apache possible auth mod needed - MKACTIVITY denied error [SOLVED]

wolfdogg · 2012-01-31 12:27:05

This problem is related to Apache, do dont let what im about to tell you throw you off... Im trying to use FSFS instead of a Berkely DB in SVN. where the setup is working with the latter, its not working now that im trying to implement the former.

The problem;(keep a broad scope when thinink about this, it doesnt have much much to do with SVN, as much as it has to do with some sort of Apache auth i suspect)

im getting a permission error in apache, when i look at my logs i see

[Tue Jan 31 03:57:02 2012] [error] [client 192.168.1.99] Access denied: 'wolfdogg' MKACTIVITY sitedir:

after doing some research it seems it a auth error, and i may have correctly traced it to a need to allow MKACTIVITY, i found this on the web here http://stackoverflow.com/questions/2524 … -forbidden, and it looks like it might be what i need

SecRule REQUEST_METHOD “^(PROPFIND|PROPPATCH)$” allow
SecRule REQUEST_METHOD “^(REPORT|OPTIONS)$” allow
SecRule REQUEST_METHOD “^(MKACTIVITY|CHECKOUT)$” allow
SecRule REQUEST_METHOD “^(PUT|DELETE|MERGE)$” allow

but im not sure where to add this, the user that needed to do this previously mentioend to add it in "modsecurity_crs_10_config.con" but i dotn know where to look to see if i have that file. furthermore, i looked in my httpd.conf file and i dont se any mention of the module to be included, i believe it should be called something like mod_security_xxx or mod_crs_xxx has anybody hear of this module?

otherwise, i think i can add it to my .htaccess file, but im not sure how to lead it off.

does anyone know about this? im about beat.

There is an offshoot possibility that i need to do something with authz instead of adding priveleges specifically for MKACTIVITY, because the app im using does use authz with an HTTP Digest for the access, im not sure which route to take (either adding privileges for MKACTIVITY somewhere, or troubleshooting the authz access)

edit: i did find this http://sourceforge.net/apps/mediawiki/m … Directives and it seems its stating that the "SecRule" can be placed inside "inside the various Apache Scope Directives such as VirtualHost, Location, LocationMatch, Directory, etc...", BUT directly adding the above contents inside my <Location Directive, causes apache to complain as as i restart

# rc.d restart httpd
:: Restarting Apache Web Server                                                                                                                                                                         [BUSY] Syntax error on line 107 of /etc/httpd/conf/extra/httpd-dav.conf:
Invalid command 'SecRule', perhaps misspelled or defined by a module not included in the server configuration

So does it look like i need to install ModSecutiry just to try to add the SecRule, or can someone else figure why im getting the 403 error permision denied to user as stated above.

Last edited by wolfdogg (2012-02-02 12:57:19)

wolfdogg · 2012-02-02 12:59:25

well, i had to edit my conf file. i place all my webdav and svn apache config directives inside /extra/httpd-dav.conf
and in order to get the svn to full work with both fsfs and berkely db i use this config

#
#Distributed authoring and versioning (WebDAV)#
# Required modules: mod_dav, mod_dav_fs, mod_setenvif, mod_alias
#                   mod_auth_digest, mod_authn_file
#

# The following example gives DAV write access to a directory called
# "uploads" under the ServerRoot directory.
#
# The User/Group specified in httpd.conf needs to have write permissions
# on the directory where the DavLockDB is placed and on any directory where
# "Dav On" is specified.
# 
# NOTE, the dav directory also needs to have write permissions to the same
# group that apache has (usually group http) 
# # chmod -r g+w /home/user/htdocs 

