83

The accepted answer is valid for previous version of Sitecore, but it does not reset the password salt and doesn't in fact reset the password to 'b'. In order to do this, you need the following script (which also will unlock the admin user if locked): UPDATE [aspnet_Membership] SET [Password]='qOvF8m8F2IcWMvfOBjJYHmfLABc=', [PasswordSalt]='...


49

Yes there is. Switch to your core database and execute the SQL below to reset the password to b: UPDATE [aspnet_Membership] SET Password='qOvF8m8F2IcWMvfOBjJYHmfLABc=' WHERE UserId IN (SELECT UserId FROM [aspnet_Users] WHERE UserName = 'sitecore\Admin') Alternatively navigate to /sitecore/admin/unlock_admin.aspx and click Unlock Administrator. For this ...


31

There are several pieces of documentation that are available for this: First is https://doc.sitecore.net/sitecore_experience_platform/setting_up__maintaining/security_hardening This contains a collection of documents relevant to your version of Sitecore. Second is The Security Hardening Guide which is the defacto guide for locking down and securing a ...


26

While the above answers are correct; you should concern yourself with more than just restricting access to the /sitecore folder - there is a very quick and easy way to achieve what you are specifically asking for. Go to "Request Filtering" on your site in IIS. Add "sitecore" as a hidden segment. You have now effectively blocked access to the /sitecore ...


21

Unlock_Admin doesn't work when you will decide to change your password encryption from SHA1 into SHA512 (regarding to Sitecore recommendations). It does NOT reset password for Sitecore admin - it just unlock the Sitecore account - as the name of method says. Here you have got a code of this method: public override bool UnlockUser(string username) { this....


21

It was I that changed the default password to 'b', but it wasn't the result of a great meaningful insight, clever security considerations or a joke. Truth is I was implementing the Change Password dialog and was flipping between 'a' and 'b'. The dialog happened to work when I was on 'b', and the 'b' password remained in the product. I think this was in CMS ...


18

If you have direct access to the database, you can run the following from SQL Management Studio: UPDATE aspnet_Membership SET IsLockedOut = 0, FailedPasswordAttemptCount = 0 WHERE UserId IN (SELECT UserId FROM aspnet_Users WHERE UserName = 'sitecore\Admin') Run this from the Core database.


18

Editing the domains through the Domain Manager tool will cause \App_Config\Security\Domains.config to be updated with the added details. If you are updating this tool then make sure you include this in your project or copy it across to the other environments. Unfortunately, the domains node is not patchable with Sitecore config overrides since it sits ...


15

This will be natively supported in Sitecore 9.0, according to the public roadmaps. For now a solution might be to use this module: https://github.com/BasLijten/SitecoreFederatedLogin See my blog on how to achieve this with Sitecore 9.0: https://blog.baslijten.com/enable-federated-authentication-and-configure-auth0-as-an-identity-provider-in-sitecore-9-0/ I ...


15

Update: Currently WAF is supported in diagnostic mode only for v8.2 and 9.0 In version 9.1 WAF is supported for the CD servers. More information can be found here: https://doc.sitecore.com/developers/91/sitecore-experience-management/en/using-application-gateway-to-secure-your-content-delivery-server.html Below are the list of OWASP rules that are ...


13

We do this using an IIS Rewrite Rule like so: <rule name="Block Sitecore Access Rule" stopProcessing="true" xdt:Transform="Insert"> <match url=".*" /> <conditions> <add input="{URL}" pattern="^/sitecore/?.*" /> <add input="{URL}" pattern="^/sitecore/service/?.*" negate="true" /> </conditions> ...


13

After a nice weekend of trial-and-error with the help of DotPeek, here is what I've come up with. This should be a complete example for use after installing the Active Directory module (using version 1.3 with Sitecore 8.2). With the following code you should now be able to patch domains required when using switchingProviders as well as add domains through ...


13

The issue here turned out to be the Sitecore.Services.SecurityPolicy setting. By default it only allows local requests to the API and as I have more servers in the mix and a load balancer on Staging I needed to allow remote requests with a patch file like so: <settings> <setting name="Sitecore.Services.SecurityPolicy"> <patch:...


12

Update: I have removed technical details about the vulnerability, since it is still present on many Sitecore installations world-wide. The Quick-and-Dirty fix If you want to remove the vulnerability quickly and without restarting your Sitecore instances, just delete PushSession.ashx—it's used very rarely anyway, and only in multi-cluster setups. You can ...


