The blog of Russ (snake) Michaels

Railo: Dynamic host configuration

Sun, 05 Sep 2010 19:22:00 --0100

Probably the biggest advantage with ColdFusion is the simple installer and the way it hides all the complexities of JRUN and Java from you and most of the time just works right out of the big. One of the simplicities of which is requiring you to only create a web site on the web server and it just works. With Railo it is more complex as you also need to add a host entry to the servlet container (railo, Tomcat, Jboss etc).

Thankfully with Railo this extra step can be avoided as well with a simple regular expression that effectively generates the host entry on the fly. This does however only work on Resin, so if you are using another servlet container I think you are out of luck, but I'm not expert so don't take my word for it, check the docs or ask on the relevant forums if you can use a regex in the host entry.

The following single host entry is what I am using on cfmldeveloper.com for the free hosting and simply requires that you stick to a standardised directory format for the home directory of all your sites.

This example presume all the sites are located at

d:\wwwoot\[domain name]\wwwroot

You can of course modify it for your own requirements.

The regex also strips the www from the domain name before evaluating it so that this is not used in the path name. Without this it would evaluate www.mydomain.com and mydomain.com as different paths.

        1: <host regexp="(?:www\.)?(.+)">

       2:  

       3:         <host-name>${host.regexp[1]}</host-name>

       4:         <root-directory>D:/wwwroot/${host.regexp[1]}</root-directory>

       5:         <web-app id="/" root-directory="wwwroot">

       6:                   <!-- enable/disable directory browsing -->

       7:                   <servlet servlet-name="directory" servlet-class="com.caucho.servlets.DirectoryServlet"/>

       8:         </web-app>

       9:     </host>

ColdFusion Directory Traversal vulnerability

Tue, 24 Aug 2010 00:53:00 --0100

There has been a lot of noise over the past week about the ColdFusion Directory Traversal Vulnerability.
If you haven't heard, the basic issue is that ColdFusion allows the inclusion of just about any file on the server (usually Windows servers) to be included by using either a URL parameter or form parameter. Without special encoding the vulnerability will let you grab any file ending in .xml, but by adding a %00 to the parameter, just about any file gets included in the normal display of the ColdFusion Administrator login page. This means that no authentication is required to pull this off. The flaw is in the internationalization tags being used by the Administrator pages which include XML files to render the text for different languages in the CFAdmin section. In turn the XML files aren't really XML files, but instead are files containing large switch/case statements which, according to the arguments, spit out the value for the piece of text the XML file is called with. The flaw is that the code calling the file uses user input to decide which file to grab, but doesn't properly sanitize the request, allowing the inclusion of other files from the same disk the CFAdmin section is living on. As Adrian Pastor points out, CF runs under the SYSTEM account by default, which means access to any file on the drive. Including the CF configuration files which may include things like database connection settings (with passwords saved which can be decrypted easily). Adrian also points out that once an attacker gains access to the CF Admin, itâ€™s game over.

The patches provided by Adobe for the problem are quite simple, and in most cases shouldn't even require a restart of the ColdFusion services. The impact of the vulnerability is huge. As Rafal Los, who rightfully calls this a "Disaster", points out, there are a lot of ColdFusion servers with the Administrator pages available to the world.

Even worse, the vulnerability can be exploited on versions 6-9 (CFMX6, CFMX7, CF8, CF9), but Adobe is only releasing patches for versions 8 and 9.

As we have been working with and hosting ColdFusion since version 5, we understand how most CF developers work, and how poorly the servers are administered in most installations. In his post, Rafal Los offers some Google dorks for finding CF servers, and states that "There is really no legitimate reason to have a ColdFusion Admin interface on the public internet" really, I can't think of one, yet there are many results!. So why are there so many results?

