115
CONFIGURING AND ADMINISTERING COLDFUSION 10
Administering Security
L
ast
u
p
dated
7/9/2
01
2
Note:
Sandbox security is not enabled by default. You enable it on the Security > Sandbox Security page before
ColdFusion enforces the settings.
Using multiple sandboxes (Enterprise Edition only)
By default, a subdirectory of a sandbox inherits the settings of the directory one level above it. However, if you define
a sandbox for a subdirectory, the subdirectory no longer inherits settings from the parent, completely overriding the
parent directory’s sandbox settings. For example, consider the following directories:
C:\Inetpub\wwwroot
C:\Inetpub\wwwroot\sales
C:\Inetpub\wwwroot\rnd
C:\Inetpub\wwwroot\rnd\dev
C:\Inetpub\wwwroot\rnd\'a
If you define a sandbox for the wwwroot directory, the settings also apply to the sales and rnd directories. If you also
define a sandbox for the rnd directory, the rnd sandbox settings also apply to the dev and qa directories. The wwwroot
and sales directories maintain their original settings, and the rnd settings override the wwwroot directory settings for
the rnd directory and subdirectories.
This hierarchical arrangement of security permits the configuration of personalized sandboxes for users with different
security levels. For example, if you are a web hosting administrator who hosts several clients on a ColdFusion shared
server, you can configure a sandbox for each customer. This prevents one customer from accessing the data sources or
files of another customer.
Resources that you can restrict
You can restrict the following resources:
Data Sources
Restrict the use of ColdFusion data sources.
CF Tags
Restrict the use of ColdFusion tags that manipulate resources on the server (or on an external server), such as
files, the registry, Lightweight Directory Access Protocol (LDAP), mail, and the log.
CF Functions
Restrict the use of ColdFusion functions that access the file system.
Files/Dirs
Enable tags and functions in the sandbox to access files and directories outside the sandbox.
Note:
To use the Administrator API when sandbox security is enabled, allow access to the cf_web_root/CFIDE/adminapi
directory.
Server/Ports
Specify the servers, ports, and port ranges that the ColdFusion tags that call third-party resources can use.
For more information, see the Administrator online Help.
Note:
When you run ColdFusion in the J2EE configuration on IBM WebSphere, the Files/Dirs and Server/Ports tabs are
not enabled.
About directories and permissions
When you enable access to files outside the sandbox, you specify the filename. When you enable access to directories
outside the sandbox, you specify
directoryname
\
indicator
, where
indicator
is a dash or asterisk, as follows:
•
A backslash followed by a dash (\-) lets tags and functions access all files in the specified directory, and recursively
allows access to all files in subdirectories.
•
A backslash followed by an asterisk (\*) lets tags and functions access all files in the specified directory and also lets
tags and functions access a list of subdirectories. However, this option denies access to files in any subdirectories.