold standard" you define in a JSON file.

box cfconfig diff gold-standard.json C:/ColdFusion2018/cfusion/ PDFReportPath=C:/nightlyDiffReports/

And you get a report that looks like this:


Hopefully this gives you some ideas on how to automate the lockdown of your server configuration.  The links and JSON file above were used with ColdFusion, but everything here applies to Lucee as well.  Also keep in mind, the JSON file I provided is an example.  Please modify it to suit your needs.  

And one final note, Adobe ColdFusion 2016+ will overwrite config on disk with the config stored in memory.  That means you must stop the server before applying any configuration changes via CFConfig and the restart the server to pick them up.  

Add Your Comment

Recent Entries

Ortus Will be at Adobe CF Summit 2022!

Ortus Will be at Adobe CF Summit 2022!

4 of our Ortusians will be speaking at CF Summit this year from Oct 3 - 4 in Las Vegas, Nevada. Here are all the details you need to join us and enjoy valuable CFML content to modernize your projects! We are sponsoring the event and will have a booth for you to come by and have a chat with our team!

Maria Jose Herrera
Maria Jose Herrera
September 27, 2022
Prefetching in CBWIRE

Prefetching in CBWIRE

When I want to increase the perceived speed of my CBWIRE apps, one tool I reach for is prefetching. Prefetching is a built-in feature of Livewire JS that allows you to invoke an Action's results on mouseOver.

Grant Copley
Grant Copley
September 20, 2022
Into the Box 2022 - Conference Recap

Into the Box 2022 - Conference Recap

This years Into the Box has just wrapped up, but we are already preparing for 2023’s Into the Box, May, Houston Texas! The event was a huge success, we had solid attendance in person, and almost doubled our online viewership from 2021, great feedback from attendees in Houston, and online. So many attendees didn’t say goodbye at the end of the conference, they said see you next year, which, as an organizer lets you know you’ve done things right, and the hard work has paid off.

Gavin Pickin
Gavin Pickin
September 16, 2022