0

I've got an Apache webdav directory serving files to clients read-only. Clients are limited to get,propfind and options. Is it 'safe' to populate this directory using native OS commands like rsync, cp, mv , then setting the owner:group to apache:apache as necessary. Or should I always use some sort of webdav client, even from the hosting server, (RHEL) such as a webdav mount or using something like cadaver? I assume it's perfectly safe to shutdown apache, populate the directory using rsync, check that owner:group permissions are correct then turn apache back on but if the contents change frequently this will get old very fast. Any tips appreciated.

user82296
  • 81
  • 1
  • 1
  • 6

1 Answers1

2

Why would you need to shut down apache? Just copy the new files in and, as you said, verify permissions.

EEAA
  • 109,363
  • 18
  • 175
  • 245
  • 1
    Apache doesn't much care HOW the files get to a servable location - It just serves what's there. – voretaq7 Sep 17 '11 at 19:42
  • 1
    The apache docs for webdav seem pretty clear that one should only use webDAV to access it: [mod_dav](http://httpd.apache.org/docs/2.0/mod/mod_dav.html) "The DAV repository is considered private to Apache; modifying files outside of Apache (for example using FTP or filesystem-level tools) should not be allowed." I'm just wondering if my case where clients only have read access loosens the above restriction. – user82296 Sep 24 '11 at 15:50
  • @user82296 - that quote is from the "security" section of the documentation. It's there to let you know that if you copy files into the DAV folder with another tool, there can be no guarantees that the file's permissions will be set correctly. As long as you make sure the owner/mode are set correctly on the files you dump into the DAV folder, you'll be just fine. – EEAA Sep 24 '11 at 16:03
  • Thanks for the input. It 'seemed' like setting owners:modes properly after using file system tools, should be ok, it's always good to get confirmation. – user82296 Sep 24 '11 at 18:40