Re: SandBox Problem

2001-12-10 Thread Bastian Schmid

Hi Scott,

well, i think it is repuired to use siteminder because we want to protect
any bad actions of primary CFFILE-Tag.

We want our custmoers not be able to use CFFILE to delete, read out and
change any files of other customers.

But the main reason was a file, with wich you can browse through the whole
server and delete every file you want (including the system-files!)

And to protect any attacks with this file or concerning this way, we want to
be absolutely sure, that this is impossible.

greez,
Bastian
~~
Structure your ColdFusion code with Fusebox. Get the official book at 
http://www.fusionauthority.com/bkinfo.cfm
FAQ: http://www.thenetprofits.co.uk/coldfusion/faq
Archives: http://www.mail-archive.com/cf-talk@houseoffusion.com/
Unsubscribe: http://www.houseoffusion.com/index.cfm?sidebar=lists



RE: SandBox Problem

2001-12-09 Thread Andrew Scott

Ok it has been a long time since I used siteminder under single sign on
scenario! But can I ask is it required, to use siteminder that is.

If it is to protect files from being downloaded etc then I think the
best way would be to use CF mappings for data that you do not want to be
guessed via the url. For example I did a porn site back in 1998 that has
content that can only be viewed by members.

But I did write my own form of Security Context tags that don't use CF
Advanced Security, they do however keep control of who is logged in and
what type of memebership they have as well as what they can view.

The principle works the same as what siteminder offers, but without the
added overheads that Siteminder adds to IIS!!


-Original Message-
From: Bastian Schmid [mailto:[EMAIL PROTECTED]] 
Sent: Tuesday, 20 November 2001 9:47 AM
To: CF-Talk
Subject: SandBox Problem

Hi,

I'm running a ColdFusion Sandbox on our server and it works quite well.
But the siteminder is so resource-intensive so that the loading of the 
websites so so terrible slow...
The siteminder-service checks all of the files within a directory 
(including subdirs).
Because of checking also the graphics and databases, wcich is absolutely

not neccassary, the speed of our server is bloody slow.

Can anybody give me a solution, how i can tell the siteminder-services

only to check the .cfm/.cfml files?

I know, that i can do this with *.cfm within one directory. But do i 
have to add every directory of my server to the security context to 
seperate the files or is there any possibility to do that instead of 
c:/xy/* like c:/xy/*/*.cfm?

greez,
Bastian


~~
Structure your ColdFusion code with Fusebox. Get the official book at 
http://www.fusionauthority.com/bkinfo.cfm
FAQ: http://www.thenetprofits.co.uk/coldfusion/faq
Archives: http://www.mail-archive.com/cf-talk@houseoffusion.com/
Unsubscribe: http://www.houseoffusion.com/index.cfm?sidebar=lists