MoreAbout MeTutorials

Contact MeSocialPresentations

UpcomingRecent2009Older

ProjectsBooks

What I'm ReadingMy Books

Blog

Feb7

Super Guide: Installing ColdFusion 9 on CentOS Linux39 Responses

4

Posted by Aaron West at 8:14 AM in ColdFusion, Apache, Security, Linux

This post is a followup to my previous guide to installing ColdFusion 9 on Ubuntu. While thatpost was all about the specifics to getting ColdFusion up and running on Ubuntu, this post is allabout CentOS. The overall process is the same and I'm covering all the same steps, but thecommands in this post are specific to the CentOS operating system. So why I'm writing this?

Overall, installing ColdFusion isn't that big of a deal. But I've yet to see a guide or blog post thatoutlines all the other topics related to getting a decent ColdFusion server on CentOS up andrunning. That's why I wrote this super guide, to outline what I believe is important to know aboutinstalling ColdFusion. Of course, I'm not covering every single possible detail, but I believe I'vehit on all the major topics. Along the way I sprinkle in my own ideas, thoughts, and what Ibelieve are best practices. After you read this post and walk through all the instructions youshould have a very solid ColdFusion / Apache set up on CentOS Linux.

There are two important things to note, so please read on.

Everything you will read, all paths, and every setup aspect is written specifically for CentOS.I've tested these instructions on CentOS 5.5, but they should be applicable to other recentversions. If you need instructions for Ubuntu, please read that guide here.

Secondly, and this is extremely important, all commands throughout this post are assumed tobe run as root. Some of the commands can be run without root, but most of them cannot. So

please, log into your CentOS server using the root account, put sudo in front of everycommand, or run the su ­ root command (under a non­root account) before walking through theinstructions.

Before we get going, here's a list of what I'll be covering:

1. Creating a Linux user for ColdFusion2. Disabling SSH and FTP login for the coldfusion user account3. Installing the required libstdc++.so.5 C++ Library4. Running the ColdFusion installer5. Starting ColdFusion for the first time6. Installing the ColdFusion 9.0.1 updater7. Verifying the installation of 9.0.18. Creating a new ColdFusion instance for general use9. Tweaking the JVM memory settings10. Hooking Apache and ColdFusion together11. Getting the Apache Connector running with selinux12. Locking down Apache13. Configuring ColdFusion to start on system boot

Create a Linux user for ColdFusion

Generally speaking it's a good idea to run each Linux service under its own Linux user account.This allows you to tailor the security and permissions of the service based on your applicationor business needs. When you install ColdFusion on Linux you will be asked which useraccount you want the service to run as. Create the user account using the command below.You don't have to use the same username I am, but if you choose something differentremember it as it'll be needed later. The useradd command on CentOS will create a useraccount and group account of the same name. It'll also create a home directory for the user in/home/coldfusion/. You won't be prompted to create a password for the user account but that'sokay as we'll be disabling remote logon in a moment.

useradd coldfusion

Disable SSH and FTP login for the coldfusion user account

When you create a Linux user account the account comes with the ability to login to the servervia SSH. This is generally a good thing but not when you are creating an account for the solepurpose of running an application as a service. The coldfusion user account you just createdisn't meant to be used as a remote access account so let's lock it down so no one can use it toaccess the server.

# Open the CentOS passwd file in a text editor. Nano or vim work great. I'm a# huge fan of vim, but since nano is easier I'll show the instructions for nano.nano /etc/passwd

Look for the line that starts "coldfusion:x:501:501..." Your numbers may be different from mine.It should be the last line in the file. Change the last part of the line that reads "/bin/bash" ­ whichis the users shell ­ to "/sbin/nologin." Here's both of my lines, before and after.

# BEFORE: coldfusion:x:501:501::/home/coldfusion:/bin/bash# AFTERcoldfusion:x:501:501::/home/coldfusion:/sbin/nologin

# Exit the file and saveCTRL­x [enter]y [enter]

Get the ColdFusion 9 installation file (.bin on Linux)

There are several ways you can go about getting the installation file for ColdFusion 9. Theeasiest is probably by logging into your Adobe account and downloading either the 32­bit installfile (coldfusion_9_WWE_linux.bin) or the 64­bit install file (coldfusion_9_WWE_linux64.bin). Ihighly recommend you go with a 64­bit installation as this will allow you to allocate much moreRAM to the ColdFusion server than in a 32­bit environment. Of course, this requires you have a64­bit version of CentOS installed as well. After you've downloaded the install file you need totransfer it to your Linux server. I generally use scp (Secure Copy) on my MacBook Pro totransfer the coldfusion_9_WWE_linux64.bin file directly to my server via SSH. Here's anexample showing how to do that. Whether you are on a Mac or not, use whatever you'recomfortable with.

# Format: scp [path_to_file_on_your_mac] [linux_username]@[remote_server_ip]:[remote_path]# You'll be prompted to enter the password for the remote user.scp /Users/aaron/Downloads/coldfusion_9_WWE_linux64.bin user@10.0.1.9:/install

Make the install file executable

Before you can run the installation file you need to make it executable. Navigate to the directorywhere you placed the file and run the change mod command to make it executable.

cd /install

# For the 32­bit installationchmod +x coldfusion_9_WWE_linux.bin

# For the 64­bit installationchmod +x coldfusion_9_WWE_linux64.bin

Install the required libstdc++.so.5 C++ Library

There's one final thing you need to do before running the installer. ColdFusion 8 and 9 requirethe libstdc++.so.5 C++ library for a few features such as custom tags, Web Services and somecfimage functionality. Download and install the library using the package manager built intoCentOS.

yum install libstdc++.so.5

Run the ColdFusion installer

You now have your server set up and ready for ColdFusion. You created a user account forColdFusion to run as, you downloaded the ColdFusion install file, and you installed the requiredC++ library libstdc++.so.5. To begin the ColdFusion installation, execute the install file with thefollowing command:

# Be sure and run this command in the same directory where the ColdFusion .bin is located.cd /install

# For the 32­bit installation (Remember to run this as root; use sudo)./coldfusion_9_WWE_linux.bin

# For the 64­bit installation (Remember to run this as root; use sudo)./coldfusion_9_WWE_linux64.bin

The install process may take a few minutes to get going depending on your server specs. You'llbe presented with a multi­page license agreement that you have to accept in order to continuethe installation. After that, you are presented with installation questions. Below are the installoptions and the choices I recommend.

