4

I have a CD/CM site which I hardened by restricting access to Sitecore by adding "sitecore" to the Hidden Segments in the Request Filtering section in IIS (second answer here). However, this has blocked access to /sitecore/service/keepalive.aspx, and I am getting errors logged every time the keepalive service runs.

Is there a way to block the entire sitecore folder on CD except for sitecore/services? I expect I could add each subfolder to the Hidden Segments but I'm not sure if there's a better solution.

  • The other answer is similar to what we use, an IIS Rewrite rule which negates the service folder acess (i.e. still allows request access to items in that folder) – jammykam Dec 19 '18 at 20:22
4

I'm not aware of a way to do what you are asking because deny permissions are always stronger than grant permissions, so the instruction to deny access to /sitecore/* would beat the instruction to grant access to /sitecore/service/keepalive.aspx.

Instead, I would recommend following Sitecore's Security Hardening Guide (section 1.5):

To restrict access to the client interfaces, we recommend that you implement IP-based security restrictions or disable Anonymous IIS access to the /sitecore/admin, /sitecore/login, /sitecore/shell folders and to the /sitecore/default.aspx page.

Also related (from the same section):

The /sitecore/service folder should be excluded from the IIS restrictions because it contains a number of service ASPX pages that are used by Sitecore to report various conditions that can occur in the application, such as, 404 Page Not Found or 403 Forbidden to the web client.

However, you can move the files from the /sitecore/service folder to the /sitecore folder. If you move the files, you must also update the following settings in the web.config file:

  • ErrorPage
  • NoAccessUrl
  • NoLicenseUrl
  • LayoutNotFoundUrl
  • ItemNotFoundUrl
  • LinkItemNotFoundUrl
  • 1
    Yup, I've always preferred IP-based security restrictions as well since you can then access the Sitecore files from specific IP addresses if you need to check ShowConfig.aspx or something similar. – Jason St-Cyr Dec 19 '18 at 23:30
1

You can also handle that with authorization in web.config:

<!-- Deny users access to internal paths -->
<location path="sitecore">
    <system.web>
        <authorization>
            <deny users="*"/>
        </authorization>
    </system.web>
</location>
<location path="xsl">
    <system.web>
        <authorization>
            <deny users="*"/>
        </authorization>
    </system.web>
</location>
<location path="sitecore modules">
    <system.web>
        <authorization>
            <deny users="*"/>
        </authorization>
    </system.web>
</location>
<location path="sitecore/service">
    <system.web>
        <authorization>
            <allow users="*"/>
            <!--heartbeat, keepalive, ect. must be accessible-->
        </authorization>
    </system.web>
</location>
<location path="sitecore/shell/Webservice/Service.asmx">
    <system.web>
        <authorization>
            <allow users="*"/>
            <!--allow webservice-->
        </authorization>
    </system.web>
</location>

Best regards Dirk

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.