ColdFusion Admin Login and Password recovery - security

I recently took over the development of a CF site and am having some trouble obtaining the login and password to the Admin for CF. I was hoping another StackOverflower may haave some insight on obtaining access. We have access to the FTP and any other hosting related details. Any helpful insight will be greatly appreciated.

Open up the password.properties file which lies in <coldfusion install directory>\lib
You can see some encrypted string like
password=5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8
encrypted=true
Change it to clear text with encrypted=false
password=newPassword
encrypted=false
After that you can log in using newPassword and reset to a proper password in the CF Administrator.

http://coldfusion8.blogspot.com/2008/08/what-if-you-forget-coldfusion-admin.html
I believe this also works for 6, 7,m and 9.

Building on what Ben said Simon Whatley has a great article outlining several different ways to accomplish this: http://www.simonwhatley.co.uk/resetting-a-lost-coldfusion-password really good stuff.

If you are running Coldfusion on a Mac or Linux all you need to do is:
On the terminal go to the bin directory of Coldfusion application
There is a password reset script: passwordreset.sh
running the script will ask you for a new password
Stop and Restart Coldfusion

I was going to suggest using the admin API to see if you could reset the password or even make a .car backup of the server settings in the event of a re-install.
http://livedocs.adobe.com/coldfusion/8/htmldocs/help.html?content=basiconfig_37.html

For earlier versions, you can change a registry key, see details here : http://www.tek-tips.com/faqs.cfm?fid=3731

Related

Taking over GitLab administration

Our GitLab admin (and a couple of devs) left the company recently and I have been trying to take over. How do I go about getting admin rights? I might already have them, but I'm not sure. I can ssh to our internal GitLab server, and have sudo rights. We use LDAP.
I am looking to take over a project (I am currently a developer), how would I do that?
Thanks.
You can try restoring their password
https://docs.gitlab.com/ee/security/reset_root_password.html

how to configure windows change password policy on linux

I work in a linux system with a windows proxy account. The password must change aways at the end of the month. Nowdays i need to go to a windows machine, change my password and go back to my linux machine.
The password is used for others internal services too. (like private email, git access, database access, etc).
I want to change my password without the help of a windows. I want to do it on linux. It can be done?
This is really the wrong forum: I'd suggest trying serverfault.com.
SUGGESTION:
It sounds like smbpasswd might be a solution: http://serverfault.com.

Authenticating dialog box in Linux environment using Selenium

The Base URL in my Web Driver class asks for authentication for username and password. My Scripts run perfectly on Windows environment using AutoIT for authentication using the below mentioned code line.
`System.setProperty("webdriver.chrome.driver", this.getClass().getClassLoader().getResource("data/chromedriver_win32.exe").getFile());`
But I need to run on Linux environment and I want to replace this server authentication in place of AutoIT.
I have googled it and I got the results that I can still run the scripts using wine but the results are not perfect. If anyone found solution for this kind of problem please help me.
Thanks
This may not be a secure approach, but would it help to put user name & password in the URL?
I mention it is not a secure way since it is for an automated test and you'd have to take safeguards to ensure who the viewing audience is, since you don't want security risks.
If your application typically challenges with htpassword box, you might want to see
http://community.sitepoint.com/t/sending-htpasswd-login-information-in-a-url/2586/2

IIS 6 & Web Deploy 3.5 - ERROR_USER_NOT_ADMIN

I've been trying to use Web Deploy 3.5 to deploy an application to an IIS 6 web server without any luck.
I am connecting using a domain service account that is an administrator of the remote server, but when I attempt to deploy (or validate the connection in VS2012) I receive a "ERROR_USER_NOT_ADMIN" error instead.
I read that Web Deploy 2.0 had a bug in it where a domain user account could not be used, but surely that's fixed by now? Right?
Has anyone had any luck with IIS 6.0, Web Deploy 3.5 and domain user accounts?
Anyone else trying this (with the right password ;-) , there is an issue using non domain accounts that gives this message, and the link in the error wasn't much use for me....
There is a regedit (yes, I know it's dirty, but this was a dev machine), which gets this working.... I'd tried everything from the MS link with adding users to additional groups etc, but still didn't work, the solution below did though.
Take a look at http://networkprogramming.wordpress.com/2010/10/29/401-not-authorized-for-msdeploy%E2%80%8F-msdeployagentservice/
Well this is embarrassing. It looks like that error message is also returned if the password is incorrect.
Oh well, you live and learn!
Another possibility: The user's password has expired.
Either
go into the "local users" within computer management and make sure Password never expires is checked, OR
run this command for that user: WMIC USERACCOUNT WHERE "Name='YOUR-USERNAME-HERE'" SET PasswordExpires=FALSE

