September 2003 SIGUCCS ‘03 Paper # 62 WebDAV: What It Is, What It Does, Why You Need It by Luis O. Hernández Mahmoud Pegah

September 2003 The WebDAV Session Explain WebDAV Explain WebDAV Demonstrate the use of WebDAV in both Windows and Apple systems Demonstrate the use of WebDAV in both Windows and Apple systems Share Ringling School’s framework Share Ringling School’s framework Address issues that Ringling School has experienced with WebDAV Address issues that Ringling School has experienced with WebDAV Propose suggestions that could make WebDAV stronger and more usable Propose suggestions that could make WebDAV stronger and more usable

September 2003 WebDAV: What Is It? WebDAV: Web Distributed Authoring and Versioning WebDAV: Web Distributed Authoring and Versioning Allows web development teams and other workgroups to share files Allows web development teams and other workgroups to share files Allows easy setup for administrators and ease of use for users Allows easy setup for administrators and ease of use for users

September 2003 Distribution, Installation, and Configuration

September 2003 WebDAV: Distribution Used Apache v Apache v WebDAV module v1.3.6 WebDAV module v1.3.6 LDAP module v2.3 LDAP module v2.3 Netscape LDAP v4.1 Netscape LDAP v4.1

September 2003 WebDAV: Installation Include the WebDAV and LDAP module with the Apache installation during configuration: Include the WebDAV and LDAP module with the Apache installation during configuration: # Apache web server configure command./configure \ --prefix=/local/apache_ \ --enable-module=proxy \ --activate-module=src/modules/dav/libdav.a \ --activate-module=src/modules/ldap/mod_auth_ldap.c

September 2003 WebDAV: Configuration (Part 1) You do not need to do anything to the Apache configuration until you require LDAP support: # Enable WebDAV support Addmodule mod_dav.c DAVLockDB /local/apache/var/DAVLock You do not need to do anything to the Apache configuration until you require LDAP support: # Enable WebDAV support Addmodule mod_dav.c DAVLockDB /local/apache/var/DAVLock

September 2003 WebDAV: Configuration (Part 2) Two configuration options for authentication mechanisms: Two configuration options for authentication mechanisms: WebDAV with standard htpasswd support WebDAV with standard htpasswd support WebDAV with LDAP support WebDAV with LDAP support

September 2003 WebDAV: Configuration (Part 3) Simple configuration within a directory enables WebDAV support: Simple configuration within a directory enables WebDAV support: # WebDAV folder for a Project DAV On #RSADShareDAVOwnerUID [owneruid] #RSADShareDAVSize [Quota in MB] AllowOverride None AuthName "[Project Title]" AuthType Basic AuthUserFile [/.hiddenFolder/.hiddenFile] Require user [user names] Order Deny,Allow Deny from all Allow from trusteddomain.com

September 2003 WebDAV: Configuration (Part 4) Simple WebDAV Configuration Simple WebDAV Configuration Web Server Mac OS X Clients Windows Clients Other Clients

September 2003 WebDAV: Configuration (Part 5) WebDAV configuration with LDAP support WebDAV configuration with LDAP support # WebDAV folder for a Project DAV On #RSADShareDAVOwnerUID [owneruid] #RSADShareDAVSize [Quota in MB] AllowOverride None AuthName "[Project Title]" AuthType Basic Require user [user names] Order Deny,Allow Deny from all Allow from trusteddomain.com LDAP_Server ldap.yourdomain.com LDAP_Port 389 Base_DN "[BaseDN]" UID_Attr uid

September 2003 WebDAV: Configuration (Part 6) WebDAV configuration with LDAP support for user authentication WebDAV configuration with LDAP support for user authentication Web Server Mac OS X Clients Windows Clients Other Clients LDAP Server

September 2003 WebDAV: Configuration (Part 7) User files are available through the Internet. Unless user publishes a website, s/he may want to prevent Internet access to those files. To do that, include the “GET” and “POST” attributes in the “Limit” directive. User files are available through the Internet. Unless user publishes a website, s/he may want to prevent Internet access to those files. To do that, include the “GET” and “POST” attributes in the “Limit” directive.

September 2003 WebDAV: Other Distributions Servers Servers Internet Information Server Internet Information Server Mac OS X Server Mac OS X Server Neon Web Server v0.23.9, open source Neon Web Server v0.23.9, open source

September 2003 WebDAV: Other Distributions Clients Clients Microsoft Windows 2000 and up Microsoft Windows 2000 and up Mac OS X Mac OS X GNOME Nautilus GNOME Nautilus KDE KDE Goliath (Mac OS 9) Goliath (Mac OS 9) Java DAV Explorer for JVM Java DAV Explorer for JVM Cadaver for UNIX terminals Cadaver for UNIX terminals

September 2003 WebDAV: Other Distributions Additional Client Distributions Additional Client Distributions jEdit WebDAV plugin for Jedit text-editing application jEdit WebDAV plugin for Jedit text-editing application Eldav for Emacs Eldav for Emacs APIs APIs PerlDAV PerlDAV PythonDAV PythonDAV File-system driver File-system driver DAVfs for Linux DAVfs for Linux

September 2003 How to Connect to a Web Share

September 2003 WebDAV: Connect from Windows Depends on the version Depends on the version

September 2003 WebDAV: Connect from Apple Click on the Desktop Click on the Desktop Press Command Key + K Press Command Key + K Enter the share address and your credentials when prompted Enter the share address and your credentials when prompted

