Apache and per-user WebDAV DocumentRoot

Question

I have a WebDAV user set up that currently gets usernames and passwords from my MySQL Database. I give users the option to use WebDAV for large file uploads (this is for a file sharing service I'm currently developing) but I've reached a little issue I can't seem to figure out.

First of all - how would I go about each user having their own WebDAV root so they can't look into other user's files? I already run a cronjob that checks for any users that enabled WebDAV and automatically creates the directories with the appropriate permissions. I just need some method of telling apache this.

Thanks for any help, I really appreciate it.

I also am aware I could just run a cronjob every minute to generate me an apache config and reload the apache config, but this would just be a little too much overhead and I'd like some more flexibility.

Answer 1

It's rather a pity that Apache's config isn't as flexible as nginx's, so you could do something like:

Alias /dav /path/to/dav/store/$REMOTE_USER 

However, you can use REMOTE_USER in a rewrite rule, like so:

RewriteEngine On RewriteRule ^/dav(.*)$ /__davinternal/%{LA-U:REMOTE_USER} [PT] 

Then put all your auth/DAVish loveliness into a <Location /__davinternal> and bob's your auntie's live-in lover.

This works great if you've got consistent locations in your filesystem for all your users (say /path/to/dav/store/<username>); if you've got user folders scattered across the filesystem (with a mapping in MySQL), you can still map your user locations, but you've got to use a RewriteMap:

RewriteMap davdirs txt:/path/to/user/dir/map.txt RewriteRule /^dav(.*)$ /__davinternal/${davdirs:%{LA-U:REMOTE_USER}} 

You can do a RewriteMap straight out of MySQL (via an external script), but I'd try and get my app to update a dbm file whenever that mapping information changed and use a dbm map instead -- much better performance, and doesn't hammer your database into the ground.

I've not covered the security implications of these setups in this answer, partially because I'm not entirely sure myself, and because I don't know what your exact security policy might be.

Answer 2

As far as I could tell (2-3 years ago), you need to add a per user/directory config.

# cat /etc/apache2/conf.d/dav_store.conf # First you need to say that a share under location X will be a webdav share: Alias /store /home/davfs/storage/ <Directory /home/davfs/storage/> DAV On AuthType Basic AuthName "sample" Auth_MySQL On Auth_MySQL_Authoritative On Auth_MySQL_Host localhost Auth_MySQL_User _admin Auth_MySQL_Password 123 Auth_MySQL_DB dav Auth_MySQL_Password_Table auth_user Auth_MySQL_Username_Field username Auth_MySQL_Password_Field password Auth_MySQL_Empty_Passwords Off Auth_MySQL_Encryption_Types Django #This was custom. #AuthMySQLUserCondition = "is_active = 1" # non root users cannot view this directory Options -Indexes -MultiViews AllowOverride None require user root; </Directory> <Directory /home/davfs/storage/*/> DAV On require user root; </Directory> Include /home/davfs/etc/conf.d/*.dvu 

And the per user config file locks a user to a dir. Here's a sample

<Directory /home/davfs/storage/lm/lmwangi/> # We need this in subdirs.. otherwise error messages such as # "DAV Off" cannot be used to turn off a subtree of a DAV-enabled location. # will fill up your log DAV On require user lmwangi </Directory> 

And that's all there's to it. I think you have to reload Apache on every config change. It would be wonderful if these tasks could be done using an Apache module... (No more crons to generate configs, no more reloads etc)