1. Install type: 30­day trialChoose this option even if you have purchased a ColdFusion serial number. You'll be able toenter your serial number in the ColdFusion Administrator after the initial installation.

2. Install configuration: Enterprise Multiserver configurationThis will install a J2EE server (Adobe's own JRun 4) and create an initial instance ofColdFusion. This install type provides the most flexibility and future growth opportunities as youwill be able to deploy multiple instances of ColdFusion on the same Linux server. All running ona single copy of JRun 4. More on this later.

3. The installer tells says you cannot install the Enterprise Multiserver configuration ifColdFusion 9 or JRun4 is already on the server. If this is the case, select option two for "No."

4. Subcomponent installationYou have the option of installing ColdFusion 9 documentation, Solr Services, and SearchServices. You can also instruct the installer to "Start ColdFusion on system init." For aproduction server, you never want to install the documentation so I recommend uncheckingthat option by pressing the appropriate letter and then hitting enter. Make a decision on theother options (Solr Services and Search Services) and deselect them if you want. Finally,deselect the last option about starting ColdFusion on system boot. This install option generallyworks okay on Windows servers, but not on any Linux server I've tested other than Ubuntu8.04. We'll manually take care of this step using an CentOS­specific set up later. After you'veselected your options, press 5 for "Continue with installation" and then press enter.

5. Install FolderThe installer asks where you want to install JRun 4. The typical directory for JRun 4 on Linux is/opt/jrun4. All the ColdFusion instances you create will live in /opt/jrun4/servers/[instance­name]. At the end of these instructions you'll have two ColdFusion instances in the/opt/jrun4/servers/ directory. Keep this option set to the default by simply pressing enter.

6. Earlier versions of ColdFusionThe installer asks if you have earlier versions of ColdFusion installed on the server. Youshouldn't, so select the "No" option which should be the default.

7. Configure Web ServersYou have the option to configure an existing Web Server (Apache since you're on Linux) sorequests for ColdFusion resources such as .cfm and .cfc files are routed through Apache andthen ColdFusion via the Apache Connector. I do not recommend configuring a Web serverduring installation. Why? There are several reasons, but the most important one is how I usethe initial ColdFusion instance that the installer creates. During the installation process JRun 4will be installed at /opt/jrun4 and an initial ColdFusion instance (with the instance name cfusion)

will be installed at /opt/jrun4/servers/cfusion. The cfusion instance of ColdFusion functions asthe "master" or main instance. When you log into the ColdFusion Administrator of this instance,there's a tool called Enterprise Manager that lets you create additional instances of ColdFusion.New instances you create do not have the Enterprise Manager tool and thus cannot createother instances. My recommendation, is to use the cfusion instance as a management instanceonly to create new instances. If you use it this way, there's no reason to hook Apache toColdFusion during installation, because Apache will get hooked to the cfusion instance.Instead, you'll hook Apache to new ColdFusion instances later. You might be reading this andthinking: Okay, if I don't hook Apache to the main (cfusion) instance of ColdFusion, how will Iaccess the ColdFusion Administrator? Easy, instead of using an external (external toColdFusion) Web server, you'll use the built­in Web server that comes with ColdFusion. ThisWeb server runs on a separate port starting at port number 8300 on a multiserver configurationof ColdFusion. I'll spend more time talking about this setup and how it provides some additionalsecurity in a bit. Select the option to continue the installation without configuring a Web server.

8. Runtime userYou created a new Linux user account for ColdFusion earlier. It's now time to type the name ofthe user you created. If you didn't vary from my instructions the user will be coldfusion. Eitherway, type the name of the user account and then press enter. Be careful though. If you mistypethe name, and the name you type isn't a valid user on the server, you will not be able to startColdFusion after the installation.

9. Configure OpenOfficeI almost always skip the installation of OpenOffice components, but if you need them go ahead.

10. Administrator PasswordYou are prompted to create a password for the ColdFusion Administrator Web app. Type yourpassword and press enter. You will then need to confirm the password by typing it again. Pressenter.

11. Enable RDSRDS or Remote Development Services allow a client machine ­ such as the machine you useto write code ­ to connect to the ColdFusion server for line debugging, report builder integration,Dreamweaver extensions, introspecting datasources, and more. For security reasons, never,ever enable this on a production server. My recommendation, is to ONLY enable this on theColdFusion server running on your personal computer such as your development laptop. Thereare situations where it might be feasible to enable RDS on a server, such as a staging server.But covering all the possibilities in these instructions would be off topic. As a general rule,enable RDS on development servers only. Press "N" to disable RDS and then press enter.

12. Installation summaryThe installer displays a summary of the installation options you selected. Double­check yourselections and if something is wrong type "quit" at the prompt and start over (by running the .binfile again). Yes, I realize having to do this sucks. I don't know of a way to selectively changeone incorrect choice; you have to quit the installer as a whole and rerun it. If everything in thesummary looks correct, press enter to start the actual installation. Wait for the installer to finishwhich generally takes a few minutes.

13. Installation CompleteAfter the installation is finished you will see a success screen that tells you to start ColdFusionand run the Configuration Wizard. The wizard isn't something you have to run specifically, asthe first time you launch the ColdFusion Administrator the wizard will run for you. You are given

a URL for the ColdFusion Administrator:

http://[machinename]:8300/CFIDE/administrator/index.cfm

Start ColdFusion for the first time

You're now ready to start the ColdFusion server for the first. Below are two options for doingthis.

# Start CF without navigating to the /opt/jrun4/bin/ directory. (don't forget sudo if you need it)/opt/jrun4/bin/jrun start cfusion &

# Start CF by navigating to the /opt/jrun4/bin/ directory first. (don't forget sudo if you need it)cd /opt/jrun4/bin

./jrun start cfusion &

Finish the ColdFusion installation in your browser

Open your favorite browser and copy/paste the following into the address bar. Changemachinename to the IP address of your server. A local IP such as 10.x.x.x or 192.x.x.x will workif you are connected to a server in your office or you are connected to an external server viaVPN. You might also be able to use the external IP of the server. Or, if the server is alreadyhosting a domain name, you could change machinename to yourdomain.com.

http://[machinename]:8300/CFIDE/administrator/index.cfm

After loading this URL you should see a ColdFusion­branded Configuration and Settings wizardscreen with a password prompt. Enter the password for the ColdFusion Administrator youcreated during installation and press enter. ColdFusion will do a few things and then show anew screen with an okay button. Press the button to go straight to the main screen of theColdFusion Administrator.

