Securing Edit and Admin

Introduction

This document contains instructions on how to secure the UI folder (which contain the EPiServer editor and administration interfaces) and also how to ensure that the application will continue to work even if the UI folder is moved to a new location.

Securing the UI Folder

EPiServer CMS allows relocation of the edit and admin folders and configurable HTTP ports, to make it harder for intruders to try to access sensitive resources. By default the edit and admin folders of EPiServer CMS are located in the program files folder on the machines C:\ drive and are linked with Virtual Path Providers. Secure edit/admin and its ports on a default installation of EPiServer CMS as follows:

Step 1: UI Folder

1. Change the uiUrl attribute of the siteSettings element in the web.config file. If you want to secure the UI folder on another port other to that the site is running on, add an absolute URL including a port other than 80 (or a port the applicaiton is running on) as shown below:
   
   
   uiUrl="~/newuipath/"

     or:

   uiUrl="http://localhost:8888/newuipath/"
2.  Change the UI provider virtualpath attribute from the previous value for example. "~/UI" to "~/newuipath".
   
   
   <add name="UI" virtualPath="~/newuipath/" physicalPath="C:\Program Files\EPiServer\CMS\6.0.530.0\application\UI" type="EPiServer.Web.Hosting.VirtualPathNonUnifiedProvider, EPiServer.Framework" />
3. Change the location element path attribute from UI to newuipath see below for an example:
   
   <location path="newuipath">
4. Change the location element path attribute from UI/admin to newuipath/admin.
    
   
   <location path="newuipath/admin">
5. Add a specially designated (and restricted) port for access in the Internet Information Services (IIS) for the site (used for the UI folder in the step 1 above, port 8888 is used for uiUrl). Access to this port could then be restricted. (This step can be omitted if you only want to change the folders).
    
   
6. The default location ui folder contains the following admin and edit folders:

   /ui	C:\[Program Files]\EPiServer\CMS\[Version]\Application\UI

Step 2: SSL

Using SSL (Secure Sockets Layer) to secure the website and/or UI folder is possible, see the information in the following links:

• http://learn.iis.net/page.aspx/144/how-to-setup-ssl-on-iis-7/
• http://support.microsoft.com/kb/299875