Level 3

Stop Apache Sling WebDAV or not

Forum|Forum|5 years ago
May 27, 2020
5 replies
7411 views

In the Security Checklist for AEM 6.4 in the section Disable WebDAV, it mentions stopping the following bundles:

Apache Sling Simple WebDAV Access to repositories (org.apache.sling.jcr.webdav)
Apache Sling DavEx Access to repositories (org.apache.sling.jcr.davex)

However in Security Checks in the Operation Dashboard there is a health check for WebDAV Health Check. (Tools -> Operations -> Health Reports -> Security Checks -> WebDAV Health Check). In that Health Check it will issue a warning if "Apache Sling Simple WebDAV Access to repositories" is disabled.

The information displayed in the health check is:

INFO The WebDav bundle should be available and active in all runmodes.
INFO On instances started in author or publish + sampleconent runmodes the SimpleWebDavServlet should be configured.

With status:

[WARN] The Sling WebDav bundle is NOT active.
[WARN] The SimpleWebDavServlet is NOT configured.

Which is correct or more secure? Should the bundle be stopped, or should it be configured?

...

clint

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.

U

user05162

Adobe Employee

If you start AEM instance with the "nosamplecontent" which is production ready[1], this will automatically take care of stopping this bundle on production publish websites

[1] https://docs.adobe.com/content/help/en/experience-manager-64/administering/security/production-ready.html

ClintLundmarkAuthor

Level 3

@user05162 , Thanks for the reply. I am not certain that -nosamplecontent does disable both of those bundles. In my case, after installing using that runmode I found this bundle Active - "Apache Sling Simple WebDAV Access to repositories". Regardless of whether -nosamplecontent does or does not disable/stop the bundle, it still does not explain the discrepancy between the security checklist documentation and the security checks through the Operations Dashboard.

arunpatidar

Community Advisor

Hi,

Yes, by default it is not disabled. we used curl to disable and enable in case we need it, mostly the crx de.

The $ACTION could be start or stop

curl -u $AEMUID:$PWD -Faction=$ACTION \
                http://$H:$P/system/console/bundles/com.adobe.granite.crxde-lite
            sleep $DELAY
            curl -u $AEMUID:$PWD -Faction=$ACTION \
                http://$H:$P/system/console/bundles/com.adobe.granite.crx-explorer
            sleep $DELAY
            curl -u $AEMUID:$PWD -Faction=$ACTION \
                http://$H:$P/system/console/bundles/com.day.cq.dam.dam-webdav-support
            sleep $DELAY
            curl -u $AEMUID:$PWD -Faction=$ACTION \
                http://$H:$P/system/console/bundles/org.apache.sling.jcr.davex
            sleep $DELAY
            curl -u $AEMUID:$PWD -Faction=$ACTION \
                http://$H:$P/system/console/bundles/org.apache.sling.jcr.webdav
            sleep $DELAY

These bundles should be stopped.

Arun Patidar

ArpitVarshney

Community Advisor

Hi @clintlundmark

We must configure the production environment with -nosamplecontent run mode which by default disable the bundles and the idea behind that if they are disabled then the AEM user can't see any hierarchy in the crx/de console which makes sense for production environment so that nobody can access these sensitive console directly.

Below is the health check report for sample content run mode of nonprod environment:

The message clearly said that it should be used with author/publisher+sample content run mode while it should be disabled for -nosamplecontent run mode(production-ready)

Regards,

Arpit

ClintLundmarkAuthor

Level 3

Hey @arpitvarshney,

Thanks for the reply! Here are some screen shots of the bundles in question and the Security Checks -> WebDAV Health Check. The bundles are not active as suggested per the Security Checklist. However the WebDAV Health Check is giving me a warning [WARN]. If the bundles should not be active, then the WebDAV Health Check probably should not be in status:WARN, but instead should be in status:OK. Maybe I am missing something?