It is a combination of factors, laziness I'm sure being close to the top of the list, but there are others. The primary reason that comes to my mind is the location of the ColdFusion Administrator directory, inside of the '/CFIDE/' directory. This directory has other directories inside of it which are used by CF for things like form validation, Ajax, rendering of graphs, etc. and as such some applications stop working if the CFIDE directory does not exist, so it must be mapped as a virtual directory in most cf websites.
Often it is the webmaster or developer who is setting up and managing the ColdFusion server and who usually has very little knowledge of server security and limited knowledge of the ColdFusion Administrator and its associated security issues or the CFIDE requirements in an application, even if a real server admin is involved his knowledge of ColdFusion will be little to none.

Thankfully Adobe has finally released a Lockdown Guide written by Pete Freitag which is well done, and I hope is somewhat due to all the advice and feedback I have given Adobe over the years in this dept. I just hope people read and follow it.

Another problem is those older versions for which no patch is forthcoming. CF developers are very wary of changing the version of CF their application currently works on. Much of this comes from a botched move by Macromedia a long time ago, when their first version of ColdFusion MX 6 (6.0.0) became notorious for breaking apps and eating resources. This means that there are now a lot of old applications which are on old versions of CF.

If you run a CF server then you should install the patches and lock down access to your ColdFusion Administrator.
If you have a CFIDE vDir mapped to your sites, DO NOT use the original folder, take a copy of the CFIDE, put it somewhere else and delete the ADMINISTRATOR and ADMINAPI folders, now use this copy for your virtual directories. I have various old CF security and lockdown articles on this blog which you may want to take a look at.

Sign into multiple Gmail accounts at once

Wed, 04 Aug 2010 19:40:00 --0100

Do you have multiple Gmail accounts? Then you will be happy to hear that Google is rolling out a new feature that lets you sign into multiple Google accounts at once. This is a pretty great feature, and one that will save many people a lot of time.

As far as multiple login goes right now, you can currently be signed into only two separate accounts at once â?? one Gmail Account, and one Google Apps account. This lets you be logged into your personal stuff, and your work stuff at the same time.

Until now though, there was no way for you to be signed into multiple Google Accounts â?? say, three Gmail accounts. People maintain multiple accounts for various reasons, now switching between them is a whole lot easier.

In supported applications, like Gmail, Google Calendar, Google Sites, Google Reader, Google Voice, App Engine and Google Code, there will be a dropdown that lets you choose which account you want to look at. I suspect it will be something like Google Analytics, where you can choose which account you want to view.

To set up this functionality, you have to visit your Google Account page, and enable multiple logins â?? you may not see it yet, but according to Google Operating System, itâ??s on the way.

IIS7 blocks viewing access to certain folder names

Tue, 03 Aug 2010 20:14:00 --0100

I was just asked to help someone troubleshoot a site that worked fine on previous host but didn't work on Windows Server 2008 / IIS7. None of the images on certain pages were displaying, the image path looked something like this:

http://www.sitename.com/subfolder/bin/file.jpg

The subfolder wasn't marked as an application, although that doesn't really matter. The point is that since /bin/ was in the path somewhere, and it turns out that IIS7 wont allow any file to be displayed with a /bin/ in the path. It serves up a 404.2 error saying file or directory not found.

404 - File or directory not found.

The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.If you look

If you look in applicationHost.config you will find the following under the <requestFiltering> section:

      
    <hiddenSegments applyToWebDAV="true">

      <add segment="web.config" />

      <add segment="bin" />

      <add segment="App_code" />

      <add segment="App_GlobalResources" />

      <add segment="App_LocalResources" />

      <add segment="App_WebReferences" />

      <add segment="App_Data" />

      <add segment="App_Browsers" />

    </hiddenSegments>

So, IIS7 now blocks those key folders and doesn't allow them to be seen. To the outside world, any page in any of these folders appears to not exist.

The easy solution is to change the folder name, but there may be times when you really do want to keep the path name, such as for SEO purposes. Not to worry, it can be changed easily enough. This setting in on purpose though as it is for asp.net, so you usually shouldn't remove it for the whole site.

