how secure are Webserver like Apache2 or Nginx on a current linux, e.g. Debian, when downloaded from a repo of this distro? Of course, they have to configured correct and must be up to date.

If they are unsecure, what do companies do with their webservers for more security? Commercial support/patches?

Edit: In repos are not the latest versions, but old versions with securtity fixes. Are they secure like the latest versions?

  • They are of-course meant to be secure, of course what you mean by "secure" is unclear. Commented May 30, 2016 at 17:18
  • So are all software packages. There's nothing inherent about Linux repos that makes them more or less secure.
    – Polynomial
    Commented May 30, 2016 at 17:18

3 Answers 3


The web servers you've menationed as being shipped with Linux distributions (Apache and Nginx) are two of the three most commonly used web servers (stats from the May 2016 Netcraft report).

As such it's safe to say that a very large number of companies consider them safe for widespread use on the Internet (which is by definition a fairly hostile environment).

Having those web servers installed from linux distribution repositories likely doesn't make a large amount of difference to their practical security as most/all linux distributions will provide security patches where new issues are found. Some linux distributions will "backport" security fixes so that these are applied even where the base versio of the software is not upgraded. This can provide benefits from a stability perspective.

As to whether they are "secure" enough for your needs, that's impossible to tell without knowing about your organisation in specific.

  • "doesn't make a lot of difference" - I disagree. Firstly there!'s a lot of difference between official repositories and third party repositories (not mirrors of official repositories as long as signing is required) Secondly managing packages which are part of a distribution should ensure more up to date patch release and notification, and thirdly the official distribution packages will be better supported and pose fewer dependency issues.
    – symcbean
    Commented May 30, 2016 at 18:08
  • <sigh> I was comparing to manually getting latest releases from vendor websites, where did I mention 3rd party repo's? If you want the latest version, you can get it from Apache/nginx and compile manually. From a security stand point using a debian etc repo isn't much different as they backport fixes... Commented May 30, 2016 at 18:19

Typically yes, they're secure. They get patched just like the versions from the project. Most distros issue security advisories as they provide patches: Debian security advisories, Red Hat 6 advisories.


They are about as secure as the next widespread security fiasco, ie if you get hosed by a openssl hole, you are safe in assuming millions others are too. The upside is, the updates and fixes are usually very quick on turnaround.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .