25

I have 2 servers:

  1. Content Delivery - the live site pointing to the web database.
  2. Content Management - the internal only site pointing to the master database.

I want to prevent access to /sitecore on the live site, and require Content Editors to access this from the Content Management server.

How can I lock this down to prevent access from the Content Delivery server?

Improve this question

5 Answers 5

Reset to default
32

There are several pieces of documentation that are available for this:

First is https://doc.sitecore.net/sitecore_experience_platform/setting_up__maintaining/security_hardening

This contains a collection of documents relevant to your version of Sitecore.

Second is The Security Hardening Guide which is the defacto guide for locking down and securing a Content Delivery server.

Last, part of the process of locking down a content delivery server is removing all references to the master database. There is a config SwitchMastertoWeb.config.disabled that should be included somewhere in your config solution. Rename that to SwitchMasterToWeb.config and that will remove master from the server references.

Improve this answer
1
29

While the above answers are correct; you should concern yourself with more than just restricting access to the /sitecore folder - there is a very quick and easy way to achieve what you are specifically asking for.

Go to "Request Filtering" on your site in IIS.

enter image description here

Add "sitecore" as a hidden segment.

enter image description here

You have now effectively blocked access to the /sitecore folder. I use this option a lot, because it's quick to toggle on and off. In many real life situations, it is helpful for debugging purposes to be able to access /sitecore on a CD box - so I toggle this while debugging, then blocking it when I'm done.

Improve this answer
6
  • What benefit does accessing /sitecore on a CD box provide? How is that different from just switching to the web db in the administrative console?
    – Kyle Trauberman
    Commented Sep 27, 2016 at 18:09
  • 1
    You have access to the tools. Cache statistics (and cache clearing), and ShowConfig - are the two I use the most.
    – Mark Cassidy ♦
    Commented Sep 27, 2016 at 18:10
  • 2
    Doesn't this create issues if you are using WFFM?
    – nickwesselman
    Commented Sep 28, 2016 at 15:18
  • 1
    Could be. Modules should not reference /sitecore though, that's what /sitecore modules is for
    – Mark Cassidy ♦
    Commented Sep 28, 2016 at 15:32
  • 2
    Would give you trouble if you would be using EXM at one point. EXM files are placed in Sitecore root folder.
    – Anders Gjelstrup
    Commented Oct 5, 2016 at 13:24
14

We do this using an IIS Rewrite Rule like so:

<rule name="Block Sitecore Access Rule" stopProcessing="true" xdt:Transform="Insert">
    <match url=".*" />
    <conditions>
        <add input="{URL}" pattern="^/sitecore/?.*" />
        <add input="{URL}" pattern="^/sitecore/service/?.*" negate="true" />
    </conditions>
    <action type="CustomResponse" statusCode="404" statusReason="File or directory not found." statusDescription="The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable." />
</rule>

This is really nice as we can just toggle it on and off if needed and it's deployed in our web.config as part of our deployment package from our build server.

Improve this answer
1
  • 2
    it is an issue here. if you have WFFM ^/sitecore/?.* rule will block urls like ^/sitecore modules/*
    – Arbejdsglæde
    Commented Mar 26, 2018 at 14:45
4

You can disable anonymous access in IIS to some key folders as stated here: https://doc.sitecore.net/sitecore_experience_platform/setting_up__maintaining/security_hardening/configuring/deny_anonymous_users_access_to_a_folder

  • /sitecore/admin
  • /sitecore/debug
  • /sitecore/shell/WebService

It might be a good idea to check the complete security hardening guide. And the guide on how to setup a Content Delivery server (mostly disabling certain features that should not run on a CD).

Improve this answer
3

You have to restrict access to a few folders and files. you can do that by disabling anonymous access on IIS on the following folders /files as described here:

admin folder

login folder

shell folder

default.aspx page

The links shows you how to disabled that as well

Improve this answer
1
  • How do you restrict default.aspx page access?
    – Vincent
    Commented Nov 14, 2018 at 10:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.