Files
felhom.eu/documentation/audits/new-apps-2026-10-01/box/radicale/checks.txt
T
2026-10-01 18:01:40 +02:00

23 lines
1.5 KiB
Plaintext

0.7/3.9 a phone calendar client's discovery, through traefik over https (DAVx5 / iOS shape):
PROPFIND /.well-known/caldav (no auth) -> 301 https://192.168.0.114/
PROPFIND /.well-known/carddav (no auth) -> 301 https://192.168.0.114/
PROPFIND / Depth:0, right login -> 207
current-user-principal -> /csalad/
PROPFIND principal Depth:1 (the calendar list), right login -> 207
the same with a WRONG password -> 401
MKCOL an address book + PUT a contact + GET it back (CardDAV):
MKCOL -> 201
PUT vcf -> 201
GET vcf contains FN:Teszt Elek -> True
3.6 lock-out: 15 wrong passwords for the user's name as a stranger, then the right one:
15 wrong -> ['401'] in 20.5 s (1.37 s each — Radicale's own delay)
right password at once -> 207
wrong password for ANOTHER name (admin) -> 401
3.4 sign-up: Radicale has no sign-up route; a stranger's MKCOL on a new principal -> 401
2.2/2.7 where the data is, and its size: radicale_radicale_data=92K
the login file inside (mode, owner — never its content): -rw------- 1 radicale radicale 68 Oct 1 16:37 /var/lib/radicale/users
1.8 unknown page: http=401 debug-page=False
1.5 process in radicale: /app/bin/python /app/bin/radicale --hosts 0.0.0.0:5232 --auth-type htpasswd --auth-htpasswd-filename /var/lib/radicale/users --auth-htpasswd-encryption bcrypt --storage-filesystem-folder /var/lib/radi
4.4 negative control: docker pause radicale — controller state before: running
states while paused (s, state): [(4, 'stopped')]; running again 36 s after unpause