If it is your own server then you can use AppCmd or do it manually from applicationHost.config or web.config. Since requestFiltering is allowed to be set at the site or folder level by default, it's probably best to set a web.config file in the folder that you want to allow, which is your only option on shared hosting.

To do this on a per folder level, create a web.config file in your folder and type or paste the following into it. It should look something like this:

    <?xml version="1.0"?>

        <configuration>

          <system.webServer>

            <security>

                <requestFiltering>

                    <hiddenSegments>

                      <remove segment="bin" />

                    </hiddenSegments>

                </requestFiltering>

            </security>

          </system.webServer>

    </configuration>

If you want to make the change to your applicationHost.config file instead, you can do it by adding a location tag to the bottom of the file (well, almost the bottom - along with the other location tags) like this:

    <location path="sitename.com/subfolder/bin/debug">

        <system.webServer>

            <security>

                <requestFiltering>

                    <hiddenSegments>

                        <remove segment="bin" />

                    </hiddenSegments>

                </requestFiltering>

            </security>

         </system.webServer>

    </location>

To do this using AppCmd just drop to the command prompt and type the following: (Be sure to change the paths to the correct page before running this.)

C:\Windows\System32\inetsrv\appcmd.exe set config "sitename.com/subfolder/bin/debug" -section:system.webServer/security/requestFiltering /-hiddenSegments.[segment='bin']

After making this change, you will be able to view pages normally, even if they have /bin in the site path.

What OS are web developers using?

Tue, 20 Jul 2010 17:58:00 --0100

The open source PHP dynamic language is one of the most widely deployed languages on Web servers today. But what operating systems are PHP developers using to develop and deploy their applications? It's a question that has been asked before and now it's being answered with a new study from Zend, one of the lead commercial backers behind PHP.

The study surveyed 2,000 PHP developers in December and found that 85 percent reported that Linux was their primary operating system as a production environment for PHP.

Windows came in at a distant second at 11 percent while Mac OS X came in third at just 2 percent. However, when Zend drilled down into which platforms respondents prefer for their development, the rankings change dramatically.

According to the study, 42 percent of respondents reported that Windows was their primary operating system for development. Linux came in as No. 2 at 38.5 percent while Mac OS X remained in third place at 19.1 percent.

The findings indicate that while Microsoft Windows remains the top platform for developing in PHP, its lead may be narrowing. Back in 2006, a Microsoft executive reported that 85 percent of PHP developers were developing on Windows, but only 20 percent deployed on a Windows machine. The change comes despite joint work by Zend and Microsoft to improve the capabilities of PHP on Windows servers.

that the new study was based on over 2,000 completed surveys conducted in December 2009, some of which came from Zend customers. The survey was made public through the Zend Framework website, the Zend monthly newsletter, Twitter and DevZone.

I have also noticed recently from reading blogs and lists that the majority of CFML open source developers seem to deploy Railo or Open BlueDragon on Linux, which is a major paradigm shift from ColdFusion developers who primary use Windows.

I don't think this is a matter of preference but rather one of necessity as pretty much all the PHP documentation is for Linux, most PHP apps are written for Linux/Apache and are not supported on windows even if you can get them working.

If you have tried to install Railo then will have discovered this can also be quite a task and a challenge to get working, especially on windows/IIS7, and there are far more blog posts and docs explaining how to get it running on Linux, as well as ready made virtual disk images, which I suspects encourages people to take the path of least resistance and install Linux.

In the case of CFML this does however tend to be done using virtualisation software such as virtualbox or vmware to run a linux development servers on windows, so cfml developers do still seem to be using windows as their primary desktop OS, so I do wonder if Zend took this into consideration with their study and if many of those who listed Linux as their primary development OS may in fact be running it as a virtual machine on windows. This feeling is further extrapolated by the fact that developers are mainly using servers distros like CentOS.