Install the ColdFusion 9.0.1 updater

Generally at this point, we'd be ready to create a new ColdFusion instance for everyday use.But our ColdFusion server is not up­to­date. Adobe released ColdFusion 9.0 at their annualMAX conference in October of 2009. Then, on July 13, 2010 they released ColdFusion 9.0.1.Before we create a new ColdFusion instance we need to install the 9.0.1 updater which is notcumulative. This means the 9.0.1 updater requires an existing installation of 9.0. Fortunately,you just completed the 9.0 installation. The basic steps for getting ColdFusion 9.0.1 installedare to stop all running CF services, download the 9.0.1 updater from Adobe, transfer it to theCentOS server and run it.

Shutdown all running ColdFusion and JRun services. To get a list of all currently runningservices use the following command.

/opt/jrun4/bin/jrun status

For each instance that is running, issue the following command to stop it.

# /opt/jrun4/bin/jrun stop [instance_name]/opt/jrun4/bin/jrun stop cfusion

Next, download the 9.0.1 updater from Adobe. Access the download site and chooseColdFusion 9 in the product list. You'll be required to login using your Adobe account in order todownload the update. Make sure you choose the appropriate download, 32­bit or 64­bit.Transfer the updater file ­ either ColdFusion_update_901_WWEJ_linux.bin for 32­bit orColdFusion_update_901_WWEJ_linux64.bin for 64­bit ­ to your CentOS server just like youtransferred the 9.0 install file earlier.

Before you can run the updater file you need to make it executable. Navigate to the directorywhere you placed the file and run the change mod command to make it executable.

cd /install

# For the 32­bit installationchmod +x ColdFusion_update_901_WWEJ_linux.bin

# For the 64­bit installationchmod +x ColdFusion_update_901_WWEJ_linux64.bin

Next, run the updater file.

# Be sure and run this command in the same directory where you put the updater.cd /install

# For the 32­bit installation (Remember to run this as root; use sudo)./ColdFusion_update_901_WWEJ_linux.bin

# For the 64­bit installation (Remember to run this as root; use sudo)./ColdFusion_update_901_WWEJ_linux64.bin

An introduction screen will display giving you some information and instructions relating to theupdate process. Press enter to advance through the software license agreement screens.You'll have to agree to the license agreement by pressing "y" and enter.

1. Configure InstallationSelect the option for Multiserver configuration by pressing number 2.

2. A warning about shutting down JRun and ColdFusion services appears. You've already shutdown all services so press enter.

3. Configure ColdFusion 9 (step 1)The next screen asks you to select the root directory that contains JRun 4. The default installfolder, /opt/jrun4, should be listed so press enter to accept the default since we installed usingthe default folder.

4. Configure ColdFusion 9 (step 2)You are asked for the full system path where the ColdFusion 9 CFIDE directory is located. Thedefault directory should be listed as /opt/jrun4/servers/cfusion/cfusion­ear/cfusion­war/CFIDE.The default is correct based on how you originally installed ColdFusion 9. Press enter to acceptthe default.

5. Pre­Installation SummaryFinally, you are shown a summary of the updater installation. Like before, you can type "quit"and press enter to exit the updater if something isn't correct. If everything is correct, press enter

to start the actual installation.

13. Installation CompleteAfter the installation is finished you will see a success screen that tells you ColdFusion 9.0.1was installed at /opt/jrun4. Press enter to exit the installer.

Verify the installation of 9.0.1

The 9.0.1 updater installer displayed a success screen but it's always a good idea to verify theversion number of ColdFusion actually changed. To do this we need to start the main cfusioninstance of ColdFusion and log into the ColdFusion Administrator.

# Start CF without navigating to the /opt/jrun4/bin/ directory. (don't forget sudo if you need it)/opt/jrun4/bin/jrun start cfusion &

Once ColdFusion has started load the CF Admin in your browser using the URLhttp://[machinename]:8300/CFIDE/administrator/index.cfm. This time you'll see the regular loginform for the administrator instead of the configuration wizard you saw the first time. Log into theadmin and click the blue "i" icon in the upper right of your browser. This will display the SystemInformation screen for ColdFusion. Look for the version number in the system info grid andverify it is 9,0,1,xxxxx. At the time of this writing, the correct version number is 9,0,1,274733.

Create a new ColdFusion instance for general use

Now that you have ColdFusion updated to 9.0.1 you're nearly done with the main instance ofColdFusion. It won't be used for everyday activities, but it will be used to create additionalinstances of ColdFusion. And since we only have the main instance at this point, we need tocreate a new instance for everyday use. You should already have the ColdFusion Administratorloaded in your browser.

In the left navigation look for the Enterprise Manager section header (the last one) and expandit by clicking on it. Next, click on the Instance Manager link. Begin the process of adding a newCF instance by clicking on the Add New Instance button.

A form will display asking you to complete a few fields. But, the only field you really need tocomplete is the first one where you choose a name for the new instance. Keep your choicesimple, something like marketing, staging, dev, or similar will do. For this post I'm going withdev. After you type the name of the instance press the tab key or use your mouse to give oneof the other form fields focus. Doing this should cause the name you typed to display at the endof the second form field for Server Directory. Press the Submit button. NOTE: If you hadpreviously packaged an existing ColdFusion instance as an EAR (.ear Enterprise Archive file)or WAR (.war Web Application Archive) you could enter the path to the .ear or .war file to createthe new instance from the archive file. This comes with several benefits such as migratingColdFusion Administrator settings into the new CF instance.

The Enterprise Manager will now create and start the new CF instance in 4 steps. When it isfinished the new instance will be available and started. To verify this, run the followingcommand to list all running JRun services. You should see a new line in the output thatindicates the dev instance is running.

