Fine-tuning the Server Configuration

The server configuration done in 2.1 can serve only as a proof of concept, since it lacks authentication and allow anyone to publish content. The security can be improved using digest authentication. A new directory will be created that will be DAV-enabled and accessing it via some of the HTTP methods will require authentication.

The directory is created as in section 2.1:

# cd /usr/local/www/apache22/data
# mkdir digestdav
# chown www:www digestdav/
# chmod 770 digestdav/

The module mod_auth_digest is loaded in httpd.conf:

LoadModule auth_digest_module libexec/apache22/mod_auth_digest.so

And the corresponding location is configured in the following way in httpd.conf:

On line 2 the directory is DAV support is turned on; on line 3 the authentication type is set to be digest. Line 4 is important because it specifies the name of the authentication realm, which is used when a user is added to the realm using htdigest utility. Line 5 defines the location of the file containing the user credentials and line 6 specifies the URIs that are in the authentication realm. Lines 7-9 restrict the authentication to all HTTP methods to all except GET, HEAD and OPTIONS, hence the WebDAV methods are included in the protection scheme.

Now a file with digested password will be created and it will contain one test user:

# cd /usr/local/etc/apache22
# htdigest -c .digestdav "WebDAV Repository" admin
Adding password for admin in realm WebDAV Repository
New password:
Re-type new password:

The option -c specifies the file where the username and and password will be stored, in this case it is .digestdav in the current directory. The next argument is the name of authentication domain. which the same the one given in AuthName directive. The last argument is the username that will be added and a password is requested for it.

Now when the client request the server to perform a WebDAV operation on the directory, the client will be challenged to set the user credentials:

$ cadaver
dav:!> open http://localhost/digestdav/
Authentication required for WebDAV Repository on server 'localhost'
Username: admin
Password:
dav:/digestdav/>

Then the user can send any WebDAV request.