Windows To Web DAV A File Server Case

Windows To Web. DAV A File Server Case Study John F. Hall IT-User Services, University of Delaware MARC ‘ 05 Copyright John F. Hall 2005. This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purpose according to the Creative Commons Attribution. Non. Commercial License: http: //creativecommons. org/licenses/by-nc/2. 0/

Windows to Web. DAV • • • One Case Web. DAV Implementation Comparisons Extending the Idea

UD • <omitted pretty picture of Gore Hall, see: http: //www. udel. edu/PR/wallpaper. html>

The PRESENT Omitted big photo of the PRESENT -- see http: //www. udel. edu/present

Our Servers • NT 4 File, Print, Web • Split off Web Server to own box (Apache) • Windows 2000

Resulting Server File Server Print Server Roaming Profiles Group Policies IPSec DDNS Kerberos/LDAP

2004 Upgrade 2003

What is Web. DAV? Web. DAV

What is Web. DAV? Web Distributed

What is Web. DAV? Web Distributed Authoring

What is Web. DAV? Web Distributed Authoring and Versioning

What is Web. DAV? • Extension to HTTP/1. 1 protocol X HTTP/1. 1 GET X POST X X

Web. A • HTTP/1. 1 has basic Authoring via PUT X HTTP/1. 1 CGI PUT X X

Web. DA PROPFIND PROPPATCH LOCK MKCOL COPY X HTTP/1. 1 Web. DAV MOVE DELETE X

Web. DAV The Great American Book Chapter 1 America: A Novell Chapter 1 The Great American Novel It was long ago and far away that Star Wars It was quite some time ago in a far off land Episode 4 Chapter 1 A long, long time ago in a far-off land there once was A long time ago, In a Galaxy Far, Far Away…

Implementation

Platform • Dell Power. Edge 700 (CHEAP!) (x 2) • Fedora Core 2/3 (Free)* • Apache 2 + SSL (Free)* *As in both Beer and Speech

Free Speech is More Important Than Free Beer* • Examine source code • Alter source code • Recompile • Share * Only in this Particular, Limited, Academic Case Study

Phasing In Read Only SMB Mount Web. DAV Windows NEW OLD

Clients • • • HTTP Clients (Browsers) MS Web Folders Apple’s “Go. . . ” Web. Drive ($30) Goliath Applications: Macromedia, Adobe, Microsoft

Apples and Oranges

What Did We Gain? • • Platform Independence Freedom (as in speech) Easier Administration Access from Anywhere Simpler / Quicker Disaster Recovery Knowledge of New Technology Performance for Big Files ? ? ? Ability to Use Central Authentication

What Did We Lose? • Services We Weren’t Using • Security of a ‘Closed’ Network • GUI

Count Vulnerabilities?

Reduced Attack Surface LDAP 389 636 Kerberos 88 464 DNS 53 File/Print 135 139 445 Apache / SSL 443

Performance

DATA SYSTEM User Accounts U CAS Apache Web. DAV� U U Windows �C U� U �G U DB SSID

How Web. DAV Scales to the Enterprise • Distributed departmental servers

ASP / Outsource <Omitted screen grab of Apple’s i. Disk /. Mac>

Web. DAV May Creep In with Other Enterprise Systems… It might creep in with… CMS (Web. CT) e. Portfolio system (OSPI v. 2) Content Repository, etc. Beneath is all they’re all just web-based file servers…

Commercial Enterprise Solutions

References University of Delaware / PRESENT • http: //www. udel. edu/IR/fnf/profile/index. html • http: //www. udel. edu/present Web. Dav Protocol • RFC 2518: Web. DAV Distributed Authoring • RFC 3253: Web. DAV Versioning • RFC 3744: Web Distributed Authoring and Versioning (Web. DAV) Access Control Protocol”, IETF • http: //www. webdav. org Web. Dav Clients • http: //www. webdav. org/goliath • SRT Web. Drive - Web. DAV Servers • http: //www. sharemation. com • http: //www. xythos. com • http: //www. webdav. org/mod_dav/ • http: //www. mac. com/1/i. Tour/tour_idisk. html • http: //www. webct. com/ • http: //www. theospi. org/ Security Metrics (Apples and Oranges) Howard, M. , Pincus, J. , Wing, J. , “Measuring Relative Attack Surfaces” http: //www. cs. cmu. edu/~wing/publications/Howard. Wing 03. pdf Free as in Speech • http: //www. gnu. org/philosophy/free-sw. html CAS Authentication • http: //tp. its. yale. edu/tikiindex. php? page=Central. Authentication. Service Other • http: //www. webdav. org/deltav/WWW 10/deltavintro. htm • http: //www. webdav. org/catacomb