Get WebDAV CGI at SourceForge.net. Fast, secure and Free Open Source software downloads

WebDAV CGI - Documentation

Content of this topic:
Back to the WebDAV CGI home

Requirements

You do not need mod_dav for the Apache Web server. WebDAV CGI replaces mod_dav completely.

Installation

Note: All steps are done with root rights.

Upgrade Note: Please take a look at the Upgrade section for further information.

  1. download WebDAV CGI (note: not necessary for Gentoo)
  2. install required CPAN modules (Debian/Ubuntu package name):
    • CGI (included in most Linux dists; older dists need that: libcgi-perl)
    • DBI (libdbi-perl) and a database driver, e.g. DBD::SQLite (libdbd-sqlite3-perl) - (since v0.3.0)
    • Date::Parse (libtimedate-perl) - (since v0.2.1)
    • OSSP::uuid (libossp-uuid-perl or from http://www.ossp.org/pkg/lib/uuid/) - (since v0.3.0) (since v0.8.0 replaced by UUID::Tiny)
    • UUID::Tiny (libuuid-tiny-perl) - (since 0.8.0)
    • XML::Simple (libxml-simple-perl)
    • Quota (libquota-perl) - (since v0.3.4)
    • Archive::Zip (libarchive-zip-perl) - (since v0.5.0)
    • Image::Magick (perlmagick) - (since v0.5.1) (since v0.5.3 replaced by Graphics::Magick)
    • Graphics::Magick (libgraphics-magick-perl or http://www.graphicsmagick.org/perl.html) - (since v0.5.3)
    • File::Spec::Link (libfile-copy-link-perl) - (since v0.5.2)
    • IO::Compress::Gzip (included in most Linux dists) - (since v0.7.0)
    • IO::Compress::Deflate (included in most Linux dists) - (since v0.7.0)
    • Module::Load (included in most Linux dists, older need libmodule-load-perl) - (since v0.8.0)
    • optional (for SMB backend): Filesys::SmbClient (libfilesys-smbclient-perl) - (since v0.8.0)
    • optional (for RCS backend): Rcs (librcs-perl) - (since v0.8.0)
    • JSON (libjson-perl) - (since v0.8.5)
    • DateTime - (since v0.8.5)
    • DateTime::Format::Human::Duration - (since v0.8.5)
    • Image::ExifTool (libimage-exiftool-perl)- (since v1.0.1)
    • List::MoreUtils (liblist-moreutils-perl)- (since v1.1.0)
    • optional for SendByMail extension:MIME::Entity (libmime-tools-perl) - (since v0.9.1)
    • optional for LDAP addressbook of SendByMail extension:Net::LDAP (libnet-ldap-perl) - (since v0.9.1)
    • optional for Kerberos helpers in conjunction with mod_perl (AFS, SMB):Env::C - (since v1.0.0)
    • optional for AFS Kerberos helpers in conjunction with mod_perl:AFS::PAG - (since v1.0.1)
    You can do that with 'perl -MCPAN -e "install <ModuleName>"' or with 'apt-get install <PackageName>'. 
    ## Debian/Ubuntu quick install: 
apt-get install libdbi-perl libdbd-sqlite3-perl sqlite3 libtimedate-perl \
                libuuid-tiny-perl libxml-simple-perl libquota-perl \
                libarchive-zip-perl libgraphics-magick-perl libmodule-load-perl \
                libfile-copy-link-perl libjson-perl libdatetime-perl \
                libmime-tools-perl libnet-ldap-perl libimage-exiftool-perl \
                liblist-moreutils-perl

perl -MCPAN -e "install DateTime::Format::Human::Duration"

apt-get install speedy-cgi-perl

## only for PostgreSQL users:
apt-get install  libdbd-pg-perl

## only for MySQL users:
apt-get install libdbd-mysql-perl

## only for SMB backend users:
apt-get install libfilesys-smbclient-perl smbclient krb5-user

## only for RCS backend users:
apt-get install librcs-perl

## only for AFS users:
apt-get install openafs-client krb5-user openafs-krb5
# only for Debian users:
apt-get install libafs-pag-perl
# for Ubuntu users and maybe Debian users:
perl -MCPAN -e "install AFS::PAG"


## for mod_perl users with Kerberos (SMB, AFS) authentication:
perl -MCPAN -e "install Env::C"
  3. install additional binaries/packages for a better WebDAV CGI experience:
    • Speedy - increases the performance of WebDAV CGI (Debian/Ubuntu package: speedy-cgi-perl)
    • Ghostscript - allows the web interface of WebDAV CGI to generate thumbnails for PDF/PS files (Debian/Ubuntu package: ghostscript)
    • smbclient (only for SMB backend users) - allowes the web interface to show quota information (Debian/Ubuntu package: smbclient)
    • kinit (only for SMB and AFS backend users) - allowes you to omit mod_auth_kerberos (Debian/Ubuntu package: krb5-user)
    • libreoffice - allows file conversions
    ## Debian/Ubuntu quick install:
apt-get install speedy-cgi-perl ghostscript