/opt/jrun4/bin/jrun status

We're done with the main cfusion instance and won't be using it for the rest of theseinstructions. But before shutting it down, click the Instance Manager link in the left navigation

again. Notice how the new dev instance shows in the Available Servers list. You can use thecontrols here to start, stop, restart, and delete the instance. You can also click the rightmosticon to load the ColdFusion Administrator for the instance. I typically start and stop instancesfrom the Mac or Linux command line. For this reason I typically shutdown the cfusion instanceand only start it if I need to create a new CF instance.

/opt/jrun4/bin/jrun stop cfusion

If you decide to keep the cfusion instance shut down you won't be able to launch the CF Adminfor the dev instance using the Enterprise Manager ­> Instance Manager screen. So, you mightwant to write down or remember the CF Administrator URL for your dev instance, which ishttp://[machinename]:8301/CFIDE/administrator/index.cfm by default. The only difference in thisURL and the CF Admin URL for the cfusion instance is the port number. The cfusion instanceuses port 8300 and the dev instance uses port 8301. The Enterprise Manager we used tocreate the dev instance assigns new instances a port number of current_highest_port_number+ 1.

Tweak the JVM memory settings

ColdFusion runs in a JVM (Java Virtual Machine) and as such it is limited to the amount ofsystem RAM you allocate to the JVM. On the multiserver version of ColdFusion these memorysettings are configured in the /opt/jrun4/bin/jvm.config file. There are several memory settingsyou can change in this file and covering them all is outside the scope of this post. Also outsidethe scope of this post are the values you should put for each of the memory settings. Eachserver, each environment, and each application is different. You must tailor the settings to yourserver, your environment, and your apps. The only way to do this is to monitor your applicationsuse of memory and adjust the settings accordingly.

The two settings I do want to spend a little time on are the initial JVM heap and the maximumJVM heap. These settings are defined in the ­Xms and ­Xmx arguments to the JVMrespectively. By default only the maximum heap is included in jvm.config and it starts out at512m or 512 megabytes. This means the maximum amount of memory ColdFusion can occupyon your server is 512 megabytes. Depending on your server that may or may not be a verygood starting point for your environment, server, and app. On a virtual server with a limitedamount of RAM you might want to define a smaller maximum heap. Likewise, you may want toinclude an initial heap value ­ the amount of RAM that will be allocated to ColdFusion whenColdFusion starts up. I cannot tell you what values make sense, so it's up to you if you want tochange these settings. But, let's say you want to set the initial heap value to 386 megabytesand the maximum heap value to 512 megabytes. To do this, you add the ­Xms argument andleave the ­Xmx argument the way it is.

After editing the line it should look something like this:

java.args=­server ­Xms386 ­Xmx512m

A few things to remember:

1. the settings configured in jvm.config are applied to each instance of ColdFusion. Given thememory settings above and 4 instances of ColdFusion, your maximum memory footprinton the server is approximately 2 GB. Make sure your server has enough RAM toaccommodate your settings.

2. the megabyte values must be divisible by 32. In other words, a value of 300 for either Xmsor Xmx is technically invalid

3. ­Xms cannot be larger than ­Xmx (if you try this, you will get an error when trying to startinstances)

4. You technically don't have to define ­Xms or ­Xmx as arguments to the JVM. Yourinstances will still start up without these values. But, the amount of memory that getsallocated to each instance seems to vary server­to­server and I've yet to figure out why. Asa general rule, I recommend providing the ­Xmx argument at a minimum.

5. any changes made to jvm.config will be applied to a CF instance the next time it starts

If you made changes to jvm.config, as I did above, you need to restart the dev instance so yourchanges will take affect.

/opt/jrun4/bin/jrun restart dev &

Hook Apache and ColdFusion

So far, each time we've accessed the ColdFusion server from a Web browser we've done sothrough the built­in Web server that comes with ColdFusion (port 8300 for the cfusion instanceand 8301 for the dev instance). The built­in Web server is great for accessing things like theColdFusion Administrator but it's not ideal for anyone other than yourself. No one wants toremember what port to put in a URL. To get around this, you "hook" ColdFusion to an externalWeb server such as Apache or Internet Information Server (IIS). Since we're working with anCentOS server Apache is what we'll use.

Once ColdFusion and Apache are hooked together, any HTTP request for files ending in .jsp,jws, .cfm, .cfml, .cfc, .cfr, and .cfswf will first be sent to Apache. Apache will recognize these fileextensions as pertaining to a special JRun/CF module and it will pass the request through toColdFusion. ColdFusion will perform whatever tasks are programmed in the file ­ which istypically a .cfm or .cfc ­ and it will return the processed result. Apache will then return the resultto the browser in an HTTP Response. You can think of the Apache Connector as a sort of low­level HTTP proxy to ColdFusion, although this is not technically correct.

There's a caveat to connecting ColdFusion and Apache on RHEL (RedHat Enterprise Linux),CentOS and other distributions that come with SELinux (Security Enhanced Linux). Thisservice, if running in ENFORCING mode (which is the default), will not permit Apache andColdFusion to communicate with one another via the Apache Connector.

To see if selinux is installed and running in enforcing mode on your system, run the followingcommand.

cat /selinux/enforce

An output of 0 means selinux is in permissive mode, while 1 means enforcing mode. If you getan error, it probably means selinux isn't installed. If selinux is running in enforcing mode you'llneed to temporarily put it in permissive mode, install the Apache Connector, and then configurethe security context of the connector to work properly with selinux in enforcing mode.

If your output from the command above was a 1, run the following command to put selinux inpermissive mode.

echo 0 >/selinux/enforce

# You can run the following again to verify you now get an output of 0.cat /selinux/enforce

Another prerequisite to connecting Apache and ColdFusion is installing the httpd­develpackage. If you skip this step and attempt to run the Apache Connector, you'll get the followingerror:

Could not find the required apxs (Apache Extension Tool) binary /usr/sbin/apxs.Check that package httpd­devel package is installed. Could not build Apache2 webserver connector from source.

Install the httpd­devel package:

yum install httpd­devel

Finally, verify the ColdFusion instance you want to hook to Apache is running. The ApacheConnector tool will not work if the instance is shut down. Run the following command and makesure the dev instance is listed as running.

/opt/jrun4/bin/jrun status

If the instance isn't running, be sure to start it using the jrun start command discussed already.With the dev instance running you're ready to run the wsconfig tool.

