2. Windows To WebDAV A File Server Case Study John F. Hall IT-User Services, University of Delaware MARC ‘05 Copyright John F. Hall 2005. This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purpose according to the Creative Commons Attribution- NonCommercial License: http://creativecommons.org/licenses/by-nc/2.0/

3. Windows to WebDAV One Case WebDAV Implementation Comparisons Extending the Idea

4. UD

5. The PRESENT Omitted big photo of the PRESENT -- see http://www.udel.edu/present http://www.udel.edu/present

6. Our Servers NT4 File, Print, Web Split off Web Server to own box (Apache) Windows 2000

7. Resulting Server File Server Group Policies Roaming Profiles IPSec DDNS Print Server Kerberos/LDAP

8. 2004 Upgrade 2003

9. What is WebDAV? WebDAV

10. What is WebDAV? Web Distributed

11. What is WebDAV? Web Distributed Authoring

12. What is WebDAV? Web Distributed Authoring and Versioning

13. What is WebDAV? Extension to HTTP/1.1 protocol CGI HTTP/1.1 GET X X X X POST

14. WebA HTTP/1.1 has basic Authoring via PUT CGI HTTP/1.1 PUT X X X

15. WebDA HTTP/1.1 WebDAV PROPFIND PROPPATCH LOCK MKCOL COPY MOVE DELETE X X

16. WebDAV The Great American Book Chapter 1 It was long ago and far away that The Great American Novel Chapter 1 A long, long time ago in a far-off land there once was America: A Novell Chapter 1 It was quite some time ago in a far off land and Star Wars Episode 4 A long time ago, In a Galaxy Far, Far Away…

17. Implementation

18. Platform Dell PowerEdge 700 (CHEAP!) (x2) Fedora Core 2/3 (Free)* Apache 2 + SSL (Free)* *As in both Beer and Speech

19. Free Speech is More Important Than Free Beer* * Only in this Particular, Limited, Academic Case Study Examine source code Alter source code Recompile Share

20. Phasing In WebDAV Windows SMB Mount Read Only OLDNEW

21. Clients HTTP Clients (Browsers) MS Web Folders Apple’s “Go...” WebDrive ($30) Goliath Applications: Macromedia, Adobe, Microsoft

22. Apples and Oranges Apples and Oranges

23. What Did We Gain? Platform Independence Freedom (as in speech) Easier Administration Access from Anywhere Simpler / Quicker Disaster Recovery Knowledge of New Technology Performance for Big Files ??? Ability to Use Central Authentication

24. What Did We Lose? Services We Weren’t Using Security of a ‘Closed’ Network GUI

25. Count Vulnerabilities?

26. Reduced Attack Surface 135 139 445 53 88 464 389 636 LDAP Kerberos DNS File/Print 443Apache / SSL

27. Performance

28. Old Model F S O PassIPSec Internet

29. New Model F S O PassSSL Internet

30. User Accounts Windows SSID Apache WebDAV DATA SYSTEM C G CAS UUUU U U DB

31. How WebDAV Scales to the Enterprise Distributed departmental servers

32. ASP / Outsource

33. It might creep in with… CMS (WebCT) ePortfolio system (OSPI v. 2) Content Repository, etc. Beneath is all they’re all just web-based file servers… WebDAV May Creep In with Other Enterprise Systems…

34. Commercial Enterprise Solutions

35. References University of Delaware / PRESENT http://www.udel.edu/IR/fnf/profile/index.html http://www.udel.edu/present WebDav Protocol RFC 2518: WebDAV Distributed Authoring RFC 3253: WebDAV Versioning RFC 3744: Web Distributed Authoring and Versioning (WebDAV) Access Control Protocol”, IETF http://www.webdav.org WebDav Clients http://www.webdav.org/goliath SRT WebDrive - WebDAV Servers http://www.sharemation.com http://www.xythos.com http://www.webdav.org/mod_dav/ http://www.mac.com/1/iTour/tour_idisk.html http://www.webct.com/ http://www.theospi.org/ Security Metrics (Apples and Oranges) Howard, M., Pincus, J., Wing, J., “Measuring Relative Attack Surfaces” http://www.cs.cmu.edu/~wing/publications/Howard- Wing03.pdf Free as in Speech http://www.gnu.org/philosophy/free-sw.html CAS Authentication http://tp.its.yale.edu/tiki/tiki- index.php?page=CentralAuthenticationServicehttp://tp.its.yale.edu/tiki/tiki- index.php?page=CentralAuthenticationService Other http://www.webdav.org/deltav/WWW10/deltav- intro.htmhttp://www.webdav.org/deltav/WWW10/deltav- intro.htm http://www.webdav.org/catacomb