Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We are trying to decide which webserver to choose for our PHP application. Which of Apache, nginx or lighttpd is the most secure? Which of these has had the most and most severe security holes?

share|improve this question

3 Answers 3

Notwithstanding the recent range header craziness, I think you can make a good case for Apache, if you strip it down to only what you need. mod_security is a nice plus for Apache too.

You should also decide not just based on track record but based on how well you think they'll do going forward. A lot of that is a function of process maturity, state of the codebase, etc. I think Apache does pretty well in general, although like I said, strip it down to only what you need.

Apache has a lot of eyeballs on it, meaning it'll have more bugs reported against it, but remember that just because bugs aren't being reported against a product doesn't mean that they're not there, so if you're targeted in an attack, my opinion is that you want the fewest unknowns possible, and Apache probably wins on that count.

share|improve this answer

The OS and web server with which you have the most experience are usually going to be the most secure.

Security depends on all of the layers, not just the web server. If you pick one with very few vulnerabilities, but don't understand how to configure it, you will most likely not understand how to configure it securely.

They are all mature web servers, so the one you understand the best is the one you are going to be able to secure the most.

share|improve this answer
1  
Excellent answer. To elaborate: Apache, nginx, and lighttpd are all high-enough quality that the dominant risk is of configuration error -- you're more likely to get hosed by a configuration mistake than by a bug in the code. This suggests you should focus especially on reducing the likelihood of configuration errors that might cause security breaches. Picking the server that you know best reduces the risk of configuration error. –  D.W. Sep 8 '11 at 19:30
2  
Some people say that the biggest security vulnerability sits at the computer console ;) –  kinokijuf Dec 26 '11 at 12:22

For me the answer to this question is "it depends".

First off I guess it depends on what you mean by secure. If you're looking for freedom from software defects then you could look at vulnerability stats for the products in question from sites like http://www.secunia.com or http://www.cvedetails.com .

from those you could get a view of how many security issues have been publicly acknowledged and patched, which could lead you to say that a product is more or less secure.

Unfortunately not all products get the same level of scrutiny, so that may not be a good measure.

The other thing to consider is security capabilities. If there are specific security capabilities that you require (eg, WAF integration) then that might drive your choice of webserver.

In terms of your specific question, I'd say that Apache has recently had a fairly good security record (most of the vulns I've seen in more up to date versions tend to be in modules not the core server).

As to the others, you could argue that they're secure if there aren't any published vulnerabilities for them, but then they may still have issues that aren't publicly acknowledged.

share|improve this answer
    
One measure to consider is the delay between an exploit becoming public and a patch becoming available. The shorter the gap, the less time your webserver is potentially vulnerable. As an extreme, you might have two varieties of webserver both workable, so you can switch between them if one does become vulnerable. –  Gary Nov 12 '10 at 0:24
2  
I would also add that most of the time not the web server is exploited, but the web application running on it. In my opinion one should also take into account ease of configuration, memory/disk consumption, availability of support and not weigh security too high (at least with the better known webservers). –  Andreas Arnold Nov 12 '10 at 13:00
    
The problem I find is that "past performance is not an indicator of future behaviour", as with investment. Let's say there were 10 critical flaws fixed in Apache last year. Maybe there are none left now. Maybe there are another 100. The metric doesn't tell you. –  user185 Dec 9 '10 at 9:04
    
@graham, yep it's a real problem, to predict future flaw levels. With some projects there seems to be a steady stream of issues, which could indicate a general lack of focus on security, but if you get a high number for a while it could be because of a code clean-up or audit, which is actually a positive sign... –  Rоry McCune Dec 10 '10 at 10:10
    
@Graham Lee, it works for insurance companies. Unsafe people are similar to insecure software. But, if they don't tell anyone about the incidents, how would the insurance company know? –  Dog eat cat world Sep 8 '11 at 17:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.