I have installed webdav according to the google advice but cannot get a shared calendar to work due to HTTP permissions errors.
One server message is “SSL connection required”. I see 405 errors when issuing PROPFIND commands and 401 errors with PUT commands and 505 errors with mkcol commands (from my Rocky 9 laptop. Thunderbird on both boxes).
My URL is https://host/webdav and the /var/www/webdav directory now has 777 permissions (initially 755).
I have tried stopping nftables but still cannot create a shared calendar. The shared directory remains empty.
Using 777 is not a safe option, that makes it world writable. The correct way would be to reset it to 755, and then make sure that the apache user owns the directory, so:
chown -R apache:apache /var/www/webdav
if still having issues at this point it could be down to selinux, so you can check that by temporarily putting selinux in permissive mode, so:
setenforce 0
and see if the issue goes away. If it does, then that would suggest selinux is not allowing you to write to that directory. At this point, you can install the policycoreutils-python-utils package and then use commands like:
audit2why -a
and:
audit2allow -a
to find out what the problems are and use the selinux tools to fix it. Both the above commands will give hints as to what needs to be changed.
There are two levels of security to consider.
A) The httpd server
B) The filesystem
In the case of ‘A’, the web server decides who can make which kind of request, so by default some methods are not allowed, e.g. PROPFIND. You can check web server logs to see if it’s being blocked.
You should not disable selinux, it actually helps you know where things are going wrong, again by checking the selinux logs.
Here’s the official page for the web server, note the lock db. https://httpd.apache.org/docs/2.4/mod/mod_dav.html
I believe this shows that SSL is working and that HTTP security is OK.
If I try the same thing via Thunderbird on my laptop, I can “find” a calendar file on the server and subscribe to it but I can’t synchronise from it nor update it.