4 ms·

IIRC doesn't Apache require that the Apache user owns the files? This made it annoying when you wanted to use those files elsewhere on the server.

by Touche 11y ago

e12e 11y ago
Well, there's just three basic options: have the WebDAV server run as root, to allow changing uids. It's probably a bad idea. Have a group that both the server and uid is member of, have that group own the files (better, but breaks down when you need more than one user, unless you have dav-uid1, dav-uid2 ... groups for every uidN, and have the server be member of each -- and even then you're not much better off -- the server can still access all files -- at least uid1 logged in locally won't have access to files owned by dav-uid2 directly). Finally, just run the server as your uid, on an alternate port. That's probably more sane, optionally have a proxy stand in so you can connect over 443. The state of dav clients is a mess, FWIW last I checked, getting it to work sanely on Linux, either with Gnome, or davfs -- was easy enough. Trying to get it to work reasonably from Windows was hopeless -- I never tried OS X -- I'd hoped that they actually had a usable client. Either way, if you basically end up just being able to access it reasonably from Linux, you might as well just go with sshfs. For a handful of users, setting up reasonably secure[1], key-based file sharing -- ssh(fs) is hard to beat. SAMBA/CIFS isn't fit to be used over the Internet, NFSv4/pNFS w/kerberos and encryption might be, but it, along with AFS is complex to set up. The second easiest thing with some hope of being both secure and not a nightmare to get working for most (after sftp/sshfs) is probably Samba/CIFS over a VPN. Not sure about the current state of the webdav-server/client stuff for python -- that might be a viable way to get a pair of multiplatform client/server things working. Last I looked the WebDAV part of Zope/Plone worked fine with davfs (sadly the rest of the thing, for editing content etc, needs/needed work). On paper WebDAV har many things going for it: it works over standard TLS ports, should go through most firewalls, is "trivial" to secure using certificates (not sure about 2fa -- would probably depend on clients having a sane UI/UX for "require certificate and OTP/password" etc). Does anyone have any experience with actually using something derived from Plan9 9p for sharing files? I've only been able to find broken, abandoned implementations, and no recent how-to's or tutorials. Again, on paper, it would seem that 9p wrapped in some kind of certificate based protocol (either built from nacl primitives, or simply TLS/SSH) should be a reasonable candidate. A nice combination of not reinventing the wheel, and keeping things as simple as possible (as opposed to, NFSv4, CIFS, AFS). [1] Ssh breaks down when it comes to revoking keys etc. This is in theory solved by using ssh certificates (which can expire, be revoked etc) -- but AFAIK there aren't any sane cli/ui/management tools yet. In that case managing x509 via AD or some other CA tool is probably easier -- but still ridiculously painful.
- INTPenis 11y ago
  >The state of dav clients is a mess, FWIW last I checked, getting it to work sanely on Linux, either with Gnome, or davfs -- was easy enough. Trying to get it to work reasonably from Windows was hopeless -- I never tried OS X -- I'd hoped that they actually had a usable client. Nonsense, the reason I use WebDAV when non-tech people need a file sharing service within my company time and time again is because it works so easy on Windows and Macintosh. Their two favorite OS'. On windows you mount it as a regular network share, you can even authenticate with AD if it's in your network. On Mac you just Cmd+K in finder and use the same URL as on Windows. On Linux I've recently learned it's equally simple.
  - e12e 11y ago
    This works over TLS1.2? Without any extra software needed in Windows? Note that last I checked, clients were running Windows XP -- maybe this is fixed/improved in 7/8/8.1/10? [ed: I seem to recall I had some issues with Windows 7 as well, but I may be misremembering things. Does seem that WebDAV is now properly bundled with Windows, and https should work as long as the certificate matches. Apparently Windows will refuse basic auth (but do digest, which really isn't that much of an improvement) over standard http -- but as part of the point is the added security of simple transport encryption over SSL -- I can't imagine why anyone would want to expose WebDAV (other than read-only, perhaps) over anything other than SSL] As for it working in OS X -- I haven't tried it -- and my impression was that it did work. Apparently others in this thread have different experiences...

