Securing the Coldfusion/Railo Administrator in IIS

With the recent security hole found in ColdFusions CFIDE adminapi (see here, here and here), I thought it a good time to dust off this blog post that I've had sitting around in my drafts folder for the better part of a year.

To prevent the previously mentioned attack as well as being good practice anyway it is a good idea to limit who can access your ColdFusion/Railo administrator. One technique is to limit access by IP address (for example 127.0.0.1). This can be achieved using IIS as follows.

Limit Access to Localhost Users Only

Lets limit access to the /CFIDE/adminapi and /CFIDE/administrator folders on our server to localhost users only. The instructions for doing this vary depending on if you are using IIS6 or IIS7.

IIS 6

1. Open the IIS Manager Console
2. Navigate to a particular domain
3. Right click on the /CFIDE/administrator/ directory
4. Select Properties
5. Select the Directory Security Tab
6. Under "IP Address and domain Name Restrictions" click Edit
7. In the screen that opens select the "Denied Access" option.
8. Click the "Add" Button to open the grant access screen.
9. In the grant access screen set the type to single computer and add the ipaddress 127.0.0.1
10. Click ok to each screen to save and close
11. Now repeat for the /CFIDE/adminapi/ directory.

IIS 7+

1. Open the IIS Manager
2. Navigate to a particular domain
3. Select the /CFIDE/administrator directory
4. Open the IP Address and Domain Restrictions module
5. Click "Edit Feature Settings" in the actions sidebar
6. Select "Deny" and click ok.
7. Click the "Add Allow Entry" option in the actions sidebar
8. Enter 127.0.0.1 for specific ipv4 address and click ok
9. Now repeat for the /CFIDE/adminapi/ directory.

Repeat these steps for every domain on the server.

Railo

To accomplish this for railo just replace "/CFIDE/administrator" in the above instructions with "/railo-context".

Alternate Method Request Filtering

Pete Freitag has a very good article on using Request Filtering to achieve the same results. It looks like this technique allows for the rule to be applied globally to that server.

Note: If you use the request filtering method be aware that there is a bug in IIS7.5 where you need to filter for /folder and /folder/.

Require HTTPS For Admin Console

If you do need to access the administrator for a machine other than localhost it is a good idea to at least require ssl for that connection if you have an ssl cert for your site. Here is how you do this.

IIS 6

1. Open the IIS Manager Console
2. Right click on the CFIDE/administrator/ directory
3. Select Properties
4. Select the Directory Security Tab
5. Under Secure Communications click Edit
6. Check "Require secure channel (SSL)"
7. Click ok to each screen to save and close
8. Now repeat for the /CFIDE/adminapi/ directory.

IIS 7+

1. Open the IIS Manager Console
2. Select the CFIDE/administrator/ directory
3. Open the "SSL Settings" feature
4. Tick the "Require SSL" checkbox
5. Save and close
6. Now repeat for the /CFIDE/adminapi/ directory.