The other day I made some changes to our productio...
# cfml-beginnersr
Ryan Albrecht
04/27/2023, 1:56 PMThe other day I made some changes to our production servers to change the user that coldfusions run as in a Windows environment. Does any one have a link that shows which directories/registry keys/services need their ACLs changed? Since the change I have been having some issue and im trying to track them down.
e
Evil Ware
04/27/2023, 2:17 PMUnless you produce code, errors, and expected results, your post is far too vague to be useful. The only suggestions would be to either UNDUE what you did, use CFDUMP to troublshoot,
r
Ryan Albrecht
04/27/2023, 2:26 PMI have multiple issue and I am trying to track the source down. I dont want help on any specific issue but what I would like is if someone could point me to a resource which documents what permissions coldfusion need setup on a windows ennvironment. The coldfusion2021 lockdown guide does not document what permissions it automatically sets up
Ryan Albrecht
04/27/2023, 2:26 PMSo i can confirm if I did it correctly
e
Evil Ware
04/27/2023, 2:28 PMEvil Ware
04/27/2023, 2:32 PMSorry, still in sleepy mode. You need to audit your volume permissions. If you properly set up your Windows Server, this is enabled, if not then you will need to enable audit polices and then you can re-install and see what has changed. https://petri.com/how-to-audit-permission-changes-on-windows-file-servers/
a
Adam Cameron
04/27/2023, 2:36 PM
I'd've thought that lot ought to be listed in the guide, yeah. It's a bit opaque if it just does it for you and there's no list of what it's done.
@Mark Takata (Adobe) ..?
👍 1
r
Ryan Albrecht
04/27/2023, 2:38 PM@Evil Ware thanks, but thats not exactly what I was looking for. The issue with the lockdown tool is that it make a backup of the ACL for every single file in the webroot. Our webroot has a crapton of files and so the lockdown tool is basically useless for me. I setup the permissions manually but I think I may have done something wrong which is why I am asking for the information 👍
💯 1
e
Evil Ware
04/27/2023, 2:41 PMthe best way is to use NTFS audits
c
cfvonner
04/27/2023, 3:41 PM@Ryan Albrecht I think some of the permissions requirements are covered in older lockdown guides (for CF 2016).
r
Ryan Albrecht
04/27/2023, 3:43 PMI have found file permission error related to hibernate from an eventsnapshot generated by fusionreactor.
Ryan Albrecht
04/27/2023, 3:43 PM Copy code
The snapshot was generated by the following log call:
ERROR
Unable to delete file C:\ColdFusion2021\cfusion\logs\hibernatesql.log.1: java.nio.file.AccessDeniedException C:\ColdFusion2021\cfusion\logs\hibernatesql.log.1Ryan Albrecht
04/27/2023, 3:44 PMbut the user that coldfusion is running as definitley has access to that directory
c
cfvonner
04/27/2023, 3:45 PMDoes it have full read/write/delete permissions?
r
Ryan Albrecht
04/27/2023, 3:50 PMApparently not!
Ryan Albrecht
04/27/2023, 3:50 PM😡
Ryan Albrecht
04/27/2023, 3:52 PMStupid, I thought the
read/writemodifyRyan Albrecht
04/27/2023, 3:52 PMStoooopid!
e
Evil Ware
04/27/2023, 3:52 PMdelete is DELETE , you would also need the CHANGE attribute
r
Ryan Albrecht
04/27/2023, 3:55 PM@Evil Ware what do you mean the change attribute? Are you referring to windows NTFS permissions?
Ryan Albrecht
04/27/2023, 3:55 PMimage.png
e
Evil Ware
04/27/2023, 3:56 PMYes, Modify. 20+ hours awake does have its toll.
😎 1
c
cfvonner
04/27/2023, 3:57 PMI'd hit the Advanced button and work through the dialogs to make sure that the user has the delete file but not the delete folder permissions.
👍 1
r
Ryan Albrecht
04/27/2023, 4:01 PMWell you learn something everyday. Thanks for the help @Evil Ware @cfvonner
👍 1
m
Mark Takata (Adobe)
04/27/2023, 4:08 PMWell this blew up my phone while I was out walking but got solved so my addition will just be
😂 3
😅 1
r
Ryan Albrecht
04/27/2023, 4:11 PMHaha! Quality meme! 👌
2 Views