Can't put file into ram with secure ftp - coldfusion

I'm using coldfusion 9 and I'm trying to grab a file from an ftp site and load it into ram instead of the filesystem. If I try it using a secure ftp connection, it fails with this error:
An error occurred during the sFTP getfile operation.
Error: C:\JRun4\servers\cfusion\SERVER-INF\temp\cfusion-war-tmp\ram:\test.txt (The filename, directory name, or volume label syntax is incorrect). Check for a bad path, filename, or directory.
If I try the same thing with a non secure ftp site it works just fine. Here is the code:
<cfftp action = "open"
username = "xxxxx"
connection = "My_query"
password = "xxxxxxx"
server = "ftp.xxxxxx.com"
port="13266"
secure = "true"
stopOnError = "Yes">
<cfftp action="getfile"
connection="My_query"
remoteFile="/something.txt"
stopOnError="true"
localfile="ram://test.txt">

Adobe has confirmed this as a bug and has resolved it in ColdFusion 9.0.1

This looks like it might be correctable if you escape portions of the string.
Try replacing
ram://test.txt
with
ram:///test.txt
Also, you can try escaping the ":" character.
This type of activity is only safe if you are an advanced user. Messing around with illegal characters when transferring files has an inherent risk of leaving garbage behind on your disk.

Related

python_ldap | supplying certificate content in variable

I use the following code to supply certificate when establishing a tls connection to a ldap server
conn.set_option(ldap.OPT_X_TLS_CACERTFILE,**PATH_TO_FILE**)
where PATH_TO_FILE is the path where I have the certificate as a .pem file.But now I am fetching the certificate from the db so the certificate content is available in a variable in my code. I would like to use the variable directly in contrast to having write the data to a file and useing the file path. Is it possible?
I went through the documentation of python_ldap but couldn't find a option which takes the certificate content straight from a variable.
If you need to load a certificate from database or whatever variable that is not a file, then write the content of this variable to a file and use that filepath :
cert_content = '<dumped-certificate>'
cert_path = '/tmp/cert.pem'
with open(cert_path, 'w') as fp
fp.write(cert_content)
conn.set_option(ldap.OPT_X_TLS_CACERTFILE, cert_path)

Whats the most secure way I can use python-ldap in my script to connect to my ldap server?

I have a script that is using the python-ldap module.
Here is my basic code that makes a connection to my ldap server:
server = 'ldap://example.com'
dn = 'uid=user1,cn=users,cn=accounts,dc=example,dc=com'
pw = "password!"
con = ldap.initialize(server)
con.start_tls_s()
con.simple_bind_s(dn,pw)
This works...but does the actual literal password have to be stored in the variable pw?? it seems like a bad idea to have a password stored right there in a script.
Is there a way to make a secure connection to my ldap server without needing to store my actual password in the script??
Placing the password in a separate file with restricted permissions is pretty much it. You can for example source that file from the main script:
. /usr/local/etc/secret-password-here
You could also restrict the permissions of the main script so that only authorized persons can execute it, but it's probably better to do as you suggest and store only the password itself in a restricted file. That way you can allow inspection of the code itself (without sensitive secrets), version-control and copy around the script more easily, etc...

ColdFusion cfftp getfile exceeds timeout

I am running CF 11. I have a file on a SFTP server that I want to get. This is a zip file about 60MB in size.
I can get the SFTP connection. However, when I use action="getfile" to get the file to my local. The error that I am getting is, "getFile operation exceeded TIMEOUT". The local file size always stops at around 15MB. I have tried specifying the timeout to 999999 in the cfftp tag, setting passive to false in the cfftp tag, and adding the cfsetting tag to set requesttimeout to 999999. The behavior stays the same.
I have looked everywhere in CF admin and I don't seem to find where this 15MB is specified. Would anybody be able to help me solve this problem please?
There are a couple of timers in play here; the FTP timer and the ColdFusion page request timer since you are calling a CFML page to do this.
To increase the ColdFusion timer you need to use the cfsetting tag on the page using the cfftp tag. Like,
<cfsetting requestTimeout="3600" />
To increase the FTP timer you need to use the timeout setting of the cfftp tag itself. What's tricky here is that if you are using a cached FTP connection (using the connection attribute) you need to add the timeout attribute to the open call of your CFFTP tag.
You will need to use both of these settings to increase the overall timeout for these requests.

How to execute WMIC on ColdFusion based website

I am trying to make a plugin to a website that would show the server's CPU load, disk space, free memory etc.
I did a research and in most of the cases they suggested using wmic for that as it allows remote connection what I'll need.
I'm using the following code to get the CPU load in percentage:
<cfexecute name="C:/Windows/system32/wbem/wmic.exe"
arguments="cpu get LoadPercentage /format:csv"
timeout=100 />
When I load the site it times out. I've checked the server and the process is still running. Is there a way to make it work?
Update:
I've tried running WMIC as a different user, to make sure the problem is not coming from ColdFusion having insufficient rights. The code I'm using is the following:
<cfset Args='/user:*username* "C:\Windows\system32\wbem\wmic.exe cpu get LoadPercentage" | F:\Sanur\sanur.exe *password*'>
<cfdump var="#Args#">
<br />
<cfexecute
name="C:\Windows\system32\runas.exe"
arguments=#Args#
variable="result"
timeout=100
></cfexecute>
<cfdump var="#result#">
In this case it returns an [empty string] and does not start wmic.exe (checking task manager). If I try it without sanur I get the response below. I suspect the problem is using 2 commands in cfexecute arguments.
Enter the password for username:

Send mail through cfmail with one connection

I ran into an issue where my mail server only accepts 100 connections to the server every 5 minutes. My current code loops over my database, calling cfmail for each person on the list. I suppose the problem is im opening a new connection each time I use cfmail?
<CFLOOP QUERY="Customer" >
<!---send mail to Admin ----->
<cfmail to = "#cstEmail#"
from = "#FORM.fromAddressEmail#"
subject = "#FORM.subjectEmail#"
server = "#var.mailserver#"
port= "#var.mailport#"
username="#var.mailuser#"
password="#var.mailpass#"
failto="#var.failEmail#
type="html"
>
What I ran into was only 100 mails were being sent at a time, the rest were sent to cf's undelivered folder. I would send them to spool and again 100 would get through..
Now, I've read in older versions of cf there is a checkbox in cf administrator to "maintain connection" -Im running cf9 and dont see this option.
Would using cfmail's query attribute, force cfmail to only connect to the mail server once to send all the emails?
<cfmail query="Customer"
from = "#FORM.fromAddressEmail#"
to = "#cstEmail#"
subject = "#FORM.subjectEmail#">
Im not even sure how to test this without sending a couple hundred emails. Any thoughts if this is a viable solution to the problem?
Thanks for your help!
Biscotti
I ended up compromising by using a scheduled task to move the files every 5 minutes back over to the Spool dir from the Undelivr dir. Im not thrilled with this solution, but it works.
Thanks to Russ's Respooler extension. http://cfrespooler.riaforge.org/
By using the above code to call the QUERY within CFMAIL I only succeeded in speeding up the client side process. The mail server still rejected the mail after the 100th connection - leading me to determine there is no server side benefit to this method over simply looping CFMAIL like in my first example. I seems the only answer is to run the code within the enterprise edition of the cf environment, one that has the "maintain connection" feature enabled.