You're finally ready to run the Apache Connector tool. On Linux, this involves executing asingle command (wsconfig, which comes with JRun/ColdFusion) with several argumentspassed to the command. Here's a quick run down of the arguments:

­ws (generic name of the Webserver)­dir (directory where the Web server configuration lives)­server (the instance name of the ColdFusion server we want to hook)­bin (the location of the Web server binary)­script (the location of the Web server configuration/control file)­coldfusion (the fact that we're hooking coldfusion)­ws64 (used to configure a 64­bit connector on a 64­bit Linux install only)­v (run the wsconfig command in verbose mode)

Type the following command which should be entered on one line. If the line wraps in yourterminal screen, that's okay. Press enter after typing the command.

# For the 32­bit installation/opt/jrun4/bin/wsconfig ­ws Apache ­dir /etc/httpd/conf ­server dev ­bin /usr/sbin/httpd ­script/usr/sbin/apachectl ­coldfusion ­v

# For the 64­bit installation (the only difference here is the ­ws64 argument)/opt/jrun4/bin/wsconfig ­ws Apache ­dir /etc/httpd/conf ­server dev ­bin /usr/sbin/httpd ­script/usr/sbin/apachectl ­coldfusion ­ws64 ­v

The wsconfig tool should list several lines of output. If you want to verify the command workedyou can open Apache's global configuration file, httpd.conf, in a text editor and look for theaddition of an block of code. This block of code will reference the connector module,mod_jrun22.c, and the IP address that's bootstrapped. The IP might be 127.0.0.1 depending onyour server set up. That shouldn't pose any problems, but you can manually change the IP tothe static IP of your server if you want. Just be sure and leave the port number after the IP. Andif you do change the IP, you'll need to restart Apache for the change to take affect.

# Stop/start Apache forcing config reload

service httpd reload

You're now ready to test a simple ColdFusion page to see if the Apache and ColdFusionconnection is working properly. You'll create a simple index.cfm file in the default Apachewebroot and access it in a browser.

# Use the CentOS text editor of your choice.nano /var/www/html/index.cfm

# Add the following to the new file.<cfoutput>#Now()#</cfoutput>

# Exit the file and saveCTRL­x [enter]y [enter]

Now open your Web browser and access your server using the URLhttp://[machinename]/index.cfm. Replace machinename with your server's IP address ordomain name. If you enter the right URL, and Apache and ColdFusion are successfully hookedyou should see the current server date and time in your browser. If everything worked you areready to create additional Apache virtual hosts, define your Web sites, and start writingColdFusion code.

Get the Apache Connector running with selinux

Earlier I mentioned the Apache Connector and selinux don't play well together with selinux inenforcing mode. While it was easy to get around this by temporarily putting selinux inpermissive mode, it's not difficult to get the two to play nicely together so let's take care of that.

First, stop Apache and your dev ColdFusion instance.

/opt/jrun4/bin/jrun stop devservice httpd stop

Now, run the following commands:

# Set the Apache Connector to run in the same selinux security context as other Apachemodules.chcon ­­reference=/etc/httpd/modules/mod_auth_basic.so/opt/jrun4/lib/wsconfig/1/mod_jrun22.so

# Set the Apache Connector to use the proper selinux user security contextchcon ­u system_u /opt/jrun4/lib/wsconfig/1/mod_jrun22.so

# Set the security file label of the jrunserver.store file to that of a regular static html file.# This eliminates errors in the Apache logs.chcon ­R ­h ­t httpd_sys_content_t /opt/jrun4/lib/wsconfig/1/jrunserver.store

# Configure selinux to allow scripts to connect to Apachesetsebool ­P httpd_can_network_connect=1

Finally, put selinux back into enforcing mode and start your dev ColdFusion instance andApache.

# Put selinux into enforcing modeecho 1 >/selinux/enforce

# Verify selinux is in enforcing modecat /selinux/enforce

# Restart the dev ColdFusion instance and Apache/opt/jrun4/bin/jrun start dev &service httpd start

To verify everything is working properly go back to your browser and be sure you can run theindex.cfm template you created earlier (http://[machinename]/index.cfm). If the server date/timeshows up, you're golden.

FINAL NOTE ON selinux:I recommend double­checking the system level setting for selinux. You can do this by openingthe /etc/selinux/config file and ensuring you see a line like SELINUX=enforcing. When Linuxboots up it looks at the setting in the /etc/selinux/config file and configures selinux accordingly.If you've temporarily put selinux in permissive mode, but the config file hasSELINUX=enforcing, your temp setting will be reversed during the next system boot. While Idon't recommend this, if you get frustrated with selinux you can permanently disable selinux bychanging SELINUX=enforcing to SELINUX=disabled, and rebooting your server. There's alsosome good info on selinux here.

Lock down Apache

Earlier I mentioned I don't use the ColdFusion Administrator for the main cfusion instanceexcept to create additional instances of ColdFusion. I typically leave the cfusion instance shutdown unless I need it. To increase the security of my ColdFusion Administrator I also neveraccess it through a Web server like Apache. Instead, I use the built­in Web server that comeswith ColdFusion by loading the proper URL plus port number of the CF Admin I need to use.This is a nice start to security but you can always do more.

Another way I typically lock down my CF Administrator is by adding the following code toApache's global configuration file, httpd.conf.

# Open the global Apache config filenano /etc/httpd/conf/httpd.conf

# Add the following Location directive in the file. For CentOS, I typically add this block of codejust before the VirtualHost definitions.<Location ~ "/CFIDE/administrator">Order Deny,AllowDeny from All</Location>

# Exit the file and saveCTRL­x [enter]y [enter]

In the event someone was to try and access my ColdFusion Administrator using a URL likehttp://mydomain.com/CFIDE/administrator/index.cfm, Apache stops them. This Locationdirective looks at the URL for the string sequence "/CFIDE/administrator" anywhere in the URL.

