User Guide

72 Chapter 4 Configuring Basic Security
About Basic Security
ColdFusion Server offers two levels of security: Basic and Advanced. Basic security
allows you to impose the following types of control on the ColdFusion development
environment:
• You can secure the ColdFusion Administrator with a password. Refer to “Securing
the ColdFusion Administrator” on page 66 for more information.
• You can secure access from ColdFusion Studio to data sources and files with a
password. See “ColdFusion Studio Password” on page 76 for more information.
• You can restrict the execution of specific ColdFusion CFML tags. See “Specifying
Resources to Protect” on page 96 for more information about securing
ColdFusion resources.
To access Basic security settings in the ColdFusion Administrator, open the Server,
Basic Security page.
Advanced Security allows you to exercise a high degree of control over a wide range
of ColdFusion resources, including CFML tags (as well as individual tag ACTION
types), specific SQL operations, as well as other ColdFusion resources. For more
information, see Chapter 5, “Configuring Advanced Security” on page 79.
Installation defaults
The ColdFusion Administrator installs with secure access enabled. The password you
enter as part of the setup is saved as the default, so that when you open the
Administrator for the first time, you are prompted to enter the password. We
recommend that you continue to use Administrator security until you complete the
ColdFusion server configuration. Once you’ve determined your security
requirements, you may decide to set up Advanced security. For more information,
see Chapter 5, “Configuring Advanced Security” on page 79.
Disabling Administrator security
You can disable Basic security for the ColdFusion Administrator on the Server, Basic
Security page. Once you’ve disabled this option, anyone can open the Administrator
pages and make changes to ColdFusion Server settings.
Disabling ColdFusion Studio security
You can disable file and data source security from ColdFusion Studio on the Server,
Basic Security page. With Basic security disabled, you rely on the Web server’s
security to set permissions to ColdFusion application and document directories. In
addition, you rely on your database settings to control access to data sources.