CFUNITED – The premier ColdFusion conference CFMX7 Admin API Nate Nelson

June 28 th – July 1 st 2006 Agenda  What is it?  Security Implications  Using the Admin API  Best Practices

June 28 th – July 1 st 2006 What is it?  ColdFusion MX 7 introduces programmatic access to most ColdFusion Administrator functionality.  The Administrator API (Admin API) is a set of ColdFusion Components (CFCs).  These CFCs have methods that allow completion of Administrator tasks without accessing the ColdFusion Administrator

June 28 th – July 1 st 2006 Where is it and What does it do?  cf_web_root/CFIDE/adminapi/  The CFCs represent the functional areas of the Administrator  Server Settings, Data & Services, Debugging & Logging, Extensions, Event Gateways, Security, and Enterprise Manager.

June 28 th – July 1 st 2006 The CFC’s  administrator.cfc. Login, logout, management of settings in the Migration and Setup Wizard. You must call the login method before calling any other methods in the Admin API.  base.cfc. The base object with common methods (such as dump) inherited by all other Admin API CFCs. This component should not be accessed directly. Its methods are available via the other components.

June 28 th – July 1 st 2006 The CFC’s  datasource.cfc. Provides ColdFusion data sources management.  debugging.cfc. Provides management of settings for ColdFusion debugging and logging.  eventgateway.cfc. Provides event gateway management.

June 28 th – July 1 st 2006 The CFC’s  extensions.cfc. Provides custom tags, ColdFusion mappings, CFXs, applets, CORBA, and Web services management.  mail.cfc. Provides management of ColdFusion mail settings.  runtime.cfc. Provides management of runtime settings for caching, charting, configuration, etc.

June 28 th – July 1 st 2006 The CFC’s  security.cfc. Provides management of Administrator and RDS passwords, and sandbox security.  serverinstance.cfc. Starts, stops, and restarts JRun server instances. Only available for ColdFusion MX 7 Multiserver configuration.

June 28 th – July 1 st 2006 Security  Soon after ColdFusion MX was released, developers learned how to access the ColdFusion ServiceFactory object, by using CreateObject() and calls to coldfusion.server.ServiceFactory.  This Java object gives developers complete access to all ColdFusion server objects, including the Data Source, Licensing, Runtime, and Security Services.

June 28 th – July 1 st 2006 Security  The intent of the ColdFusion Admin API is to solve the challenge of extending ColdFusion Administrator functionality to developers/users without compromising security or exposing direct access to the ServiceFactory.

June 28 th – July 1 st 2006 Security Risks  Unauthorized access by hackers.  Malicious use by rogue developers.  Unintentional damage to systemwide settings.  Inadvertent disclosure of sensitive server information.

June 28 th – July 1 st 2006 Security  ColdFusion Administrator Security must be enabled in order to secure the Admin API with the Administrator password. If this is disabled, both the ColdFusion Administrator and Admin API are left wide open.  The login() method of the administrator.cfc provides access control. You must authenticate with login() before using any methods of the other API components.  Admin Password: strong string, say a minimum eight characters of mixed-case, alphanumeric, and special characters.

June 28 th – July 1 st 2006 Using the Admin API  Use Component Browser Utility  ls/componentdoc.cfm ls/componentdoc.cfm

June 28 th – July 1 st 2006 Using the Admin API <!--- INITIALIZE ADMIN API -  request.CFADMIN_PASSWORD = "password"; request.adminObj = createObject("Component", "cfide.adminapi.administrator"); request.adminObj.login(request.CFADMIN_PASSWORD); //NOW Call the object to be used request.debuggingObj = createObject("component", "cfide.adminapi.debugging"); //NOW Call the method to be used request.debuggingObj.setIP(ipAddress);

June 28 th – July 1 st 2006 Best Practices  Control the Administrator/RDSPassword  Secure the AdminAPIdirectory /CFIDE/adminapi  Code custom admin modules providing end- user access to the Admin API  No access to the security.cfc or runtime.cfc.  Limit access to serverwide settings  Don’t hardcode Admin Password

June 28 th – July 1 st 2006 Usage for Blue Dragon 

June 28 th – July 1 st 2006 QA  ???  Nate Nelson 