Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

From a pure security perspective, and on a Debian (or derivative, such as Ubuntu) system, what should one be installing as a web server?

  • apache2

sudo apt-get install apache2


  • apache2-mpm-prefork

sudo apt-get install apache2-mpm-prefork

Which one is the more secure option, and why?

share|improve this question
up vote 1 down vote accepted

The apache2 package is used to select the other packages you need as part of the Apache installation. apache2-mpm-prefork defines which 'processing model' will be used (prefork in this case). The other options are apache2-mpm-event, apache2-mpm-itk and apache2-mpm-worker.

One is not necessarily more (or less) secure than another, as the differences between each are in how they handle setting up to receive new requests - MPM == Multi-Processing Module.

For most uses the apache2-mpm-worker MPM is appropriate.

If you use aptitude on your Debian system, when you select the apache2 package, apache2-mpm-worker, apache2-utils and apache2.2-common will be selected for you automatically (along with any other support packages which are not already installed on your system). Similarly:

apt-get install apache2

Will install apache2, apache2-mpm-worker, apache2-utils and apache2.2-common.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.