#
#Set the DavLock
#
DavLockDB /srv/http/var/DavLock/DavLockDB
#
# Make our directory or location directive and enable dav for it 
#
<Directory /srv/http/dav>
 	Dav On
	Order 	allow,deny
	Allow 	from 192.168.1
	#
    	AuthUserFile /etc/httpd/conf/passwd
	AuthType Digest
	AuthName "WebDAV"
	Require valid-user
	#
	# Satisfy all
	Satisfy any
	#
   	# You can use the htdigest program to create the password database or add a user:
   	#  htdigest -c "/etc/httpd/conf/passwd" WebDAV USERNAME
	#
    	# Allow universal read-access, but writes are restricted
    	# to the admin user.
	# <LimitExcept GET OPTIONS>
    	#	Require user admin
    	# </LimitExcept>
</Directory>

#
# Setup another webdav location for user based access
#
<Directory /home/*/htdocs>
        Dav On
	#
	Order   allow,deny
	Allow   from 192.168.1
	#
	AuthType Digest
        AuthName "WebDAV"
        AuthUserFile /etc/httpd/conf/passwd
	Require valid-user
	#
	Satisfy Any
</Directory>

#
#Setup SVN access
#
<Location /svn>
	#
    	DAV svn
    	SVNParentPath "/srv/http/svn/repos"
	#
    	#
	# Access control is done at 3 levels: (1) Apache authentication, via
    	# any of several methods.  A "Basic Auth" section is commented out
    	# below.  (2) Apache  and , also commented out
    	# below.  (3) mod_authz_svn is a svn-specific authorization module
    	# which offers fine-grained read/write access control for paths
    	# within a repository.  (The first two layers are coarse-grained; you
    	# can only enable/disable access to an entire repository.)  Note that
    	# mod_authz_svn is noticeably slower than the other two layers, so if
    	# you don't need the fine-grained control, don't configure it.
	#
    	# Basic Authentication is repository-wide.  It is not secure unless
    	# you are using https.  See the 'htpasswd' command to create and
    	# manage the password file - and the documentation for the
    	# 'auth_basic' and 'authn_file' modules, which you will need for this
    	# (enable them with 'a2enmod'). 
	#
    	# Allow Network Access and/or Basic Auth
    	#
    	# Network Access Control
	#
    	Order	allow,deny
	Allow	from 192.168.1
	#
    	# # htdigest -c /srv/http/svn/passwd WebDAV YOUR_USERNAME
	AuthUserFile /etc/httpd/conf/passwd
    	AuthType Digest
    	AuthName "WebDAV"
	#
	Require valid-user
	#
	Satisfy any
    	#
        # You can use the htdigest program to create the password database or add a user:
   	#  htdigest -c "/etc/httpd/conf/passwd" WebDAV USERNAME
        #
        #load svn styles - not working yet, maybe file location?
	# SVNIndexXSLT /srv/http/svn/repos-web/view/repos.xsl
	#    
	# BELOW WAS NOT NEEDED
	# SecRule REQUEST_METHOD .^(PROPFIND|PROPPATCH)$. allow
    	# SecRule REQUEST_METHOD .^(REPORT|OPTIONS)$. allow
    	# SecRule REQUEST_METHOD .^(MKACTIVITY|CHECKOUT)$. allow
    	# SecRule REQUEST_METHOD .^(PUT|DELETE|MERGE)$. allow

 </Location>

BrowserMatch "Microsoft Data Access Internet Publishing Provider" redirect-carefully
BrowserMatch "MS FrontPage" redirect-carefully
BrowserMatch "^WebDrive" redirect-carefully
BrowserMatch "^WebDAVFS/1.[0123]" redirect-carefully
BrowserMatch "^gnome-vfs/1.0" redirect-carefully
BrowserMatch "^XML Spy" redirect-carefully
BrowserMatch "^Dreamweaver-WebDAV-SCM1" redirect-carefully

Last edited by wolfdogg (2012-02-02 13:07:39)

Arch Linux

#1 2012-01-31 12:27:05

apache possible auth mod needed - MKACTIVITY denied error [SOLVED]

#2 2012-02-02 12:59:25

Re: apache possible auth mod needed - MKACTIVITY denied error [SOLVED]

Board footer