11

The code you have posted will always return true by the nature of how Sitecore security works. If SelectItems() returns an item, that means the Sitecore.Context.User can read it. If the current user did not have access to the item, it would return null. So you have options depending on your use case. If you just want to restrict the current context users ...


11

If you are using Sitecore 8.1 Update-2 or newer then there is a new Security Tools admin page that can be found at /sitecore/admin/SecurityTools.aspx. The Reset User Password wil allow you to reset a users password without first having to generate a random password first. You can find more details about this (and other new admin pages) in this blog post. ...


11

You can use the Domain Manager within Sitecore to create new security domains. From the Sitecore Desktop: Start > Security Tools > Domain Manager From there, you can setup your Sitecore Roles specifing your new domains, then assign users to the Domain Role.


11

Check if Version 2 of your item in "final" workflow state. This is not an error. This is a functionality of Sitecore. When the current item version you are working on does not satisfy the requirement to publish (ex: item version is not in the final workflow state, item version is set to never publish, item version have publish time set, etc), this warning ...


11

Yes, this is one of the recommended approaches to prevent clickjacking, and adding the X-frame-options header is one of the required steps. After making the changes to the web.config, you should see that X-frame-options should be present in the response headers. You should also ensure that relevant Content Security Policy headers have also been set. ...


10

There is also an admin page: URL: http://www.yoursite.com/sitecore/admin/unlock_admin.aspx By default, it's disabled so you need to edit the aspx file to set enableUnlockButton to true.


10

In addition to the answer above, if you have the misery of forgetting the Sitecore password then this will save you: UPDATE [aspnet_Membership] SET [Password]='qOvF8m8F2IcWMvfOBjJYHmfLABc=', [PasswordSalt]='OM5gu45RQuJ76itRvkSPFw==', [IsApproved] = '1', [IsLockedOut] = '0' WHERE UserId IN (SELECT UserId FROM dbo.aspnet_Users WHERE UserName = 'sitecore\...


10

You can remove access to /sitecore/templates/System/Layout/Rendering Parameters/Standard Rendering Parameters/Caching Navigate to the item Open Security tab Click on Assign button In the dialog which will appear select user or group (preferably) from whom you would like to hide the section Remove the inheritance for the item and its descendats


10

You can set this in the web.config. In your membership section. You can set a password strength regular expression. <add name="sql" type="System.Web.Security.SqlMembershipProvider" connectionStringName="core" applicationName="sitecore" minRequiredPasswordLength="8" minRequiredNonalphanumericCharacters="1" ...


10

It usually means that a Url for a media asset is missing the Hash query string parameter when being called. This was introduced in v7.5. It attempts to fix an image resize vunerability where you could potentially fill a disk with different image sizes. If you use a FieldRenderer you will get a valid url with the Hash query string appended. If you just ...


10

As you can't get the old password, you should use the reset functionality: var user = System.Web.Security.Membership.GetUser(@"domain\username") string oldPassword = user.ResetPassword(); user.ChangePassword(oldPassword, newPassword); To change the password, you need to work with the Membership user. But as Dražen mentioned, you can get use the Name ...


10

It might. There is a company claiming to have an option for it, but there is no direct download link and no way to easily verify the claim. https://www.ssoeasy.com/sitecore-sso/ That said; you might be better off, going through something like Gigya. Not only will you get SAML, but Gigya opens up for a host of other authentication modes and options. And ...


9

It seems I was very close with overriding Sitecore's FormsAuthenticationProvider. With our first attempt we could successfully prevent cookie replay attacks, but we were unable to access the Sitecore backend! Only GetActiceUser() is called when signing in to the Sitecore backend, the other methods not at all. So, on recommendation of Sitecore Support, we ...


9

The Problem The problem is that the "Deny" access right trumps the "Grant" access right. For this reason, if neither the "Deny" or "Grant" have been applied, then the "Deny" access right is assumed. It is only in this case (i.e. no access right explicitly assigned) that subsequently applying the "Grant" access right will trump the "Deny" access right. In ...


9

You need to change the domain attribute of the login site node in configuration, by default it is "sitecore": <configuration xmlns:set="http://www.sitecore.net/xmlconfig/set/"> <sitecore> <sites> <site name="login" set:domain="powerful" /> </sites> </sitecore> </configuration> As you say, you can ...


9

Exclude everything in the /Data folder except for packages folder. The packages folder is the only folder that an external user could upload data to.


Only top voted, non community-wiki answers of a minimum length are eligible