If the sequence is found, Apache denies the request. I highly recommend implementing boththese solutions, accessing your CF Admins from the built­in Web server, and disallowing anyURL that looks like the CF Admins URL. Is this enough security? The answer depends on whatyou consider enough. I personally feel there can never be enough security to protect yourcustomers and your business. There is a point where security begins to negatively impactdevelopers, system admins, and daily work, so you need to judge what is secure enough foryou. A final recommendation I have about locking down the CF Admin, is to access the built­inWeb server via a private IP address such as 192.x.x.x or 10.x.x.x. You can do this with VirtualPrivate Networks and other setups. An attacker would need to first infiltrate your network andobtain an IP address on the network before the IP range 192.x.x.x or 10.x.x.x would betraversable. For more information on blocking the ColdFusion Admin from Apache, see myother post on the topic.

Configure ColdFusion to start on system boot

If you've gotten this far you've accomplished a lot in getting ColdFusion installed andconfigured on CentOS. You created a Linux user the ColdFusion server can use (though it isn'tuse it yet) and you removed remote access from the user. You installed ColdFusion 9.0 and the9.0.1 updater. You created a second ColdFusion instance for daily use and tweaked the JVMmemory settings each ColdFusion instance will use. Next, you hooked ColdFusion and Apachetogether so your sites can benefit from all the Apache goodness, and so you can access CFresources without a port number in the URL. Finally, you locked down your ColdFusionAdministrators by editing the Apache server configuration.

That's a nice list of accomplishments, but there's one important thing left to do. You need toconfigure the ColdFusion service so it starts when your CentOS server boots up. When weinstalled ColdFusion we explicitly skipped this step so we could manually set it up. And I thinkthis is a better way to go.

To get this working you'll create a script that will function as a service. You'll store the script filein the /etc/rc.d/init.d directory and then add and configure the script to run as a service.

Create the service script

# Navigate to the /etc/rc.d/init.d directorycd /etc/rc.d/init.d

# Create a new file that functions as the service.# Use cf­[instance_name] where instance_name is the name of your CF instancenano cf­dev

# Paste all of the following code into the file. Specifically, paste everything that# is between the start of file indicator and end of file indicator.# ­­­­­­­­­­­­­­­­ start of file below this line#!/bin/bash## Startup script for ColdFusion# chkconfig: 345 90 14# description: Start/stop ColdFusion as service#INSTANCE_NAME="your_instance_name"# Source function library.

. /etc/rc.d/init.d/functions#case "$1" instart)echo ­n "Starting CF $INSTANCE_NAME: "/opt/jrun4/bin/jrun ­start $INSTANCE_NAME &echo;;stop)echo ­n "Shuting down CF $INSTANCE_NAME: "/opt/jrun4/bin/jrun ­stop $INSTANCE_NAMEecho;;restart)/opt/jrun4/bin/jrun ­restart $INSTANCE_NAME &;;*)echo "Usage: $0 start|stop|restart"exit 1esacexit 0# ­­­­­­­­­­­­­­­­ end of file above this line

This script, when set up as a service, allows you to start, stop, restart, and get the status of therunning ColdFusion instance. After you paste the script into the cf­dev file there is one line youneed to change. This script is going to specifically start the dev CF instance when CentOSboots up so we need to change the INSTANCE_NAME variable.

# Find the following line: INSTANCE_NAME="your_instance_name"# Change it so it looks like thisINSTANCE_NAME="dev"

# Exit the file and saveCTRL­x [enter]y [enter]

The INSTANCE_NAME variable is a string that should be the exact same name of the CFinstance that shows in the /opt/jrun4/servers directory. Now, we need to make the cf­dev fileexecutable and add it as a service.

# Make the script executablechmod +x cf­dev

# Add the script as a servicechkconfig ­­add cf­dev

After running these commands you can reboot your server and ensure your dev instance ofColdFusion starts automatically. You can do this by running the jrun status command(examples above) or by hitting your test index.cfm page you created earlier in the /var/www/htmldirectory. To reboot your server now, run the following command.

reboot

About this post:

This entry was posted by Aaron West on February 7, 2011 at 8:14 AM. It was filed in thefollowing categories: ColdFusion, Apache, Security, Linux. It has been viewed 8374 times andhas 39 comments.

1 related blog entries

Super Guide: Installing ColdFusion 9 on Ubuntu Linux (January 24, 2011)

39 Responses to Super Guide: Installing ColdFusion 9 on CentOS Linux

[Add Response] [Subscribe to Responses]

1. Andy Allan2/7/11 1:28 PM

When creating the linux user you can simply run:useradd ­s /sbin/nologin 'user'

Saves you from having to manually edit the passwd file.

Reply

2. Aaron West2/7/11 1:43 PM

Nice suggestion Andy, thanks!

Reply

3. Simon Bailey2/10/11 10:43 AM

Having had to rebuild my linux server from scratch I was dreading the CF installation,Aaron this is a fantastic resource buddy well done and thanks!

Simon

Reply

4. Aaron West2/10/11 10:53 AM

@Simon ­ thanks for the kind words. And good luck with your next installation; hopefullythis guide will be able to help you out.

Reply

5. Jacques Choquette2/16/11 9:41 PM

Hi aaron

Your article has been a live saver so far but I am running into a problem after the HookApache and ColdFusion part. everything is going smooth however when I try an accessthe .cfm page my browser prompts me to download the file. It's like the connector did notwork or something. I do have plesk installed do you think that would create any problemscan you provide any insights?

Reply

6. Jacques Choquette2/16/11 11:29 PM

figured it out i needed to change the dev referance in to the name of my instance ...... thankyou you are a life saver!

Reply

7. Sandeep3/3/11 5:17 AM

Thanks for saving my time.

I am getting this error when i tried to access .cfm file :

Internal Server Error

The server encountered an internal error or misconfiguration and was unable to completeyour request.

Please contact the server administrator, root@localhost and inform them of the time theerror occurred, and anything you might have done that may have caused the error.

More information about this error may be available in the server error log.

httpd log says :

[notice] jrApache[3792: 45723] Server has not been properly configured for JRun.

Thanks,Sandeep

Reply

8. Nick3/14/11 12:32 PM

Really, really great tutorial. Generally, I try to follow these types of guides and end up stuck

somewhere because the environments are different. Aside from the 'service' command(using mt), all was very tight!

Reply

9. Aaron West3/14/11 2:04 PM

@Nick ­ thank you for the feedback, it makes the effort of putting together a detailed postworth it. Most of the online Linux guides I have seen leave much to be desired. Authorsoften assume you understand as much as them so they leave out critical pieces that makeit near impossible to make progress.