You also need to consider all the obvious facts as well:- While Linux has a lot going for it and plenty of software, most of the best/popular software, especially web dev/design products like Dreamweaver and the rest of the Adobe line is not available on Linux. Sure there are alternatives, but they are certainly not in the same league and you can't walk into PC World and buy any of it. For those who have always been running a Linux desktop this will of course not matter at all, but for the rest this will be a big issue, especially if it is software you have spent a lot of money on, so running a virtual machine makes sense.

Of course it could be the other way round entirely and developers are running a windows VM on linux, but this would seem an off way of doing it if their primary tools are on windows.

Before the Linux fanboys start ranting, let me make it 100% clear that this is not a linux vs windows slanging match and I will delete all churlish comments attempting to turn it into one. If you comment keep it on-topic and professional.

Enabling Railo errors on IIS7

Tue, 13 Jul 2010 20:03:00 --0100

I just did a Railo/Tomcat install on an IIS7 server and thought the whole thing was hosed as I could only get a 500 internal server error. As I was using the viviotech installer I even bugged Jordan Michaels ( great name dude :-) ) for some help.

I didn't imagine for a second it could be my test.cfm file as it only said "hello world", man do I feel silly now.

It turns out that everything was working just fine, but IIS7 was actually hiding the Railo errors. Here is what happened.

What I had done on the default website was create a new text file, then rename it to test.cfm. Now by default windows hides known file extensions, so what I really did was rename it to test.cfm.txt but as I couldn't see the .txt I didn't realise.

As a result Railo was throwing file not found errors, IIS was hiding it and giving me a "500 internal server error".

On my 2nd site I had a working test.cfm file, but there was also an application.cfm which was trying to access a non existent DSN, which was also causing an error, which was also hidden.

The setting in IIIS that causes this can be changed as follows. Click images for bigger versions.

Open your IIS management console, select the ROOT to change this for all sites, or the site you want to change, and double click "Error Pages".

Now click on "Edit Feature Settings"

In the following dialog box change it to "detailed errors". The default setting only shows the errors locally on the server.

Thanks to Jordan Michaels for trying to help me resolve a non existent problem with his installer.

Although I did discover a problem with the FusionReactor instll at the same time :-)

Dell Streak - first impressions

Tue, 29 Jun 2010 17:46:00 --0100

I have had my new Dell Streak for a week now after returning my iPhone 3G and I have to say I am quite impressed and I certainly like it more than the iPhone. I have had comments that is wrong to compare against the iPhone 3G and I should have got the iPhone 4G, but sorry I think this is crap, I owned an iPhone3G so that is of course what I am going to review or compare against. I also read about all the new features and improvements to the iPhone4 and it was nothing earth shattering, yes it resolved a couple of big issues for some people but did not make me want to buy one and would not have resolved most of my dislikes or issues. [More]

FREE Railo hosting is now available at CFMLDeveloper.com

Tue, 29 Jun 2010 16:41:00 --0100

As of today, Railo 3.1 is now available at CFMLdeveloper.com.

If you already have an account then simply login to HELM and go to Packages -> add new and choose one of the new Railo Plans. Please note that the SETUP fee still applies for all new packages, but is still a one-time fee for fraud validation purposes and your hosting is then FREE forever. For more info please refer to the HELP pages.

If you do not yet have an account then simply SIGNUP from the hosting page.

Please don't forget to check the Hosting support pages if you get stuck, most common questions can be found there.

Hosting Reviews Exposed

Wed, 23 Jun 2010 12:49:00 --0100

Just noticed the owner of this site has recently done a revamp and has a shiny new blog. He is now personally reviewing many of the dodgy hosts that are falsely promoted by the even dodgier host review sites like the now infamous webhostingstuff.com

If you are looking for a new host or actually use any of host review sites then I would recommend checking the above blog first. If you are looking for ColdFusion hosting then the only legitimate review site I am aware of is www.forta.com

iPhone Disappoints

Mon, 14 Jun 2010 14:59:00 --0100

I was due for an upgrade on my mobile this month, after looking at the options O2 offered I decided I really wanted the new Dell streak, but it would have cost me Â£250 to upgrade, and honestly I don't need it that much. I have accepted the fact that I am rarely away from my computer anyway, so having these phones that do everything is rather pointless as I never use them. So I looked at the FREE upgrades. O2 were offering me the original iPhone 8GB, or I could have the current iPhone 16GB 3GS for Â£50. I pointed out that the 4G was out soon and I believed they would then have to give the 3G away for FREE to get rid of old stock, which worked and I got it FREE.