September 2003 WebDAV: Monitoring the Shares Ringling School created custom monitoring tools to check for quota usage on each share Ringling School created custom monitoring tools to check for quota usage on each share The following attributes were added to the WebDAV Apache configuration for the custom tool: The following attributes were added to the WebDAV Apache configuration for the custom tool: RSADShareDAVOwnerUID (user name) RSADShareDAVOwnerUID (user name) RSADShareDAVSize (MB) RSADShareDAVSize (MB) Scripts are available at Scripts are available at

September 2003 Security

WebDAV: Authentication WebDAV authentication is sent in clear text WebDAV authentication is sent in clear text For security purposes, allow only campus connections to the shares For security purposes, allow only campus connections to the shares Apple will enable encrypted connections to WebDAV shares from their upcoming OS, Panther Apple will enable encrypted connections to WebDAV shares from their upcoming OS, Panther

September 2003 WebDAV: DoS Attacks Multiple users could create a DoS situation if they upload large files at the same time Multiple users could create a DoS situation if they upload large files at the same time An increase in server memory and an increase in Apache processes should diminish the probability of DoS An increase in server memory and an increase in Apache processes should diminish the probability of DoS

September 2003 WebDAV: Module Signature All Apache modules, including WebDAV, are identified in the server signature All Apache modules, including WebDAV, are identified in the server signature NetCraft.net provides information about any server on the Internet NetCraft.net provides information about any server on the Internet Malicious intruders can use the server signature to find vulnerabilities in the system Malicious intruders can use the server signature to find vulnerabilities in the system

September 2003 Lessons Learned No Quota System Single Authoritative User Replication

September 2003 WebDAV: No Quota System Custom monitoring tools necessary to enforce quota usage Custom monitoring tools necessary to enforce quota usage Tools report quota breach to administrator Tools report quota breach to administrator Tools available at Tools available at

September 2003 WebDAV: Single Authoritative User A typical install of Apache does not allow for changing the running user identification A typical install of Apache does not allow for changing the running user identification Apache can be installed to allow for changing the running user identification, but then it must also run as root, which is in itself a security vulnerability Apache can be installed to allow for changing the running user identification, but then it must also run as root, which is in itself a security vulnerability All web shares are owned by one user who also owns Apache running processes All web shares are owned by one user who also owns Apache running processes Users can overwrite each other’s files in a share Users can overwrite each other’s files in a share

September 2003 WebDAV: Replication Apache v Apache v WebDAV module v1.3.6 WebDAV module v1.3.6 LDAP module v2.3 LDAP module v2.3 Netscape LDAP v4.1 Netscape LDAP v4.1 Solaris 8 Solaris 8 SunFire 280R, 2GB memory SunFire 280R, 2GB memory

September 2003 Helpful Suggestions Directory Quotas Quota Attributes Apache SetUID WebDAV Support in NAS Devices

September 2003 WebDAV: Directory Quotas Some software vendors (Novell) already support directory quotas Some software vendors (Novell) already support directory quotas No open source solution yet available No open source solution yet available Allows web shares to comply with quota limits with a single authoritative user Allows web shares to comply with quota limits with a single authoritative user

September 2003 WebDAV: Quota Attributes New attributes that work with the WebDAV module would alert users of quota breaches and would set quota limits New attributes that work with the WebDAV module would alert users of quota breaches and would set quota limits DAVDiskLimit – sets quota limit in MB DAVDiskLimit – sets quota limit in MB DAVOwner – address of user DAVOwner – address of user DAVAlertOn – alarm limit to alert owner DAVAlertOn – alarm limit to alert owner

September 2003 WebDAV: Apache SetUID Allow the WebDAV module to set the ownership of the running process so that it can act on behalf of authenticated users and not the process owner of the web server Allow the WebDAV module to set the ownership of the running process so that it can act on behalf of authenticated users and not the process owner of the web server Internet Draft, Quota and Size Properties for DAV Collections, explains properties and minor behaviors needed for clients to interoperate with quota implementations on web foloders Internet Draft, Quota and Size Properties for DAV Collections, explains properties and minor behaviors needed for clients to interoperate with quota implementations on web foloders

September 2003 WebDAV: Support in NAS Devices Network Appliance Servers support CIFS, NFS, HTTP, FTP, and NDMP, but not WebDAV Network Appliance Servers support CIFS, NFS, HTTP, FTP, and NDMP, but not WebDAV WebDAV support in NAS devices would be easy to implement since HTTP is already supported WebDAV support in NAS devices would be easy to implement since HTTP is already supported Administration of WebDAV enabled NAS devices would improve with a WebDAV “broker” Administration of WebDAV enabled NAS devices would improve with a WebDAV “broker”

September 2003 WebDAV: NAS WebDAV Broker Clients would connect to the WebDAV broker instead of the NAS devices Clients would connect to the WebDAV broker instead of the NAS devices The WebDAV broker would be responsible for authenticating the users with an LDAP server The WebDAV broker would be responsible for authenticating the users with an LDAP server NAS WebServer LDAP Server Other Clients Windows Clients Mac OS X Clients

September 2003 WebDAV: NAS WebDAV Broker After authentication, the broker would send a list of available shares to the client After authentication, the broker would send a list of available shares to the client The client then connects to the NAS devices directly The client then connects to the NAS devices directly NAS Other Clients Windows Clients Mac OS X Clients

September 2003 WebDAV: Announcing a New Service! Service initially released with a minimal amount of users Service initially released with a minimal amount of users Faculty learns of web share availability with introduction to IT upon employment Faculty learns of web share availability with introduction to IT upon employment Online tutorials available at Online tutorials available at Students have been helpful in spreading the word Students have been helpful in spreading the word

September 2003 Thank You!