## only for SMB backend users:
apt-get install smbclient

## only for SMB and AFS backend users:
apt-get install krb5-user

## for ODFConverter extension:
apt-get install libreoffice


    ## Gentoo quick install:
emerge -va dev-perl/SpeedyCGI
emerge -va app-text/ghostscript-gpl

## only for SMB backend users:
emerge -va net-fs/cifs-utils

## only for SMB and AFS backend users:
emerge -va app-crypt/heimdal
  4. change directory to your preferred installation path, e.g. cd /etc
  5. install WebDAV CGI:
    • unzip webdavcgi-latest.zip or tar jxf webdavcgi-latest.tar.gz2 (Gentoo: emerge -va www-apps/webdavcgi)
    • or checkout from subversion: svn checkout svn://svn.code.sf.net/p/webdavcgi/code/trunk webdavcgi
  6. change directory to the source base (e.g: cd webdavcgi*) and call bash install.sh to compile all wrappers and to fix file permissions
  7. configure webdav.pl
  8. configure your web server:
    • you can do that with rewrite rules (recommended)
    • or with a handler action (unsupported)
    Examples for Apache 2.x: (you need the Apache rewrite module: a2enmod rewrite) - and don't forget to take a look at the backend specific configuration: AFS, GFS, SMB/CIFS, DBB, or RCS 
    ### EXAMPLE 1: a complete (virtual) server root handled by WebDAV CGI:
ScriptAlias /webdavcgi /etc/webdavcgi/cgi-bin/webdavwrapper
# ScriptAlias /logout /etc/webdavcgi/cgi-bin/logout
<Location /webdavcgi>
        AuthType Basic
        AuthName "WebDAV space"
        AuthUserFile /path-to-my-auth-file
        Require valid-user
</Location>
RewriteEngine On
# RewriteRule /logout - [L]
RewriteRule ^/ /webdavcgi [PT,E=WEBDAVCONF:/etc/webdav.conf,E=PERLLIB:/etc/webdavcgi/lib/perl,L]
    

    ### EXAMPLE 2: a virtual path /webdav
ScriptAlias /webdavcgi /etc/webdavcgi/cgi-bin/webdavwrapper
# ScriptAlias /webdav/logout /etc/webdavcgi/cgi-bin/logout
<Location /webdavcgi>
        AuthType Basic
        AuthName "WebDAV space"
        AuthUserFile /path-to-my-auth-file
        Require valid-user
</Location>
# if you want to map this to a real path, do that:
# (and setup $VIRTUAL_BASE='/webdav/?' and $DOCUMENT_ROOT in your WebDAV CGI config)
RewriteEngine On
# RewriteRule ^/webdav/logout - [L]
RewriteRule ^/webdav /webdavcgi  [PT,E=WEBDAVCONF:/etc/webdav.conf,E=PERLLIB:/etc/webdavcgi/lib/perl,L]
    

    ### EXAMPLE 3: a .htaccess file to handle a complete folder with WebDAV CGI:
### Prerequisites: /webdavcgi is a script alias 
##       (ScriptAlias /webdavcgi /etc/webdavcgi/cgi-bin/webdavwrapper) and
###      'AllowOverride AuthConfig FileInfo' is set for the current folder
RewriteEngine On
RewriteRule .* /webdavcgi [E=WEBDAVCONF:/etc/webdav.conf,E=PERLLIB:/etc/webdavcgi/lib/perl]

AuthType Basic
AuthName "A protected WebDAV folder"
AuthUserFile /path-to-my-auth-file
Require valid-user

Upgrade

Upgrading from 1.1.0 to 1.1.1

Upgrading from 1.0.0 to 1.1.0

Upgrading from 0.9.0 to 1.0.0

Upgrading from 0.8.6 to 0.9.0

Upgrading from 0.8.5 to 0.8.6

  1. The Simple View:

Upgrading from 0.8.4 to 0.8.5

  1. the SVN repository URL has changed: svn switch --relocate https://webdavcgi.svn.sourceforge.net/svnroot/webdavcgi/trunk http://svn.code.sf.net/p/webdavcgi/code/trunk
  2. the default view was changed from 'sidebar' to 'simple'
  3. new Perl modules are needed:
    • JSON (Ubuntu/Debian package: libjson-perl)
    • DateTime (Ubuntu/Debian package: libdatetime-perl
    • DateTime::Format::Human::Duration (CPAN)
  4. SMB backend: the new optional flag 'secure' was added to enable a URL check for allowed servers and shares

Upgrading from 0.8.3 to 0.8.4

  1. The new install.sh script does not copy or link webdav.pl and webdavwrapper to your cgi-bin directory. You can add/change ScriptAliases to use webdav.pl or a webdavwrapper from your installation src, e.g. 
    ScriptAlias /webdavcgi /etc/webdavcgi/cgi-bin/webdavwrapper
RewriteRule ^/ /webdavcgi [PT,L,E=WEBDAVCONF:/etc/webdav.conf,E=PERLLIB:/etc/webdavcgi/lib/perl]
<Location /webdavcgi>
	AuthType Basic
	AuthUserFile /etc/apache2/webabusers
	AuthName "WebDAV space"
	Require valid-user
</Location>
  2. AFS backend:
    • Speedy support for AFS was added and a mod_auth_kerberos free installation is now possible:
      • a new setuid/setgid wrapper was added: helper/webdavwrapper-afs.c (mod_waklog isn't required if you use webdavwrapper-afs.c)
      • a PAG script was added: cgi-bin/afswrapper
      • visit AFS section for details
    • mod_waklog is no longer required for AFS
  3. SMB backend:
    • a wrapper for mod_auth_kerberos free installation was added
    • username/password/workgroup authentication support was added

