HOWTO (v1.06): Creating a WebDAV server with apache2

[autarkeia]

I was wrestling with all of these options and Windows XP's totally wonky Web Folders WebDAV client, and someone here suggested putting the ":80" into the URL so that it looks like this: http://www.domain.com:80/davdirectory . I toyed around with changing configs for hours before I finally tried this, and it worked. FYI the authentication dialog box that pops up when using this method looks different than the standard authentication dialog box. Actually, I had a weird sequence of events:

1. I put in :80 into the URL and entered into the New Network Place dialog box
2. A different authentication dialog box than normal popped up. I entered my username and password and it connected successfully.
3. The drive mounted, and I was asked if I wanted to view it immediately. I said "Yes."
4. The "normal" authentication dialog box popped up. I clicked cancel.
5. The "other" authentication dialog box (exactly like in step 2) popped up again, with none of my data filled in, even though I had selected "Save my data..." in the previous attempt
6. I entered in my login and password a second time, and then everything just worked right.

It sounds wonky, and it is, but it worked. I have attempted to get Windows XP to work with WebDAV many times, and there are just tons of reports all over the Net about how M$ screwd up the client in some weird way. This worked for me.

YMMV.

[arkepp]

Hi,

I also got

Code: Select all

[Tue Aug 02 14:21:21 2005] [error] [client 192.168.1.60] client denied by server configuration: /var/dav/svn

but Pergamon's suggestion

Code: Select all

AllowOverride None
Order allow,deny
Allow from all 

(in the Directory section) worked beautifully.

I suggest making it standard in the tutorial. I had just moved everything onto a new server and started with "fresh" configuration files, so I think almost everyone will need it. I wonder how long it would have taken me to figure this one out thanks again

[Pergamon]

I added both the XP port 80 trick (autarkeia) and the permission inheritence thing (arkepp) to the trouble shooting section of the how-to. Normaly, this (AllowOverride None | Order allow,deny | Allow from all) should be the standard permissions already present in httpd.conf.

[niltonvolpato]

Is there any way to permit only secure webdav connection and deny non secure connections in the webdav directories? But, of course, still permit non-secure http for the others sites on the same apache server.

This is for security reasons, so an user will not type his/her password in clear text.

Thanks,
-- Nilton

[Pergamon]

Just a pointer:

I found a hint here. (See chapter "Set up access rules to the WebDAV directory". )

It seems that one can move the WebDAV directory defintions (<location> .. </location>) from 45_mod_dav.conf into the
SSL only vhost configuration.

If you figure out how to do this with Gentoo, I would add this to the howto.

Update: It seems that /etc/apache2/modules.d/41_mod_ssl.default-vhost.conf is the place to define locations that should be accessed only via SSL. Can somebody confirm that?

[niltonvolpato]

Is there any way to permit only secure webdav connection and deny non secure connections in the webdav directories? But, of course, still permit non-secure http for the others sites on the same apache server.

I found it! It suffices to put SSLRequireSSL inside Location, this way:

Code: Select all

<Location /mydavserver>
    SSLRequireSSL
    ...
</Location>

This way connections through http will be forbidden, only https connection will work. One thing that is important to note is that mod_ssl is loaded before mod_dav, in my modules.d directory 40_mod_ssl.conf comes earlier than 45_mod_dav.conf (the numbers indicate the loading order). But I think this should be a default for gentoo installations.

Thanks Pergamon,

-- Nilton

[Pergamon]

Thanks niltonvolpato, added the SSLRequireSSL tip into the howto.

[spil]

Tip for Windows compatibility:
don't use a slash to terminate the alias, e.g.

Code: Select all

Alias /dav /var/dav
not
Alias /dav/ /var/dav/

Windows XP SP2 will strip the trailing slash of the path making your connection fail, e.g.

Code: Select all

http://gentoo/dav/
returns
x.x.x.x - - [18/Sep/2005:12:25:19 +0200] "OPTIONS /dav HTTP/1.1" 401 521 "-" "Microsoft Data Access Internet Publishing Provider Protocol Discovery"

[stillman]

thank you for this nice intro to webdav, much better than the documentation on the mod_dav-website. one thing i noticed at my fresh installation of apache is the location of modules.d, in my case it is /etc/apache2/conf/modules.d

[jlongs2]

My access_log has entries like these:

Code: Select all

127.0.0.1 - - [06/Oct/2005:11:29:25 -0500] "PROPFIND /dav HTTP/1.1" 405 293
127.0.0.1 - - [06/Oct/2005:11:29:25 -0500] "HEAD /dav HTTP/1.1" 301 -
127.0.0.1 - - [06/Oct/2005:11:29:25 -0500] "HEAD /dav/ HTTP/1.1" 200 -

Nautilus says "Couldn't display "dav://csdept@acm.cs.uic.edu/dav". The location is not a folder."

