Subject: WebDAV vs FTP, not an easy choice

From: Frank Lowney <[email-masked]>
Date: Sun, 29 Jun 2003 08:47:17 -0400

Greg Stein's DAV Frequently Asked Questions (FAQ) contains this 
interesting (to me) comparison of WebDAV and FTP:

>Q.  Why should I use DAV instead of FTP?
>
>A.   Since DAV works over HTTP, you get all the benefits of HTTP 
>that FTP cannot provide. For example:           strong 
>authentication, encryption, proxy support, and caching. It is true 
>that you can get some of this through SSH, but the HTTP 
>infrastructure is much more widely  deployed than SSH. Further, SSH 
>does not have the wide complement of tools, development libraries, 
>and applications that HTTP does.
>
>DAV transfers (well, HTTP transfers) are also more efficient than 
>FTP. You can pipeline multiple transfers through a single TCP 
>connection, whereas FTP requires a new connection for each file 
>transferred (plus the control connection).

Recent events prompting heightened concerns about security and the 
ever widening distribution of FireWall products certainly support the 
assertions about plain vanilla FTP  being problematic.  As well, 
FTP's SSH-enhanced varieties (SFTP, SCP, etc.) are generally beyond 
the reach of typical clients although GUI apps currently available 
are beginning to tear down that barrier (see: 
http://www.gideonsoftworks.com/sshhelper.html and 
http://afp548.com/Software/Vapor/index.html).

However, the answer does not address those valuable things that FTP 
can do that WebDAV currently cannot do or cannot do well. 
Specifically, I refer to the following:

1) WebDAV cannot be programmatically and securely applied to 
individual web sites.  Currently, creating an account on my MacOS X 
Server (Apache) programmatically creates web space whose address 
takes the form http://myserver.gcsu.edu/~username and 
programmatically enables FTP access to that web space using the un/pw 
assigned to the account.  This can be done on a large scale with 
batch methods.

2)  WebDAV does not offer disk space quota enforcement and the means 
with which to discover one's usage of that disk space and take 
corrective action.

3) WebDAV does not offer password management (neither does FTP but I 
mention it here to complete a basic feature list).

Of course, I would like to be wrong about this and I believe that I 
am.  Apple seems to have accomplished a good measure of what I 
describe above with "dotMac" accounts that include WebDAV access via 
what it calls an "iDisk."  However, the techniques behind this are 
not generally and perhaps not even publicly, available.

I would like to extend this kind of functionality to the thousands of 
students and hundreds of faculty at my university but apparently 
cannot due to the unavailability of critical information n the 
techniques employed.  Being able to drop support for FTP would 
certainly make our networking a security folks happy.  Being able to 
supplant FTP with WebDAV would likely be viewed as progress by our 
clients.    Unfortunately, it does not appear to be possible right 
now.

Here, again, I hope to be shown the error of my thinking.

-- 
=====================================================================
Dr. Frank Lowney  [email-masked]
     Director, Electronic Instructional Services, a unit of the
     Office of Information and Instructional Technology,
     Professional Pages: http://www.gcsu.edu/oiit/eis/
     Personal Pages: http://www.faculty.de.gcsu.edu/~flowney
Voice: (478) 445-5260
=====================================================================
We don't make instruction effective, we make effective instruction 
more accessible.

---

From: "Lisa Dusseault" <[email-masked]>
Date: Sun, 29 Jun 2003 08:17:12 -0700

Hi Frank,

> assigned to the account.  This can be done on a large scale with 

I'm not sure what you're asking here.  Are you asking from an
implementor/administrator point of view, whether a server can be implemented
that supports WebDAV and securely supports individual Web sites?  If that's
the question, then Sharemation is an existence proof that this can be easily
done.  The site www.sharemation.com hosts individual web sites for many
thousands of accounts.  Although there's a Web interface to allow users to
sign up, after registration users can manage their sites with WebDAV.  Many
universities are now starting to provide WebDAV-enabled individual sites to
students with this technology, but instead of allowing free signup as
Sharemation does, these universities use batch methods to create thousands
of accounts each semester as new students arrive.  There is no FTP access to
these accounts because it's no longer needed.

Or are you asking whether WebDAV can be used by a client program to manage a
Web site remotely and automatically?  Sitecopy and GoLive are client
programs that do this.

> with which to discover one's usage of that disk space and take 

A WebDAV server implementation can offer disk space quota enforcement, as
Apple iDisk and Xythos WFS do.  This must be managed by the administrator of
course.  It's true that it's difficult to discover one's usage of that disk
space however there is a HTTP error commonly used when that quota is reached
("Insufficient Storage").  Furthermore, we're working on an extension to
WebDAV to provide quota-related properties so that an individual user may
discover their quota and storage usage. 

