Securing the CF administrator

[tsongas]

I'm looking for a way to better secure the CF administrator, which comes up at
[url]http://www.domain.com/cfide/administrator/index.cfm[/url] because of the CFIDE
virtual directory used for javascript includes. On shared servers, it is not
practical for me to set permissions inside each site in IIS. I'd like to
remove IUSER file system permissions from the CF administrator folder, so a
Windows username and password is required to get to the CF admin login, but
will that interfere with other sites on the server in any way?

[ke4pym]

You've got a couple of options.

Set NTFS permissions on /cfide/administrator and below to a group of
administrators. Day-to-day operation doesn't need anything in that directory.

Completely delete /cfide/administrator and move it to a new folder. Say
d:\inetpub\cfadmin\administrator. Then create a new virtual directory on a new
"administrative" web site called CFIDE and lock that down with NTFS privs
and/or IP restrictions.

[tsongas]

Thanks for the reply.

Are there other directories inside CFIDE I should worry about i.e. adminapi, componentutils, etc.?