From: Joshua Slive Date: Mon, 21 Apr 2003 03:00:40 +0000 (+0000) Subject: Some serious updates to the top section of the mod_dav docs. Many of the ideas X-Git-Tag: pre_ajp_proxy~1817 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=93aafc3499f42b74f74a6347d37f47cd785e550a;p=thirdparty%2Fapache%2Fhttpd.git Some serious updates to the top section of the mod_dav docs. Many of the ideas are stolen from Greg's mod_dav site. Some specifics: - Change recommendations about where to place the dav lockfile and be specific about required permissions. - Remote the HEAD from the block, since it is implied by GET. - Add a security section discussing file permissions, auth issues, denial of service, etc. - Add a "complex config" section discussing the dynamic content issue. Review requested. Unfortunately, I can't check in the html because of transformation problems in my setup. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@99469 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/docs/manual/mod/mod_dav.xml b/docs/manual/mod/mod_dav.xml index a800702718f..fc8abf5ec85 100644 --- a/docs/manual/mod/mod_dav.xml +++ b/docs/manual/mod/mod_dav.xml @@ -28,19 +28,29 @@ Dav On -

This enables the DAV file system provider, which is implemented by - the mod_dav_fs module. Therefore that module has to - be compiled into the server or has to be loaded at runtime using the +

This enables the DAV file system provider, which is implemented + by the mod_dav_fs module. Therefore, that module + must be compiled into the server or loaded at runtime using the LoadModule directive.

-

In order to make it work you have to specify a web-server writable - filename for the DAV lock database by adding the following to the - global section in your httpd.conf file:

+

In addition, a location for the DAV lock database must be + specified in the global section of your httpd.conf + file:

- DavLockDB /tmp/DavLock + DavLockDB /usr/local/apache2/var/DavLock +

The directory containing the lock database file must be + writable by the User + and Group under which + Apache is running. For security reasons, you should create a + directory for this purpose rather than changing the permissions on + an existing directory. In the above example, Apache will create + files in the /usr/local/apache2/var/ directory + with the base filename DavLock and extension name + chosen by the server.

+

You may wish to add a Limit clause inside the Location directive to limit access to @@ -62,7 +72,7 @@ AuthName DAV
AuthUserFile user.passwd

- <LimitExcept GET HEAD OPTIONS>
+ <LimitExcept GET OPTIONS>
require user admin
 @@ -71,14 +81,77 @@ </Location>
- Security -

The use of HTTP Basic Authentication is not recommended. You - should use at least HTTP Digest Authentication, which is provided by - the mod_auth_digest module. Nearly all WebDAV clients - support this authentication method. Of course, Basic Authentication - over an SSL enabled connection is secure, - too.

- +

mod_dav is a descendent of Greg Stein's mod_dav for Apache 1.3. More + information about the module is available from that site.

+ + +
Security Issues + +

Since DAV access methods allow remote clients to manipulate + files on the server, you must take particular care to assure that + your server is secure before enabling mod_dav.

+ +

Any location on the server where DAV is enabled should be + protected by authentication. The use of HTTP Basic Authentication + is not recommended. You should use at least HTTP Digest + Authentication, which is provided by the + mod_auth_digest module. Nearly all WebDAV clients + support this authentication method. An alternative is Basic + Authentication over an SSL enabled + connection.

+ +

In order for mod_dav to manage files, it must + be able to write to the directories and files under its control + using the User and + Group under which + Apache is running. New files created will also be owned by this + User and Group. For this reason, it is + important to control access to this account. The DAV repository + is considered private to Apache; modifying files outside of Apache + (for example using FTP or filesystem-level tools) should not be + allowed.

+ +

mod_dav may be subject to various kinds of + denial-of-service attacks. The LimitXMLRequestBody directive can be + used to limit the amount of memory consumed in parsing large DAV + requests. The DavDepthInfinity directive can be + used to prevent PROPFIND requests on a very large + repository from consuming large amounts of memory. Another + possible denial-of-service attack involves a client simply filling + up all available disk space with many large files. There is no + direct way to prevent this in Apache, so you should avoid giving + DAV access to untrusted users.

+
+ +
Complex Configurations + +

One common request is to use mod_dav to + manipulate dynamic files (PHP scripts, CGI scripts, etc). This is + difficult because a GET request will always run the + script, rather than downloading its contents. One way to avoid + this is to map two different URLs to the content, one of which + will run the script, and one of which will allow it to be + downloaded and manipulated with DAV.

+ + +Alias /phparea /home/gstein/php_files
+Alias /php-source /home/gstein/php_files
+<Location /php-source> + + DAV On
+ ForceType text/plain
+ +</Location> + + +

With this setup, http://example.com/phparea can be + used to access the output of the PHP scripts, and + http://example.com/php-source can be used with a DAV + client to manipulate them.