23

I have 2 servers:

  1. Content Delivery - the live site pointing to the web database.
  2. Content Management - the internal only site pointing to the master database.

I want to prevent access to /sitecore on the live site, and require Content Editors to access this from the Content Management server.

How can I lock this down to prevent access from the Content Delivery server?

31

There are several pieces of documentation that are available for this:

First is https://doc.sitecore.net/sitecore_experience_platform/setting_up__maintaining/security_hardening

This contains a collection of documents relevant to your version of Sitecore.

Second is The Security Hardening Guide which is the defacto guide for locking down and securing a Content Delivery server.

Last, part of the process of locking down a content delivery server is removing all references to the master database. There is a config SwitchMastertoWeb.config.disabled that should be included somewhere in your config solution. Rename that to SwitchMasterToWeb.config and that will remove master from the server references.

26

While the above answers are correct; you should concern yourself with more than just restricting access to the /sitecore folder - there is a very quick and easy way to achieve what you are specifically asking for.

Go to "Request Filtering" on your site in IIS.

enter image description here

Add "sitecore" as a hidden segment.

enter image description here

You have now effectively blocked access to the /sitecore folder. I use this option a lot, because it's quick to toggle on and off. In many real life situations, it is helpful for debugging purposes to be able to access /sitecore on a CD box - so I toggle this while debugging, then blocking it when I'm done.

  • What benefit does accessing /sitecore on a CD box provide? How is that different from just switching to the web db in the administrative console? – Kyle Trauberman Sep 27 '16 at 18:09
  • You have access to the tools. Cache statistics (and cache clearing), and ShowConfig - are the two I use the most. – Mark Cassidy Sep 27 '16 at 18:10
  • 1
    Doesn't this create issues if you are using WFFM? – techphoria414 Sep 28 '16 at 15:18
  • 1
    Could be. Modules should not reference /sitecore though, that's what /sitecore modules is for – Mark Cassidy Sep 28 '16 at 15:32
  • 2
    Would give you trouble if you would be using EXM at one point. EXM files are placed in Sitecore root folder. – Anders Gjelstrup Oct 5 '16 at 13:24
14

We do this using an IIS Rewrite Rule like so:

<rule name="Block Sitecore Access Rule" stopProcessing="true" xdt:Transform="Insert">
    <match url=".*" />
    <conditions>
        <add input="{URL}" pattern="^/sitecore/?.*" />
        <add input="{URL}" pattern="^/sitecore/service/?.*" negate="true" />
    </conditions>
    <action type="CustomResponse" statusCode="404" statusReason="File or directory not found." statusDescription="The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable." />
</rule>

This is really nice as we can just toggle it on and off if needed and it's deployed in our web.config as part of our deployment package from our build server.

  • 2
    it is an issue here. if you have WFFM ^/sitecore/?.* rule will block urls like ^/sitecore modules/* – Arbejdsglæde Mar 26 '18 at 14:45
4

You can disable anonymous access in IIS to some key folders as stated here: https://doc.sitecore.net/sitecore_experience_platform/setting_up__maintaining/security_hardening/configuring/deny_anonymous_users_access_to_a_folder

  • /sitecore/admin
  • /sitecore/debug
  • /sitecore/shell/WebService

It might be a good idea to check the complete security hardening guide. And the guide on how to setup a Content Delivery server (mostly disabling certain features that should not run on a CD).

3

You have to restrict access to a few folders and files. you can do that by disabling anonymous access on IIS on the following folders /files as described here:

admin folder

login folder

shell folder

default.aspx page

The links shows you how to disabled that as well

  • How do you restrict default.aspx page access? – Vincent Nov 14 '18 at 10:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.