使用 Nginx 搭建 Webdav 服務(wù)

一、 自簽名根證書(shū)

1. 生成根證書(shū)密鑰

openssl genrsa -out ./root.key 2048

2. 生成根證書(shū)

openssl req -x509 -new -key ./root.key -out ./root.pem -days 365

交互信息
Country Name (2 letter code) []:CN
State or Province Name (full name) []:HeNan
Locality Name (eg, city) []:HZG
Organization Name (eg, company) []:www.hzg.com
Organizational Unit Name (eg, section) []:HZG
Common Name (eg, fully qualified host name) []:HZG
Email Address []:123456789@qq.com

二、生成應(yīng)用證書(shū)

1. 生成應(yīng)用證書(shū)密鑰

openssl genrsa -out webdav.key 2048

2. 生成應(yīng)用證書(shū)請(qǐng)求

openssl req -new -key webdav.key -out webdav.csr

3. 創(chuàng)建證書(shū)附加用途文件

基于域名的證書(shū)
這里解決的問(wèn)題是瀏覽器訪問(wèn)網(wǎng)頁(yè)驗(yàn)證證書(shū)域名的問(wèn)題，保存為 webdav.ext 文件，生成證書(shū)的時(shí)候使用

基于域名的證書(shū)
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName=@SubjectAlternativeName

[ SubjectAlternativeName ]
DNS.1=hzgwebdav.com
DNS.2=*.hzgwebdav.com

基于IP的證書(shū)
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName=@SubjectAlternativeName

[ SubjectAlternativeName ]
IP.1=192.168.0.1
IP.2=192.168.0.2

4. 簽發(fā)證書(shū)

openssl x509 -req -in webdav.csr -CA root.pem -CAkey root.key -CAcreateserial -out webdav.crt -days 365 -sha256 -extfile webdav.ext

三、Nginx 部署 Webdav 服務(wù)

1. 生成 Webdav 用戶(hù)密碼文件

echo hzg:$(openssl passwd -crypt 12345678)>/path/certs/webdav/webdavpasswd

2. Nginx WebDav 配置

注意 Nginx 需要安裝以下模塊

nginx-dav-ext-module
ngx_http_headers_module

dav_ext_lock_zone zone=davlock:10m;
# Http 配置
server {
    listen 8080;
    server_name hzgwebdav.com *.hzgwebdav.com;

    location / {
        root /path/webdav;
        autoindex_localtime on;

        set $dest $http_destination;
        if (-d $request_filename) {                   # 對(duì)目錄請(qǐng)求、對(duì)URI自動(dòng)添加"/"
            rewrite ^(.*[^/])$ $1/;
            set $dest $dest/;
        }

        if ($request_method ~ (MOVE|COPY)) { # 對(duì)MOVE|COPY方法強(qiáng)制添加Destination請(qǐng)求頭
           more_set_input_headers 'Destination: $dest';
        }

        if ($request_method ~ MKCOL) {
            rewrite ^(.*[^/])$ $1/ break;
        }

        client_body_temp_path /tmp;

        dav_methods PUT DELETE MKCOL COPY MOVE;       # DAV支持的請(qǐng)求方法
        dav_ext_methods PROPFIND OPTIONS LOCK UNLOCK; # DAV擴(kuò)展支持的請(qǐng)求方法
        dav_ext_lock zone=davlock;                    # DAV擴(kuò)展鎖綁定的內(nèi)存區(qū)域
        create_full_put_path  on;                     # 啟用創(chuàng)建目錄支持
        dav_access user:rw group:r all:r;             # 設(shè)置創(chuàng)建的文件及目錄的訪問(wèn)權(quán)限

        auth_basic "Authorized Users WebDAV";
        auth_basic_user_file /path/certs/webdav/webdavpasswd;
    }
}

# Https 配置
server {
    listen 443 ssl;
    server_name hzgwebdav.com *.hzgwebdav.com;

    autoindex on;

    ssl_certificate "/path/certs/webdav/webdav.crt";
    ssl_certificate_key "/path/certs/webdav/webdav.key";

    ssl_protocols           SSLv2 SSLv3 TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 ;
    ssl_prefer_server_ciphers on;
    ssl_ciphers               ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_session_cache         shared:SSL:10m;
    ssl_session_tickets       off;
    ssl_stapling              off;

    location / {
        root /path/webdav;
        autoindex_localtime on;

        set $dest $http_destination;
        if (-d $request_filename) {                   # 對(duì)目錄請(qǐng)求、對(duì)URI自動(dòng)添加"/"
            rewrite ^(.*[^/])$ $1/;
            set $dest $dest/;
        }

        if ($request_method ~ (MOVE|COPY)) { # 對(duì)MOVE|COPY方法強(qiáng)制添加Destination請(qǐng)求頭
           more_set_input_headers 'Destination: $dest';
        }

        if ($request_method ~ MKCOL) {
            rewrite ^(.*[^/])$ $1/ break;
        }

        client_body_temp_path /tmp;

        dav_methods PUT DELETE MKCOL COPY MOVE;       # DAV支持的請(qǐng)求方法
        dav_ext_methods PROPFIND OPTIONS LOCK UNLOCK; # DAV擴(kuò)展支持的請(qǐng)求方法
        dav_ext_lock zone=davlock;                    # DAV擴(kuò)展鎖綁定的內(nèi)存區(qū)域
        create_full_put_path  on;                     # 啟用創(chuàng)建目錄支持
        dav_access user:rw group:r all:r;             # 設(shè)置創(chuàng)建的文件及目錄的訪問(wèn)權(quán)限

        auth_basic "Authorized Users WebDAV";
        auth_basic_user_file /path/certs/webdav/webdavpasswd;
    }
}