Apache2Triad Help, Support and Development

[Joshua Meadows (DemoRic)]

One popular file transfer method over ftp is webDAV(also known as webfolders). Apache has some modules to allow this type of file management. In this quick example I'll show how I use webDAV over SSL to provide encrypted data transfers using this method.

What you need:
Properly Running website that already has SSL working.
Ports 81, 444 open on your firewall/router.
Virtual hosts correctly running.
To be comfortable with manually editing your conf files.
mod_rewrite enabled

Setting webDAV defaults:
In your httpd.conf file uncomment
Quote: LoadModule dav_module modules/mod_dav.so
LoadModule dav_fs_module modules/mod_dav_fs.so
Add some default webDAV settings.
Quote: ## -------- Config for DAV (webfolders) access -------------
# Note: Exteneded status is required if you use DAV
<IfModule mod_dav.c>
#A good resource http://apacheworld.org/ty24/site.chapter13.html

DAVLockDB logs/davlock

#if your DAV server will be accessed via Windows Web folders, you need to add the following
BrowserMatch "Microsoft Data Access Internet Publishing Provider" redirect-carefully

#allows clients to request meta info, on adds potential for Denial Of Service attacks
#DavDepthInfinity On

#You can disable the size limit by setting the value of LimitXMLRequestBody to 0, default is 1000000
LimitXMLRequestBody 1000000

#This is useful in certain situations to reduce the network traffic or reduce the possibility of
#clients being dropped, a value of 0 will disable this
DAVMinTimeout 120
</IfModule>
## ---------------------------------------------------------

Setup Default WebDAV site:
In your httpd.conf add:
Quote: ## =========================================================
# Virtual Host Section http://httpd.apache.org/docs-2.0/vhosts/
NameVirtualHost *:80
NameVirtualHost *:81
#yoursite DAV access
<VirtualHost *:81>
ServerName yoursite.com:81
ServerAdmin admin@yoursite.com
ServerAlias yoursite.selfhost.com yoursite.com
DocumentRoot "C:/apache2triad/htdocs"
Include C:/apache2triad/conf/protect.conf
#mod_rewrite rule Make All requests SSL
RewriteCond %{HTTPS} !=on
#RewriteRule .* https://%{HTTP_HOST}:444%{REQUEST_URI} [QSA,R=permanent,L]
RewriteCond %{REQUEST_URI} ^/+.*$
RewriteRule ^/+(.*) https://%{SERVER_NAME}:444/$1 [L,R,NC]
#Remove PHP info in headers
php_value expose_php 0

<IfModule mod_dav.c>
<Directory />
DAV On
#remove handles for Dynamic content 2
RemoveHandler .pl .cgi .shtm .shtml
RemoveType .php .phps .phtml
Require user root
AuthType Basic
AuthName "Webfolder Access"
AuthUserFile C:\apache2triad\htdocs\.htpasswd
</Directory>
</IfModule>

<IfModule mod_bw.c>
BandWidth all 102400
MinBandWidth all 50000
</IfModule>
</VirtualHost>
Setting Up webDAV over SSL:
In your ssl.conf add:
Quote: Listen *:444
<VirtualHost *:444>
DocumentRoot "C:/apache2triad/htdocs"
ServerName yoursite.com:444
ServerAdmin admin@yoursite.com
ErrorLog logs/ssl_error.log
TransferLog logs/ssl_access.log
DirectoryIndex webdav.htm

SSLEngine on
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLCertificateFile "C:/apache2triad/OpSSL/cert/certificate.crt"
SSLCertificateKeyFile "C:/apache2triad/OpSSL/cert/privkey.pem"

<Files ~ "\.(pl|cgi|shtml|phtml|php3?)$">
SSLOptions +StdEnvVars
</Files>
<Directory "C:/apache2triad/cgi-bin">
SSLOptions +StdEnvVars
</Directory>
<Directory "C:/apache2triad">
Options FollowSymLinks IncludesNoExec
</Directory>
SetEnvIf User-Agent ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0

CustomLog logs/ssl_request.log \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
Include C:/apache2triad/conf/protect.conf

<IfModule mod_dav.c>
<Directory />
DAV On
BrowserMatch "Microsoft Data Access Internet Publishing Provider" redirect-carefully
#remove handles for Dynamic content 2
RemoveHandler .pl .cgi .shtm .shtml
RemoveType .php .phps .phtml

Require user root
AuthType Basic
AuthName "Webfolder Access"
AuthUserFile C:\apache2triad\htdocs\.htpasswd
</Directory>
</IfModule>
</VirtualHost>