3 Q's: Apache Security Question, PHP4 & Apache 2, Free ASP for Apache 2

[wjsulliv]

Just to clarify I have properly setup a windows webserver with Apache 2, mySQL, and Chilisoft ASP, for a project. I turns out that this machine maybe on a network for an extended period of time (being used as a workstation) prior to being used as a server for a presentation. Before I go and disable/uninstall Apache 2, etc. I had a couple of questions... Hopefully I won't have to uninstall anything?

1) Is Apache any more or less secure on a windows machine vs. a linux/unix box? I wouldn't think they should be any different, but I want to make sure before I route people one way or the other...

2) Can anybody recommend a good site to read about Apace sercurity? Yes I know I can search google, I'm asking if anybody has a favorite site? Or something that they refer to often as a difinitive answer, like Anandtech for hardware, but in this case for Apache Security.

3) Is there a fully functional PHP out there for Apache 2? I can only seem to find one that indicates that it is user beware (untested or something like that) for Apache 2. Is anybody running PHP successfully in Apache 2

4) I currently am working with a developer edition of Chilisoft ASP for Apache 2 (which is free as long as its being used for development). Is there any truely free ASP server software that works with Apache 2?

5) Assuming I am behind a firewall and/or in an educational enviroment at a small university (few users whom would hack the machine) do you see any reason to disable/uninstall Apache until the presentation?

 

[Barnaby W. Füi]

Originally posted by: wjsulliv
1) Is Apache any more or less secure on a windows machine vs. a linux/unix box? I wouldn't think they should be any different, but I want to make sure before I route people one way or the other...

i'm not really qualified to give an informed opinion, but i wouldnt see why apache itself would be any less secure on windows than on unix. perhaps windows itself is more insecure, but i dont see that having an affect on apache.

2) Can anybody recommend a good site to read about Apace sercurity? Yes I know I can search google, I'm asking if anybody has a favorite site? Or something that they refer to often as a difinitive answer, like Anandtech for hardware, but in this case for Apache Security.
there are lots of sources, apache.org of course, apache mailing lists, #apache on irc.freenode.net, and possibly apache.slashdot.org (holes get posted there very quickly after they are announced, i'm talking within minutes or at most a couple hours). also securityfocus.com.

3) Is there a fully functional PHP out there for Apache 2? I can only seem to find one that indicates that it is user beware (untested or something like that) for Apache 2. Is anybody running PHP successfully in Apache 2

this is not a php problem but rather an apache2 problem. the apache api for modules has not (at least last i heard) fully stabilized yet, so you should expect problems. many have success but for anything serious i wouldnt rely on it. is there honestly a reason you are using apache2? if not, i'd go with 1.3. its much better tested, better known, stable, reliable, etc. and it just works.

4) I currently am working with a developer edition of Chilisoft ASP for Apache 2 (which is free as long as its being used for development). Is there any truely free ASP server software that works with Apache 2?

not sure on that

5) Assuming I am behind a firewall and/or in an educational enviroment at a small university (few users whom would hack the machine) do you see any reason to disable/uninstall Apache until the presentation?

i would see no reason to worry about it, as long as you're running an up to date apache.

 

[CTho9305]

i run apache 2.0.35 and php 4.2.1. I couldn't get 2.0.40 to work with php 4.2.1 or 4.2.3 (winXP)

 

[ProviaFan]

I had nothing but pain attempting to set up a recent PHP version with Apache2 on Windows 2000; finally I ended up going with apache 1.3 - it works just fine and is actually better; BBWF has already stated the reasons why, so I am not going to repeat them here.

Try searching on Sourceforge and Freshmeat for free ASP plugins for Apache. The Apache website might have some useful information about this as well.

 

[aviris]

I'm currently running PHP 4.2.3 with Apache 2.0.39 on a Windows 2000 server. No problems with either of them for the past 6 months. Setup went smoothly.

As for the ASP for Apache, I'd be interested as well. I've looked before with no luck. If you are at a univeristy there is a program that you can sign up for with Sun and Chilisoft is one of the programs you can get much cheaper than $495 per server.