Using Sandbox Security - Adobe 38043755 - ColdFusion Enterprise - Mac Administration Manual

CONFIGURING AND ADMINISTERING COLDFUSION 10
Administering Security
Administrator Settings
10 Enable WebSocket Server
11 Start Flash Policy Server
12 Allowed SQL (all settings)
13 Enable Robust Exception
Information
14 Enable CFSTAT
15 Select the type of
Administrator authentication
16 Enable RDS Service
17 Select the type of RDS
authentication
18 Enable ColdFusion Sandbox
Security
19 Allowed IP addresses for
ColdFusion Administrator
access
Note: Secure Profile disables Directory Browsing for a stand alone ColdFusion installation with built-in web server.

Using sandbox security

Sandbox security (called Resource security in the Standard Edition) uses the location of your ColdFusion pages to
control access to ColdFusion resources. A sandbox is a designated directory of your site to which you apply security
restrictions. Sandbox security lets you specify which tags, functions, and resources (for example, files, directories, and
data sources) can be used by ColdFusion pages located in and under the designated directory.
To use sandbox security in the J2EE editions, the application server must be running a security manager
(
java.lang.SecurityManager
in the cf_root/cfusion/bin/jvm.config file):
-Djava.security.manager "-Djava.security.policy=cf_root/WEB-
INF/cfusion/lib/coldfusion.policy" "-Djava.security.auth.policy=cf_root/WEB-
INF/cfusion/lib/neo_jaas.policy"
Path Default Admin
Profile
Server Settings > Enabled
WebSocket
Server Settings > Enabled
WebSocket
Data & Services > Data Enabled.
Sources > [database] >
Advanced Settings
Debugging & Logging > Disabled
Debug Output Settings
Debugging & Logging > Enabled.
Debug Output Settings
Security > Administrator Use a single
password only
Security > RDS Configurable at
install time
Security > RDS Use a single
password only
Security > Sandbox Security Disabled
Security > Allowed IP Not available at
Addresses install time
) and you define the following JVM arguments (for Tomcat, this is the java.args line
Last updated 7/9/2012
Secure Profile Changes to the
setting post
migration to
ColdFusion 10
Disabled N/A
Disabled N/A
Create, Drop, Alter, Retained if specified
Grant, Revoke,
Stored Procedures
are disabled
Disabled Overwritten
Disabled Overwritten
Separate user name N/A
and password
authentication
(allows multiple
users)
Disabled N/A
Separate user name N/A
and password
authentication
(allows multiple
users)
Disabled Overwritten
Available at install N/A
time
114