Which Web Server?

If you've been lurking in the various forums and newsgroups devoted to webmastering, you could hardly fail to notice the heated debate going on at this time. No, it's not which is the best browser. This debate is about web servers. More precisely, which one is better: Apache or Internet Information Server (IIS). To tell you the truth, I've used them both (and a few others as well) and the simple plain truth of the matter is these two web server platforms are really functionally equivalent. Ease Of Use IIS is much easier for the novice as operators can maintain it from easy-to-use screens and forms. Windows 2000, on the other hand, costs a lot more than other operating systems such as Linux, FreeBSD and Unix. Straight Apache requires a huge learning curve to learn how to operate and administer. Everything is configured in extremely obscure text files, and these configurations are done by hand (although you can purchase add-on utilities to enable entry of much of this information from screens and forms.) Security The security model of IIS is one of the best ever designed, based as it is upon NTFS (the security model of Windows NT and Windows 2000). This model is far superior to the anything provided with Apache for non-Windows systems. Of course, on Windows, Apache can use NTFS as well. Of course, IIS has been plagued with a number of vulnerabilities lately, and these are a concern. It's common to patch IIS at least monthly, and to install a new service release (a collection of patches) twice a year. Most of the bugs were worked out of Apache (prior to version 2) long ago. Of course, with the release of version two of Apache you can expect a number of security and other flaws to surface - these are a normal part of a product's life cycle. Customization IIS does NOT have the equivalent of HTACCESS. The HTACCESS file in Apache is used to individually configure virtual sites (web sites) without restarting the web server. However, on IIS you have a very flexible method of configuration with ISAPI filters and other similar methods. Both methods (HTACCESS and ISAPI filters) are very obscure and for advanced webmasters. Efficiency According to several reports that I've come across lately IIS is more efficient than Apache. My own testing has led me to conclude the performance of the two is roughly the same for static pages. PHP (the server side scripting platform common on Apache) tends to be more efficient than ASP (the server side scripting system for IIS) according to many sources, although I have tested neither for speed. Hardware Requirements I have run both web server platforms on large and small boxes of many different configurations, and I've found they require much the same hardware. This is not surprising, since the two platforms basically do the same thing. When you configure Windows and IIS, it's a good idea to strip the operating system of unneeded functions. This reduces the size box you need (as well as increasing security). I've run both platforms on 64mb of memory with a single 5600 RPM IDE drive and 200mhtrz processors with reasonable response time (all things considered). I've also run them on dual 2gigahertz systems with 15k RPM SCSI raid 10 drives with incredible performance. The two platforms are equivalent in hardware needs. Large Server Farms Microsoft has worked hard on load balancing, so there are more options available for IIS and Windows 2000 for this than other operating systems. In fact, Windows 2000 clustering (the ability to run several servers using the same disks) is very advanced and makes disaster recovery a breeze. Disaster Recovery IIS backup solutions (those which are provided with Windows 2000) are surprisingly weak. There is no way to back up the metabase (all of the IIS configuration parameters) from one machine and restore it to another (which makes disaster recovery difficult). On the other hand, with Apache it's just a matter of saving all of the configuration text files. Language and other support IIS and Apache both support CGI, SSI and PERL (ActivePerl on IIS is excellent). IIS natively supports ASP and I'm sure you could find PHP if you looked (I have not). Apache tends towards PHP, although you can install something like Chilisoft ASP if you want. CGI, SSI and PERL are performance hogs and security nightmares in both web platforms. Stability Both web platforms are rock solid stable. I have run apache servers which have stayed up for longer than a year without a reboot, and my IIS servers have run for years with the only rebooting required is the occasional service pack and security patch. Neither web platform (or OS for that matter) has even once crashed due to a bug. Operating System Integration IIS and Windows 2000 is a more "integrated" environment than Apache, since IIS is targeted specifically for the operating system. This has the advantage that the GUI and controls of IIS look and feel the same as every other tool on Windows. On the other hand, you can find Apache for just about any platform, including Lunix, Unix, BSD, and even such things as OpenVMS. If you need to be able to move between platforms, then Apache is a great choice. Email SMTP on IIS is primitive but functional. This is because it is only provided to allow scripts and such to send email from the server. If you need additional email support, you are expected to use Exchange or some other email system. Apache does not support SMTP (sendmail), although a version is usually provided on the target system. The provided email solution is full featured - but you must be very sure to check the configuration to be sure your system is not an open relay. The IIS SMTP module is configured through the standard Windows 2000 entry system, while Sendmail requires configuration file editing. IIS SMTP is absolutely trivial to maintain; Sendmail can be a challenge. DNS DNS on Windows 2000 is far, far superior to anything available on Unix or Linux. Bind (he DNS for Unix and similar systems) has traditionally suffered from a huge number of security vulnerabilities) and is very involved to maintain. My own experience with DNS servers indicates the best solution is a dedicated DNS application box. These are inexpensive (for a business), easy-to-configure and much more secure than either the Windows 2000 version or the Unix version. Search Engines There is NO difference as far as search engines are concerned between Apache and IIS (or any other web server, for that matter). Conclusions I'm sure I could write for hours and hours about this subject (and perhaps I will in an article on my own web site). Basically, IIS and Apache do the same thing. They have a vastly different design philosophy, however, and the underlying operating systems have even wider differences. My experience is that Linux and Unix people prefer apache, and windows people prefer IIS. To me, the choice of webserver really comes down to "what are you and your group comfortable with?" If your experience is with apache, linux or unix, then you probably want to stick with Apache. If your experience is with Windows, then you will probably be uncomfortable with Apache. I've used both (and several others) and quite frankly, to me, it does not matter. Drop me on a server running apache or IIS, and I will feel at home.