Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

From a pure security perspective, and on a Debian (or derivative, such as Ubuntu) system, what should one be installing as a web server?

  • apache2

sudo apt-get install apache2

OR

  • apache2-mpm-prefork

sudo apt-get install apache2-mpm-prefork

Which one is the more secure option, and why?

share|improve this question
up vote 1 down vote accepted

The apache2 package is used to select the other packages you need as part of the Apache installation. apache2-mpm-prefork defines which 'processing model' will be used (prefork in this case). The other options are apache2-mpm-event, apache2-mpm-itk and apache2-mpm-worker.

One is not necessarily more (or less) secure than another, as the differences between each are in how they handle setting up to receive new requests - MPM == Multi-Processing Module.

For most uses the apache2-mpm-worker MPM is appropriate.

If you use aptitude on your Debian system, when you select the apache2 package, apache2-mpm-worker, apache2-utils and apache2.2-common will be selected for you automatically (along with any other support packages which are not already installed on your system). Similarly:

apt-get install apache2

Will install apache2, apache2-mpm-worker, apache2-utils and apache2.2-common.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .