1. September 2003 SIGUCCS ‘03 Paper # 62 WebDAV: What It Is, What It Does, Why You Need It by Luis O. Hernández Mahmoud Pegah

2. September 2003 The WebDAV Session Explain WebDAV Explain WebDAV Demonstrate the use of WebDAV in both Windows and Apple systems Demonstrate the use of WebDAV in both Windows and Apple systems Share Ringling School’s framework Share Ringling School’s framework Address issues that Ringling School has experienced with WebDAV Address issues that Ringling School has experienced with WebDAV Propose suggestions that could make WebDAV stronger and more usable Propose suggestions that could make WebDAV stronger and more usable

3. September 2003 WebDAV: What Is It? WebDAV: Web Distributed Authoring and Versioning WebDAV: Web Distributed Authoring and Versioning Allows web development teams and other workgroups to share files Allows web development teams and other workgroups to share files Allows easy setup for administrators and ease of use for users Allows easy setup for administrators and ease of use for users

4. September 2003 Distribution, Installation, and Configuration

5. September 2003 WebDAV: Distribution Used Apache v1.3.27 Apache v1.3.27 WebDAV module v1.3.6 WebDAV module v1.3.6 LDAP module v2.3 LDAP module v2.3 Netscape LDAP v4.1 Netscape LDAP v4.1

6. September 2003 WebDAV: Installation Include the WebDAV and LDAP module with the Apache installation during configuration: Include the WebDAV and LDAP module with the Apache installation during configuration: # Apache web server configure command./configure \ --prefix=/local/apache_1.3.27 \ --enable-module=proxy \ --activate-module=src/modules/dav/libdav.a \ --activate-module=src/modules/ldap/mod_auth_ldap.c

7. September 2003 WebDAV: Configuration (Part 1) You do not need to do anything to the Apache configuration until you require LDAP support: # Enable WebDAV support Addmodule mod_dav.c DAVLockDB /local/apache/var/DAVLock You do not need to do anything to the Apache configuration until you require LDAP support: # Enable WebDAV support Addmodule mod_dav.c DAVLockDB /local/apache/var/DAVLock

8. September 2003 WebDAV: Configuration (Part 2) Two configuration options for authentication mechanisms: Two configuration options for authentication mechanisms: WebDAV with standard htpasswd support WebDAV with standard htpasswd support WebDAV with LDAP support WebDAV with LDAP support

9. September 2003 WebDAV: Configuration (Part 3) Simple configuration within a directory enables WebDAV support: Simple configuration within a directory enables WebDAV support: # WebDAV folder for a Project DAV On #RSADShareDAVOwnerUID [owneruid] #RSADShareDAVSize [Quota in MB] AllowOverride None AuthName "[Project Title]" AuthType Basic AuthUserFile [/.hiddenFolder/.hiddenFile] Require user [user names] Order Deny,Allow Deny from all Allow from trusteddomain.com

10. September 2003 WebDAV: Configuration (Part 4) Simple WebDAV Configuration Simple WebDAV Configuration Web Server Mac OS X Clients Windows Clients Other Clients

11. September 2003 WebDAV: Configuration (Part 5) WebDAV configuration with LDAP support WebDAV configuration with LDAP support # WebDAV folder for a Project DAV On #RSADShareDAVOwnerUID [owneruid] #RSADShareDAVSize [Quota in MB] AllowOverride None AuthName "[Project Title]" AuthType Basic Require user [user names] Order Deny,Allow Deny from all Allow from trusteddomain.com LDAP_Server ldap.yourdomain.com LDAP_Port 389 Base_DN "[BaseDN]" UID_Attr uid

12. September 2003 WebDAV: Configuration (Part 6) WebDAV configuration with LDAP support for user authentication WebDAV configuration with LDAP support for user authentication Web Server Mac OS X Clients Windows Clients Other Clients LDAP Server

13. September 2003 WebDAV: Configuration (Part 7) User files are available through the Internet. Unless user publishes a website, s/he may want to prevent Internet access to those files. To do that, include the “GET” and “POST” attributes in the “Limit” directive. User files are available through the Internet. Unless user publishes a website, s/he may want to prevent Internet access to those files. To do that, include the “GET” and “POST” attributes in the “Limit” directive.

14. September 2003 WebDAV: Other Distributions Servers Servers Internet Information Server Internet Information Server Mac OS X Server Mac OS X Server Neon Web Server v0.23.9, open source Neon Web Server v0.23.9, open source

15. September 2003 WebDAV: Other Distributions Clients Clients Microsoft Windows 2000 and up Microsoft Windows 2000 and up Mac OS X Mac OS X GNOME Nautilus GNOME Nautilus KDE KDE Goliath (Mac OS 9) Goliath (Mac OS 9) Java DAV Explorer for JVM Java DAV Explorer for JVM Cadaver for UNIX terminals Cadaver for UNIX terminals

16. September 2003 WebDAV: Other Distributions Additional Client Distributions Additional Client Distributions jEdit WebDAV plugin for Jedit text-editing application jEdit WebDAV plugin for Jedit text-editing application Eldav for Emacs Eldav for Emacs APIs APIs PerlDAV PerlDAV PythonDAV PythonDAV File-system driver File-system driver DAVfs for Linux DAVfs for Linux

17. September 2003 How to Connect to a Web Share

18. September 2003 WebDAV: Connect from Windows Depends on the version Depends on the version

19. September 2003 WebDAV: Connect from Apple Click on the Desktop Click on the Desktop Press Command Key + K Press Command Key + K Enter the share address and your credentials when prompted Enter the share address and your credentials when prompted

20. September 2003 WebDAV: Monitoring the Shares Ringling School created custom monitoring tools to check for quota usage on each share Ringling School created custom monitoring tools to check for quota usage on each share The following attributes were added to the WebDAV Apache configuration for the custom tool: The following attributes were added to the WebDAV Apache configuration for the custom tool: RSADShareDAVOwnerUID (user name) RSADShareDAVOwnerUID (user name) RSADShareDAVSize (MB) RSADShareDAVSize (MB) Scripts are available at http://www.rsad.edu/~lhernand/webdav Scripts are available at http://www.rsad.edu/~lhernand/webdav

21. September 2003 Security

22. WebDAV: Authentication WebDAV authentication is sent in clear text WebDAV authentication is sent in clear text For security purposes, allow only campus connections to the shares For security purposes, allow only campus connections to the shares Apple will enable encrypted connections to WebDAV shares from their upcoming OS, Panther Apple will enable encrypted connections to WebDAV shares from their upcoming OS, Panther

23. September 2003 WebDAV: DoS Attacks Multiple users could create a DoS situation if they upload large files at the same time Multiple users could create a DoS situation if they upload large files at the same time An increase in server memory and an increase in Apache processes should diminish the probability of DoS An increase in server memory and an increase in Apache processes should diminish the probability of DoS

24. September 2003 WebDAV: Module Signature All Apache modules, including WebDAV, are identified in the server signature All Apache modules, including WebDAV, are identified in the server signature NetCraft.net provides information about any server on the Internet NetCraft.net provides information about any server on the Internet Malicious intruders can use the server signature to find vulnerabilities in the system Malicious intruders can use the server signature to find vulnerabilities in the system

25. September 2003 Lessons Learned No Quota System Single Authoritative User Replication

26. September 2003 WebDAV: No Quota System Custom monitoring tools necessary to enforce quota usage Custom monitoring tools necessary to enforce quota usage Tools report quota breach to administrator Tools report quota breach to administrator Tools available at http://www.rsad.edu/~lhernand/webdav Tools available at http://www.rsad.edu/~lhernand/webdav

