Blog

Brad Wood

January 27, 2020

Spread the word


Share your thoughts

I wanted to highlight a recent project I help a client out with, where we used CFConfig to help automate the process of applying government STIGs to ColdFusion servers.  A STIG, or Security Technical Implementation Guide, is meant to standardize the process of setting up and auditing secure servers.  If you manage servers in a government or corporate setting, you may be familiar with this.  If not, you should still be automating your locks downs anyway, so keep reading.  

So first things first, CFConfig is primarily a CLI tool that runs on CommandBox, however this article is NOT about CommandBox servers.  In fact, the client in question doesn't use CommandBox at all, but just regular ColdFusion installations.  They run CFConfig via a CommandBox installation on a thumb drive so it's never even installed and nothing remains on the server.  Of course, if you're using CommandBox for your servers, it gets even easier, but this is not a requirement.  And finally, credit goes to George Murphy for coming up with this idea and helping assemble all the required lock down elements.

STIG

So back to the STIG, here's an example lockdown guide for ColdFusion

https://www.stigviewer.com/stig/adobe_coldfusion_11/

Among other things, they cover dozens of settings that must be checked in the ColdFusion administrator-- a process which is manual, time consuming, and prone to mistakes.  We reviewed the lockdown requirements for our project and enhanced CFConfig to ensure it supported all of the settings that we needed to automate.  Then, we created a JSON file representing the lockdown profile that was required for the application servers.  Note, if you're already using CFConfig to manage your datasources, custom tags, or mappings, your lockdown settings can be incorporated into that same JSON, or into a separate JSON you apply only on top of production servers.

So given the file above which is an EXAMPLE, you can apply it to any ColdFusion server like so:

box cfconfig import STIG-CFConfig.json C:/coldfusion2018/cfusion

Adjust the filename and server home path as necessary.  You can review the docs for this here:

https://cfconfig.ortusbooks.com/using-the-cli/command-overview/import-settings

And just like that you can apply hundreds of individual lock down settings to a server in seconds.  

Reporting

The other nifty thing that George used CFConfig for was nightly reporting to verify if anyone had changed any settings directly in the administrator of the servers.  Again, this was done by running CommandBox out of a temporary folder on the machines so nothing was ever "installed", which made it much easier to get approval for the process.  CFConfig has a cfconfig diff command that can compare two servers OR a server and a config JSON file and report any differences between the two.  We added the ability to export the diff report to HTML or PDF so you can create an audit trail of whether your server's settings match the "gold standard" you define in a JSON file.

box cfconfig diff gold-standard.json C:/ColdFusion2018/cfusion/ PDFReportPath=C:/nightlyDiffReports/

And you get a report that looks like this:

Conclusion

Hopefully this gives you some ideas on how to automate the lockdown of your server configuration.  The links and JSON file above were used with ColdFusion, but everything here applies to Lucee as well.  Also keep in mind, the JSON file I provided is an example.  Please modify it to suit your needs.  

And one final note, Adobe ColdFusion 2016+ will overwrite config on disk with the config stored in memory.  That means you must stop the server before applying any configuration changes via CFConfig and the restart the server to pick them up.  

Add Your Comment

Recent Entries

Ortus February Newsletter 2024

Ortus February Newsletter 2024

Welcome to Ortus Solutions’ monthly roundup, where we're thrilled to showcase cutting-edge advancements, product updates, and exciting events! Join us as we delve into the latest innovations shaping the future of technology.

Maria Jose Herrera
Maria Jose Herrera
March 06, 2024
Unveiling the Future of CFML Development - 3rd Round of Sessions

Unveiling the Future of CFML Development - 3rd Round of Sessions

Welcome back to our journey into the future of CFML development! As excitement continues to build for Into the Box 2024, we're thrilled to bring you the latest updates on what promises to be a transformative event. Continuing our blog post series, let's delve deeper into the third wave of session releases and discover the key surprises awaiting attendees. Learn More

Maria Jose Herrera
Maria Jose Herrera
March 01, 2024
Elevate Your ColdBox Experience and Skills

Elevate Your ColdBox Experience and Skills

We're thrilled to announce a significant overhaul of our ColdBox training experience to ensure it's nothing short of extraordinary! We've listened closely to your feedback and made significant improvements geared towards transforming you into a ColdBox superhero. Learn What's New!

Maria Jose Herrera
Maria Jose Herrera
February 20, 2024