apache2 or apache2-mpm-prefork, which one is more secure?

Question

From a pure security perspective, and on a Debian (or derivative, such as Ubuntu) system, what should one be installing as a web server?

• apache2

sudo apt-get install apache2

OR

• apache2-mpm-prefork

sudo apt-get install apache2-mpm-prefork

Which one is the more secure option, and why?

Answer 1

The apache2 package is used to select the other packages you need as part of the Apache installation. apache2-mpm-prefork defines which 'processing model' will be used (prefork in this case). The other options are apache2-mpm-event, apache2-mpm-itk and apache2-mpm-worker.

One is not necessarily more (or less) secure than another, as the differences between each are in how they handle setting up to receive new requests - MPM == Multi-Processing Module.

For most uses the apache2-mpm-worker MPM is appropriate.

If you use aptitude on your Debian system, when you select the apache2 package, apache2-mpm-worker, apache2-utils and apache2.2-common will be selected for you automatically (along with any other support packages which are not already installed on your system). Similarly:

apt-get install apache2

Will install apache2, apache2-mpm-worker, apache2-utils and apache2.2-common.