45_mod_dav.conf:

Code: Select all

<IfDefine DAV>
  <IfModule !mod_dav.c>
    LoadModule dav_module    modules/mod_dav.so
  </IfModule>
</IfDefine>

<IfDefine DAV_FS>
  <IfModule !mod_dav_fs.c>
    LoadModule dav_fs_module   modules/mod_dav_fs.so
  </IfModule>
</IfDefine>

<IfModule mod_dav.c>

    DavMinTimeout 600
        <Location /dav>
                Dav On
                <Limit PUT POST DELETE PROPFIND PROPPATCH MKCOL COPY MOVE LOCK UNLOCK>
                        AuthType Basic
                        AuthName "WebDAV Restricted"
                        AuthUserFile /var/www/localhost/DAV/.htdavpasswd
                        Require user csdept
                </Limit>
                AllowOverride None
                Order allow,deny
                Allow from all
        </Location>

</IfModule>

<IfModule mod_dav_fs.c>

    # Location of the WebDAV lock database.
    DavLockDB /var/lib/dav/lockdb

</IfModule>

edit: I was editing /etc/apache2/conf/modules.d/45_mod_dav.conf, not /etc/apache2/modules.d/45_mod_dav.conf. Fixed.

[olt]

great how-to. thanks.

[wayt]

Thanks for a nice How-To. It allowed me to get a WebDAV repository up and working in about 15 minutes.
Windows Explorer and Mac OS X Finder both login fine and can save and copy files to and from the repository.

But for some reason, Apple's iCal program refuses to publish a calendar to the site. That's the primary reason I created the repository, so this is frustrating.

When I select iCal's "Publish..." menu option, enter a base URL of "http://gentoo/private" (same as I do to connect in Explorer or Finder), my login and password, then click the Publish button, iCal responds:

Publish failed for calendar "WWG"
Connection to gentoo failed because it is unreachable or down.

Neither of which is true, of course. Both the server and the client are on the same LAN, BTW.

Has anyone got iCal successfully uploading its calendar to a gentoo-based WebDAV server? Any tips to make this work?

[ptfoof]

Pergamon,

Good job. This is a pretty well written HOWTO. I had a few problems, but they were minor and my fault.

ptfoof

[quantum0726]

Thanks for the great HowTo!

With exception of taking a good hour to realize that not adding 'AllowOverride All' to the conf file for web_dav, I couldn't add Indexes with a .htaccess file, I got it up and working in short time.

I have one question though, is there a way to give different users different access?

For example, let's say I want no anonymous connections (i.e. GET requires even a user); I want user 'foo' to be able to GET and PROPFIND, but not write in any way; I want user 'bar' to have full access, read and write. Using the 'require user foo' and 'require user bar' I should be able to set up two separate <Limit> statements, but I'm too sure how to set the requirements to ensure that anonymous users get no access.

[quantum0726]

Has anyone got iCal successfully uploading its calendar to a gentoo-based WebDAV server? Any tips to make this work?

I am able to get iCal working fine, but so far no https access. My guess is that since my server has an invalid cert. (going to try to follow the link in this HowTo to get that fixed...it's been busted for some time now) it's rejecting the connection and not prompting as Finder does. If I disable SSL on the WebDAV share it publishes fine. Which version of iCal/OS X are you using?

[M1Sports20]

How would you do this with userdirs

I like how each user has a public_html dir right now. could I do webdav with this

[dkaplowitz]

Great guide. Worked like a charm. Thanks!

[zbindere]

Is it possible to setup different subfolders for different users, so that only a user with the right permission can access his folder?

[superczar]

I'm having a spot of trouble, followed the guide many times on a clean system, just installed apache. Can't connect from either of my OS X Tiger machines to my gentoo server/workstation.

Here's my access log.

192.168.0.152 - - [15/Dec/2006:23:39:03 -0800] "OPTIONS /idisk/ HTTP/1.1" 403 10

Here's my error log.

[Fri Dec 15 23:39:03 2006] [error] [client 192.168.0.152] (13)Permission denied: access to /idisk/ denied

All I get is 403 errors no auth window or anything useful.

I can view html files from outside the webdav folder but not from inside it, whether or not I have restricted GET access.

