Are the configuration files only accessed on startup or change?

[Juan Aguilar]

I stumbled across the following idea: once a server has loaded its configuration files (lucee-server.xml and each context's lucee-web.xml.cfm), these could be removed so that any sensitive information in the configuration would not be accessible on a file on the machine and the configuration of the machine could not be changed through the web administrator.

Once the configuration files are loaded, are there any negative repercussions to removing these, provided they are replaced before the next time the service is restarted?

[Gert Franz]

Actually the whole administration is something that is potentially should be overhauled because of things like Software as a Service and running Lucee on a Dokker-like environment. Many Saas approaches require that you have a read-only access to the file system and you only use services to talk to the environment. We have been approached by several companies that want to have their applications running in a SaaS environment. So there is work to be done here J

 

The current implications of running Lucee without a physical file are actually 0. Since even without such a file, Lucee loads with a default configuration. This mostly happens when Lucee cannot write to the directories where the whole configuration will be stored. So theoretically it is already possible. I just think that this should be something like a LSR (analog to JSR J) which then contains the whole details and as well what happens when you change something in the Lucee Administrators.

 

HTH

 

Sincerely
Gert Franz

 

RASIA GmbH

Spittelgasse 7

5103 Moeriken-Wildegg

Email: ge...@rasia.ch
Skype: gert.franz

Phone Switzerland: +41 76 5680 231

--
You received this message because you are subscribed to the Google Groups "Lucee" group.
To unsubscribe from this group and stop receiving emails from it, send an email to lucee+un...@googlegroups.com.
To post to this group, send email to lu...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/lucee/cae9ef4b-e1a6-4d54-8618-618a30f2bb60%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Juan Aguilar]

Excellent answer. Thanks.

I'm not sure where this fits in terms of "security best practices" but, provided its operational impact is minimum, it seems like a winner to me.