It was delivered next day, and I have to say the packaging is quite nice and surprisingly small. All you get in the box though is the phone, headphone and charger. The headphone are the usual bog standard cheap style that hurt your ears, so I wont be using it. The charger is a plug with a USB port so you can charge either via power socket or USB port with same cable, the cable supplied is however very short and will probably not be long enough for charging in the car.

The phone itself is completely self contained, you cannot open it up, which means you are stuck with the battery it comes with, which has quite a poor battery life. It seems to only last for 1 day with moderate use, less I would imagine if you like to listen to music a lot or play games.

Overall I found the phone very usable, the menus are easy to use and are responsive, navigation with your thumb and fingers really is possible, and the on screen keyboard is better than any other phone I have owned to date, although it is still a little fiddly unless you have small fingers, so for women I expect it works a lot better.

The included software is rather sparse, there is no SatNav for example, which is really disappointing for me, yes it has Google Maps which is great to getting directions but is certainly no SatNav replacement. And due to the poor battery life if you do use any satnav software for anything but a short trip it will kill the battery quickly. I did look into getting TomTom installed, but it turns out to be cheaper to buy a separate TomTom device for the car.

What is does have works well though, the email and messaging apps are nice to use, itunes is easy to use and handy for downloading new apps and the safari browser is quite a joy to use compared to other phones I have used, I was actually able to access our ticketing system and have everything work perfectly.

I downloaded a couple of 99p games and they play really well and look nice, I got quite addicted to fragger.

I then tried to copy my custom ringtone from my old phone, and this proved to be more trouble than it is worth, the iPhone will not allow you to use mp3 or other file types as ringtones, you need to convert them to iPhones AAC native format first, then you have the added problem that the only way to connect your iPhone to your PC is using iTunes which will not allow you to copy files, only sync folders.

The biggest disappointment I think has to be the camera, it has no resolution or other settings at all, just point and click and that is it. The picture quality is poor and there is no flash. So if you are looking for a phone with a decent camera, then you can forget the iPhone. This is also an issue for me as I like to have a camera handy to take pics of my kids.

The other major issue I have is the signal strength which is dire, I have either a very low (1 bar) signal or no signal at all at home, and I am in a high coverage area, with my old phone having 4/5 bars most of the time. This may just be a problem with my phone, but I found a lot of complaints about this same issue online.

In summary I would say that if you purely want a phone for calls, email, messaging and the occasional bit of gaming and music and the ability to get online with a decent browser then the iPhone is perfect and has an awesome touch screen menu to boot.

If you want good battery life, satnav, good camera, or any of the control you have with a windows smart phone then you better stick with a windows smart phone.

StarWars comes to the TomTom

Mon, 14 Jun 2010 14:08:00 --0100

After discovering my iPhone has no SatNav software, I was just looking on the tomTom web site and came across this. http://starwars.tomtom.com/voices/index-starwars.php?Lid=1

You can now have your directions read toyou in the voices of Darth Vader, C3PO or Yoda, very cool I do have to say, and I bet if Ray Camden doesn't already have a TomTom he will own one very soon :-)

By the way be sure to watch the Darth Vader video, quite entertaining.

cfmldeveloper upgraded to CF9

Sun, 30 May 2010 13:31:00 --0100

Last night I just completed upgrading cfmldeveloper.com to ColdFusion 9. For those that do not know cfmldeveloper.com is the FREE ColdFusion hosting service that I run for developer. Recently rebranded from cfdeveloper.co.uk.