(IIS/Win2000Pro) Granting Registry read rights to IIS user?

Okay, so I'm running a small test webserver on my private network. I've got a machine running Windows 2000 Pro, and I'm trying to run an ASP.NET app through IIS.
I wrote it so that the webpage would use the registry to store certain settings (connection strings, potentially volatile locations of other web services, paths in the local filesystem where certain information is stored etc...) Of course, it worked fine when testing with VStudio.NET 2005, because the user running the app has elevated privileges. However, running it on IIS I get a "Access to the registry key 'HKEY_LOCAL_MACHINE\Software' is denied.", which suggests the IIS user doesn't have read access to that part of the registry (I only do reads through the website itself, never writes).
I was like "okay, simple enough, I'll just go give that user rights to that part of the registry through regedit." The problem is, I don't see an option anywhere in regedit to change security settings... at all. Which got me thinking... I don't think I've ever actually had to change security settings for registry hives/keys before, and I don't think I know how to do it.
Half an hour of searching the web later, I haven't found any usable information on this subject. What I'm wondering is... how DO you change security rights to portions of the registry? I'm stumped, and it seems my ability to find the answer on Google is failing me utterly... and since I just signed up here, I figured I'd see if anyone here knew. =)
If your having touble with RegEdit in Windows 2000 you can try the following:
Copy the Windows XP RegEdt32.exe to the Windows 2000 Machine
Using a Windows XP Machine, connect to the Windows 2000 registry remotely: File > Connect Network Registry
You can set permissions at the folder level for which you want to grant user permissions read/write access.
In your case, right click on the "Software" folder and select "Permissions".
You'll probably know the rest from there.
EDIT: If you still run into issues, you may want to modify your web.config file and use impersonation to have your web application run as a certain user account. Then you can put a tighter reign on the controls.
RegEdt32.exe will allow you to set permissions to registry keys.
Simply right click on a Key (Folder) and click Permissions, then you can edit the permissions as you would an file system folder.
I did so, assuming that a Security setting would be available. I didn't see any "Security" option when I right-clicked on the Key. =( I triple-checked just to make sure... and I just tried it on my XP machine, and it does indeed have the "Permissions" section... but the Windows 2000 machine doesn't. (how's that for wierd?)
In my searching, I found:
http://www.experts-exchange.com/Programming/Languages/.NET/ASP.NET/Q_21563044.html
Which notes that RegEdit for Windows 2000 doesn't have the Security/Permissions settings... but it proposes no solution to the problem. (Whoever asked the question was using Windows XP so he was okay... but in my case, it's 2000)
Is there any way to make it happen specifically in 2000?
EDIT: Ahhhh... if worse come to worse, I suppose I can do the impersonation as mentioned below... though if I can't set security settings for the registry in 2000, I'm left with making that user have Administrative access (I assume?) to actually get those rights, which sadly defeats the purpose. =(
Oh, let me try that! I didn't realize you could remotely connect to another registry.
(EDIT: I was wrong, it did work... it just took several minutes to respond to my request to change permissions remotely)
The remote connection idea did it! You're good! Thanks so much for your help! I never realized you could remote connect with RegEdit... you learn something new every day, they say! =) Thanks again for your assistance! =)
On another note though, about copying the XP version of RegEdit to Windows 2000... is that safe? I figured they would be coded in such a way as to be incompatible... but I could be assuming too much. =)
Just use RegEdt32.exe instead of Regedit.exe.
Go to the desired key or folder, then open the security menu and click on 'permissions'.

Resources