IIRC doesn't Apache require that the Apache user owns the files? This made it annoying when you wanted to use those files elsewhere on the server.

by Touche 11y ago

IIRC doesn't Apache require that the Apache user owns the files? This made it annoying when you wanted to use those files elsewhere on the server.

e12e 11y ago

Well, there's just three basic options: have the WebDAV server run as root, to allow changing uids. It's probably a bad idea. Have a group that both the server and uid is member of, have that group own the files (better, but breaks down when you need more than one user, unless you have dav-uid1, dav-uid2 ... groups for every uidN, and have the server be member of each -- and even then you're not much better off -- the server can still access all files -- at least uid1 logged in locally won't have access to files owned by dav-uid2 directly). Finally, just run the server as your uid, on an alternate port. That's probably more sane, optionally have a proxy stand in so you can connect over 443. The state of dav clients is a mess, FWIW last I checked, getting it to work sanely on Linux, either with Gnome, or davfs -- was easy enough. Trying to get it to work reasonably from Windows was hopeless -- I never tried OS X -- I'd hoped that they actually had a usable client. Either way, if you basically end up just being able to access it reasonably from Linux, you might as well just go with sshfs. For a handful of users, setting up reasonably secure[1], key-based file sharing -- ssh(fs) is hard to beat. SAMBA/CIFS isn't fit to be used over the Internet, NFSv4/pNFS w/kerberos and encryption might be, but it, along with AFS is complex to set up. The second easiest thing with some hope of being both secure and not a nightmare to get working for most (after sftp/sshfs) is probably Samba/CIFS over a VPN. Not sure about the current state of the webdav-server/client stuff for python -- that might be a viable way to get a pair of multiplatform client/server things working. Last I looked the WebDAV part of Zope/Plone worked fine with davfs (sadly the rest of the thing, for editing content etc, needs/needed work). On paper WebDAV har many things going for it: it works over standard TLS ports, should go through most firewalls, is "trivial" to secure using certificates (not sure about 2fa -- would probably depend on clients having a sane UI/UX for "require certificate and OTP/password" etc). Does anyone have any experience with actually using something derived from Plan9 9p for sharing files? I've only been able to find broken, abandoned implementations, and no recent how-to's or tutorials. Again, on paper, it would seem that 9p wrapped in some kind of certificate based protocol (either built from nacl primitives, or simply TLS/SSH) should be a reasonable candidate. A nice combination of not reinventing the wheel, and keeping things as simple as possible (as opposed to, NFSv4, CIFS, AFS). [1] Ssh breaks down when it comes to revoking keys etc. This is in theory solved by using ssh certificates (which can expire, be revoked etc) -- but AFAIK there aren't any sane cli/ui/management tools yet. In that case managing x509 via AD or some other CA tool is probably easier -- but still ridiculously painful.

INTPenis 11y ago
>The state of dav clients is a mess, FWIW last I checked, getting it to work sanely on Linux, either with Gnome, or davfs -- was easy enough. Trying to get it to work reasonably from Windows was hopeless -- I never tried OS X -- I'd hoped that they actually had a usable client. Nonsense, the reason I use WebDAV when non-tech people need a file sharing service within my company time and time again is because it works so easy on Windows and Macintosh. Their two favorite OS'. On windows you mount it as a regular network share, you can even authenticate with AD if it's in your network. On Mac you just Cmd+K in finder and use the same URL as on Windows. On Linux I've recently learned it's equally simple.
- e12e 11y ago
  This works over TLS1.2? Without any extra software needed in Windows? Note that last I checked, clients were running Windows XP -- maybe this is fixed/improved in 7/8/8.1/10? [ed: I seem to recall I had some issues with Windows 7 as well, but I may be misremembering things. Does seem that WebDAV is now properly bundled with Windows, and https should work as long as the certificate matches. Apparently Windows will refuse basic auth (but do digest, which really isn't that much of an improvement) over standard http -- but as part of the point is the added security of simple transport encryption over SSL -- I can't imagine why anyone would want to expose WebDAV (other than read-only, perhaps) over anything other than SSL] As for it working in OS X -- I haven't tried it -- and my impression was that it did work. Apparently others in this thread have different experiences...