0

It's being a week I'm trying to get webdav working on a Vhost without any success....
Here is my setup:
Debian 9
Apache 2.4
Virtualmin 6.01

SuexecUserGroup "#1039" "#1038"
ServerName dav.mydom.com
DocumentRoot /home/dav/public_html
ErrorLog /var/log/virtualmin/dav.mydom.com_error_log
CustomLog /var/log/virtualmin/dav.mydom.com_access_log combined
<Directory "/home/dav/public_html">
 Options Indexes MultiViews
 AllowOverride None
 Require all granted
</Directory>
Alias /webdav /home/dav/public_html
<location /webdav>
 Dav on
 AuthType Basic
 AuthBasicProvider file
 AuthName "WebDav"
 AuthUserFile /home/dav/public_html/.htpasswd
 <Limit GET PUT POST DELETE PROPFIND PROPPATCH MKCOL COPY MOVE LOCK UNLOCK OPTIONS>
  Require valid-user
 </Limit>
</location>
ProxyPassMatch ^/(.*.php(/.*)?)$ fcgi://localhost:8005/home/dav/public_html/$1
RemoveHandler .php
RemoveHandler .php7.0
php_admin_value engine Off

Trying to test it with cadaver, I got the message I can't even enter my user name and pass

[matth@www ~]# cadaver http://dav.mydom.com/webdav/
Authentication required for WebDav on server `dav.mydom.com':
Username: 
Authentication aborted!
Could not open collection:
Could not authenticate to server: rejected Basic challenge
dav:/webdav/? 

I have also tested by creating a .netrc pass to authenticate automatically but i good this then:

[matth@www ~]# cadaver https://dav.mydom.com/webdav
Could not access /webdav/ (not WebDAV-enabled?):
405 Method Not Allowed
Connection to `db.ducorporation.com' closed.
dav:!> 

access.log

s.r.c.ip - - [18/Jan/2018:04:03:29 +0100] "OPTIONS /test.txt HTTP/1.1" 200 4236 "-" "Mozilla/5.0 (Windows NT 6.1; rv:57.0) Gecko/20100101 Firefox/57.0"
s.r.c.ip - - [18/Jan/2018:04:03:30 +0100] "HEAD /test.txt HTTP/1.1" 200 620 "https://app.dom.com/" "Mozilla/5.0 (Windows NT 6.1; rv:57.0) Gecko/20100101 Firefox/57.0"
s.r.c.ip - - [18/Jan/2018:04:03:31 +0100] "OPTIONS /test.txt HTTP/1.1" 200 1146 "-" "Mozilla/5.0 (Windows NT 6.1; rv:57.0) Gecko/20100101 Firefox/57.0"
s.r.c.ip - - [18/Jan/2018:04:03:32 +0100] "HEAD /test.txt HTTP/1.1" 200 620 "https://app.dom.com/" "Mozilla/5.0 (Windows NT 6.1; rv:57.0) Gecko/20100101 Firefox/57.0"
s.r.c.ip - - [18/Jan/2018:04:03:32 +0100] "OPTIONS /test.txt HTTP/1.1" 200 1146 "-" "Mozilla/5.0 (Windows NT 6.1; rv:57.0) Gecko/20100101 Firefox/57.0"
s.r.c.ip - - [18/Jan/2018:04:03:33 +0100] "PUT /test.txt HTTP/1.1" 405 938 "https://app.dom.com/" "Mozilla/5.0 (Windows NT 6.1; rv:57.0) Gecko/20100101 Firefox/57.0"

error.log is empty

With suexec i'm making sure Apache is running under the proper user, also the access to any files does work from a Web browser after authentication.
Also tested
- not to use location but directory
- Disable Directory indexing
- Auth none/Digest/Basic
- Webdav folder at the route of the DocumentRoot as well as sub-folder
- Changed ownership of the public_html folder to the apache user - Some other thing i don't remember

With all these tests, I'm getting the same error

Done my testing with Firefox/litmus/cadaver/webdav client app With Firefox and the webdav app I'm able to read and download files but not edit PUT get as a 405 error (meaning PUT is not allowed, but it's allowed in my <Limit> section) With litmus/cadaver no chance to do anything so far…

Hope I'm clear enough
Any input would be much appreciated

EDIT: apache logs added

Matth

  • And not a single hint in /var/log/virtualmin/dav.mydom.com_error_log ? – Gerard H. Pille Jan 16 '18 at 13:05
  • Is this syntax understood by Apache: SuexecUserGroup "#1039" "#1038"? – Gerard H. Pille Jan 16 '18 at 13:11
  • I'm with Gerard, what does the error log say? Without that feedback you are going blind. – ezra-s Jan 17 '18 at 12:50
  • From my testing the logs are saying exactly the same as the client error 405, as per suexec Apache doesn't complaint at all about it. I'll post the logs as soon as I have rerun a bunch of tests. – Matthieu Ducorps Jan 17 '18 at 14:44
  • Okey I have added the Apache logs – Matthieu Ducorps Jan 18 '18 at 3:22
0

Here is how I finally manage to get it work:
This config is working for Apache 2.4 for the SSL vhost, the HTTP one redirect to SSL.
I had to set a dedicated folder where the Apache user has dedicated read/write access.

To be more secure I wish to have Apache running as a specific user but it seems the easiest way today is to use MPM-ITK which is apparently not compatible with MPM-Prefork module that I'm using now.
Will give a try once I understand the consequences of moving from MPM-Prefork to ``MPM-ITK`.

Any comment for security improvement are welcome !

Header always set Access-Control-Allow-Origin "*"
Header always set Access-Control-Allow-Headers "origin, content-type, cache-control, accept, authorization, if-match, destination, overwrite"
Header always set Access-Control-Expose-Headers "ETag"
Header always set Access-Control-Allow-Methods "GET, HEAD, POST, PUT, OPTIONS, MOVE, DELETE, COPY, LOCK, UNLOCK"
Header always set Access-Control-Allow-Credentials "true"

RewriteEngine On RewriteCond %{REQUEST_METHOD} OPTIONS RewriteRule ^(.*)$ blank.html [R=200,L,E=HTTP_ORIGIN:%{HTTP:ORIGIN}]
ServerName my.domain.com
DocumentRoot /home/www/public_html
ErrorLog /var/log/virtualmin/my.domain.com_error_log
CustomLog /var/log/virtualmin/my.domain.com_access_log combined
DavLockDB /home/www/public_html/DavLock
<Directory /home/www/public_html>
RewriteEngine On RewriteCond %{SERVER_PORT} 80 RewriteRule ^(.*)$ https://my.domain.com/$1 [R,L]
Options Indexes MultiViews SymLinksIfOwnerMatch
AllowOverride None
Require all granted
</Directory>

Alias /webdav /home/www/public_html

<Location "/webdav">
 Dav on
 DirectoryIndex none
 AuthType Basic
 AuthBasicProvider file
 AuthUserFile /home/www/public_html/.htpasswd
 AuthName "WebDav"
 <Limit GET HEAD POST PUT OPTIONS MOVE DELETE COPY LOCK UNLOCK>
  Require valid-user
 </Limit>
 <Limit  OPTIONS>
  Require all granted
 </Limit>
DavDepthInfinity off
</Location>
SSLEngine on
SSLCertificateFile /home/my/ssl.cert
SSLCertificateKeyFile /home/my/ssl.key
SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLCACertificateFile /home/my/ssl.ca
RemoveHandler .php
RemoveHandler .php7.0
php_admin_value engine Off
RedirectMatch ^/(?!webdav) "https://my.domain.com/webdav"
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.