Are you sure that FTP offers this functionality anyway?  I didn't think that
was part of the FTP standard.  I would think the user would have to type in
Unix queries and understand the answer themselves, rather than be able to
use a GUI client that is capable of parsing the quota information and issue
warnings.

> mention it here to complete a basic feature list).

Typically password management is not part of an application protocol -- as
you point out, it's not part of FTP (nor is it part of IMAP, etc)

Instead, typically password management is an administrative function, which
means that it can either be done through an administration UI (not through
the application protocol) or through LDAP.  WebDAV can work with LDAP: e.g.
an administrator can create LDAP accounts and set passwords, then when users
try to log into the WebDAV server the WebDAV server queries the LDAP server
to see if the login should be allowed.  A number of universities are also
doing this already.  I can provide you with more details if you're
interested.

Good questions!
Lisa Dusseault

---

From: Frank Lowney <[email-masked]>
Date: Sun, 29 Jun 2003 12:23:27 -0400

>these accounts because it's no longer needed.

What I hope to do is provide WebDAV-enabled sites to thousands of 
students and hundreds of faculty at our university on a very limited 
budget and without obsoleting investments already made, to wit:

o several XServe units running the latest MacOS X Server software 
(10.2.6) with includes the Apache webserver with mod_dav precompiled. 
See: http://www.apple.com/macosx/server/

o several MacOS X towers running the latest WebSTAR V Server Suite 
(5.3.x).  NOTE: WebSTAR V supports WebDAV with a very elaborate 
security model that is great for many people working on a single web 
site -- the conventional application of WebDAV.  See: 
http://www.webstar.com

I would like to be able to provide individual web site accounts 
programmatically in batched and on-demand formats using a GUI front 
end not unlike what is available to MacOS X Server and WebSTAR V 
Server Admins.

That this is possible is difficult to deny.  I now have several 
existence proofs as follows:

1) Sharemation (see: http://www.sharemation.com)
2) Apple's iDisk (part of dotMac) (see: http://www.mac.com/)
3) WebCT 3.8 and WebCT Vista (see http://www.webct.com)
    NOTE: WebCT Vista uses the BEA WebLogic server.  WebCT is a 
Courseware Management System (CMS) widely used in higher education. 
WebCT Vista has been adopted system-wide in Georgia's University 
System.  Interestingly, I see no mention of this at www.webdav.org in 
the way of an announcement.

>use a GUI client that is capable of parsing the quota information and issue

FTP Servers offer this functionality.  Two examples include Rumpus 
(http://www.maxum.com) and the FTP client bundled with the WebSTAR V 
Server Suite (see http://www.webstar.com).

Clients will report the soft limit and hard limit warning messages 
issued by these FTP servers.

>you point out, it's not part of FTP (nor is it part of IMAP, etc)

 From the client perspective, such functionality is needed in a way 
that **appears** to be integrated with the editing experience is 
desirable.

>doing this already.  I can provide you with more details if you're

Admins need to be able to set pw criteria (# chars, composition, even 
checking pw history in a database) and enforce a pw change schedule. 
On the client side, users need to have the means with which to easily 
comply with these requirements/policies - a pw changing interface. 
Again, we seek only the **appearance** of integration from the 
client's perspective.

---

From: Brian Korver <[email-masked]>
Date: Mon, 30 Jun 2003 16:10:16 -0700

On Sunday, June 29, 2003, at 05:47 AM, Frank Lowney wrote:
[snip]
> Server (Apache) programmatically creates web space whose address takes 
> the form http://myserver.gcsu.edu/~username and programmatically 
> enables FTP access to that web space using the un/pw assigned to the 
> account.  This can be done on a large scale with batch methods.

If your WebDAV server integrates with your directory service (LDAP, 
ActiveDirectory,
NetInfo, YP, etc.), then these accounts would appear as soon as the 
user's account
is created in the directory.  I do know of vendors that produce such 
servers ;).

> with which to discover one's usage of that disk space and take 

FYI:  http://www.ietf.org/internet-drafts/draft-ietf-webdav-quota-01.txt

> what it calls an "iDisk."  However, the techniques behind this are not 
> generally and perhaps not even publicly, available.
>
> clients.    Unfortunately, it does not appear to be possible right > now.
>

Again, directory service integration would give you what you want.  
When the
user changes their password using their standard password change 
mechanism,
that password change goes into the directory, which of course the server
will pick up immediately.

-brian
[email-masked]