Using Railo, Secure The railo-context

If you are using Railo you will want to make sure you have locked down the uri /railo-context/ - this is Railo's equivilent to ColdFusion's /CFIDE/ directory. It contains the Railo Administrator, as well as some other supporting files and mappings.

Running Lucee?

If you are running Lucee you can follow the same procedure, just replace /railo-context with /lucee.

Note: This is one issue that HackMyCF.com CF security scanner will look for.

One of the features of Railo / Lucee is that each web site can have its own administrator and settings. The first time you access the web administrator eg: /railo-context/admin/web.cfm it prompts you to set the administrator password. The drawback to this approach is that if you have multiple virtual hosts you have to go through and setup a password for each one. If you don't set the password, and the railo-context is wide open, anyone can go and set the password and access the railo administrator. It would be nice if you could specify a default password for all web contexts in the server wide Railo administrator. (Update See Todd's comment, you can set a server wide password)

So how do you go about this, James Allen has written up a guide (link no longer works, was: jamesallen.name/index.cfm/2009/8/1/How-to-Secure-Railo-31-Admin-in-IIS-6) for securing Railo Administrator on IIS. Here's how you can easily do it on Apache httpd.conf using basic authentication:

<Location /railo-context>
    AuthName "railo"
    AuthType Basic
    AuthUserFile /etc/httpd/admin.passwords
    Require valid-user
</Location>

You will want to setup a password file using htpasswd (located in your apache bin directory) and place the path to that file in AuthUserFile directive.

Using Digest Authentication (better) your config will look as shown below, and you create the password file using htdigest:

<Location /railo-context>
    AuthType Digest
    AuthName "railo"
    AuthDigestFile /etc/httpd/admin.passwords
    Require valid-user
</Location>

Another approach you can take is limit access by IP. For example to limit it localhost:

<Location /railo-context>
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
</Location>

You could also use mod_rewrite to block railo-context uri on all sites but one:

RewriteEngine ON
RewriteCond %{HTTP_HOST} !^admin\.example\.com$ [NC]
RewriteRule ^/railo-context.* [F,L]

Note: By password protecting or blocking the entire /railo-context you are blocking access to things like cfform, keep that in mind, you may want to be more selective about the uri's that you password protect. If you aren't using any features that require the railo-context it's best to block the entire thing.

Do you have any other Railo Security Tips? I plan on writing a few more articles on Railo Security in the future.