Upgrading from 0.8.2 to 0.8.3

  1. changed @UNSELECTABLE_FOLDERS default to () (relevant for AFS backend users)
  2. changed helper/webdavwrapper-smb.c to fix a Kerberos ticket bug (relevant for SMB backend users)

Upgrading from 0.8.1 to 0.8.2

  1. see Speedy support section to improve the WebDAV CGI performance

Upgrading from 0.8.0 to 0.8.1

  1. %AUTOREFRESH was added for the new auto-refresh feature

Upgrading from 0.7.x to ≥0.8.0

  1. a new Perl module is needed: Module::Load (Ubuntu/Debian package: libmodule-load-perl)
  2. OSSP::uuid Perl module was replaced by UUID::Tiny (Ubuntu/Debian package: libuuid-tiny-perl)
  3. WebDAV CGI comes with some own modules so you need to set a additional Perl library path:
    • add E=PERLLIB:/etc/webdavcgi/lib/perl to your rewrite rule options in the Apache configuration
    • OR add SetEnv PERLLIB /etc/webdavcgi/lib/perl to your Apache configuration (don't forget to activate/install env module, e.g. a2enmod env; /etc/init.d/apache restart)
    • OR change shebang of webdav.pl to #!/usr/bin/perl -I/etc/webdavcgi/lib/perl
  4. $IGNOREFILEPERMISSIONS config variable was removed
  5. $BACKEND variable was added and is required (allowed values: 'FS', 'AFS', 'GFS', 'SMB', 'DBB')
  6. $SHOW_MIME and $SHOW_PERM were removed: use the new options @ALLOWED_TABLE_COLUMNS and @VISIBLE_TABLE_COLUMNS instead
  7. %MIMETYPES format was changed: only a single filename suffix is allowed as a key (instead of a space separted list of suffixes); please use $MIMEFILE instead
  8. @EXTENSIONS parameter was added: contains a list of extensions
  9. $ENABLE_SYSINFO was removed: add 'SysInfo' to the @EXTENSIONS list
  10. $ENABLE_PROPERTIES_VIEWER was removed: add 'PropertiesViewer' to the @EXTENSIONS list
  11. $ENABLE_SIDEBAR was removed: use @SUPPORTED_VIEWS instead
  12. $MAXLASTMODIFIEDSIZE was removed
  13. $MAXNAVPATHSIZE was added

Upgrading from ≤0.6.x to ≥0.7.x

  1. two new Perl modules are used by WebDAV CGI: IO::Compress::Gzip and IO::Compress::Deflate (both are integraded in most Linux dists)
  2. WebDAV CGI is no longer a single file distribution therefore:
    1. unpack the new installation package in your preferred installlation path, e.g. cd /etc; unzip webdavcgi-0.7.?.zip
    2. link the path for easier upgrades, e.g. ln -s /etc/webdavcgi-0.7.? /etc/webdavcgi
    3. copy the webdav.pl script to your CGI directory and allow execution, e.g. 
      cp /etc/webdavcgi/cgi-bin/webdav.pl /usr/lib/cgi-bin 
chmod a+x /usr/lib/cgi-bin/webdav.pl
    4. add the $INSTALL_BASE variable to your existing /etc/webdav.conf, e.g. 
      echo "\$INSTALL_BASE='/etc/webdavcgi/';" >> /etc/webdav.conf
    5. check your config file and modules, e.g. 
      #> perl -c /etc/webdav.conf
webdav.conf syntax OK

#> perl -I/etc/webdavcgi/lib/perl -c /usr/lib/cgi-bin/webdav.pl
webdav.pl syntax OK

#> bash /etc/webdavcgi/checkenv
+++ Checking perl:
  perl /usr/bin/perl
++++ Checking required modules:
  CGI installed
  DBI installed
  POSIX installed
  File::Temp installed
  Date::Parse installed
  UUID::Tiny installed
  XML::Simple installed
  Quota installed
  Archive::Zip installed
  IO::Compress::Gzip installed
  IO::Compress::Deflate installed
  Digest::MD5 installed
  Module::Load installed
++++ Checking optional modules:
  DBD::SQLite installed
  DBD::mysql installed
  DBD::Pg installed
++++ Checking required modules for FS backend:
  File::Spec::Link installed
++++ Checking required modules for AFS backend:
  File::Spec::Link already checked
++++ Checking required modules for GFS backend:
  File::Spec::Link already checked
++++ Checking required modules for SMB backend:
  Filesys::SmbClient installed
++++ Checking required modules for RCS backend:
  Rcs installed
++++ Checking optional binaries:
  smbclient /usr/bin/smbclient
#### Summary:
All modules found.
All binaries found.
  3. WebDAV CGI has a new Web interface and some configuration defaults were changed and new options were added. See CHANGELOG in your installation path and take a look into webdav.pl for further information.