27. September 2003 WebDAV: Single Authoritative User A typical install of Apache does not allow for changing the running user identification A typical install of Apache does not allow for changing the running user identification Apache can be installed to allow for changing the running user identification, but then it must also run as root, which is in itself a security vulnerability Apache can be installed to allow for changing the running user identification, but then it must also run as root, which is in itself a security vulnerability All web shares are owned by one user who also owns Apache running processes All web shares are owned by one user who also owns Apache running processes Users can overwrite each other’s files in a share Users can overwrite each other’s files in a share

28. September 2003 WebDAV: Replication Apache v1.3.27 Apache v1.3.27 WebDAV module v1.3.6 WebDAV module v1.3.6 LDAP module v2.3 LDAP module v2.3 Netscape LDAP v4.1 Netscape LDAP v4.1 Solaris 8 Solaris 8 SunFire 280R, 2GB memory SunFire 280R, 2GB memory

29. September 2003 Helpful Suggestions Directory Quotas Quota Attributes Apache SetUID WebDAV Support in NAS Devices

30. September 2003 WebDAV: Directory Quotas Some software vendors (Novell) already support directory quotas Some software vendors (Novell) already support directory quotas No open source solution yet available No open source solution yet available Allows web shares to comply with quota limits with a single authoritative user Allows web shares to comply with quota limits with a single authoritative user

31. September 2003 WebDAV: Quota Attributes New attributes that work with the WebDAV module would alert users of quota breaches and would set quota limits New attributes that work with the WebDAV module would alert users of quota breaches and would set quota limits DAVDiskLimit – sets quota limit in MB DAVDiskLimit – sets quota limit in MB DAVOwner – email address of user DAVOwner – email address of user DAVAlertOn – alarm limit to alert owner DAVAlertOn – alarm limit to alert owner

32. September 2003 WebDAV: Apache SetUID Allow the WebDAV module to set the ownership of the running process so that it can act on behalf of authenticated users and not the process owner of the web server Allow the WebDAV module to set the ownership of the running process so that it can act on behalf of authenticated users and not the process owner of the web server Internet Draft, Quota and Size Properties for DAV Collections, explains properties and minor behaviors needed for clients to interoperate with quota implementations on web foloders Internet Draft, Quota and Size Properties for DAV Collections, explains properties and minor behaviors needed for clients to interoperate with quota implementations on web foloders

33. September 2003 WebDAV: Support in NAS Devices Network Appliance Servers support CIFS, NFS, HTTP, FTP, and NDMP, but not WebDAV Network Appliance Servers support CIFS, NFS, HTTP, FTP, and NDMP, but not WebDAV WebDAV support in NAS devices would be easy to implement since HTTP is already supported WebDAV support in NAS devices would be easy to implement since HTTP is already supported Administration of WebDAV enabled NAS devices would improve with a WebDAV “broker” Administration of WebDAV enabled NAS devices would improve with a WebDAV “broker”

34. September 2003 WebDAV: NAS WebDAV Broker Clients would connect to the WebDAV broker instead of the NAS devices Clients would connect to the WebDAV broker instead of the NAS devices The WebDAV broker would be responsible for authenticating the users with an LDAP server The WebDAV broker would be responsible for authenticating the users with an LDAP server NAS WebServer LDAP Server Other Clients Windows Clients Mac OS X Clients

35. September 2003 WebDAV: NAS WebDAV Broker After authentication, the broker would send a list of available shares to the client After authentication, the broker would send a list of available shares to the client The client then connects to the NAS devices directly The client then connects to the NAS devices directly NAS Other Clients Windows Clients Mac OS X Clients

36. September 2003 WebDAV: Announcing a New Service! Service initially released with a minimal amount of users Service initially released with a minimal amount of users Faculty learns of web share availability with introduction to IT upon employment Faculty learns of web share availability with introduction to IT upon employment Online tutorials available at http://www.it.rsad.edu Online tutorials available at http://www.it.rsad.edu Students have been helpful in spreading the word Students have been helpful in spreading the word

37. September 2003 Thank You!