Steven Erat's Blog Steven Erat Photography
 
 
Viewing By Entry
 
 

TalkingTree  A ColdFusion Trick for Lost Datasource Password

 

Here's a quick trick if you don't have a datasource password when creating a new datasource but you do have another ColdFusion server with the same datasource.

Imagine you have two production servers running ColdFusion, each one with different datasources running different applications. What if you have a datasource on one server and you need to create that datasource on the second one but can't find (or don't have) the database password?

All recent ColdFusion versions use the same encryption algorithm for encrypting and decrypting passwords for datasources registered in the CF Administrator. This is why you can copy the ColdFusionX/lib/neo-datasources.xml from one ColdFusion 8 server to another ColdFuson 8 server, and the second server will have all the same datasources as the first. This is a quick way to mirror datasources across different ColdFusion servers.

But now, back to the problem where you have different datasources on each CF server, and you cannot copy over the whole datasource config file. If you don't have the database password, you can create a new datasource on the second server but without supplying a password. The datasource will then fail to verify. However, if you examine the datasource config file from the first server you can find the encrypted version of the password. A snippet from the ColdFusion8/lib/neo-datasource.xml file is shown below. Notice the encrypted version of the password in this xml sections:

<var name="timeout">
<number>1200.0</number>
</var>
<var name="password">
<string>RgmrmRQhiQM=</string>
</var>
<var name="update">
<boolean value="true"/>
</var>
<var name="drop">
<boolean value="true"/>
</var>
<var name="pooling">
<boolean value="true"/>
</var>
<var name="url">
<string>
jdbc:seefusion:{jdbc:mysql://localhost:3306/cfcontact?};driver=com.mysql.jdbc.Driver;dsn=cfcontact;
</string>
</var>


In this case the particular datasource has an encrypted version of the password shown as RgmrmRQhiQM=. You could find the datasource of interest in the config file, then find the encrypted version of the password, and copy it to the other neo-datasource.xml config file on the other server. Find the XML node for the failed datasource. It should have no value for the contents of the password field:

<var name="password">
<string></string>
</var>


Then paste the encrypted version of the password in between:

<var name="password">
<string>RgmrmRQhiQM=</string>
</var>


For this to work, the ColdFusion server for where you are pasting the password should be stopped to avoid having ColdFusion overwrite your changes with a copy it already has in memory. Then start ColdFusion after pasting and the datasource will verify.

This can also work between ColdFusion versions. For example, ColdFusion MX 7 used neo-query.xml, and ColdFusion 8 restructured the file into neo-drivers.xml and neo-datasource.xml, but the encryption remained the same. You can copy the encrypted form of the password from a CF7 server and paste it into a CF8 or CF9 datasource config file.

This is a bit of a hack, but it does work.

 


Comments

Incidentally, the reason I know this works is because I used it during a company meeting on the first morning of the first day of my new job (last week). The definition of pressure is having a room full of new coworkers watch you as you try it out on a projection screen.


Unfortunately, I don't think this is going to work after 9.01. One of the security enhancement planned is to give each CF instance it's own seed/key for encryption. Meaning the encrypted value found in neo-query.xml will be different for each instance.

-Adam


That's good news! I wasn't sure this was going to work in the first place since I thought the encryption might be salted. The first thing I thought of was that this would make a good enhancement request.

There's legions of 'legacy' ColdFusion servers out there, so this blog entry may be useful for years to come.


On the bright side, I'm pretty confident you'll still be able to retrieve passwords using Wireshark to capture your unencrypted database connections.


You can also just read the encrypted password out of the 'edit DSN' HTML instead of digging around in the XML file. Save you a step.


Well it seems that if I copy lib/seed.properties, lib/neo-drivers.xml, and lib/neo-datasource.xml from one CF 901 instance to another instance (even on another OS platform) that the datasources will still verify from that second machine. So the trick still works, just more files to copy.


 

 

Calendar

 
Sun Mon Tue Wed Thu Fri Sat
    1 2 3 4 5
6 7 8 9 10 11 12
13 14 15 16 17 18 19
20 21 22 23 24 25 26
27 28 29 30 31    

Search This Site

 
This is an exact search only

topics

 
adobe blogging coldfusion computer technology events flex java learning linux mac os x macromedia meetup new england odds & ends outdoors personal photos photoshop science travel video

About This Site

 
Adobe Alumni & Community Professional. Expert in ColdFusion, Flex, LCDS, Photoshop, Lightroom. Linux RHCE. Follow Me!. For my photography check out Boston Portrait Photographer.

Speaker at CF.Objective(): Automated UI Testing with CFSelenium, MXUnit, ANT, and JenkinsCI

Adobe Community Professional (ACP)
Red Hat Linux Certified Engineer

Recent Entries

 
Automated System Testing for ..
Could not find ColdFusion com..
No April Fools: Selenium Ship..

Recent Comments

 
Posted By Steven Erat:
Jim, and anyone else that may attend, if you would like the full slide deck and my demo project files BEFORE the conference, please reply as a comment ...

Posted By Jim Priest:
Can't wait for this one!!

Posted By iPhone Repair:
It appears there are so many people have issue with their iPhone & iPod Touch screens dropped and cracked. It happened to me also when u haven't got a ...

recently played

 
Mr. Brightside
by The Killers
on Hot Fuss
Get Hot Fuss by The Killers on Amazon

now playing, a plug-in for itunes

Categories

 
RSS Adobe (34)
RSS Bicycling (9)
RSS Blogging (39)
RSS Books (13)
RSS Breeze (13)
RSS CFMX Podcasts (10)
RSS ColdFusion (437)
RSS Computer Technology (51)
RSS Events (26)
RSS Flex (20)
RSS Gadgets (11)
RSS HiTech Industry (16)
RSS Java (26)
RSS Learning (57)
RSS Linux (70)
RSS Mac OS X (23)
RSS Macromedia (27)
RSS Meetup (35)
RSS New England (62)
RSS Odds & Ends (25)
RSS Outdoors (32)
RSS Personal (29)
RSS Photos (111)
RSS Photoshop (29)
RSS Podcasts (18)
RSS Rants (19)
RSS Restaurants (8)
RSS Science (34)
RSS Spain (16)
RSS Travel (42)
RSS Twitter (10)
RSS Video (20)
RSS Webcam (3)
RSS Writing (10)

RSS

 


Add to Google
Add to My Yahoo!

Credits and Stuff

 
BlogCFC - Free ColdFusion Powered Blog Software


 
 
blog | photos | flickr | referers | webcam | stats | about | contact
 
Copyright © 2012 Steven Erat. All rights reserved.
This is a personal weblog. The opinions expressed here represent my own and not those of my employer