WebDAV CGI Setup

The WebDAV CGI can be easier upgraded if you use a configuration file instead of changing the setup section of webdav.pl.
  1. Create a /etc/webdav.conf with a minimal setup and don't forget to fix file permissions:
    chmod a+r /etc/webdav.conf: 
    ## the install base is needed to find webdav-ui.* and locale files 
## (don't forget the trailing slash):
$INSTALL_BASE = '/etc/webdavcgi/';

## the backend module (supported: FS, AFS, GFS, SMB, DBB, RCS, GIT):
$BACKEND = 'FS';

## this is an example if a user starts with home dir (http://mywebdavserver/ -> user home):
$VIRTUAL_BASE = '/';
$DOCUMENT_ROOT = '/home/'.$ENV{REMOTE_USER}.'/';
## if you use a complex home folder structure, try this:
# $DOCUMENT_ROOT=(getpwnam($ENV{REMOTE_USER}))[7].'/';


$DBI_SRC='dbi:SQLite:dbname=/tmp/webdav.'.$ENV{REMOTE_USER}.'.db';
$DBI_USER='';
$DBI_PASS=''; 
$CREATE_DB = !-e '/tmp/webdav.'.$ENV{REMOTE_USER}.'.db';
  2. Please take a look at backend specific configuration sections AFS, GFS, SMB/CIFS, DBB, RCS, GIT
  3. Set up your database
  4. If you need to change other options take a look at etc/webdav.conf.complete
  5. There are a lot of extensions to activate.
  6. Don't forget to check the config file syntax: perl -c /etc/webdav.conf
  7. configure your Apache web server

Hints

Apache and webdav.pl setup: Graphics::Magick does not compile:

Database Setup

Common Instructions

  1. Install the necessary Perl DBI driver (Debian/Ubuntu package: libdbd-...-perl)
  2. Create the database and the schema
  3. Configure WebDAV CGI ($DBI_SRC, $DBI_USER, $DBI_PASS)

SQLite 3

PostgreSQL

MySQL

UID/GID Wrapper

If you use the example wrapper (webdavwrapper.c, webdavwrapper-krb.c, webdavwrapper-afs.c) you should consider this: Attention: for AFS and/or Kerberos support you need webdavwrapper-afs.c or webdavwrapper-krb.c instead of webdavwrapper.c (see AFS Support section)

Folder Sharing / Group Access

There are two ways to share a folder between users of a group (not for AFS users - see AFS note below):
  1. Add all users to UNIX/Posix group (/etc/groups, a LDAP group, ...) - recommended:
    • create a group, e.g: groupadd GROUP
    • create a folder to share: mkdir SHAREDFOLDER
    • change the group: chgrp GROUP SHAREDFOLDER
    • set set-GID-flag to the folder and make it readable/executable/writeable for the group: chmod g+srwx SHAREDFOLDER
    • set the $UMASK parameter in your WebDAV CGI config file: $UMASK = 0002;
    Attention: You need a single database for all users to share WebDAV locks and properties. If you use a file based database like SQLite you have to use a singe file writeable for all users.
  2. Use the UID/GID Wrapper to map all users to a common user:
    • create a common user, e.g.:adduser USER
    • create a folder to share: mkdir SHAREDFOLDER
    • change the owner: chown USER SHAREDFOLDER
    • set the WEBDAV_USER environment variable: add E=WEBDAV_USER:USER to your Apache rewrite rule option
AFS note: If you use AFS you have to use AFS groups and AFS ACLs to share folders instead of folder permissions because AFS ignores all Linux/UNIX permissions:
  1. Create a AFS group and add AFS users to the group.
  2. Set lookup, read, write, delete, insert, and lock rights for that group to the shared folder.
  3. Don't forget to set lookup rights for the AFS group to all upper folders.

Web interface

How to add a new translation

Copy the locale/webdav-ui_default.msg to locale/webdav-ui_<MYLANGCODE>.msg and translate all values (leave the keys unchanged; format: key "value").
The Simple view has a lot of extensions with locale files: /etc/webdavcgi/lib/perl/WebInterface/Extensions/*/locale/*.
And don't forget to sent me your translation. Thanx :-)

How to change CSS styles

There are many ways to do it:

How to add or change icons

Here are some examples to do that in the WebDAV CGI configuration file:

How to customize error messages/documents

Two HTTP status codes are supported for customized error documents: '404 Not Found' and '403 Forbidden'

You have to use '.html' or '.txt' extensions for your error documents to determine a correct MIME type.

  1. put your error documents to the $INSTALL_BASE/htdocs folder or wherever you want (should be readable by your users)
  2. add following options to your WebDAV CGI configuration file: 
    $ERROR_DOCS{'404 Not Found'} = "$INSTALL_BASE/htdocs/404.html";
$ERROR_DOCS{'403 Forbidden'} = "$INSTALL_BASE/htdocs/403.html";

Variable substitution in $HEADER, $SIGNATURE, $LANGSWITCH, and %ICONS

Following variables are substituted:
$CLOCKa clock with client time formatted with locale value for key 'vartimeformat'
$ENV{_VAR_}value of environment variable _VAR_
$LANGcurrent language code
$NOWcurrent date formatted with locale value for key 'varnowformat'
$PATH_TRANSLATEDlocale folder name corresponding to the request URI
$REQUEST_URIrequest URI without query string
$TIMEcurrent time formatted with locale value for key 'vartimeformat'
$TL{_KEY_}locale value for key _KEY_
$USERcurrent user id
$VBASEvirtual host base matching $VIRTUAL_BASE
$VHTDOCSvirtual htdocs path $VHTDOCS to the $INSTALL_BASE/htdocs

AFS Support

WebDAV CGI can be used as a Web frontend for AFS and as a WebDAV-AFS bridge. It's a complete replacement for filedrawers.