What's new in ColdFusion 9

ColdFusion 9's list of new features is quite long, so I'll just mention a few items that I find most interesting. For a complete list of new features, go to Adobe's site.

One huge addition in ColdFusion 9 is the incorporation of the Java Hibernate object-relational mapping (ORM) library. ColdFusion abstracts much of the complexity of Hibernate away and offers a simple API to allow the loading and saving of CFCs to a relational database. This makes object-oriented development even easier, as you can build an object model without thinking about the database at all, and let Hibernate translate that model into a schema automatically. By providing nested transactions and hooks into the Hibernate event model, you can build robust domain models very quickly.

The next feature is sure to be a favourite of anyone who has spent many hours building "export to Excel" logic in applications. Sometimes it is the simple approach of creating an HTML table and letting Excel convert it; other times, it is the much more tedious option of using Apache POI to build up worksheets and formulas. ColdFusion 9 includes the new cfspreadsheet tag, which finally puts an end to this chore. Along with the tag is a large set of functions to allow virtually any manipulation of a spreadsheet. These functions can be saved in Excel or OpenOffice format as well.

There are a lot of new goodies I could talk about, but here is a quick list:

|> Server API for SOAP and AMF (allowing remote use of core features such as charting, PDF creation, and email from Flex or other external systems)
|> Huge set of Microsoft SharePoint integration functions to leverage an existing SharePoint deployment
|> Seamless support for the Java portlet specifications, making integration with things like Liferay a breeze
|> Addition of Apache Solr to supply search services (a worthy replacement over Verity)
|> Addition of Ehcache to supply page and page-fragment caching, along with cache statistics and other cache manipulation functions
|> Big performance improvements over ColdFusion 8 and ColdFusion 7.

ColdFusion Builder

The next item isn't actually a feature of ColdFusion 9, but it's worth pointing out. Adobe has built a dedicated IDE for ColdFusion development called ColdFusion Builder. Back when ColdFusion was run by Allaire, there was a tool called CF Studio or Homesite. When Macromedia acquired Allaire, it dropped Studio development in favour of its Dreamweaver tool. Since then, many people have used Dreamweaver or migrated to the CFEclipse plug-in for the Eclipse IDE. Thankfully, Adobe has now released ColdFusion Builder, which is built on the Eclipse platform and offers tight integration with their Flash Builder tool for building Flash and Flex applications.

ColdFusion Builder offers a useful and predictable set of tools, which include code completion, server management, debugging, templates, snippets, etc. And since it is built on Eclipse, the world of Eclipse plug-ins is open; it includes things such as Git or Subversion integration, Mylyn, ANT, Maven, etc. ColdFusion developers have been vocal about wanting a real IDE from Adobe, so it is nice to see that Adobe is listening.

ColdFusion 9 Tutorials and Resources

Create Edit & Share Your Sitemaps Online

Sun, 30 May 2010 13:19:00 --0100

Just found this rather handy tool I thought I would share.
WriteMaps is a free web-based tool that allows you to create, edit, and share sitemaps online. As a WriteMaps user, you and your team will be able to build and access your sitemaps from anywhere, without having to rely on proprietary desktop apps and static files. To get started, take the tour or sign-up for an account!

It is incredibly simple to use, just click the + to add nodes wherever you live and has a drag and drop interface to allow you to move nodes around. Certain a very quick and easy way to make a nice looking sitemap for your website.

MangoBlog: Adding a custom page title

Thu, 20 May 2010 16:33:00 --0100

l have recently decided to try out MangBlog for the new cfmldeveloper.com site and I have to say I really like it much better than BlogCFC (sorry Ray).

Because MangoBlog allows you to add custom pages you can pretty much use it to create your entire web site with a basic CMS as long you don't need to do anything complex on your pages, at which point you may find the tinyMCE editor too restrictive.

When you add a custom page to MangoBlog the "title" is used not only on the page but also on the navigation menu, which I didn't find too useful as I did not want the menu text and page title to be the same. So I was instantly thrown in at the deep end with a requirement to customise MangoBlog, which thankfully turned out to be very easy as it is very well written and easy to understand.

