如何阻止人们通过 webdav 访问克隆服务器？
我想知道如何禁用 webdav 对我的 plone4 服务器 的访问。服务器配置为阻止对普通 zope 客户端端口（8080 和 8081）的所有直接 http 访问，并且无法通过 http://ploneservername:8080 地址从外部访问 plone。这是因为我们希望所有客户端连接都被加密。我已经对其进行了配置，以便所有访问都必须通过在端口 443 上侦听/终止 SSL 的同一服务器上运行的 apache2 服务进行代理。标准 zope 侦听端口（8080、8081、8100）是仅配置为侦听 127.0.0.1 地址，无法从外部使用它们。 apache 服务将所有 SSL/443 流量代理到 127.0.0.1:8080，这是 zope 客户端正在监听的内容。
外部客户端可以连接到的唯一端口是 443，它由 apache 提供服务，并且代理到 http/8080 地址（通过使用 virtualhostmonster 的 proxypass 指令）。这一切都很完美。
问题是 webdav 客户端仍然能够通过 SSL/port443 连接到盒子并成功验证和上传/下载文件。即使 webdav 端口尚未在 plone 配置文件中的任何位置打开/配置，并且通过 netstat -ap 查看时服务器未侦听 webdav 连接，情况也是如此。我已经能够使用 2 个不同的 webdav 客户端（bitkinex 和 win7 内置）进行连接，使用 https://ploneserveraddress URL。我的印象是，只有通过配置文件的 zope 实例部分显式启用 webdav 才可用。
有没有办法完全关闭 webdav 访问？简单地从配置文件中省略它并不能阻止我们在通过 apache/443/SSL 进入时使用此方法进行连接。任何帮助将不胜感激。谢谢。
I would like to know how I can disable webdav access to my plone4 server. The server is configured to block all direct http access to the normal zope client ports (8080, and 8081), and it is impossible to access plone externally via the http://ploneservername:8080 address. This is intended as we want all client connections to be encrypted. I have configured it so that all access has to be proxied via an apache2 service running on the same server that listens/terminates SSL on port 443. The standard zope listening ports (8080, 8081, 8100) are only configured to listen on the 127.0.0.1 address, they are not available from outside the box. The apache service proxies all SSL/443 traffic to 127.0.0.1:8080 which is what the zope client is listening on.
The only port that external clients can connect to on the box is 443 which is served by apache, and which proxies to the http/8080 address (via proxypass directive using the virtualhostmonster). This all works perfectly.
The problem is that webdav clients are still able to connect to the box via SSL/port443 and successfully authenticate and upload/download files. This is the case even though the webdav port hasn't been opened / configured anywhere in the plone config files, and the server is not listening for webdav connections when viewed through netstat -ap. I have been able to connect using 2 different webdav clients (bitkinex and win7 built-in), using the https://ploneserveraddress URL. I was under the impression that webdav should only be available if it's been explicitly enabled via the zope instance sections of the config file.
Is there a way to completely shut down webdav access? Simply ommiting it from the config files hasn't stopped us being able to connect using this method when going in via apache/443/SSL. Any help would be appreciated. Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
WebDAV 在同一端口上运行（从 4.0 开始？）。除了任何其他 Plone 内部解决方案之外，您还可以将 Apache 配置为仅允许某些 HTTP 动词： http://httpd.apache.org/docs/2.1/mod/core.html#limit 。这很有帮助，因为浏览器通常只生成 GET 和 POST。 （不过，您可能需要仔细检查 AJAX-y 编辑器功能。）
WebDAV runs on the same port (since 4.0?). In addition to any other Plone-internal solutions, you can configure your Apache to only allow some HTTP verbs: http://httpd.apache.org/docs/2.1/mod/core.html#limit . This helps insofar as a browser usually only generates GET and POST. (You might want to double-check with the AJAX-y editor features, though.)