Is it possible to lock down the _vti_bin and _layouts pages with a wildcard option.

Question

Hi all,
A client of mine is running an internet facing sharepoint site. I have managed to lock down the _vti_bin and _layouts pages users for anonymous by using the following entries in my main web.config file:
<location path="_layouts">
      <system.web>
        <authorization>
          <deny users="?" />
        </authorization>
      </system.web>
    </location>
and
<location path="_vti_bin">
      <system.web>
        <authorization>
          <deny users="?" />
        </authorization>
      </system.web>
    </location>
But this is only ok for the root site collection. Is there a way to lock down all site collections, including sub sites with a type of wildcard entry?
Due to the nature of the clients business, they will be creating many site collections and subsites. I am trying to find a scalable way to manage this. To add an entry for every new site collection or subsite that gets created on the fly does not seem like
the most manageable solution.
Any suggestions would be appreciated.
Regards
Mirco

Answer 1

Hi Sachin,
Thank You very much for the feedback. The info to secure system pages from authenticated FBA users is very helpful and I will definitely  implement it.  With reference to your second post. This is actually the information I used to lock down my
sites from anonymous users. Applying this method I noticed that you needed to put an entry for every single site collection and sub site collection, e.g. if I ONLY had a site collection at
https://me.myserver.com then the following entries in the web.config would secure the _vti_bin and _layouts folder from anonymous users:
<location path="_layouts">
      <system.web>
        <authorization>
          <deny users="?" />
        </authorization>
      </system.web>
    </location>
and
<location path="_vti_bin">
      <system.web>
        <authorization>
          <deny users="?" />
        </authorization>
      </system.web>
    </location>
But lets say I added another site collection at
https://me.myserver.com/sites/mysitecollection I would have to add the following entries to the web.config file to secure it from anonymous users:
<location path="sites/mysitecollection/_layouts">
      <system.web>
        <authorization>
          <deny users="?" />
        </authorization>
      </system.web>
    </location>
and
<location path="sites/mysitecollection/_vti_bin">
      <system.web>
        <authorization>
          <deny users="?" />
        </authorization>
      </system.web>
    </location>
Now this method might be manageable if you are only gonna have 5 or 10 site or subsite collections. My client will have 30, 40, 50, who knows how many. This is why I am trying to find a more manageable way of locking these sites down.
You can imagine what my web.config will look like eventually and the admin involved in continuously adding these entries to the web.config file to keep it safe from anonymous users.
Regards
Mirco