I try and do the exact opposite. It's not for everyone as it makes for much longer posts, butknowing folks like yourself find it useful makes it all worth it. Thanks again.

Reply

10. Daryl3/30/11 3:15 PM

Thanks for the terrific tutorial. I followed it to the "T" with making the service script butcoldfusion won't auto start when I reboot... renamed the server instance and everything.

What else could be preventing it from starting?

Reply

11. Aaron West3/30/11 11:13 PM

Daryl, check the system logs to see if there are any error messages about the bootsequence. Also, are you using SELinux? If so, try turning it off permanently using theinstructions in this post and reboot. Make sure you are following the instructions aboutediting the selinux config file, not the instructions about temporarily disabling SELinux.

Finally, make sure the CF instance name in the boot script matches your real CF instancename and that the script was properly adding to the boot sequence with the chkconfigcommand.

Reply

12. Daryl4/2/11 1:27 AM

Bingo on the SELinux, turned it off and kept it off permanently, rebooted, works like acharm. Thanks, Aaron!

Reply

13. Aaron West4/2/11 9:04 AM

@Daryl, that's great to hear. You've identified the issue being with SELinux, but I'drecommend you try and resolve why SELinux is preventing ColdFusion from starting onboot. Is it possible you missed one of the steps I outlined in the section on configuringColdFusion, Apache, and SELinux? If you want to have your system run with SELinuxenabled you could read through the instructions I wrote and see if you missed something.Your system will be more secure with SELinux running but it's certainly not a requirement.

Reply

14. jairobg4/12/11 2:30 PM

This is realy a Super Guide, I'm new for linux (and english) and is very easy follow theguide, tanks Aaron. I have a problem with the ajax framework, no error, no messages onlynot work. any idea?

Reply

15. Aaron West4/12/11 2:53 PM

@jairobg4 Thanks for the kind words. I worked hard to make this guide useful and easy tofollow. Can you give me more info about your Ajax framework issue? I'm not sure what youare referring to or what isn't working properly.

Reply

16. jairobg4/12/11 3:20 PM

Tanks Aaron for your answer... There is an application using cfwindow, cfdiv, cflayout, thatworks on local server But does not work in the new linux server, don't show the cfdivcontent, don't show the cfwindow, and cflayout shows all content without the tabs oracordeon object. Checking javascritp in the page show "ReferenceError: ColdFusion is notdefined".

Reply

17. jairobg4/12/11 3:26 PM

I fout some thing ... in IIS you need create virtual directory to CFIDE, in this place is thejavascript library. (Insecure... I think... ) ok . Maybe .. in CentOs apache .. how I do that?

Reply

18. Jace4/13/11 12:32 PM

Hi Aaron, amazing tutorial, you got me up and running on my test machine with noproblem. However, I seemed to have screwed up on another machine, how would youadvise a newbie on the proper way to uninstall CF9 on Centos?

Reply

19. Aaron West4/13/11 12:48 PM

@Jace Glad to hear you had some success. There's an uninstall script for ColdFusionlocated in the /opt/jrun4/bin directory on Linux (assuming you installed CF in the defaultlocation). You should run the script as root or as the same user who owns all the CF andJRun directories.

Reply

20. Mevin Pothunnah4/30/11 4:35 PM

That is the best ever tutorial on installing ColdFusion I have ever read. Thanks Aaron!!!!!!!!!

Reply

21. Aaron West5/1/11 12:33 PM

Mevin, thank you for the kind words. Knowing folks like yourself enjoy the things I writeabout is why I spent so much time on each post.

Reply

22. Kelly Matthews5/5/11 8:42 AM

Aaron maybe you can help me. I installed Coldfusion, although not the multi serverinstance, using your guide. Everything appears to have gone correctly. The connector ranand updated my httpd.conf file. However when I surf to any .cfm file it says NOT FOUND,even though it is there. It is throwing a CF not found error, so apparently apache is handingthe request off correctly to coldfusion.

Any ideas?

Kelly

Reply

23. Mevin Pothunnah5/5/11 8:48 AM

Do you have similar guide for installing Tomcat 7 on Centos?

Reply

24. Aaron West5/5/11 3:12 PM

@Kelly ­ without looking at your system I'm unsure what the problem could be. There are

several things that come to mind like path issues, permissions issues, or issues with howthe connector configured itself. I'd troubleshoot with plain html files and a cfm file to see ifyou can verify the path is correct. An html file won't hit your ColdFusion server so you'll beable to test just Apache.

@Mevin ­ I replied to the e­mail you sent me, but in case others come here wonderingabout Tomcat, I don't have any experience with it so I'm afraid I couldn't be of much help.

Reply

25. Kelly Matthews5/5/11 3:20 PM

@Aaron thanks I am using Virtualmin and it sets a different home directory. For whateverreason even though I specified the correct home directory, coldfusion still used the default.So I just moved all the home directories there and it works like a charm! :)

Reply

26. Larry Lowe7/27/11 9:33 PM

Aaron, Your a life savior this was so helpful, thanks you!! I do have two questions, 1) Afterthe reboot I did a ps ­ef|grep jrun and it returned "root 3146 1 8 22:13 ? 00:00:31/opt/jrun4/bin/jrun ­start dev" it looks like jrun is running as root instead of coldfusion did Imiss something? 2) I'm a DBA by training who did a little CF when the version was 4.5 andhave gotten drafted into CF development again so if you covered this elsewhere I'm sorrybut can I get RDS working with CFEclipse with this setup and if so how?

ThanksLarry

Reply

27. Aaron West8/8/11 5:20 PM

@Larry ­ sorry the late reply. I thought my post covered having the start up script run as aspecific user, such as the coldfusion user I created in the post. I see that is missing now. I'llupdate the post when I get a chance.

Reply

28. Loic Mahieu8/31/11 1:02 PM

Hi Aaron,

Useful article! You've help me a lot today :)

Thanks

Reply

29. David Johnson10/19/11 7:58 AM

Aaron,

Your guide was essential for getting me up and running on CentOS. All of the commentshere about what a great service you've done in writing this are spot­on. Please keep up thegreat work!