Please choose your installation variant:
  1. without mod_perl (maybe with Speedy CGI) and without mod_auth_kerberos (recommended)
  2. without mod_perl (maybe with Speedy CGI) and with mod_auth_kerberos and mod_waklog
  3. with mod_perl with or without mod_auth_kerberos/mod_waklog (recommended if Speedy CGI is not available)

... without mod_auth_kerberos (recommended)

Requirements:
  1. OpenAFS client installed on your server (Debian/Ubuntu package: openafs-client) and configured with a default realm: /etc/krb5.conf: default_realm = MY.DOMAIN.NAME (kinit <uid_without_domain> ; aklog should work)
  2. Kerberos client tool kinit (Debian/Ubuntu package: krb5-user)
  3. All users should be visible for the system and have the same password for AFS and your authentication facility like LDAP, RADIUS,... to authenticate your users with kinit and to allow setuid/setgid: getent passwd <uid> should work
  4. The AUTHHEADER environment variable with the HTTP Authorization header value has to be passed to the wrapper: see RewriteRule of the Apache config example.
  5. The TICKET_LIFETIME environment variable value should be a little bit smaller than your Kerberos ticket lifetime.
  6. cgi-bin/webdavwrapper-afs (call bash install.sh from your installation directory to compile helper/webdavwrapper-afs.c)
  7. Replace the pagsh with a bourne shell in the afswrapper script to improve performance and avoid trouble with PAG limits:
    sed -i -e 's@^#!/usr/bin/pagsh@#!/bin/sh@' cgi-bin/afswrapper
Apache example: 
<Location /webdavcgi>
	AuthName "WebAFS"
	AuthType Basic
	Require valid-user
</Location>

ScriptAlias /webdavcgi /etc/webdavcgi/cgi-bin/webdavwrapper-afs
# ScriptAlias /logout /etc/webdavcgi/cgi-bin/logout
RewriteEngine on
# RewriteRule ^/logout - [L]
RewriteRule ^/ /webdavcgi \
               [PT,L,E=WEBDAVCONF:/etc/webdav.conf,\
	             E=PERLLIB:/etc/webdavcgi/lib/perl,\
		     E=AUTHHEADER:%{HTTP:Authorization},\
                     E=TICKET_LIFETIME:82800]
/etc/webdav.conf example: see next section

... with mod_auth_kerberos

Requirements:
  1. mod_auth_kerberos installed (Debian/Ubuntu package: libapache2-mod-auth-kerb)
  2. a keytab file for your server (service name: HTTP/<YOUR SERVER NAME>@<YOUR DOMAIN>, e.g. HTTP/webafs.cms.hu-berlin.de@CMS.HU-BERLIN.DE)
  3. OpenAFS client installed on your server (Debian/Ubuntu package: openafs-client) and configured (kinit ...; aklog should work)
  4. The TICKET_LIFETIME environment variable value should be a little bit smaller than your Kerberos ticket lifetime.
  5. cgi-bin/webdavwrapper-afs (call bash install.sh from your installation directory to compile helper/webdavwrapper-afs.c)
Apache example: 
KrbMethodNegotiate off
KrbMethodK5Passwd on
KrbSaveCredentials on
Krb5Keytab /etc/webafs.keytab

<Location /webdavcgi>
	AuthName "WebAFS"
	AuthType Kerberos
	Require valid-user
</Location>

ScriptAlias /webdavcgi /etc/webdavcgi/webdavwrapper-afs
RewriteEngine on
RewriteRule  ^/ /webdavcgi [PT,L,E=WEBDAVCONF:/etc/webdav.conf, \
                                 E=PERLLIB:/etc/webdavcgi/lib/perl, \
                                 E=TICKET_LIFETIME:82800]
/etc/webdav.conf example: 
$INSTALL_BASE = '/etc/webdavcgi/';

$BACKEND = 'AFS';

$DOCUMENT_ROOT = '/afs/';
$VIRTUAL_BASE='/';

$DBI_SRC='dbi:SQLite:dbname=/tmp/webdav.'.$ENV{REMOTE_USER}.'.db';
$DBI_USER='';
$DBI_PASS=''; 
$CREATE_DB = !-e '/tmp/webdav.'.$ENV{REMOTE_USER}.'.db';

$BACKEND_CONFIG{AFS}{quota}='/usr/bin/fs listquota $FS';

@EXTENSIONS = (@DEFAULT_EXTENSIONS,@EXTRA_EXTENSIONS,@AFS_EXTENSIONS);
$EXTENSION_CONFIG{AFSACLManager} = { allow_afsaclchanges =>1 };
$EXTENSION_CONFIG{AFSGroupManager} = { disallow_groupchanges=>0 };

$ALLOW_SEARCH = 0;
$ALLOW_CHANGEPERM = 0;


$MIMEFILE='/etc/mime.types';

GFS Support

The GFS backend replaces only the quota command. Requirements:
  1. a mounted GFS filesystem
  2. gfs_quota command executable by a user
/etc/webdav.conf example: 
$INSTALL_BASE = '/etc/webdavcgi/';

$BACKEND='GFS';

$DOCUMENT_ROOT = '/mygfsmountpoint/';
$VIRTUAL_BASE = '/';
 
$DBI_SRC='dbi:SQLite:dbname=/tmp/webdav.'.$ENV{REMOTE_USER}.'.db';
$DBI_USER='';
$DBI_PASS=''; 
$CREATE_DB = !-e '/tmp/webdav.'.$ENV{REMOTE_USER}.'.db';

$BACKEND_CONFIG{GFS}{quota}='/usr/sbin/gfs_quota -f';

SMB/CIFS Support

The SMB backend supports Kerberos and username/password/workgroup authenticated file share access.

