Well, thanks to everyone who commented. I thought I'd fill you all in on my progress since I posted the question:

• I still find it faintly implausible that no-one's made a DAV-based replacement for ftpd, which makes me think that I'm either missing something about DAV which makes it utterly unsuitable for the job, or I've been searching in the wrong places. Oh well, it's a learning project.
• Right now I have: a root-owned process which accepts connections and spawns a child which looks for basic authentication. The child then bottles out or drops privileges to said user, fires up a Net::DAV::Server and starts serving requests from ~user. It works with cadaver and Windows Web Folders. Security-wise, the root-owned process is still doing far too much work, but at least the file serving aspects are done with the right privileges.
• Net::DAV::Server is an 80% solution for the protocol aspects. I have made some changes to it which I may send back to the author, although he does mention that he's working on it.
• Authen::SimplePam provides a great way of checking system users without having to know too much about PAM. Seriously, if I'd had to start understanding PAM as well, I probably wouldn't have got the job done. Thanks to jaldhar and DrHyde for confirming that PAM was the way to go.
• Thanks to roju, I am now adding privsep, although it does add to the complexity of the code overall. But hey, better a few hours now than a compromise somewhere down the line, eh kids?
• Permanently dropping privileges in Perl seems to be non-trivial on platforms that have a "saved UID". For this reason I am using the (experimental) Proc::UID. I get a better feeling from that than simply setting $< and $> but it is very much prerelease. Any clarification on this subject would be welcome: I'm still researching.
• The future will include: proper privsep; more general user authentication; HTTPS (a must).

---

---

Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!

Titles consisting of a single word are discouraged, and in most cases are disallowed outright.

Read Where should I post X? if you're not absolutely sure you're posting in the right place.

Please read these before you post! —

• How do I compose an effective node title?
• How do I post a question effectively?
• Markup in the Monastery

Posts may use any of the Perl Monks Approved HTML tags:

a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr

You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)

	For:		Use:
	&		&
	<		&lt;
	>		&gt;
	[		&#91;
	]		&#93;

Link using PerlMonks shortcuts! What shortcuts can I use for linking?

See Writeup Formatting Tips and other pages linked from there for more info.