Reply

30. Aaron West10/19/11 8:11 AM

David J, thanks for letting me know the guide was useful to you and thanks for reading!

Reply

31. Dave Ferguson11/17/11 1:09 PM

Thanks for a great article.

I was just going through this and ran into an error creating the apache connector..

/usr/lib64/apr­1/build/libtool: line 970: gcc: command not foundError running "/opt/jrun4/lib/wsconfig/1/build_jrun22": exit code was 1apxs:Error: Command failed with rc=65536Could not build Apache2 web server connector from source. Use build script/opt/jrun4/lib/wsconfig/1/build_jrun22.

This literally left Apache unusable. Since I have a couple skills (I know how to use google) Irooted around for a solution. The issue as quickly remedied by running:

yum install libtool

Thanks,

­­Dave

Reply

32. Aaron West11/17/11 1:15 PM

@Dave ­ Did you have to install libtool and libstdc++.so.5 (mentioned in the post)? Curiousas I've only ever had to install libstdc++.so.5 on CentOS for this process to work. Whatversion of CentOS were you trying this on.. or was it CentOS?

Reply

33. Dave Ferguson11/17/11 1:25 PM

Yes.. I had to install both.

The server is running: CentOS Linux release 6.0 (Final)

­­Dave

Reply

34. Aaron West11/17/11 1:57 PM

I've not tested these instructions on CentOS 6, so perhaps the requirement of libtool is newand specific to v6.

Reply

35. Dave Ferguson11/17/11 4:27 PM

Well.. I can say that with the exception of needing to install libtool, the instructions workedjust fine on CentOS 6.

Reply

36. Aaron West11/17/11 4:51 PM

Awesome, thanks for the feedback Dave!

Reply

37. Jean­Paul Claude11/24/11 5:11 PM

I have CentOS 6, followed the directions & even the extras recommended by DaveFerguson, however the install errors out with 27 NonFatalErrors and 1 Fatal Errors.

I don't want to flood this post with the log file so I sent it to you via your "contact" form.

Reply

38. Patrick12/8/11 4:50 AM

Really a great tuto.

I'm a CFM lover since more 10 years but not linux expert...

Install on Centos5... perfect at first time...

Thanks

Reply

39. Anthony Webb12/17/11 6:07 PM

One major gotcha I am hitting just now, wanted to see if anyone had any insight.

I installed using the instructions, and it worked flawlessly.

Problem was when I sent to apply my license key. It accepted my license key find, but I amnow finding out that my $1300 license key wont work in a multiserver config like the tutorialrecommends, I'll need the $7500 license!?

I've got sufficient time into this build that I hate to have to do it again from scratch.

Is there anyone out there who knows how to go from a multiserver config to a singel serverconfig? Or if it is even possible?

Reply

[Add Response] [Subscribe to Responses]

Leave a Reply

Name (required)

Mail (will not be published) (required)

http:// Website

Remember My Information

Subscribe

If you subscribe, any new posts to this thread will be sent to your email address.

Submit Comment

4

Search

Calendar

<< January 2012 >>M T W T F S S1 2 3 4 5 6 78 9 10 11 12 13 1415 16 17 18 19 20 2122 23 24 25 26 27 2829 30 31

Post Categories

30onAIR (10) RSSAaron Answers (3) RSSAdobe AIR (65) RSSAdobe Community Experts (18) RSSAdobe Community Professionals (1) RSSAdobe Community Summit 06 (3) RSSAdobe Community Summit 08 (6) RSSAdobe General (43) RSSAdobe MAX 2009 (3) RSSAjax (8) RSSAndroid (5) RSSApache (14) RSSApollo (8) RSSApple TV (1) RSSBlazeDS (16) RSSBlogCFC (12) RSSBlogging (24) RSSBooks (4) RSSCFEclipse (10) RSSCFUnited 2006 (11) RSSCFUnited 2009 (5) RSSCFUnited 2010 (4) RSSColdFusion (284) RSSColdFusion Builder (2) RSSCoworking (1) RSSDataium (3) RSSDealerskins (19) RSS

70% Off withOnline DealsBest Deals EveryDay in Singapore.Join Groupon

Today & Save Up to70%

www.GROUPON.sg/…

Eclipse (8) RSSEvernote (2) RSSExtJS (1) RSSFlash (64) RSSFlex (108) RSSGeneral (22) RSSGit (3) RSSGolf (5) RSSGTD (7) RSSHacks (6) RSSiPhone (27) RSSJobs (12) RSSLeopard (8) RSSLightroom (2) RSSLinux (6) RSSMac (56) RSSMac Programming (7) RSSMach­ii (3) RSSMAX 2006 (4) RSSMobile & Devices (35) RSSMobileMe (7) RSSModel­Glue (4) RSSMountain Biking (2) RSSMusic (20) RSSNashville (7) RSSNew Technology (13) RSSOmniFocus (5) RSSPersonal (85) RSSPhotography (7) RSSPodcasts (5) RSSPresentations (14) RSSProductivity (20) RSSProgramming (15) RSSRIAdventure (4) RSSSecurity (5) RSSSite News (24) RSSSnipEx (3) RSSSource Control (2) RSSSQL (5) RSSSubclipse (3) RSSSubversion (11) RSSTortoiseSVN (3) RSStwitterAIR (10) RSSUser Groups (81) RSSVideo (3) RSSWatches (2) RSSWeb Standards (7) RSSWebmaniacs 2008 (2) RSS

Recent Posts

I'm Hiring a DBA and Senior Software EngineerFive Ten Sam Hill Mountain Bike ShoesRiding the Latest Bikes from TrekIt's Working for MeNew Business Card!

Popular Posts

Recent Comments

Hartono on Configuring Chrome with Flash Player DebuggerLNK on How To Fix Missing Plug­in Issue in ChromeAaron West on Super Guide: Installing ColdFusion 9 on Ubuntu LinuxMax Hamby on Super Guide: Installing ColdFusion 9 on Ubuntu Linux

twitter.com/awest

If you haven't seen or heard This Week In Tech episode 332, the first section on SOPA isgreat! #TWiT

There's nothing like Firestone coffee. Nothing.

Tried my new Roku last night. It crashed twice while watching a movie on the Cracklechannel. Hoping that was an anomaly.

Follow

© 2012 Aaron West. All rights reserved.