Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Here's two possible ways,

  1. Use Apache and PHP module to interpret a php file
  2. Use nginx's ProxyPass with fastcgi

So, would passing the request to another server with ProxyPass more secure than a php module?

share|improve this question
2  
I don't have an objective answer, but it would increase your attack footprint. –  Polynomial Oct 22 '12 at 7:51
add comment

2 Answers

It would depend on your threat model, "secure against what"?

Most application vulnerabilities (PHP side) are unrelated to the web server or architecture; they will be caused by perfectly normal and legal HTTP requests being illegal or unplanned-for at the PHP application layer. E.g. the classic

GET /...login.php?user=' OR 1=1;&pass=

Against this broad spectrum of possible attacks, there's little that Apache module or NginX can do for you, and no real reason to choose the one over the other.

Then there's the possibility of directly attacking the HTTP server. It is not very likely (though it can happen) that a forged request against which Apache is vulnerable can pass through NginX unscathed, much less be reformatted to lethality to Apache by NginX itself. We can then reasonably assume that in the NginX + fastcgi structure, NginX is the only point vulnerable to such attacks.

So I think that NginX ought to provide an additional layer of security, if ran on a machine of its own, with proper monitoring and reduced privileges (of which NginX would need much less than PHP).

Then, attacking the system would result in NginX being subverted and either crashing (or otherwise betraying itself to the monitoring), and stopping the attack; or leaving the NginX box compromised and wide open to the attacker.

In this latter case you're no worse than with PHP directly exposed, as far as your application is concerned; in both cases there's nothing between you and an attacker-controlled box (only now he's operating from an unfamiliar box, and there's some slight consolation there).

As far as the rest of the world is concerned, things are now possible (and you might be held liable for them) that weren't before: e.g., the attacker's purpose might not have been to compromise your application at all, but just to gain a foothold on the NginX machine to operate as a zombie or cat's paw against somewhere else. In this scenario you've actually increased your attack surface - an attacker in search of vulnerable NginX's wouldn't have had reason to attack a PHP installation.

If NginX runs on the same machine as the PHP application, then the overall risk is increased. On a separate machine, I'd say that the risk... changes, both in type and level.

If warded against properly, it can diminish; and you can reap some benefits from being able to juggle different fastcgis with different settings, or different machines altogether to spread the load with ease. If you don't monitor and maintain the NginX box also, i.e. if you don't increase your maintenance surface and cost, then the risk may again increase.

So what this all boils down to is, it's not so much a question of NginX versus Apache module, but of what NginX deployment (and maintenance) versus what Apache deployment (and maintenance).

All the rest being equal (i.e. same level of cost and effort, on Apache alone or shared between PHP and NginX), I'd prefer to keep things simple and my attack surface small, and go with Apache module. If you think you might benefit from load balancing in the future, and are willing to shoulder the extra costs, then NginX would be a suitable choice now.

share|improve this answer
add comment

nginx is young and so far it has had an awful security track record. It is more likely for nginx to suffer yet another critical vulnerability than a more seasoned HTTPD such as Apache or even IIS (gasp!).

share|improve this answer
    
Did you really tried to compare vulnerabilities between Apache (2.2.x to be fair, even gentle) with Nginx ? Have a look at this page and compare the number of CVE per year. Apache has such a codebase that it's normal it has more vulnerabilites, Nginx have the advantage of being way much lighter. –  Shadok Oct 24 '12 at 10:47
    
@Shadok the flaws found in apache are in obscure modules and are much less severe. A new project is going to have a lot more problems. –  Rook Oct 24 '12 at 16:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.