ORAGetSource OraDAV Configuration Parameters

Configuring mod_oradav 9-11

9.2.1.19 ORAUser

Specifies the database user schema to use when connecting to the service specified by the ORAConnect , ORAConnectSN , or ORAService parameter. This user must have the following privileges: ■ CONNECT ■ RESOURCE ■ CREATE TABLESPACE ■ DROP TABLESPACE ■ CREATE ANY TRIGGER

9.2.2 Using Fusion Middleware Control to Configure mod_oradav

On the Advanced Server Configuration page of Fusion Middleware Control, you can enter parameters within a Location container directive in the mod_oradav.conf file. The Location container directive specifies the DAV-enabled URL. The DAV keyword is followed by the parameter On, which instructs mod_dav to use the local file system for content. The following example specifies that the directory myfiles under the Web server documents directory htdocs by default to be DAV-enabled, along with all directories under myfiles in the hierarchy. There must not be any symbolic links defined on the myfiles directory or any of its subdirectories. Location myfiles DAV On Location

9.3 WebDAV Security Considerations

Because WebDAV enables readwrite capabilities, Internet users can write to your Web site or to an Oracle repository. A major concern is preventing users from placing an inappropriate file, such as a Trojan horse, that can run on the Web server system. If the WebDAV configuration and authorization is not set up properly, an inappropriate file from the file system can be run. However, mod_oradav is disabled by default in new installations of Oracle HTTP Server so that your system is secure out-of-the-box. Be sure to apply the standard Basic or Digest authentication and authorization mechanisms supported by Oracle HTTP Server. Generally, you do this for the default location, such as dav_public, in the supplied mod_oradav.conf file. This restricts who can use your system for remote storage, preventing unauthorized users from filling up your disks. In addition, you should always apply Oracle HTTP Server authentication and authorization to authors of the Web site. You should also provide both an execution context and an editing context, so that Web authors, after being properly authenticated and authorized, can edit a JSP file or other executable file and then see how it runs. To do this, create an alias for the directory associated with the execution context, and then DAV-enable the aliased location. See Also: Apache Module mod_dav Security Issues in the Apache Server documentation.