Here's my 45_mod_dav.conf file

<IfDefine DAV>
<IfModule !mod_dav.c>
LoadModule dav_module modules/mod_dav.so
</IfModule>
</IfDefine>

<IfDefine DAV_FS>
<IfModule !mod_dav_fs.c>
LoadModule dav_fs_module modules/mod_dav_fs.so
</IfModule>
</IfDefine>

<IfModule mod_dav.c>

Alias /idisk /mnt/personal/DAV/idisk
DavMinTimeout 600
<Location /idisk>
Options None
Dav On
<Limit PUT POST DELETE PROPFIND PROPPATCH MKCOL COPY MOVE LOCK UNLOCK>
AuthType Basic
AuthName "Andrew's WebDAV"
AuthUserFile /mnt/personal/DAV/lib/.davpasswd
Require valid-user
</Limit>
AllowOverride None
Order allow,deny
Allow from all

</Location>

</IfModule>

<IfModule mod_dav_fs.c>

# Location of the WebDAV lock database.
DavLockDB /mnt/personal/DAV/lib/lockdb

</IfModule>

My file/folder permissions are good... apache:apache rwx r-x r-x....

Apache is running as apache:apache

I'm using the finder to connect, not a web browser... (although i've tried to access an html file from a webbrowser to no avail).

Any ideas? (it's being called idisk, cause eventually it's gonna act as a fake idisk server, but for now plain ol' webdav would do nicely).

[M1Sports20]

This is a great howto. I am able to connect to my webdav server from both linux and windows. However I have a Microsoft Windows Vista Client. It won't connect. I tried both the port trick (append :80) and append # trick described on the first page of this thread.

Here is what the apache log looks like

access_log

Code: Select all

12.210.97.5 - - [21/Jan/2007:23:06:38 -0600] "PROPFIND / HTTP/1.1" 207 817
12.210.97.5 - - [21/Jan/2007:23:06:38 -0600] "PROPFIND / HTTP/1.1" 207 817
12.210.97.5 - - [21/Jan/2007:23:06:45 -0600] "PROPFIND / HTTP/1.1" 207 817

error_log -- Has nothing.


Anyone have any clue whats going on. Did Microsoft break the standard.

[Sakkath]

Why don't you warn before saying 'rm -rf /var/www'?

[Caffeine]

Great HowTo!

Has anybody managed to get this working for users other than apache? I'd like to be able to setup access to user homedirs and have the webdav process switch to the user's UID. I'd be happy setting up a virtual host per user. I've had a look here: http://httpd.apache.org/docs/2.2/mod/mp ... .html#user but it seems that the User directive no longer works within a <VirtualHost> section.

This must be a reasonably common request I'd have thought.

Cheers,
Dkam

[ailpein]

I can not connect with my webdav server. I try many trick's but it still doesn't work!
I need help...

When I look at : http://localhost/
I see:

Hello, world!

So apache is working. When I use nautilus to look at localhost/webdavserver or cadaver to open: localhost/mydavserver, I 've :

Could not contact server:
403 Forbidden


This is my 45_mod_dav.conf


<IfDefine DAV>
<IfModule !mod_dav.c>
LoadModule dav_module modules/mod_dav.so
</IfModule>
</IfDefine>

<IfDefine DAV_FS>
<IfModule !mod_dav_fs.c>
LoadModule dav_fs_module modules/mod_dav_fs.so
</IfModule>
</IfDefine>

<IfModule mod_dav.c>

Alias /mydavserver /var/dav/mydavserver
DavMinTimeout 600
<Location /mydavserver>
Options None
Dav On
<Limit GET PUT POST DELETE PROPFIND PROPPATCH MKCOL COPY MOVE LOCK UNLOCK>
AuthType Basic
AuthName "WebDAV Restricted Repository"
AuthUserFile /var/dav/.davpasswd
Require valid-user
</Limit>
</Location>

</IfModule>

<IfModule mod_dav_fs.c>

# Location of the WebDAV lock database.
DavLockDB /var/lib/dav/lockdb

</IfModule>

And folders:

drwxr-xr-x 3 apache apache 112 XII 17 22:12 dav

-rw-r--r-- 1 root root 22 XII 17 22:12 .davpasswd
drwxr-xr-x 2 apache apache 48 XII 17 22:11 mydavserver

Options in /etc/conf.d/apache:

APACHE2_OPTS="-D DAV -D DAV_FS -D DEFAULT_VHOST -D INFO -D LANGUAGE -D SUEXEC"

Thanks for help.

[notHerbert]

I couldn't get it to work with nautilus - must be some kind of gnome problem.

But it works fine with cadaver and KNetAttach.