MangoBlog is written in classic CFML style using imported tag libraries and <mango: mytag attributes> syntax as apposed to using the OO style frameworks that are popular these days.

Adding a custom page title is a snip.

When adding a new page, simply add a new custom field like this

label:    page title
key:      pagetitle
Value:   My Page Title

Now edit the page.cfm file in your skin folder and edit the code that displays the <mango:Blog title />, it will look something like this depending on your skin.

<h1 id="banner-header"><a href="<mango:Blog url />" accesskey="1"><mango:Blog title /></a></h1>

and change it to this

   <mango:PageProperty ifHasCustomField="pageTitle" customField="pageTitle" />
     <mango:PageProperty ifNOTHasCustomField="pageTitle"><mango:PageProperty title />
   </mango:PageProperty>

This checks for the existance of the "pageTitle" custom field on each page, it is exists then it will display that value, otherwise it will display the title.

You can use the same method to insert any custom field values on any page.

Fix the DNS caching in ColdFusion

Fri, 16 Apr 2010 15:22:00 --0100

It has been a well known fact for many years (to some of us at least) that ColdFusion (or rather the JRE) caches DNS look-ups forever until the service is next restarted.

The caveat of this is that if any domain name you are connecting to from CFML has had a DNS change such as a change of IP address then code will suddenly stop working until you next restart CF.

Areas that will affect include:-

SMTP servers in the CFADMIN
Database Servers in your Datasources
CFHTTP calls
Web Services
CFFTP, CFPOP, CFEXCHANGEMAIL, CFIMAP, CFMAIL

Plus any other tag, CFX tag, java class that allows you to connect to a remote server.

This has never really caused us any major issues, occasionally we had had a customer complain that CFHTTP calls have mysteriously stopped working, or that they could no longer connect to their payment gateway after the provider made some updates, but it has been so rare that restarting CF was an acceptable solution.

Recently we got a notice from our payment gateway provider (SagePay formerly ProtX) telling us that their IP addresses would change. Knowing this would affect CF and that we have several customers who also used SagePay I knew we would have to restart CF on every server to make sure their ecommerce stores did not break.

This prompted me to look into this problem, find out why the JRE cached DNS look-ups and see if I could change it.

After some investigation I learned that the class used to lookup host names for HTTP operation is the Java InetAddress class

If You read the above page you can see that the result of positive host name resolutions is cached forever, it also advises how to override the default behaviour with the following property.

networkaddress.cache.ttl
Indicates the caching policy for successful name lookups from the name service. The value is specified as as integer to indicate the number of seconds to cache the successful lookup. The default setting is to cache for an implementation specific period of time.

In a standard ColdFusion installation you would find this in the following file:-

C:\ColdFusion8\runtime\jre\lib\security\java.security

If you are using a custom JRE in a J2EE type installation then the path may be something like:-

C:\Program Files\Java\jdk1.6.0_12\jre\lib\security\java.security

In a CF multi-server installation:-

C:\JRun4\jre\lib\security\java.security

Find the following line

    #networkaddress.cache.ttl=-1 

and change it to

    networkaddress.cache.ttl=14400

This sets the TTL to 14400 seconds (4 hours).

Now you will note that there are various warnings about DNS cache poisoning and the security manager which may scare you. So also note that InetAddress by default resolves against localhost, so if there was a cache poisoning problem then the problem is with your local machine or DNS server thus any application that resolves DNS lookup-up against localhost will be affected, which includes ASP, PHP, local services etc, so ColdFusion/Java is really not where you area of concern should be when it comes to DNS, but rather that your local machine is secure and that your DNS server is protected against cache poisoning. Plus the problem would still exist when you restart CF anyway, and this is probably a fairly common occurrence for most people, so I personally would not worry about it and I think this is a pretty daft and pointless reason for this default setting. Some may disagree, but hey that's their prerogative.