4

How secure is webdav? Is smb tunneling over ssh (with putty) a better solution? What do you prefer?

5 Answers 5

9

WebDAV over SSL is as secure as the SSL implementations in the server and the client, the mechanism used for user authentication, and your trust with the certificates in use to authenticate the server computer and, if you're really paranoid, to authenticate the client computer (mutual SSL authentication isn't common, but it's certainly possible and used in many security-conscious deloypments).

SMB suffers HORRIBLY over latent connections. If your WebDAV client is fully-featured and works well I'd highly recommend that rather than SMB over anything in a WAN scenario.

2
  • Totally agree! You beat me to it. Was in the process of composing a very similar answer.
    – user1797
    Jul 16, 2009 at 14:33
  • @David: I tend to do that with a lot of people... >smile< Jul 16, 2009 at 14:34
2

You may also want to look at SFTP:

FTP, SCP or something else

1

Webdav over SSL is secure.
SMB over ssh will be less easy to setup I think
I think that in both case you want to do a performance test to see which one will be faster when used with SSL/SSH.
If there is no major difference I would choose Webdav

1

As Evan Anderson said, webdav can be made fairly secure. If you use SSL, then you have encryption in transit. Depending on how you configure it, you can point your authentication at a centralized location. As an example, I have run WebDav using Apache with LDAP auth. The downside to WebDav, is that is is an extension of the HTTP protocol. Unless you do some magic then the files on disk will be owned by the webserver user. That, was my biggest problem with WebDav as a system. That being said, for anything bigger than a single network it is likely going to be better than SMB. Single network being organizational, not broadcast domain.

3
  • amazing! What magic have I to do if I want files, owned by their users?
    – Martin K.
    Jul 16, 2009 at 14:52
  • If I figure it out, I'll edit this answer. A previously employer did this somehow, but so far can't find how it was done.
    – Scott Pack
    Jul 16, 2009 at 19:02
  • can this be accomplished with a stickybit on the directories?
    – egorgry
    Nov 13, 2009 at 21:14
0

I'd use WebDAV over SFTP using NULL FTP Server . FTP is a lot faster than SMB.

1
  • I'm assuming "over" here means "instead of". The link is broken. Apart from FTP being faster than SMB, which is not something OP asked about, this answer contains no useful information.
    – crantok
    May 21, 2021 at 16:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .