2

I'm looking for a way to share a calendar for different platforms via a Linux Debian server which runs Apache 2.2.16 with WebDAV (mod_dav, mod_dav_fs) support.

So far I use for the basic authentication process for directories. The problem is that the only software which support this authentication method is Thunderbird with the Lightning add-on. Neither Outlook nor the different web-calendars can get access.

The Apache authentication setup looks like that:

<Directory "/var/www/calendar/">
  Dav on
  ForceType text/plain
  Require user test
  Options +Indexes
  AuthType Basic
  AuthName "WebDAV"
  AuthUserFile /etc/apache2/htpasswd/calendar.htpasswd
  require valid-user
</Directory>

How can I secure the WebDAV with a proper authentication and insure different software support?

wittich
  • 147
  • 1
  • 10
  • Why do you use `ForceType text/plain`? At least Outlook 2010 should be able to publish to this directory without it (it's my setup). – tricasse Feb 18 '16 at 08:27

1 Answers1

1

The only way I found is to use no authentication but a long URL containing a random hash, like:

https://example.org/somepath/calendarname-averylonghashtoavoidpiracy.ics

This is similar to the "private URLs" used by Google Calendar or Dropbox when sharing. Not perfect, but still better than an easy-to-guess URL.

You may use symlinks (or aliases) on the server to make this hash point to your file. This also allows you to have different hashes for different clients and increases security as you can revoke one hash if compromised while keeping the others.

HTTPS (freely available via e.g. Let's Encrypt) is of course recommended if your calendar contains sensitive material.

tricasse
  • 140
  • 5