Please choose your installation variant:
  1. with mod_perl and with Kerberos authentication (recommended)
  2. with mod_auth_kerberos and Kerberos authentication
  3. without mod_auth_kerberos but with Kerberos authentication
  4. with username/password/workgroup authentication

... with mod_auth_kerberos

Requirements:
  1. maybe a Active Directory integrated Windows or Samba file server
  2. mod_auth_kerberos installed (Debian/Ubuntu: libapache2-mod-auth-kerb)
  3. a keytab file for the kerberos module:
    1. create a Windows/ADS user account with a good password (e.g. exampleuser)
    2. disable password change requirements (policies) for your Windows/ADS user account
    3. create a keytab file as a domain admin on your domain controller: 
      C:>ktpass -princ HTTP/my_www_server_name@MY.EXAMPLE.DOMAIN.ORG -mapuser exampleuser@MY.EXAMPLE.DOMAIN.ORG -pass MySeCreTexampleuserPassw0rd -out keytab.HTTP
    4. copy the keytab file keytab.HTTP to a Web server path, e.g. /etc/keytab.HTTP
  4. Filesys::SmbClient perl module installed (Debian/Ubuntu package: libfilesys-smbclient-perl)
  5. optional the /usr/bin/smbclient binary for quota information (Debian/Ubuntu package: smbclient)
  6. You must not use a setuid/setgid wrapper because mod_auth_kerberos creates a ticket cache file and the WebDAV CGI script needs read rights for the Kerberos ticket cache.
  7. You need a wrapper if you use Speedy (see Speed Support section) because the SMB backend needs a fresh Kerberos ticket.
  8. unough temporary file space for thumbnails and ZIP upload/download
Apache example: 
ScriptAlias /webdavcgi /etc/webdavcgi/cgi-bin/webdav.pl

KrbVerifyKDC off
KrbMethodNegotiate on
KrbMethodK5Passwd on
KrbAuthoritative on
KrbServiceName HTTP
Krb5Keytab /etc/keytab.HTTP
# required:
KrbSaveCredentials on
KrbAuthRealms MY.EXAMPLE.DOMAIN.ORG MYSECOND.EXAMPLE.DOMAIN.ORG

AuthType Kerberos
AuthName "MY.EXAMPLE.DOMAIN.ORG Account"
Require valid-user

RewriteEngine on
RewriteRule  ^/ /webdavcgi [PT,L,E=WEBDAVCONF:/etc/webdav.conf,E=PERLLIB:/etc/webdavcgi/lib/perl]
/etc/webdav.conf example: see next section

... without mod_auth_kerberos but with Kerberos authentication

Requirements:
  1. a Active Directory integrated Windows or Samba file server
  2. a Apache authentication provider like auth_n_file, mod_authnz_ldap, ... with the same users and synchronized passwords
  3. a Kerberos configuration file (/etc/krb5.conf) with a default_realm
  4. Filesys::SmbClient perl module installed (Debian/Ubuntu package: libfilesys-smbclient-perl)
  5. optional the /usr/bin/smbclient binary for quota information (Debian/Ubuntu package: smbclient)
  6. Kerberos client tool kinit (Debian/Ubuntu package: krb5-user)
  7. the cgi-bin/smbwrapper script (Speedy compatible): the TICKET_LIFETIME (in seconds) should be a little bit smaller than your Kerberos ticket lifetime
  8. unough temporary file space for thumbnails and ZIP upload/download
Kerberos configuration example: /etc/krb5.conf: 
[libdefaults]
        dns_lookup_realm = true
        dns_lookup_kds = true
        default_realm = MY.EXAMPLE.DOMAIN.ORG
        clockskew = 900
        forwardable = true
        proxiable = true
        allow_weak_crypto = yes
[domain_realms]
	my.example.domain.org = MY.EXAMPLE.DOMAIN.ORG
	.my.example.domain.org = MY.EXAMPLE.DOMAIN.ORG
Apache example: 
ScriptAlias /webdavcgi /etc/webdavcgi/cgi-bin/webdav.pl

AuthType Basic
AuthName "MY.EXAMPLE.DOMAIN.ORG Account"
Require valid-user

RewriteEngine on
RewriteRule ^/ /webdavcgi [PT,L,E=WEBDAVCONF:/etc/webdav.conf,\
                                E=PERLLIB:/etc/webdavcgi/lib/perl,\
                                E=AUTHHEADER:%{HTTP:Authorization},\
                                E=TICKET_LIFETIME:21600]
/etc/webdav.conf example: 
$INSTALL_BASE = '/etc/webdavcgi/';

require Helper::Krb5AuthHelper;
Helper::Krb5AuthHelper->new();

$DOCUMENT_ROOT = '/';
$VIRTUAL_BASE = '/';

$BACKEND='SMB';

