Disabling the Tomcat6 WebDAV module

To disable the Tomcat6 WebDAV module:


Description: After opening the WebDAV module, the Web can be uploaded, downloaded, modified and deleted via command line or client, such as bad control will bring security hidden trouble.


# vi/var/lib/tomcat6/conf/web.conf (added under <web-app)

Press A or I to enter edit mode


<security-constraint>
<web-resource-collection>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
</login-config>
<init-param>
<param-name>readonly</param-name>
<param-value>true</param-value>
</init-param>

Press the ESC key to exit edit mode

: Wq (Exit and save)


# Service Tomcat6 Restart


Verify:

Download:

$ curl-v-X OPTIONS http://localhost:8080/index.html (if http/1.1 403 Forbidden, the Disable is active)

Upload:


$ curl-v-T a.html http://localhost:8080/aa/a.html (if http/1.1 403 forbidden appears, the Disable is active)

This article from "Linux" blog, declined reprint!

Disabling the Tomcat6 WebDAV module