0

Has anyone made Sitecore CM server publicly visible so that anyone can see the Sitecore login page?

My client wants to make content management available to external agencies (who are comfortable using Experience Editor). The CM server is on a private network and the use of IP based restriction, certificates, VPN have all been rejected.

If I follow all the Sitecore security recommendations (https://doc.sitecore.com/developers/90/platform-administration-and-architecture/en/securing-xm.html and https://doc.sitecore.com/developers/90/platform-administration-and-architecture/en/user-security.html) would it be sufficient to then put the server on the web?

Thanks

Improve this question
4
  • I work for a major client, that is very much into having maximum security everywhere in the solution, and their Sitecore login page is accessible to anyone. They haven't had any issues for the past 10 years, so I would guess the answer to your question is yes.
    – WulfgarDK
    Aug 12, 2019 at 9:42
  • Your site will be accessible by a crawler then, meaning google may eventually index your authoring site. Make sure you have your robots.txt updated to disallow crawling.
    – Phil
    Aug 13, 2019 at 22:24
  • @WulfgarDK thanks and I am going to go down this route as well.
    – S Prod
    Aug 16, 2019 at 8:15
  • Thanks for the pointers @Phil
    – S Prod
    Aug 16, 2019 at 8:15

2 Answers 2

Reset to default
0

I worked on multiple projects and one as a high profile client. Everyone CM of every environment is hosted on the web and it is exposed publicly.

So yes sure you can also host your Sitecore CM on the web. But to ensure the security of the CMS they have used the following approach where you can also implement the same.

  • First and foremost they have disabled the robots.txt file from CM server so that the page will not be crawled by the search engine or you can disallow all engine both are fine
  • They have also enabled the IIS Windows / NTLM authentication which provides the extra security on the accessing the Sitecore

These are the major changes we have made to secure our CM site which was hosted on the web and till now we haven't received any issues on that.

So yes sure you can also host your Sitecore CM on the web.

Improve this answer
3
  • Hey Gowtham, it's not possible to have IIS basic authentication on a CM server, is it? Won't it interfere with the login page forms authentication and cause an error? I am getting the following: [AccessDeniedException: Application access denied.] Sitecore.Diagnostics.Assert.HasAccess(Boolean accessAllowed, String message) +81 Sitecore.Shell.Applications.ShellForm.OnLoad(EventArgs e) +62 [TargetInvocationException: Exception has been thrown by the target of an invocation.] ...
    – S Prod
    Aug 16, 2019 at 13:34
  • Here is an article about it: sagepath.com/blogs/development/articles/…
    – S Prod
    Aug 16, 2019 at 13:39
  • Hai @SProd I intend to mention the Windows Authentication. I've corrected the answer. Kindle enable the Windows / NTLM auth for extra protection.
    – Gowthamaraja Eswaramoorthy
    Aug 16, 2019 at 15:11
0

I have worked on multiple implementations similar implementations, it is suggested to have multi-factor authentication when CM server opened without Ip restrictions.

A clean integration is on v9.2 with sitecore Identity server instance to manage the users cleanly.

https://doc.sitecore.com/developers/92/sitecore-experience-management/en/sitecore-identity.html which inturn uses OWIN and oData integration.

https://doc.sitecore.com/developers/92/sitecore-experience-management/en/use-the-sitecore-identity-server-as-a-federation-gateway.html

Quick thing could be an upgrade to Sitecore 9.2 and turn-around to Sitecore Identity Server.

Improve this answer
1
  • Thanks @yogi, for now I am on 9.0 so i'll harden the system and go with Gowtham's suggestion
    – S Prod
    Aug 16, 2019 at 8:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.