$DBI_SRC='dbi:SQLite:dbname=/tmp/webdav.'.$ENV{REMOTE_USER}.'.db';
$DBI_USER='';
$DBI_PASS=''; 
$CREATE_DB = !-e '/tmp/webdav.'.$ENV{REMOTE_USER}.'.db';

$SHOW_QUOTA = -x '/usr/bin/smbclient';
$ALLOW_CHANGEPERM = 0;
$ALLOW_SYMLINK = 0;

#### SMB backend setup:
### required entries: defaultdomain, domains, fileserver
### optional entries: sharefilter, usersharefilter, shares, sharealiases
$BACKEND_CONFIG{SMB} = {
  defaultdomain => 'MY.EXAMPLE.DOMAIN.ORG',	#required

  ## allow only configured server names and shares (default: 0)
  secure => 1, # optional

  ## a global share filter (filter out admin shares with trailing $):
  sharefilter => [ qr/\$$/, ],  #optional

  usersharefilter => {  #optional
    ## admin has no matching filter so he can see all shares (overwrites sharefilter):
    myadminexample => [ qr/__NEVER_MATCH/, ],
  }, 

  sharesep => '~', #optional - servername-share separator symbol (default: '~')
  ## don't use a separator symbol like '$', '-', '_', '#', '%', '?', '&', '/', '\', or letters/numbers
  ## good alternative separators are '!', ':', '=', '\'', '"', '`', '+', '*', or '@'

  ## enables/disables quota support for all domains and shares:
  quota => 1, # optional

  domains => { #required
    'MY.EXAMPLE.DOMAIN.ORG' => {	#required (multiple domain entries allowed for forrests)
      ## a domain based filter (overwrites sharefilter and userfilter above):
      sharefilter => [ qr/\$$/, ],	#optional
      usersharefilter => {		#optional
        ## a domain based user filter (overwrites all sharefilter and global filter):
        myadminexample => [ qr/__NEVER_MATCH/, ], 
      }, 
      fileserver => {			#required
        'mywindowsfileserver1.my.example.domain.org' => {	#required

          ## a fileserver based share filter (overwrites all domain based filter):
          sharefilter => [ qr/\$/, ],	#optional

          usersharefilter => {		#optional
            ## overwrites all sharefilter and domain based filter
            myadminexample => [ qr/__NEVER_MATCH/ ] 
          }, 

          ## disables all filter and (slow) automatic share detection:
          shares => [ 'MyFirstShare', 'MySecondShare', 'MyThirdShare/start/here' ],	#optional
          
          ## enables/disables quota support for given shares:
          quota => { 'MyFirstShare' => 0 }, # optional

	  ## defines a initial directory for a share (don't forget the initial '/'):
	  initdir => { 			#optional
	  	'MyFirstShare' => '/starthere', 
		'MySecondShare'=> '/start/here' 
	  },

          sharealiases => {		#optional
            ## shows 'H: (Home)' instead of 
            ## 'mywindowsfileserver1.my.example.domain.org~MyFirstShare' in the Web interface
            'MyFirstShare' => 'H: (Home)/',
            ## shows 'S: (Scratch)' instead of 
            ## 'mywindowsfileserver1.my.example.domain.org~MySecondShare' in the Web interface
            'MySecondShare' => 'S: (Scratch)/',
	    'MyThirdShare/start/here' => 'T: Temp (/start/here/)',
          },
        },
      },
    },
  },
};

... with username/password/workgroup authentication

Requirements:
  1. a Windows or Samba file server
  2. a Apache authentication provider like auth_n_file, mod_authnz_ldap, ... with the same users and synchronized passwords
  3. optional the /usr/bin/smbclient binary for quota information (Debian/Ubuntu package: smbclient)
  4. the cgi-bin/smbwrapper script (Speedy compatible)
  5. unough temporary file space for thumbnails and ZIP upload/download
Apache example: 
ScriptAlias /webdavcgi /etc/webdavcgi/cgi-bin/smbwrapper

AuthType Basic
AuthName "Workgroup Account"
Require valid-user

RewriteEngine on
RewriteRule ^/ /webdavcgi [PT,L,E=WEBDAVCONF:/etc/webdav.conf,\
                                E=PERLLIB:/etc/webdavcgi/lib/perl,\
                                E=AUTHHEADER:%{HTTP:Authorization},\
                                E=SMBWORKGROUP:Workgroup]
/etc/webdav.conf example: see previous section

DBB database backend

The DBB backend module is an example module. It shows the possibility to put all your data to your own backend and not only to file systems.

Features: Requirements: /etc/webdav.conf example: 
$INSTALL_BASE='/etc/webdavcgi/';
$VIRTUAL_BASE = '/';
$DOCUMENT_ROOT='/';


$DBI_SRC='dbi:SQLite:dbname=/tmp/webdav.'.$ENV{REMOTE_USER}.'.db';
$DBI_USER='';
$DBI_PASS=''; 
$CREATE_DB = !-e '/tmp/webdav.'.$ENV{REMOTE_USER}.'.db';

$THUMBNAIL_CACHEDIR="/tmp";

$ALLOW_CHANGEPERM = 0;
$ALLOW_SYMLINK = 0;

$BACKEND = 'DBB';

$BACKEND_CONFIG{DBB} = {
	dsn => 'dbi:SQLite:dbname=/tmp/webdavcgi-dbdbackend-'.$ENV{REMOTE_USER}.'.db',
	username => '',
	password => '',
};

GIT backend

The GIT backend is a showcase for a revision controlled backend. It is derived from the FS backend and so it works only with local file systems.

