CODEWITHSUNDEEP
coldfusion
Phillip Senn
Phillip Senn

Reputation: 47635

Running ColdFusion as a specific user

On this page, it talks about Windows NT, 2000, XP and 2003. Fortunately, I have a Windows 7 machine.

The very first line says:

In User Manager for Domains, create a local user for the ColdFusion service to log in as.

I don't see a "User Manager for Domains", so do they mean just "Add a new user"?

If it DOES mean that, can I use my own user account as the ColdFusion user, or should I specifically create a new account just for ColdFusion?

Upvotes: 7

Views: 1945

Answers (4)

bernster
bernster

Reputation: 61

Just did this on Windows 2008 R2 with CF 10. The trick was to change the ownership of the c:\windows and c:\windows\system32 directories as outlined here.

change ownership from trustedInstaller

Upvotes: 1

Mark A Kruger
Mark A Kruger

Reputation: 7193

If you are creating a domain account it has to be created ON the domain - using user manager for domains connected to your domain controllers. If that's what you need then a sys admin has to help.

If you are doing a "local" user on a windows 7 I always end up hunting around for the right view of user manager before I get it right :) Here are the steps that I use:

  1. Search from start and open the "user accounts" cpl.
  2. Click on "Manage User Accounts"
  3. Click on the "advanced" tab
  4. Click on the "advanced" buttton.

This takes me to the mmc-like view of users that I'm accustomed to where I can add a user, change membership, set passwords etc.

Hope this helps :)

Upvotes: 4

Justin Scott
Justin Scott

Reputation: 865

You can use either an account local to the OS where ColdFusion is running, or a domain account if the OS is joined to a domain. In your case, you can just create a local user on your Windows 7 OS and run the ColdFusion Application Service as that user. The user account will need access to ColdFusion's installation folder, as well as read access to the webroot.

The whole idea is to run the ColdFusion service as a user with the minimum privileges necessary to handle requests and prevent access to other resources in the event of a data breach or remote code execution (e.g. someone exploits an upload form and manages to get their own CF code to run on your server; it's not pretty but can be somewhat restricted by running the CF service under a user account with restricted access).

As someone else mentioned, if CF needs access to other network resources, the user account will need to be granted access to those resources as well (either by using a domain account or having a local account with the same username and password on the remote system).

Upvotes: 2

Paul
Paul

Reputation: 1575

You can use your own username or you can create one for CF to run as. Creating a user to run CF as probably more closely replicates your production environment ( an assumption ) so if production for example writes to a UNC path the coldfusion user must have acces. You could Mimic this locally.

Upvotes: 2

Related Questions