3

In the security hardening directions for 8.2 on denying anonymous access the screen shots all show having all access disabled for the /sitecore/admin folder and others.

The question is, those screen shots are from 8.2 initial, I'm guessing, because sometime during the updates (definitely by Update 3) Sitecore made the authentication mode Forms out of the box instead of None like it used to be. The result is that /sitecore/admin shows Forms Authentication enabled now, and the only way to change it is to change it in the web.config (you can't change it at just the /sitecore/admin level).

Should changing the authentication mode to None be done on CDs as part of security hardening as well, or is just setting the anonymous access to Disabled sufficient and Sitecore needs to update their screen shots appropriately?

  • I would think we could just create a transformed web.config in the /sitecore/admin/ and turn authentication back to none. I personally prefer to use IP whitelisting on my production admin folder. That lets my internal IPs see the admin sites for debugging purposes. – Chris Auer Jul 7 '17 at 12:39
  • The IP whitelisting's an interesting idea. This actually came up because in IIS, if you go to authentication, it says the value for Forms Auth is locked and read-only anywhere but the top level. I don't think it's intended to be changed in sub-folders unless you designate that folder as an application in IIS. I just wonder why Sitecore made that change. – Ken McAndrew Jul 7 '17 at 14:45
  • The change happened between versions 161221 and 170407. There was only one web.config change and it was the authentication. – Chris Auer Jul 7 '17 at 15:07
2

Let me start by saying that I don't think that there is going to be any one right or wrong answer to this question, but rather that this question will (and should) receive a lot of good opinion-based answers.

Using IP Restrictions Instead of Disabling Access

IMHO, the authentication mode should be left as-is and instead of following Sitecore's documentation at all, what you should do is use IP restrictions to block requests to the entire /sitecore folder from all locations except the IP of the server itself (for sake of the /KeepAlive.aspx, local access and so on), and the IP of the responsible party for maintaining the site (e.g. the development agency, client's IT department, development VPN, etc.).

Troubleshooting issues on CD environments can be a challenge, especially when log4net priorities are raised to make Sitecore only log ERRORS and access to admin pages like the Jobs Viewer and the Show Config are disabled. Moreover, issues on production CD environments tend to be of the highest priority, since they are on production and on the applications that the general public is hitting. By using IP restrictions to block access to all but those specifically authorized for access, you maintain the same level of security and performance while giving yourself more tools and visibility into the application at troubleshooting time.

If You Still Want to Disable Access...

If you do not want to use IP restrictions (due client security policies, or some other reason) and instead want to follow the guide and blanket-disable access to the /sitecore/admin section then my recommendation would be to change the web.config (preferably via a transform, as described by @ChrisAuer in his comment on the OP) to disable both Forms Authentication and Anonymous Access.

  • Interesting thoughts on the matter, Zachary. I agree, I think there will be different schools of thought here. This mainly came up because in IIS if you're running 8.2 Update 3 out of the box, if you go to /sitecore/admin and click on Forms Authentication to disable it, it says it's locked and read-only. Unless the folder is marked in IIS as an application, you can't change it except at the root. I'm curious as to why Sitecore went from None to Forms between 8.2 Initial and 8.2 Update 3 (somewhere in there)...maybe it's in the release notes. – Ken McAndrew Jul 7 '17 at 14:48
  • So I downloaded the config files for the upgrade process, it looks like Sitecore changed the authentication mode from None to Forms in 8.2 Update 3. But I don't see anything in the release notes saying they did that or why...some stuff about login redirect, but nothing explicit jumps off the page. – Ken McAndrew Jul 7 '17 at 14:54
  • I didn't see any release notes for that change either. From a security standpoint, if you do not want to use IP restrictions and instead want to follow the guide and disable access to the admin section and below, I have updated my answer with my recommendation for that, as well. – Zachary Kniebel Jul 7 '17 at 15:07
1

I'd like to second what Zachary has mentioned about using IP restrictions instead of authorisation.

Here's the solution I use to lock down /sitecore on a CD.

IIS Configuration

  • Install "IP and Domain Restrictions" IIS feature
  • Enable feature delegation for aforementioned feature
    • If you don't do this, IIS will complain and your site will throw a 500. By default you can't override the <ipSecurity> node in your Web.config. A lot of "word on the street" will tell you to modify the applicationHost.config file, I found this didn't work in our instance.

Web.config

<configuration>
    <location path="sitecore">
        <system.webServer>
            <httpErrors errorMode="DetailedLocalOnly">
                <remove statusCode="404" subStatusCode="-1" />
                <error statusCode="404" prefixLanguageFilePath="" path="/404" responseMode="ExecuteURL" />
            </httpErrors>
            <security>
                <ipSecurity allowUnlisted="false" denyAction="NotFound">
                    <clear/>
                    <add ipAddress="127.0.0.1" allowed="true"/>
                </ipSecurity>
            </security>
        </system.webServer>
    </location>
</configuration>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.