We want to lock down a Sitecore install when hitting it from the web with Windows Authentication to avoid brute force style attacks and to add a second layer of security on the web interfaces. Particularly on the /login and /shell folders.
By simply turning Windows Authentication on for those folders and disabling Anonymous Authentication, we do seem to be able to get it working. However, we use the Hedgehog Sitecore Package Deployer as part of the deploy process. It appears to be breaking and causing unexpected behaviour as a result of the security changes, which is indicative of a greater permissions issue, meaning that clearly there is more setup we need to do to allow backend tasks / processes to run properly.
We are currently working on implementing the following solutions:
- Configuring subdirectory authentication mode in applications hosted under root site
- Windows Authentication for Sitecore
However, a more concise answer for how to properly tackle this in Sitecore 8.2 would be appreciated. Cheers.