Requirements: How it works: /etc/webdav.conf example: 
...
$BACKEND = 'GIT';

$BACKEND_CONFIG{GIT} = {
	## path to git command  (default: /usr/bin/git):
	gitcmd => '/usr/bin/git',

	
	## path to a lockfile (default: /tmp/webdav-git.lock) 
	## it have to be writeable by all users using the git repo:
	lockfile => '/tmp/webdav-git.lock',
};
...

RCS backend

The RCS backend is a showcase for a revision controlled backend. It needs another backend like FS, or SMB to work because it's a simple backend wrapper.

How it works:
Known issues: Requirements: /etc/webdav.conf example: 
...
$BACKEND = 'RCS';

$BACKEND_CONFIG{RCS} = {
        ## backend used for versioning:
        backend=>'FS',                  # required 

        ## relative path in a directory for revision files 
	## (slashes are not allowed):
        rcsdirname=>'.rcs',             # required

        ## RCS binary path:
        bindir=>'/usr/bin',             # required

        ## a relative virtual path in 'rcsdirname' to access 
	## all revisions, logs and diffs of a file 
	## (slashes are not allowed):
        virtualrcsdir=>'REVISIONS',     # required

	## limits the number of revisions for a file:
	## note: maxrevisions includes the current revision that means:
	## you have to set maxrevisions to 4 if you need access to 3 old revisions
	# maxrevision=>31,              # optional

        ## ignore suffixes (check is case insensitive):
        # ignoresuffixes => [ 'jpg', 'gif', 'png', ],  # optional

        ## allowed suffixes (check is case insensitive):
        # allowedsuffixes => [ 'txt', 'html' ],        # optional

        ## ignore filenames (check is case insensitive):
        # ignorefilenames=> [ '.*~'],   # optional

};
...

Read-only backend RO

The RO backend is a backend wrapper for all other backends and allows only read access to files and folders.

webdav.conf example: 
...
$BACKEND='RO';
$BACKEND_CONFIG{RO}{backend} = 'FS';
...

Amazon S3 browser backend S3B

The S3B backend is a simple Amazon S3 browser. It is tested only with Ceph Radows S3 gateway and supports:

Requirements: /etc/webdav.conf example: 
...
$BACKEND='S3B';
$BACKEND_CONFIG{S3B} = {
        access_id => '[myaccessid]',   # required
        secret_key => '[mysecretkey]', # required
        host => '[myradosservername]', # optional, default: s3.amazonaws.com
        bucketprefix => '[myaccessid][separator like "-"]', # optional, default: undefined (usefull for a Ceph Rados gateway with a required access id in a bucket name)
        secure => 1, # optional, 1: https, 0: http, default: 0
        retry => 1,  # optional, default: 0 
        timeout=>2,  # optional, default: 0
};
...

Performance

Speedy Support

Speedy or PersistentPerl allows you to increase the request/response speed of WebDAV CGI. WebDAV CGI is up to 7 times faster with Speedy than without.
Setup:
  1. Install Speedy (Debian/Ubuntu: apt-get install speedy-cgi-perl)
  2. Change the shebang of webdav.pl: 
    OLD: #!/usr/bin/perl
NEW: #!/usr/bin/speedy -- -r50 -M10 -t3600
    The -r50 limits the requests per Speedy process. This is necessary because Perl runs out of memory (you can set it higher but watch your Apache error log). The -M10 limits the count of Speedy processes (see man speedy). If you do not use a setuid/setgid wrapper (e.g. if you use the SMB backend) you should remove the -M10 or set it higher because all your clients using the same Speedy processes and you need one Speedy process per request. The -t3600 sets the timeout for a idle Speedy process to one hour.
  3. Only for the SMB backend:
    1. Add E=TICKET_LIFETIME:28800 to your RewriteRule: 
      RewriteRule ^/ /webdavcgi [PT,L,E=WEBDAVCONF:/etc/webdav.conf, \
                                E=PERLLIB:/etc/webdavcgi/lib/perl, \
                                E=TICKET_LIFETIME:21600]

      The ticket (renewal) lifetime depends on your domain controller setup (Kerberos policy of your domain group policy). You can check it (Debian/Ubuntu: apt-get install krb5-user): 
      kinit mydomainaccount@MY.EXAMPLE.DOMAIN.ORG
klist
    2. Change the Apache script aliases: 
      OLD: ScriptAlias /webdavcgi /etc/webdavcgi/cgi-bin/webdav.pl
NEW (with mod_auth_kerberos): ScriptAlias /webdavcgi /etc/webdavcgi/cgi-bin/webdavwrapper-smb 
NEW (without mod_auth_kerberos): ScriptAlias /webdavcgi /etc/webdavcgi/cgi-bin/smbwrapper
    3. Known issue: every request creates a new service ticket therefore the file size of ticket cache file grows for every request; Solution: reduce the TICKET_LIFETIME to reduce the temporary file space consumption
  4. That's all and don't forget to check the notes below.
Notes:

Mod_Perl Support

See mod_perl topic.

© ZE CMS, Humboldt-Universität zu Berlin | Written 2011-2015 by Daniel Rohde