How to lockdown an Internet facing MOSS-based web site
Since posting my blog entry about recently launched MOSS-based web sites on the Internet, I’ve received several inquiries about how to lockdown this type of web site to prevent anonymous users from accessing pages in the /_layouts vdir or any of the Form pages. Fortunately, the answer along with a comprehensive set of security guidance was published several months ago on TechNet in the following article:
Plan security for an external anonymous access environment (Office SharePoint Server)
Updated: November 16, 2006
In this article:
Security guidance for an external anonymous access environment is targeted to allow anonymous access to content while protecting back-end servers in the farm from direct user access or malicious actions targeted through front-end Web servers. In an environment where multiple farms might be deployed to support authoring, staging, and publishing, the guidance for this environment is intended for the published farm (the farm that is anonymously accessed by users).
[Update (05/14/2007): Tyler provides a bit more explanation about the "lockdown feature" over on the ECM Team Blog.]
<Lawrence />
