[Owasp-portland] Nginx vs. Apache2 for web service

Thu Jun 7 17:20:22 UTC 2012

Hello All,

I'm doing an in depth comparison to Nginx vs. Apache2 as a case study
for moving towards using Nginx for our web servers and in doing so, I've
hit the part where I believe some input from the group would be
appreciated.  

Security.

I'm fairly well versed in locking down vHosts, .htaccess files,
redirects, rewrites, etc. on Apache2 and I'm just learning some of the
techniques found in Nginx to do the configuration in their "VCL" files.
What I'm curious about is what the "buzz" is around if Nginx  and if it
sacrifices any security for the speed?  The context of this is obviously
important  so let me flesh that out.  This would be running on:  Ubuntu
12.04 64-bit VM, 100GB HD space, 1GB RAM, MySQL, PHP5 w/ php5-gd,
php5-curl, php5-xcache, php5-fpm (for FastCGI which by most tutorials
listed as the BKM, I've changed it from a :9000 port listening to an
actual .socks listing) Varnish reverse proxy, PHPMyAdmin,
Webmin,Shorewall FW (using IP Tables) and of course Nginx running a
Wordpress site.  As mentioned I have everything setup and running right
now and it is able to handle an absurd amount of web traffic compared to
an Apache2 install; numbers wise we're talking 100 users max concurrent
@ 5000 requests w/ Apache2 vs. 750+concurrent @ 5000 requests w/ Nginx.

Anyways, just curious what people's thoughts were on it.

Thanks.

-Aaron

  <http://www.warnerpacific.edu/> 

mysteries made known 

Aaron Hockett
Network Systems and Securities Manager  

Warner Pacific College
2219 SE 68th Ave.
<http://maps.yahoo.com/py/maps.py?Pyt=Tmap&addr=2219+SE+68th+Ave.&csz=Po
rtland%2C+OR+97215&country=us> 
Portland, OR 97215
<http://maps.yahoo.com/py/maps.py?Pyt=Tmap&addr=2219+SE+68th+Ave.&csz=Po
rtland%2C+OR+97215&country=us>   

ahockett at warnerpacific.edu <mailto:ahockett at warnerpacific.edu> 
www.warnerpacific.edu <http://www.warnerpacific.edu/>   

tel:
fax: 

503-517-1203 

503-517-1352 

This message is intended for the sole use of the individual to whom it
is addressed. It may contain information that is privileged,
confidential or exempt from disclosure under applicable laws. If you are
not the intended addressee you are hereby notified that you may not use,
copy, disclose, or distribute to anyone this message or any information
contained within this message. If you have received this message in
error, please immediately advise the sender by replying to this email
and delete this message. 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.owasp.org/pipermail/owasp-portland/attachments/20120607/a8b3ae8a/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 2568 bytes
Desc: image001.jpg
URL: <http://lists.owasp.org/pipermail/owasp-portland/attachments/20120607/a8b3ae8a/attachment.jpg>